Auth0 Release notes from Okta

HTTP Message Signatures Added to Tenant Network ACLs

Auth0 now supports RFC 9421 HTTP Message Signatures for Tenant Network ACLs, allowing enterprise tenants to enforce cryptographic origin verification and prevent request tampering.

GAOct 29

Introducing Universal Portals - Developer Preview

Universal Portals are now in developer preview, providing self-service interfaces for end users and administrators to manage accounts and organizations. These portals are hosted by Auth0 and built using pre-built components.

PreviewOct 27

Identity Conversion Suite is now in Early Access

Auth0's Identity Conversion Suite, which includes Anonymous Sessions and Experiment Center, is now available in Early Access.

PreviewOct 26

Application Profiles are available in Early Access

Application Profiles are now in early access, allowing administrators to centrally manage security settings for third-party applications and AI agents.

PreviewOct 22

Agent Mode for the Auth0 CLI

Agents are increasingly operating the CLI to configure Auth0 on behalf of developers. The CLI wasn't built for that. A misspelled command could exit `0` like nothing went wrong. A routine re-login could hang forever waiting on a browser click that would never come. Finding the right command meant drilling through `--help` one level at a time.

UpdateOct 21

Improved Bot Detection: Enhanced IPv6 Signal Analysis

### Bot Detection Model Update We have updated our Bot Detection model to improve threat intelligence against fast-rotating distributed bot networks while preserving a seamless user experience.

UpdateOct 20

Universal Login identifier and phone country controls in Early Access

Universal Login's identifier and phone country controls are available in Early Access on all Auth0 plans. Choose type-specific login entry with "Continue with" buttons, or keep the default unified field.

UpdateOct 16

Tenant ACL Dashboard UX

Easily construct, sequence, and audit Tenant Access Control List (ACL) rules using our new intuitive, step-by-step dashboard interface . ### Features #### Guided Rule Builder Construct complex Tenant ACL policies directly under **Security > Access Control** using step-by-step input prompts that simplify scope, entity, and action selection without syntax...

UpdateOct 12

Actions - Access Token Scope Customization - GA

We are excited to announce that __Access Token Scope Customization for Actions is now Generally Available__, and with this release we are __extending support to Post Login Actions__. Credentials Exchange Actions, which had these interfaces in Early Access, are now GA as well.

GAOct 9

Upcoming changes to the length of refresh tokens

As part of our commitment to maintaining the highest security and compliance standards, we will soon be updating our authentication service configuration to increase the length and entropy of our refresh tokens. ## What is changing? We are increasing the cryptographic entropy of our issued Refresh Tokens.

UpdateOct 1

Actions - Modules - GA

We are excited to announce that __Actions Modules__ is now available in [__General Availability__](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#general-availability). This feature allows you to create, manage, and share reusable code across different Actions within your Auth0 Tenant.

GASep 18

Custom User ID Assignment with Actions , Early Access

You can now assign a custom `user_id` to new database-connection users at signup by calling the `api.user.setUserId()` method in a `pre-user-registration` Action. Previously, Auth0 automatically generated user IDs in the standard `auth0|<id>` format for new signups.

UpdateSep 17

B2B Connect - Enterprise in Early Access!

You can now connect your existing authorization server to Auth0 for enterprise SSO, SCIM provisioning, and multi-tenant org management , without migrating your users. __What's new__ B2B Connect Beta let you layer Auth0 enterprise identity on top of your own authorization server.

BetaSep 16

New Deny All Rule for Tenant ACL

You can now configure a Deny All rule within your Tenant Access Control List (ACL) to reject all incoming traffic to your assigned scope. By utilizing the new `match_all: true` attribute, this rule bypasses specific signal matching (such as IP or geolocation) to apply comprehensive protection across the full tenant scope.

UpdateSep 8

My Organization API and Embeddable UI Components - XAA and third-party app access configuration in Early Acces

We're excited to announce that self-service configuration of Third-Party Application Access and Cross App Access (XAA) is now available through the My Organization API and Embeddable UI Components, in Open Early Access.

UpdateSep 3

Dashboard Navigation & IA Refresh is now in Early Access

![New Navigation & IA](//images.ctfassets.net/kbkgmx9upatd/3uWbyYvS9yTvyhcKh6JVQv/ce950a253172da4e73dc3c934ff24acc/new-nav.png) We're excited to announce that the Dashboard Navigation & IA Refresh is now available in Early Access, bringing a redesigned sidebar, improved information architecture, consistent, breadcrumbs, and a modernized visual experience to...

UpdateSep 2

Advanced MFA Configurations are now Generally Available

We are happy to announce that Advanced MFA Configurations are now Generally Available! This is a highly awaited capability that allows customers to completely tailor their user's MFA Journeys to their security and UX needs ### With Advanced MFA Configurations you can: Change the period that we will "Remember this device" for MFA purposes, from a minimum of...

GASep 1

Cross-App Access Requesting App now in Early Access

We're excited to announce that Auth0 now supports acting as a __requesting application in Cross-App Access flows in Early Access__. Today, every user has to click "Connect your account" for every integration, in every app, one at a time.

UpdateAug 31

Custom Token Exchange is now Generally Available

We are excited to announce that Custom Token Exchange is now Generally Available. This feature is available to all Enterprise, B2B Professional, and B2C Professional customers, as well as part of the Trial period for free tenants.

GAAug 28

Custom Rate Limits available in Early Access

Custom Rate Limits allow Auth0 Customers to limit the amount of RPS their first-party, third-party, or CIMD apps can consume, so as to mitigate the risk that any one Client can exhaust the customer’s Tenant Rate Limit Entitlement on their tenant’s Authentication API Rate Limit Policy.

UpdateAug 17

Flexible Password Policy is now generally available

The Flexible Password Policy for database connections is now generally available. The Flexible Password Policy replaces Auth0's legacy password configuration with a single `options.password_options` object, giving you more granular control over how passwords are validated on your database connections: * **Composition** , set a minimum length, require...

GAAug 13

Custom Prompts now capture the same fields on Social and Enterprise connections

Your custom signup and login fields and consent checkboxes configured in Universal Login now capture the same data on Social and Enterprise connections as they already do on database and passwordless.

UpdateAug 10

Custom Token Exchange - Session Delegation is now available in Open Early Access

We're excited to announce that __Auth0 now supports Session Delegation via Custom Token Exchange__. This release is available to all Enterprise, B2B Professional, and B2C Professional customers.

UpdateAug 7

Google Workspace Directory Sync for Groups - Now in General Availability!

We’re excited to announce that support for Group and Group Membership in Google Workspace Inbound Directory Sync is now Generally Available (GA) for all Auth0 customers!

GAAug 6

Organizations Search Expands with Advanced Filtering

We're expanding __Organizations Search__ with powerful new filtering capabilities. __What's New__ Find organizations using: __Name__ , Search by unique organization identifier __Display name__ , Search by human-readable display name __ID__ , Exact organization identifier lookup __Metadata__ , Filter by custom key-value pairs __Third-party client access__ ...

UpdateAug 4

Global Search in Cmd+K is now in Beta

We're excited to announce that Global Search is now in Beta, bringing entity search directly to the Command Palette (Cmd+K). __What's New__ Search across your Auth0 tenant in real time: __Applications, APIs, Organizations, and Users__ , Find by name, ID, email, or identifier __No syntax required__ , Plain text search with instant results __Copy identifiers...

BetaJul 31

Curated Blocklists in Tenant Access Control Lists is Now GA!

### Overview Curated Blocklists extend Auth0 Tenant Access Control Lists (ACLs) by integrating dynamically updated threat intelligence directly into your Tenant ACL rules.

GAJul 30

4 releases →

Dashboard Search for Organization members now in Beta!

__Dashboard Search for Organization members is now available in Public Beta!__ Find your organization members faster without scrolling through paginated lists. Users can now __search Organization Members in real time by name, email, ID and filter by blocked status.__ Rolling out progressively to Public Cloud tenants starting this week, with broader...

BetaJul 29

4 releases →

Cross App Access (XAA) for Resource Applications is now in Open Early Access

We're excited to announce that __Cross App Access (XAA) for Resource Applications is now in Open Early Access__. You can use this feature in production today at no additional cost through Auth0 Enterprise Connections, available to __Enterprise, B2B Pro, and B2B Essential__ customers, or test it during the __trial period on Free tenants__.

UpdateJul 27

Self-Service Enterprise Configuration: Customer admins can now configure third-party application access during SSO setup

When generating a Self-Service Enterprise Configuration ticket, you can now delegate the third-party application access decision to your customer's customer admin , rather than setting it yourself at ticket creation time.

UpdateJul 22

Anonymous sessions are now in beta!

We are excited to announce that Anonymous Sessions is now available in Beta for Auth0 customers with paid plans. This feature enables applications to create and manage stateless sessions for unauthenticated users, supporting use cases like guest checkout, shopping cart persistence, and pre-login personalization.

BetaJul 20

Dashboard Search for Roles Now in Beta

__Dashboard Search for Roles is now available in Public Beta!__ Find your Roles faster without scrolling through paginated lists. Dashboard users can now __search Roles in real time by ID and name.__ Rolling out progressively to Public Cloud tenants starting this week, with broader availability in the coming weeks.

BetaJul 14

Third-Party Apps for Organizations is now Generally Available

Third-party applications now work with Auth0 Organizations. Tenant admins can allow or block third-party app access on a per-organization basis , access is blocked by default, so existing organizations are unaffected until you explicitly opt in.

GAJul 10

Google One Tap Support for Universal Login EA

Bring frictionless, one-tap authentication to your users! Auth0 now supports Google One Tap within the Universal Login prompt for Early Access. Users are greeted with a secure, non-intrusive identity overlay that lets them sign in instantly with a single tap, completely eliminating manual forms and page redirects.

UpdateJul 9

IPSIE session_expiry Claim Support for Okta and OIDC Enterprise Connections

Auth0 now supports the session_expiry claim for Okta and OIDC-based Enterprise connections, in alignment with the IPSIE SL1 profile. When your upstream identity provider includes a session_expiry value in the ID token, Auth0 uses it to enforce the ceiling on the Auth0 session lifetime , evaluated as the minimum of the IdP claim, your tenant's absolute...

UpdateJul 8

Tenant Log Catalog Now Available in Auth0 Docs

We now have an expansive and interactive Tenant Log Catalog available to dive deeper into [Tenant Logs](https://auth0.com/docs/deploy-monitor/logs) Codes and their associated schemas.

UpdateJul 7

Automate Downstream Provisioning with Outbound SCIM for Users via Event Streams

We are excited to announce the release of our new __Outbound SCIM Action template for Event Streams__! This new capability delivers an infrastructure-free way to push `user.created`, `user.updated`, and `user.deleted` events directly from Auth0 to any `SCIM 2.0`-compliant downstream application, making it easier than ever to automate your user provisioning...

UpdateJul 1

Refresh Token metadata is now Generally Available

We're excited to announce that **Refresh Token Metadata** is now **Generally Available** for Enterprise customers. Refresh Token Metadata allows you to attach custom key-value pairs to refresh tokens, enabling richer context storage and more personalized authentication experiences.

GAJun 22

Google Workspace Directory Sync for Groups - Early Access Updates

We are happy to share that Google Workspace Directory Sync for Groups is now available in Early Access without enrolment! All [previously announced](https://auth0.com/changelog#3sQ4fmmnZQuIAu9jZBoBOS) Early Access capabilities including automated group synchronization, "Sync all" functionality, and partial group selection are now available out-of-the-box...

UpdateJun 17

Dashboard Search for APIs Now in Beta

__Dashboard Search for APIs is now available in Public Beta!__ Find your API faster without scrolling through paginated lists. Dashboard users can now __search APIs in real time by ID, identifier or name.__ Rolling out progressively to Public Cloud tenants starting this week, with broader availability in the coming weeks.

BetaJun 15

Improved refresh token management is Early Access

We're excited to announce the addition of two new endpoints for refresh token management, introducing granularity in search and revocation capabilities, as well as bulk revocation of refresh tokens (up to 100 individual IDs at a time): A new GET api/v2/refresh-tokens endpoint which allows retrieving refresh tokens for a user_id or a user_id + client_id...

UpdateJun 11

Enhanced Bot Detection for Signup Flows

We have updated the machine learning model driving Bot Detection during the Signup Flow. This update lowers false-negative rates to intercept more automated traffic while keeping false-positive rates low for valid users.

UpdateJun 8

Inbound SCIM Groups for Enterprise Connections is now Generally Available!

We’re pleased to announce that support for Groups within Auth0’s [Inbound SCIM](https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim) for Enterprise Connections capability is now Generally Available (GA)!

GAJun 5

Dashboard Navigation & IA Refresh is now in Beta

We are excited to announce that the redesigned __Dashboard navigation and information architecture (IA)__ is now available in Beta. This update is the first step toward a more unified platform experience across Auth0, making it faster to find what you need and easier to act on everything across the platform.

BetaJun 2

Customize RPID values for Passkeys GA

Boost Passkey adoption by enabling shared enrollment across subdomains. You can now customize the RP ID to allow a single Passkey to authenticate users across multiple applications under the same root domain. Now GA!

GAJun 1

Auth0 Teams: Delegate tenant management with the new Tenant Manager role

You can now delegate tenant-level user management with the **Tenant Manager** role. This allows you to offload day-to-day administrative tasks from Team Owners to dedicated managers, providing the autonomy they need without exposing sensitive configuration settings.

UpdateMay 29

Token Vault with Organization Support Available in GA!

We're excited to announce the GA release of __Token Vault with Organization Support__! ISVs building multi-tenant B2B SaaS applications and agents on Auth0 Organizations can now use Token Vault to store and exchange third-party tokens within the context of each organization their users belong to.

GAMay 28

Actions - Access Token Scope Customization - EA

We are excited to announce that we are adding __new Credentials Exchange Actions Access Token Scope Interfaces__ and they are now available in [__Early Access__](https://auth0.com/docs/troubleshoot/product-lifecycle/product-release-stages#early-access "Early Access").

UpdateMay 27

Federated Logout for OIDC and Okta enterprise connections is now generally available

Federated Logout is now generally available for OIDC and Okta enterprise connections. When a user logs out with `?federated` appended to the logout URL, Auth0 calls the upstream identity provider's `end_session_endpoint` to terminate the IdP session, closing the gap where a lingering IdP session could silently re-authenticate the user on their next login...

GAMay 26

Suspicious IP Throttling for Custom Token Exchange

We have introduced a Dashboard configuration interface for Suspicious IP Throttling, specifically for Custom Token Exchange. This update allows administrators to easily set thresholds to throttle high-velocity traffic from suspicious IP addresses during the token exchange process.

UpdateMay 19

Non-Unique Emails is Now Generally Available

Non-Unique Emails is now Generally Available (GA) for all Auth0 customers. This feature allows multiple user accounts to share the same email address within a database connection, supporting real-world use cases like families, small businesses, and multi-role users who need separate accounts tied to the same email.

GAMay 13

Secure your Account API with ACR EA

Auth0's ACR EA release empowers you to secure Account API token issuance by enforcing step-up authentication for sensitive scopes. Whether your users are managing their authentication factors via Universal Login or Embedded flows, you can now gate access through Actions-driven policies or enable a secure-by-default toggle.

UpdateMay 12

Online Refresh Tokens is now in Beta

We are excited to announce that our new feature "Online refresh tokens" is now available to all customers in Beta. This powerful new feature is designed to simplify token management and modernize your application architecture, especially for Single Page Applications (SPAs) allowing you to bind refresh tokens to the sessions they originated from, which...

BetaMay 11

Auth for MCP is now Generally Available

We are excited to announce Auth for MCP is now Generally Available. Auth for MCP gives you a straightforward way to add authentication and authorization to any MCP server, so you control exactly who gets access, and what they get access to. Implement authentication, CIMD registration, and OBO token exchange for AI agents.

GAMay 6

Support for Private Key JWT assertions and additional signing algorithms on Okta and OIDC enterprise connections

Private Key JWT assertions and expanded signing algorithm support are now generally available across Enterprise Okta and OIDC Connections. Private Key JWT assertions deliver enterprise-grade security by leveraging asymmetric cryptography to authenticate against your upstream Okta and OIDC identity providers.

GAMay 5

Auth0 Event Streams for Outbound User Lifecycle Management – Now in General Availability

Event Streams is now available for all customers in General Availablity. Customer can: Subscribe to Auth0 User, Organizations, and Groups (Early Access Limited Release) Events Deliver Events to AWS EventBridge, Auth0 Actions, and Webhooks (including to [Okta Workflows](https://help.okta.com/wf/en-us/content/topics/workflows/execute/flow-api-endpoint.htm...

GAApr 30

Organization Discovery by Domain now in General Availability!

We're thrilled to announce that __Organization Discovery by Domain is now in General Availability__! Automatically identify your customers' users and route them to the right identity provider based on their email domain , before they even reach the login screen.

GAApr 28

4 releases →

Auth0 Private Cloud Now Available on Azure in Japan

Auth0 Private Cloud is now supported in the Azure Japan East (Tokyo) region! Japan already has Auth0 coverage through AWS Private Cloud and our Public Cloud environment, and this addition brings Azure into the mix for the first time.

UpdateApr 23

Deploy CLI Dry Run is now GA

We're excited to announce that Dry Run on Auth0 Deploy CLI is now Generally Available , giving developers full visibility into tenant changes before they're applied. __Key Benefits:__ Preview changes before they hit your tenant. Run a0deploy import --dry-run to see exactly what resources will be created, updated, or deleted , then exit safely.

GAApr 22