Aliyah Winfrey

I'm Aliyah Winfrey, a staff design researcher who’s passionate about creating clarity and alignment in complex research spaces. I thrive on asking the right questions and uncovering insights that drive meaningful design. Outside work, I tend to my garden, experiment with new baking recipes, or get lost in a classic PS2 game.

Staff Design Researcher

Brandon Simons

Brandon Simons is a Principal Product Manager at Auth0, where he has spent over three years dedicated to empowering customers to build great login experiences. His focus is on providing the right balance between ease of development and maintenance, while ensuring a delightful end user journey. Prior to his role at Auth0, Brandon spent over a decade working in SaaS at companies large and small.

Principal Product Manager

The benefits of leveraging social connections for your customers

Social Login has become a login method across [numerous regions, ages, and community types](https://auth0.com/blog/digital-identity-what-users-think-about-devices-and-logins/). Globally, we are connected through social media, and leveraging social login allows us to fortify those connections through a seamless and secure login. However, many everyday people don’t understand [how social login or social connections work](https://auth0.com/blog/analysis-of-social-connection-data/) or, more importantly, if [social login is a safe way](https://auth0.com/blog/social-login-on-the-rise/) to log in or sign up. 

Social login uses existing social media accounts, such as Google, Facebook, X (Formerly Twitter), Apple, and Microsoft, to sign in or go up for websites. It reduces the cognitive load of users remembering another username and password or, worse… _reusing a password_ 😱 over 70% of general users do. Over thousands of our customers have integrated Social Login in their authentication flow. Social login offers the following.

1. Frictionless and rapid method for users to sign up/log in via a 1-click solution
2. Implementing social login significantly increases the conversion rate.<a href="https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/#Increase-Your-Sign-Up-Conversion-Rate-by-20-">1 </a><a href="https://www.marketone.com/articles/maximizing-conversion-rates-with-social-sign-in">2</a>
3. Security of social login 

However, internal research of general population users cited the sentiment that social login is the most vulnerable identifier to cyberattacks.

![Social login](https://images.ctfassets.net/23aumh6u8s0i/13wdcxqs5xSsqyzL1bkQjx/2dad6f825cb64537ce2ae1dd1d4884c5/Social_Login.png)

Given this sentiment, let’s break down three common myths about Social Login among general users and share some key points to keep in mind when using it in your applications.

## The Myths of Social Login

> **Myth #1**: Logging in via my social account (Facebook, Google, or Microsoft) gives away the data in my social account.

Social account hacking is a huge and serious concern for everyday users. However, many social login services such as Google, Facebook, Apple, and Microsoft do not grant full access to your account and share only what’s necessary, such as name and email. Social Login providers share limited information with the application or website users are logging in to. Social login minimizes the data you store when signing up for accounts. The less data you store, _the better_.

This means they are not sharing your data on your social login account. Social login only grants authentication rights to create or log into an account. Additionally, many social login providers allow users to review, control, and revoke access to their account settings, meaning users must grant permission to access _any_ account data. Social login does not give the application or service users a sign-up for access to data such as private messages, browsing history, or other sensitive information.

> **Myth #2**: Social login is less secure than a password.*

Social login is often more secure than using a password for a few reasons. Traditional login methods, such as passwords, are prone to reuse and have general weaknesses, such as hackers guessing simple passwords. Social login reduces the risk by offering a passwordless way to authenticate. Moreover, users' risk of credential theft and phishing is diminished, given they are not creating and storing credentials to log in to third-party sites and services. Social Login often provides built-in Multi-Factor Authentication (MFA) as an added layer of security in comparison to relying on a password, which may or may not offer MFA.

Social login utilizes big companies like Google, Microsoft, and Apple's investment in keeping users’ accounts safe with a team of security experts working 24/7. These companies monitor accounts for unusual and suspicious activity, unauthorized access, and hackers. \

> **Myth #3**: Social Login isn’t safe cause it’s too easy.*

It’s really that simple. Ease of access ≠ lacks security. Social Login simplifies authenticating users as who they say they are while leveraging leading security measures. In other words, it’s simple authentication that does not sacrifice security. Remembering a password is more challenging and less secure. Weak or reused passwords pose a greater risk to personal data and security.

## Let’s Enable Our Users and Build Trust

Building trust with users is about more than just convenience. It requires a strong commitment to security, clear communication, and giving users the tools to protect themselves. Social login makes signing in easier while keeping accounts secure, but users should take extra steps to stay safe. Enabling MFA, reviewing permissions in Google, Microsoft, or Apple account centers, and staying aware of account activity all help strengthen security. When an organization provides these options and offerings, such as Auth0, allow for seamless integration, users take advantage of them, and online interactions become both safer and simpler.

Ready to rethink social login? Start implementing it in your apps, and learn more [here](https://auth0.com/learn/social-login)! Or [review some of our social login Labs](https://developer.auth0.com/resources/labs?topic=authentication)”

Demystifying Social Login

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

Native login with passkeys allows you to integrate passkeys into your native applications and offers a smooth user experience with all the benefits of passkeys.

Native login with passkeys allows you to seamlessly integrate [passkeys](https://learnpasskeys.io/introduction) into your mobile applications. If you wanted to add passkeys before, you had to integrate a web redirect flow that uses Universal Login. 

Today, we are announcing Limited Early Access to Native Login with passkeys for Android applications. 

## How Does It Work? 

In order to use Native Login with passkeys in your Android application, there are a few requirements:

* **Enable and configure your passkey policy**: First of all, you need to enable passkeys for your tenant. Learn how to do it using [our documentation](https://auth0.com/docs/authenticate/database-connections/passkeys/configure-passkey-policy).
* **Configure a Custom Domain**: you can learn how to configure a custom domain using [our documentation](https://auth0.com/docs/customize/custom-domains).
* **Enable Android App Links Support**, which you can do following [our docs](https://auth0.com/docs/get-started/applications/enable-android-app-links-support).

Native login is available on the Android SDK from version 3.2.0 and Android API 28. 

### Sign Up 

To sign up, you’ll need to use the "`signupWithPasskey`" method from the "`AuthenticationAPIClient`". When successful, you can handle the passkey creation from your device using Android’s CredentialManager following [Android’s official docs](https://developer.android.com/identity/sign-in/credential-manager#create-passkey). Here’s an example implementation in Kotlin:

```java
val account = Auth0.getInstance("{YOUR_CLIENT_ID}", "{YOUR_DOMAIN}")

val client = AuthenticationAPIClient(account) 

client.signupWithPasskey(
 UserData(
 email = "jndoe@email.com"
 ), "{realm}" 
 ).start(object : Callback<PasskeyRegistrationChallenge, AuthenticationException> {
 override fun onSuccess(result: PasskeyRegistrationChallenge) {
 val passKeyRegistrationChallenge = result
 val request = CreatePublicKeyCredentialRequest(
 Gson().toJson(
 passKeyRegistrationChallenge.authParamsPublicKey
 )
 )
 var response: CreatePublicKeyCredentialResponse?

 // start credential creation on the device 
 credentialManager.createCredentialAsync(requireContext(),
 request,
 CancellationSignal(),
 Executors.newSingleThreadExecutor(),
 object :
 CredentialManagerCallback<CreateCredentialResponse, CreateCredentialException> {

 override fun onError(e: CreateCredentialException) {
 }

 override fun onResult(result: CreateCredentialResponse) {

 response = result as CreatePublicKeyCredentialResponse
 val authRequest = Gson().fromJson(
 response?.registrationResponseJson,
 PublicKeyCredentials::class.java
 )

 // once the device created the key pair and signed the challenge you can sign in to Auth0 
 client.signinWithPasskey(
 passKeyRegistrationChallenge.authSession,
 authRequest,
 "{realm}"
 )
 .validateClaims()
 .start(object : Callback<Credentials, AuthenticationException> {
 override fun onSuccess(result: Credentials) {
 credentialsManager.saveCredentials(result)
 Snackbar.make(
 requireView(),
 "Hello ${result.user.name}",
 Snackbar.LENGTH_LONG
 ).show()
 }

 override fun onFailure(error: AuthenticationException) {
 Snackbar.make(
 requireView(),
 error.getDescription(),
 Snackbar.LENGTH_LONG
 ).show()
 }
 })
 }
 })
 }

 override fun onFailure(error: AuthenticationException) {
 Snackbar.make(
 requireView(),
 error.getDescription(),
 Snackbar.LENGTH_LONG
 ).show()
 }
 })
```

The `signupWithPasskey` method starts the passkey creation ceremony. It generates the challenge for the authenticator to sign once it has created the public key credential pair. In your case, your Android device acts as the authenticator and you create the key pair and sign the challenge when you use the `CreatePublicKeyCredentialRequest` method from Android’s Credential Manager. 

Then, you can use Android’s Credential Manager method `createCredential` or `createCredentialAsync` to start the creation. Once successful, you can use the result from the creation to send that data to Auth0 and sign in using the ``signinWithPasskey`` method, which is covered below.

### Login 

To sign in, you’ll have to first initiate the passkey challenge by using the `passkeyChallenge` method from the `AuthenticationAPIClient`. When the call is successful, you can initiate the credential retrieval using Android’s [`getCredential` method from the `CredentialManager`](https://developer.android.com/identity/sign-in/credential-manager#sign-in).

When your device retrieves the credential successfully, you can then initiate the sign-in process with Auth0. An example implementation could be:

```java
val account = Auth0.getInstance("{YOUR_CLIENT_ID}", "{YOUR_DOMAIN}")
val client = AuthenticationAPIClient(account)

client.passkeyChallenge(realm)
 .start(object : Callback<PasskeyChallenge, AuthenticationException> {
 override fun onSuccess(result: PasskeyChallenge) {
 val passkeyChallengeResponse = result
 val request =
 GetPublicKeyCredentialOption(Gson().toJson(passkeyChallengeResponse.authParamsPublicKey))
 val getCredRequest = GetCredentialRequest(
 listOf(request)
 )
 credentialManager.getCredentialAsync(context,
 getCredRequest,
 CancellationSignal(),
 executor,
 object :
 CredentialManagerCallback<GetCredentialResponse, GetCredentialException> {
 override fun onError(e: GetCredentialException) {
 Log.w(TAG, "Error fetching public key credential")
 callback.onFailure(handleGetCredentialFailure(e))
 }

 override fun onResult(result: GetCredentialResponse) {
 when (val credential = result.credential) {
 is PublicKeyCredential -> {
 val authRequest = Gson().fromJson(
 credential.authenticationResponseJson,
 PublicKeyCredentials::class.java
 )
 // initiate signin process with Auth0
 client.signinWithPasskey(
 passkeyChallengeResponse.authSession,
 authRequest,
 realm
 )
 .validateClaims()
 .addParameters(parameters)
 .start(callback)
 }

 else -> {
 Log.w(
 TAG,
 "Received unrecognized credential type ${credential.type}."
 )
 callback.onFailure(AuthenticationException("Received unrecognized credential type ${credential.type}"))
 }
 }
 }
 })

 }
```

For more detailed examples, you can check out the [Android SDK sample folder on Github](https://github.com/auth0/Auth0.Android/tree/main/sample).

If you need [Java examples, you can check out this doc](https://github.com/auth0/Auth0.Android/blob/main/EXAMPLES.md#passkeys).

## What Use Cases Are Supported?

The initial early access release provides support for the following use cases:

* **Sign Up with a passkey**: users can register a new passkey for Auth0/your app and store it in the device credential manager for future use. 
* **Login with a passkey**: users can retrieve passkeys using the device’s credential manager and use them to log in. 

## How Can You Apply?

If you are interested in joining the early access program, please reach out to your account manager.

_Any products, features, or functionality referenced in this material that are not currently generally available may not be delivered on time or at all. Product roadmaps do not represent a commitment, obligation, or promise to deliver any product, feature, or functionality, and you should not rely on them to make your purchase decisions._

Native Login with Passkeys Is Now in Limited Early Access for Android Applications!

amanda-giannelli

Senior Software Engineer

Amanda Giannelli

Simplify logins, boost security, and enhance productivity with the power of Single Sign On!

## Introduction

Are you tired of juggling a bunch of usernames and passwords just to get your work done? You’re not alone. In today’s world, where we use so many different apps and services, keeping track of login details can feel like a full-time job. 

Enter Single Sign On (SSO), a simple yet powerful solution that lets you access all your apps with just one login. Let’s dive into what SSO is and why it’s such a game-changer for businesses.

## What is SSO?

You may have already used SSO without realizing it. Whenever you log into a website that leverages [identity providers](https://auth0.com/docs/authenticate/identity-providers) such as Google, Facebook, or Apple (to name a few), that is single sign-on in action.

SSO is a fancy term for a straightforward concept: log in once, and you’re good to go across all your apps. Whether it’s checking your email, collaborating on a project, or logging into your CRM with SSO, one login gets you everywhere you need to be. It’s like having an all-access pass to everything you need for work.

## How Does SSO Work? 

When SSO is enabled, and you attempt to authenticate to App A, you are sent to the authentication server to provide your credentials. Once authenticated, you are redirected back to App A and signed in. If you then access any other services (for example, another app) connected to the same auth server, you will be immediately authenticated into this application.

![SSO authentication and how it works](https://images.ctfassets.net/23aumh6u8s0i/1rHF8E9UCO7abbWzLRntV0/6856815f4ee9b078d83093d2a21a6bc7/typical-sso.png)

> Read more about [SSO authentication and how it works](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/). 

## Benefits of SSO

Now that you have a general understanding of what SSO is, let’s take a look at some of the benefits.

### Enhanced User Experience

Remembering a bunch of different passwords is a hassle. With SSO, you only need to remember one password. No more struggling to recall if your password for App A has a special character or if App B requires an uppercase letter. Log in once, and you’re in — it’s that simple.

#### Goodbye, Password Overload

Keeping track of passwords can feel overwhelming. While a password manager is an option, SSO puts an end to needing scores of passwords. By reducing the number of passwords you have to remember, it’s less likely you’ll get locked out or end up using the same password everywhere (which, let’s be honest, [isn’t very safe](https://www.security.org/resources/online-password-strategies/)).

#### Get to Work Faster

SSO saves you time. Instead of typing in different credentials every time you switch apps, SSO gives you instant access. It’s like walking through an open door instead of fumbling for keys — you get to work faster and with less hassle.

SSO providers also typically provide a dashboard with all of the apps you have access to. Open the dashboard, select your app, and you’re in. 

### Boost Security

You might think that having one login for everything sounds risky, but SSO actually makes your business more secure. Here’s how:

#### One Secure Login Point

With SSO, all your logins are managed in one place. This means your IT team can keep a close eye on things and quickly respond if something looks suspicious. It’s like having all your valuables in one safe instead of scattered around the house.

#### Reduced Chance of Phishing 

[Phishing scams](https://auth0.com/blog/protecting-against-phishing-attacks/) — fake emails trying to steal your info — are a big problem. But with SSO, you’re not entering your password over and over, so you’re less likely to fall for a phishing trap. Fewer logins mean fewer chances for scammers to trick you.

#### Add Extra Security with MFA

Most SSO solutions let you add [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication) (MFA), which provides another layer of security by requiring more than just a password to log in. Maybe you’ll need to enter a code sent to your phone or scan your fingerprint. This extra step makes it much harder for hackers to get in, even if they have your password.

### Lighten the Load on Your IT Team

SSO isn’t just great for users. It's also a lifesaver for your IT department. Managing user accounts and passwords can be a real headache, but SSO makes it a breeze.

#### Easier User Management

With SSO, your IT team can manage who has access to what from a single dashboard. Need to give new employees access to all the tools they need? Done in a few clicks. Need to remove access when someone leaves? Just as easy. It’s all centralized, which saves time and reduces errors.

#### Fewer Helpdesk Calls

Did you know that [up to 50% of helpdesk calls](https://agio.com/your-employees-are-wasting-30-of-their-time-resetting-passwords/) are for password resets? SSO cuts down on the need to [reset your password](https://auth0.com/learn/password-reset), freeing up your IT team to focus on bigger issues and your employees to work on what truly matters. Less time resetting passwords means more time to solve real problems.

#### Smooth Compliance and Reporting

If your business is in a regulated industry (such as finance or healthcare), SSO can make compliance a lot easier. It keeps detailed logs of who accessed what and when, so when it’s time for an audit, you’ve got everything you need at your fingertips.

### Scale Up with Ease

As your business grows, so do your tech needs. The good news? SSO grows with you. Whether you’re adding new apps or expanding your team, SSO makes it easy to scale up.

#### Integrates with What You Already Have

SSO solutions are designed to work with the tools you’re already using, whether they’re in the cloud, on your servers, or a mix of both. So, no need to overhaul your entire system — just plug SSO in and keep moving forward.

#### Works Across All Environments

Many businesses today use a mix of on-premises and cloud-based applications. SSO bridges the gap, providing a seamless login experience across all platforms. So, as you move more of your operations to the cloud, SSO keeps everything running smoothly.

#### Future-Proof Your Business

By implementing SSO, you’re setting your business up for success as you grow. No matter how many new apps or services you add, SSO will be there to keep everything secure and accessible, ensuring your team can stay productive without getting bogged down by tech hurdles.

### Better Collaboration with Partners

If your business works with external partners or clients, SSO can make those relationships smoother and more secure. Here’s how:

#### Secure Partner Access

SSO lets you extend secure access to your partners without compromising your internal security. You control who sees what, so everyone has the access they need — and nothing more.

#### Easier Collaboration

When your partners can log in easily without juggling multiple credentials, it’s easier to work together. Whether you’re sharing documents or managing a project, SSO makes collaboration a breeze.

### Challenges

For all of its amazing benefits, SSO is not without its challenges. Understanding these considerations can help you plan effectively and ensure that your SSO implementation is successful. Here are a few to keep in mind:

#### Single Point of Failure

SSO centralizes authentication, so if the SSO system goes down, users may lose access to all connected applications. This is why high availability coupled with redundancy for your SSO solution is critical to reduce downtime. High availability means the system is always on and available no matter what happens. Redundancy enables high availability by acting as a backup plan in the event of failure to ensure the services remain functional. 

#### Setup and Integration

Integrating SSO into existing applications can be complex and time consuming, especially when dealing with a mix of legacy and new systems. Careful planning and coordination between IT teams and application owners is crucial to ensure a smooth implementation.

#### Security Risks

While SSO can enhance security, it can pose a risk if not properly managed. If an attacker gains access to a user’s SSO credentials, they could potentially access multiple applications. Implementing strong authentication methods, such as MFA, is essential to mitigate this risk. 

#### User Adoption and Training

Users need to be educated on how SSO works and the importance of keeping their credentials secure. Without proper training, there may be confusion or resistance — especially in less tech-savvy organizations. 

## Conclusion

SSO isn’t just a buzzword. It’s a powerful tool that can make your business more efficient, secure, and scalable. By simplifying the login process, reducing security risks, and lightening the load on your IT team, SSO can help your business thrive in today’s fast-paced digital world.

If you’re not using SSO yet, now’s the perfect time to start. Whether you’re a small business looking to grow or an established company ready to streamline operations, SSO can give you the boost you need to stay ahead of the curve.

Benefits of Single Sign-On (SSO)

cailyn edwards_24-05-16_OktaASM_3465

Senior Security Engineer

Cailyn Edwards

Everything you need to know about IdPs, from how they work to the benefits of using one.

**TL;DR**: IdPs are services that manage entities' digital identities. They help service providers verify the identity of their users and enable SSO to minimize user password fatigue.

## What Is an IdP?

An Identity Provider (IdP) is a service that stores and manages digital identities. These identities can belong to human or software entities. You can imagine an identity provider like a social register from Regency-era England containing information about specific individuals, including names, titles, and familial connections. This information could be used to dictate who should be invited to which events in high society or even to verify that someone is who they say they are. Modern IdPs probably won’t help you get invited to any major society events, but they do ensure that access to digital services is limited to the intended audience.

### What Do We Mean by Identity?
[**Digital identity**](https://auth0.com/docs/get-started/identity-fundamentals/identity-and-access-management) is the mapping of information about an individual to that person or entity. An identity will consist of user information like a username, address, email, etc. A subset of this information is unique and can be used to validate the identity of the entity it’s mapped to. This subset is what makes up a user's identity factors, which can be things like credentials, biometrics, security questions, or device information. These identity factors fit into three categories: knowledge, possession, and inheritance — in other words, something you know, something you have, and something you are.

## Why Are IdPs Important?

IdPs are crucial in the modern world because they allow entities to access resources securely while ensuring that only the users who are supposed to access them are able to access them. While service providers (SPs) can — and often do — manage identities, they have to balance that specialized service with their standard offerings. IdPs have the advantage of focusing primarily on managing and securely storing identities; thus, they are better suited to work with things like [Single Sign-on (SSO)](https://auth0.com/docs/authenticate/single-sign-on) and [Multi-factor Authentication (MFA)](https://auth0.com/docs/secure/multi-factor-authentication).

## How Do IdPs Work?

IdPs work by allowing users to log in to a variety of service providers using the authentication factors available to them. IdPs often support using existing credentials, like your Google login or a set of credentials set directly with the IdP.

A typical interaction with an IdP might look like this:

1. User requests to log in to the SP
2. SP redirects the user to the IdP for login
3. User enters credentials (or uses other authentication mechanisms)
4. IdP validates the user and reports back to the SP
5. The user is granted or denied access to the SP’s platform

IdPs also allow SPs to have a high level of control over how they manage access. They can have varied policies depending on the resources being accessed and by whom. These policies and rules are managed by admins, and can be changed and improved upon over time.

## What Are the Different Types of IdPs?

You can have different types of identity providers.

**Social** - Social IdPs are an easy way to validate users with minimal friction, saving the user from creating another password and username combination. An example of a social identity provider is Facebook. Web applications can use Auth0 to leverage a social IdP, allowing users to log in using their Facebook credentials.

**Enterprise** - Enterprise IdPs are often used for SSO. They allow employees to have a single set of credentials to access the variety of services needed to do their job. [Okta](https://www.okta.com/) is an example of an enterprise IdP, allowing employees to sign into any applications they are authorized to use through a convenient dashboard.

**Legal** - Legal IdPs are IdPs managed by governments. This is most common in Europe, but is becoming more prevalent elsewhere as well. An example of a legal IdP is [Criipto](https://www.criipto.com/electronic-identities), which offers eIDs for Denmark, Norway, Sweden, and other European countries.

## What Are the Benefits of IdPs?

Because IdPs are specialized in managing identity, they typically offer higher security and easier integration with multiple SPs.

There are many additional benefits to using an IdP, including:

* **Easier Credential Management**: When users have options like SSO, signing in with social or biometric/device-based authentication means one less set of credentials to manage. This leads to less reuse of easy to remember (and easy to guess) passwords — and a secure, seamless experience.
* **Automated User Onboarding and Offboarding**: With identity managed in one place, it’s easier to grant and revoke permissions at once based on things like group membership.
* **Allows SP to Focus on Core Offerings**: Dedicated identity management empowers service providers to concentrate on their primary business functions. By partnering with expert IdPs, SPs ensure secure identity management while devoting their resources to what matters most to their customers.
* **Better Identity Security**: IdPs have significant field experience, are dedicated to identity management, setting industry standards, and focus on protecting user data.
* **Increased Telemetry**: Identity management is the core product of IdPs, and they treat it as such. An IdP tracks who accessed what and when — which is useful for compliance, audits, and incident response.
* **Multiple Ways to Authenticate**: Users and SPs can choose the authentication options that work best for them, meaning less friction on sign-up and login.
* **Service Agnostic:** If you manage multiple service providers, or a user has worked for multiple tech companies, you will likely have run into the same IdPs. This makes onboarding and management easier — and allows you to leverage your existing knowledge. 

## FAQs

**What’s the difference between an IdP and a Single Sign-On (SSO) provider?**

While an IdP stores and manages digital identities, SSO is an authentication mechanism that allows a single user identity to access multiple service providers. SSO will still use an IdP to verify the user’s identity, and link it to a collection of applications a user can access. Think of an employee dashboard that allows the employee to use their corporate login to access their HR tools, travel planning, email, and so on.

**How do IdPs work with MFAs?**

Service providers can define policies for specific resources and user groups. Many IdPs support specifying the requirement for MFA, what MFAs are supported, and the lifespan of the MFA confirmation in these security policies. Most IdPs have their own MFA options, for example [Okta Verify](https://help.okta.com/en-us/content/topics/mobile/okta-verify-overview.htm).

**Can I move users from my custom-built solution to an IdP?**

Most IdPs will allow the import of users from external applications, allowing you to up your security and reduce your workload in just a few clicks. In the case of Auth0, we can support [automatic migrations](https://auth0.com/docs/manage-users/user-migration), so you can make the switch with little to no impact on your users.

## Conclusion

IdPs are a purpose-built solution that helps both SPs and users access resources securely. They allow SPs to manage granular access policies and reduce the mental load of credential management. IdPs are feature-rich identity and access management solutions, and they’re becoming even more crucial in the ever-evolving technical landscape. If you’re interested in learning about the future of IAM, you can [read about the identity challenges facing AI-powered applications](https://auth0.com/blog/identity-challenges-for-ai-powered-apps/).


What is an IdP (aka Identity Provider)?

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Passkeys and WebAuthn for developers. Learn how passkeys work and the benefits they provide.

A Passwordless Future: Passkeys for Developers

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

From scalability to CX, CIAM unlocks business-wide benefits

Customer experiences happen primarily online. If this wasn’t completely true for your business before 2020, it’s probably true now. Companies have come to understand that a seamless digital experience is no longer a competitive differentiator; it’s a baseline requirement.

Moreover, pressure-cooker economic conditions during the pandemic have shown that [companies that understand their customers’ needs on a deep level](https://digitally.cognizant.com/customer-identity-and-access-management-in-the-age-of-covid-19-codex5721/) are better-positioned to succeed. One way organizations are trying to do this is [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/).

CIAM refers to a set of solutions intended to create the optimal balance between convenience, privacy, and security for each type of user. While [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) is focused on managing identity and access for employees and partners, CIAM centers on customers.

CIAM exists at the intersection of customer experience, security, and analytics. It enables a smooth onboarding/login experience to build customer loyalty and increase conversion rates, guides compliance with data privacy laws and empowers companies to prevent data breaches. Crucially, CIAM encompasses not only how companies control end-users’ access to digital assets but also how they collect, analyze, and store data related to those users.

## A Centralized Source of Truth

CIAM enables companies to compile siloed user data into a single source of truth that helps you make better strategic decisions. If your user data is disorganized, siloed, and inaccurate, you can’t generate a clear picture of your customers. Without clear insight into your users, you can’t offer highly personalized offers and product recommendations that drive additional revenue and create more value for your customers.

> Duplicate and siloed data also create barriers to compliance with data privacy laws. A centralized view of your customers gives you the tools you need to meet the requirements of laws like [GDPR](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) and [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/).

### Can’t we build it ourselves?

Some organizations manage part or all of CIAM themselves, but that’s a big challenge, and it gets bigger as you scale. Given the complexity and dynamism of CIAM, forward-thinking companies are entrusting CIAM to one or more third-party [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) experts. Outsourcing CIAM to a third party is a wiser use of your resources than asking your developers to manage customer identity in-house. [Buying rather than building your CIAM solution](https://auth0.com/resources/whitepapers/ciam-buyers-guide) saves time and money, and it gives you the agility and expertise you need to respond to evolving use cases, new or updated privacy laws, and other variables that can make identity management more complicated.

## Business Benefits of CIAM

Centralizing user data on one platform unlocks company-wide benefits even beyond creating a single source of truth. Here’s an overview of the organizational rewards you can realize with CIAM.

### Scalability

On the list of advantages of CIAM, scalability is near the top. Unlike B2B and workforce identity solutions that support users with static access to preassigned applications, CIAM platforms must be able to support millions, even billions, of users. In addition, CIAM solutions must be able to scale in response to not only anticipated events (like the holiday shopping season or the World Cup) but also to unanticipated events that can dramatically increase demand (like [viewers eager for official updates during the pandemic](https://auth0.com/case-studies/tvnz-cs/)).

### Customer experience

When customer experience is a priority, features like [single sign-on (SSO)](https://auth0.com/docs/sso) and adaptive [multi-factor authentication (MFA)](https://auth0.com/learn/social-login/) help you deliver the frictionless CIAM experience your customers expect.

CIAM platforms also enable event-driven personalization tactics, such as progressive profiling, in which user data is collected incrementally in a series of interactions over time. The goal is to build a trusting, mutually beneficial relationship between the company and customers. Users recognize that by providing more information (such as rating a purchase or filling out demographic information), they can get more value in the form of personalized offers and relevant recommendations. And by cultivating the trust of their customers, companies ultimately realize more value in terms of both reputation and revenue.

### Security

Customer data is among your organization’s most prized assets. In the wrong hands, however, data becomes a liability. That’s why the best CIAM solutions have robust security features built to defend against malicious attacks on any front.

For many organizations, the login box is the front line of defense against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). A CIAM solution with MFA and brute force protection is an important part of your defense strategy. MFA ensures that one stolen credential won’t allow automatic access to your users’ other accounts, while brute force protection keeps attackers from barraging your application with fraudulent login attempts that can crash your site.

### Privacy and compliance

Centralized user management is necessary to meet the reporting and erasure requirements of data privacy laws like [GDPR](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/), APPI, and LGPD. These laws are literally rewriting the rules for how organizations are permitted to collect, store, and leverage user data. CIAM helps you meet these legal requirements by enabling the encryption of sensitive data, controlling access to digital resources, and collecting data, and [managing consent](https://auth0.com/blog/what-you-need-to-understand-about-consent-management/) in compliance with applicable laws.

## Create More Value with CIAM

As organizations initiate and accelerate digital transformation projects to meet sky-high demand for digital services, CIAM is becoming indispensable across industries, from [retail](https://auth0.com/case-studies/dunelm/) to [tech-powered fitness](https://auth0.com/case-studies/gymshark/). 

In our whitepaper, we explore in depth the capabilities you should look for in a CIAM platform, from scalability and agility to personalization and compliance. You can also [reach out to the Auth0 team](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us) to learn more about how CIAM could benefit your organization.

<include src="asides/AboutAuth0" />

Why do you need CIAM?

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Fintech companies must evolve their identity strategy for the future of banking.

A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />

How FinTech Benefits From IAM

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

FlexJobs and Built In Seattle recognize Auth0 for industry-leading perks, benefits, and remote-friendly culture

**BELLEVUE, Wash. – January 21, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has been included on [FlexJobs’ annual list of ‘Top 100 Companies to Watch for Remote Jobs in 2020'](https://www.flexjobs.com/blog/post/100-top-companies-with-remote-jobs-2020/) and [Built In Seattle’s list of ‘Best Places to Work in 2020'](https://www.builtinseattle.com/companies/best-places-to-work-seattle-2020), both of which recognize Auth0 for its flexible, remote-friendly culture, and commitment to providing its employees with the best benefits and perks. 

Based on an analysis of more than 54,000 companies and their remote job posting histories in the FlexJobs database in 2019, Auth0 – along with companies like Amazon, Aetna, JPMorgan Chase, Dell, and Salesforce – had the highest number of remote job openings on the FlexJobs site last year. The number of people telecommuting in the U.S. has dramatically increased by [159 percent](https://www.flexjobs.com/blog/post/flexjobs-gwa-report-remote-growth/) since 2005, with remote work bringing very real benefits to both employers and workers, such as greater work-life balance, wider talent pool, higher productivity, stronger retention rates, and much more.

Auth0 was also recognized for its top employee perks and benefits on Built In Seattle’s list of Best Places to Work in 2020. Built In's ‘Best Places to Work’ list rates companies based on their employer benefits and employee submitted compensation data. 

“We pride ourselves on being a company that enables our team members to do their best work – regardless of location – at a global scale,” said Eugenio Pace, CEO, and co-founder of Auth0. “Our inclusion on the FlexJobs and Built In Seattle lists is a reflection of our dedication to providing the best culture and work-life balance for our team that spans more than 33 countries, and we’re honored for the recognition.”

Auth0 is dedicated to creating a work environment that centers around collaboration, communication, and culture. Inclusion in these listings is continued validation of this dedication and follows other ‘best places to work’ recognition, including [Inc. Magazine’s Best Workplaces 2019](https://auth0.com/blog/auth0-recognized-as-one-of-inc-magazines-best-workplaces-2019/) and Battery Ventures’ [50 Highest Rated Private Cloud Computing Companies To Work For](https://auth0.com/blog/auth0-named-one-of-50-highest-rated-private-cloud-computing-companies-to-work-for/). 

Auth0 provides a competitive total rewards package including (but not limited to): 401(k) matching, flexible paid vacation time, career development opportunities and training, competitive parental leave, diversity and inclusion initiatives, top of the line gear, an annual company-wide offsite, and other flexible and generous practices. For current job opportunities, please visit [https://auth0.com/career](https://auth0.com/careers). 

## About FlexJobs
[FlexJobs](https://www.flexjobs.com/) is a premium online job service for professionals seeking flexible work, specializing in full-time and part-time remote jobs, employee and freelance jobs, and on-site jobs with flexible, part-time, and alternative schedules. Since its start in 2007, FlexJobs has helped more than 4 million people in their job searches and has created the largest vetted database of legitimate flexible job opportunities in over 50 career categories. Besides, FlexJobs provides robust career support, including curated expert resources and career coaching services, to partner with job seekers in all phases of their journey. A trusted source in the media, FlexJobs has been cited in top national outlets such as CNN, Wall Street Journal, New York Times, CNBC, Forbes, and many others. FlexJobs' Founder & CEO Sara Sutton has also launched two additional partner sites, [Remote.co](http://remote.co/) and [1 Million for Work Flexibility](http://www.workflexibility.org/), to help provide education and awareness about the viability and benefits of flexible work. Sutton is the creator of [The TRaD* Works Forum (Telecommuting, Remote, & Distributed)](https://trad.works/), dedicated to helping companies leverage the benefits of telecommuting, remote and distributed teams.

## About Built In
Working in tech is a way of life. Built In helps people live it with purpose. Across the most vibrant tech hubs in the US, Built In helps tech professionals stay on top of tech news and trends, expand their networks and carve out futures at companies they believe in. Built In attracts a niche audience of 1 million tech professionals every month and, in 2019, the company hit a milestone, serving 1,100 companies annually. Built In recently launched BuiltIn.com, a national hub for tech trend coverage and resources to help professionals grow in their careers.

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East 
Auth0 Communications 
[press@auth0.com](mailto:press@auth0.com) 
 
Alexandria Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Honored for Excellent Workplace Culture in Two Industry ‘Best of’ Lists

kapehe-jorgenson

Kapehe is an R&D Content Engineer for Auth0 with a passion for learning and teaching. With her primary focus on ReactJS and JavaScript, she is impressed with what code can create for the web. Technology and web development are constantly evolving and naturally bring that need for continual learning. She enjoys writing tutorials, hosting local meetups, and learning with others to expand coding knowledge.

R&D Content Engineer

Kapehe Jorgenson

Platform Engineer Dorrin Poorkay on the challenge of scaling and the benefits of calm leadership

Platform Engineer [Dorrin Poorkay](https://www.linkedin.com/in/dorrin-poorkay-94552b82/) came to [Auth0](https://auth0.com/) after working as an infrastructure engineer for a local startup facing rapid growth where she handled [Amazon Web Services (AWS)](https://aws.amazon.com/) infrastructure. She also maintained the cloud infrastructure (OpenStack) at the [University of Louisville](http://louisville.edu/), where she also earned her degree in computer science and engineering.

Sitting down with Dorrin was not your typical "let's meet in a conference room" because Auth0's a globally distributed company. We kept in touch via Slack, Google Docs, and Zoom. I learned more about her path to Auth0, what it’s really like to be a platform engineer, and her favorite programming language — all while being on the other side of the United States from each other.

![Photo of Dorrin Poorkay](https://images.ctfassets.net/23aumh6u8s0i/chaGa7c9KKM8i2ZOja0i2/6a6360c8eee3f36061e8a1c6cccb186e/dorrin-poorkay-2)

**On the daily life of a platform engineer at Auth0:**

Platform engineers design and build the underlying infrastructure for applications to run on. Given that we’re responsible for the foundation of our entire product, a lot goes on in a typical day of platform engineers.

Some days I'm on-call and responding to incidents — those days are chaotic, but fun! Other days I work on building new infrastructure, automating our current one, and making improvements.

I always start my day with coffee and aim to be productive right from the start. Over the years, I’ve found I’m most productive after my first cup of coffee and again late at night. I try to structure my day by scheduling meetings during my "downtime" (when I’m least productive) and snoozing Slack and my phone to minimize distractions.

During my on-call week, things are a bit different as I have to be alert and respond to pages quickly, but I adjust by planning for the interruption beforehand and setting expectations. When I am on-call, each day is unique. The flow of my day depends on what happens. Sometimes you wake up at 3:00 a.m. to a page. Most of the time our incidents are short but if incidents are long (say a few hours) then your teammates will fill in for you to get some rest and sleep. It balances out nicely. While most of our incidents do not mean “widespread outage”, we proactively monitor all of our systems and can be paged preemptively before our customers can experience issues.

Whether on-call or not, a light lunch and an hour of exercise are also included in my daily routine. I also find time to learn about topics that I am passionate about. For example, these days I spend most of my time programming in [Go](https://golang.org/) which I enjoy immensely.

<include src="TweetQuote" quoteText="On being a platform engineer at Auth0: Some days I'm on-call and responding to incidents - those days are chaotic, but fun! -Dorrin Poorkay"/>

**On moving up to the challenge of scaling and maintaining a service that can’t have any downtime:**

When I came to Auth0, I was really looking for a challenge.

I started my career with a few internships during college and a few weeks before finals I landed my first job at a local startup. It was extremely fast-paced and as chaotic as small startups can be. I thoroughly enjoyed it until it was time for me to move on to a more challenging job.

What attracted me to Auth0 was the engineering talent, specifically evident in the engineers I spoke to [during the Auth0 interview process](https://auth0.com/blog/how-we-hire-engineers/), the [Auth0 blog](https://auth0.com/blog/), and, of course, the [identity platform](https://auth0.com/docs/getting-started/overview) product, but the big attraction was the challenge of scaling and maintaining a service that can’t have any downtime.

Working at a startup at a much smaller scale had its own challenges but things like writing postmortems, doing root cause analysis, measuring SLAs of services were not part of my daily job. Auth0 has a unique challenge of "can't be down at all.". We serve billions of authentication requests and none of them can fail. Banks, airlines, news websites, or anyone using Auth0 expect a very high Service Level Agreement (SLA) because our service is critical to the success of theirs.

**On keeping up with rapid changes in the engineering field:**

Engineering changes quickly. I keep up by reading — lots and lots of reading. I try to read a few articles every day. The tech industry moves very quickly, you have to keep up. I also implement new technologies I’m curious about in my personal projects. Although when there is not a lot of time to do personal projects, reading is still the best substitute.

I get a lot of my exposure to the tech industry's ins and outs from [Hacker News](https://news.ycombinator.com/), [my twitter feed](https://twitter.com/fseekme) and different Slack workspaces. In terms of books, I've been reading [Advanced Programming in the UNIX Environment](https://www.amazon.com/Advanced-Programming-UNIX-Environment-3rd/dp/0321637739). It might seem like it's not necessarily knowledge in the world of cloud, containers and serverless but it's a great read that continues to be helpful in my day-to-day job.

<include src="TweetQuote" quoteText="The tech industry moves very quickly, you have to keep up. -Dorrin Poorkay, Platform Engineer for Auth0"/>

**On her favorite project for Auth0 (so far):**

We had [another record growth year in 2018](https://auth0.com/blog/auth0-announces-record-year/) and are on track to continue that rapid growth. That means we’re always looking at ways to scale our systems to meet customer needs while we improve our products and services. Our product and engineering teams are also continuing to expand — we have to develop more tooling and services around our platform and infrastructure to keep up with our growth. My favorite projects (so far) aim to solve many of these challenges with code by blending programming and infrastructure knowledge.

**On what it’s like to work remotely from Louisville, KY and its great tech community:**

Most people think of fried chicken and bourbon when they hear Kentucky. While it is true that Kentucky has great chicken and bourbon, it also has great coffee shops, micro-breweries, and co-working spaces. Those places are usually where you see remote workers hacking away at their laptops.

I was born and raised in a big city, so it took a while to adjust to life in Louisville. I’d describe it as a big city with a small city feel. We have a close-knit tech community which has its own Slack workspace. We also have a lot of tech meetups around town. So if you’re working remote and looking to socialize with other software engineers, there’s plenty to do here!

->![Louisville, Kentucky](https://images.ctfassets.net/23aumh6u8s0i/5X808xp71KOaN6J34cZ69b/f70ed2c326fbe15bb0532245e6c14adf/louisville-kentucky-2)<-

Check out two of our local [meetup](https://www.meetup.com/) groups:

* [Kubernetes and Cloud Native Computing Louisville](https://www.meetup.com/Kubernetes-and-Cloud-Native-Computing-Louisville/)
* [Louisville AWS User Group](https://www.meetup.com/Louisville-AWS-Users-Group/)

**On the importance of calm leadership:**

During my on-boarding, I joined an incident call (we collaborate via video chat on incidents to facilitate communication). My fellow colleagues were on the call, but I noticed our Chief Technology and Product Officer and co-founder, [Matias Woloski](https://auth0.com/blog/authors/matias-woloski/) was also on the call. Even though he was incident-commanding and aware of the urgency, he remained calm. To me, this shows how Auth0 leadership contributes to a culture of openness where engineers are not afraid to touch production, make mistakes, ask questions, and be confident in taking ownership.

**On her favorite Auth0 value:**

That would have to be: [We are obsessed with delivering customer value](https://auth0.com/blog/our-culture-and-values-at-auth0/).

Most of what we do is for customers. Even though as platform/infrastructure engineers we don’t write code directly for the product, we still put a lot of emphasis on how a tool we’re implementing, a change we’re making, or infrastructure improvements affect customers.

**On being a woman in tech:**

Growing up my mom highlighted the importance of a role model. Being a surgeon, my mom was already a strong woman in a male dominant field. Because of her, nothing felt unachievable to me. I was encouraged to take classes like math and physics in school; I was very good at it. My grandfather also highlighted the importance of "allies" to me. An ally is basically an advocate that [boosts and draws attention to an oppressed group’s own voices](https://www.huffpost.com/entry/what-does-it-mean-to-be-a-male-ally_b_596d49d8e4b05561da5a5a05). He encouraged us, especially his daughters and granddaughters, to be career and science driven. I'd like to extend this analogy and say I find that having such role models and allies is beneficial to women in tech.

I have been privileged to work with great people over the years and my exposure to negativity has been small. Unfortunately, that's not the same experience for everyone. We need more allies, education, awareness, support, and empathy as we still fight discrimination and bias. This year, UI Engineer [Dasha Nikitina](https://www.linkedin.com/in/darianikitina/), R&D Content Engineer [Kapehe Jorgenson](https://auth0.com/blog/authors/kapehe-jorgenson/), and I will be attending [Women Who Code (WWC)](https://women.dev/) this Saturday, April 13th, in San Francisco. Come meet us at the Auth0 booth!

**On the advice Dorrin would give to someone interested in this field:**

First is to try to understand the reason behind your task. Why are you typing this command or writing code this way? This thinking gives you a deeper understanding of the tech you’re using. It also helps you with troubleshooting problems that might arise in the future, and for me personally, it brings a lot of joy to know the ins and outs of what I’m doing.

Second is to keep looking if you haven’t found the right place! There are so many companies with different cultures, tech stacks and standards that you can find a company that matches all your values.

**Join the Auth0 Team**

As you've learned, we are growing rapidly at Auth0. We have multiple engineering job openings available in our [career page](https://auth0.com/careers). You can learn more about our hiring and interview process through our [How We Hire Engineers](https://auth0.com/blog/how-we-hire-engineers/) post. If you have any questions or feedback, please let us know in the comments below!

---

Meet the Experts: Dorrin Poorkay

sambiopic

I'm Director of Developer Relations and a Google Developer Expert for Angular and Web Technologies. I believe anyone who wants to learn to code should be able to learn code and I love teaching. When I'm not coding or writing, you'll find me outside hiking or camping in the beautiful Pacific Northwest.

Director of Developer Relations

Sam Julien

Auth0's Sam Julien shares some of the things that have surprised him in switching to his first remote job.

Starting my first remote job has been everything I’d hoped for, plus a bit more than I expected. When I first moved to Portland from Gainesville, Florida ([Go Gators!](https://floridagators.com/)) in November 2014, I got a job writing software at a financial company out in the western suburbs. It wasn’t ideal, but it got me out here and I was grateful for it. I quickly got tired of the commute, though — it took over an hour each way in traffic just to drive 11 miles. Ugh. Back in Gainesville I could get anywhere within 15 minutes, so this came as quite a shock.

I made it my mission to get a job downtown to reduce my commute. Before long, I started working at a small non-profit and eventually became the lead front end engineer there. I commuted downtown from Southeast Portland on public transportation in about 40 minutes for three years. It wasn’t the worst commute by any means, but it started to wear on me because it felt unnecessary. Most days, I just sat or stood at my desk wearing headphones writing code and occasionally instant-messaging coworkers. Why did I need to travel somewhere for that? Aside from some focused tech sessions with my team, I rarely felt like there was any reason for me to be physically in the office.

On snow days, furniture delivery days, or not-quite-sick-but-not-quite-well days, I was able to work from home through a VPN. Those were my most treasured and productive days. I could listen to music without headphones, I had no interruptions, and I could just get in the zone and code. Sadly, because we were such a small company — and not a software company — it wasn’t possible to make remote work permanent or even regular. We just didn’t have the infrastructure.

When I got offered a fully remote job at Auth0, I was so happy to have achieved my goal to no longer be tethered to an office or a daily commute. Most of it has been everything I’d hoped for. Since I’ve started working remotely, I’ve slept better, worked out more, cooked more, and spent more time with my friends, girlfriend, and family. Auth0 has also been super supportive of my speaking and travel responsibilities as a [Google Developer Expert for Angular](https://developers.google.com/experts/people/sam-julien). I love getting to work from anywhere.

It hasn’t all been a bowl of cherries, though. Remote work has its own set of challenges, some of which really caught me off guard. I want to share these surprises with you in case you’re looking at transitioning to a remote job (hopefully [here at Auth0](https://auth0.com/careers)!).

## What’s Surprised Me about Going Remote

Even though there are [tons of benefits to having a remote job](https://auth0.com/blog/we-are-thankful-for-these-benefits-of-working-remote/), there are some things people don’t tell you about working full time from home. An office job is kind of like having a clock speed on a processor or a governor on an engine. The office regulates your life and keeps it maintained. It provides some basic boundaries of when you need to wake up, when to work, and when to come home. It regulates your meal times and your social activities. When you remove the governor or overclock the processor, you can get a lot more performance, but you take more risk.

Most people think about the "no boss over your shoulder" and "no commute" benefits of working remote, but they’ve taken for granted the rest of the regulation: the set schedule (with a physical boundary between home and work), the regulated meal times, and the planned social interaction. Some people jump enthusiastically into remote work and quickly realize it’s too much. Their work time is blending with their home time, they’re eating too often or too much, and they’re desperately lonely.

For me, I would take being fully in control over my time any day over outsourcing that to an office. I’m also extremely introverted, despite how much I love teaching and speaking. I thought I’d be absolutely golden switching to remote, but while it has been amazing, a few things have surprised me.

### It Takes Work to Build Your Own Structure

Unlike my job at the non-profit, my role at Auth0 is fairly autonomous. I occasionally collaborate with team members or work on group projects, but the majority of my job is to write great technical content alone. This caught me a bit off guard after a life of daily stand-ups and regular team meetings. It’s back on me to set and maintain a schedule. Unlimited freedom takes a lot of discipline.

<include src="TweetQuote" quoteText="A remote job requires you to build your own structure into your day to stay productive, like regular workouts and breaks."/>

I was surprised by how long it took me to get into the "self-motivated focus" routine by building my own work day from scratch. I think part of this was due to traveling so much this fall, but it still felt like it took longer than I predicted to get into a routine. I had always imagined that, whenever I finally started working from home, I’d wake up at 5 am, hit the gym, and crank out a super productive workday every single day with no trouble.

It turns out real life is a bit more complicated than that. That surprised me because it’s not as if I haven’t had to focus in the last few years. For example, when I was making my first Angular video course, I had to force myself to crank out at least a few videos every evening after work in order to get 200+ videos finished. Or, at development jobs during the day, I had to focus to get a particular feature done or bug resolved on time. There’s a key difference with those that’s a principle of life and work: work expands to the time you give it. If you give yourself three days to work on something, guess how long it will take? Yet if your boss tells you a new feature in the application needs to be done by the end of the day, guess how long it will take?

I’ve learned that working from home and being autonomous, I have to give myself shorter deadlines and more work. I’ve also built in structure to my day through scheduled gym time and breaks. It’s certainly been a slower process than I imagined, but I’m getting into a solid routine.

### Even Introverts Get Lonely

As I said earlier, I’m a hardcore introvert. I love my alone time. Even so, I’ve been surprised by my need for social time. I worked with some really great people at the non-profit and I miss them much more than I anticipated. On top of that, when you cut out meetings, chatting with coworkers in the kitchen, commuting on public transportation, and going out for lunch or coffee during work, you end up with...a lot of alone time. That goes double when you live by yourself as I do. I'm not alone in this, either. In Buffer's [State of Remote Work 2018](https://open.buffer.com/state-remote-work-2018/) survey, they found 21% of remote workers struggled with loneliness.

->![Buffer remote work survey chart showing 21% of remote workers struggle with loneliness](https://images.ctfassets.net/23aumh6u8s0i/3fQVUgLA0xvqtRlcO6pwO2/e44787e96ed3f019dcc818d9ceb1c64f/buffer-loneliness)
[[Source](https://d2mxuefqeaa7sj.cloudfront.net/s_6A1F19D3C9C27A032B77599B390536CA1709A830CEA405B393E39F6D5868EB7B_1519662359312_Biggest+Struggle2x.png)]<-

One of the best decisions I made when I joined Auth0 was to also join a new gym that offered classes. I had been going to a 24-hour bare bones gym. The new gym has a triple benefit: it gets me out of the house, it gets me around people, and it gets me a killer workout every time. If I was still going to the 24-hour gym, I’d have yet another thing I’d be doing alone.

<include src="TweetQuote" quoteText="A great way to combat loneliness while working remotely is to take up new hobbies with friends."/>

I also run the [Angular Portland](https://www.meetup.com/ngpdxers/) meetup, so that’s another scheduled event that I go to about every month. Beyond that, it’s on me to be purposeful with scheduling time with friends. I’ve figured out that I need to see some pals about one or two times a month to retain my well-being. Of course, I still spend a bunch of time with my girlfriend, but that’s sort of a different category of social time. Everyone needs friends outside of their relationship, but especially when you’re inside alone all day!

### It’s Hard to Build Relationships Online

Finally, I’ve been surprised by how necessary occasional in-person communication is with coworkers, even when you’ve got great remote infrastructure. We use Slack and Zoom to stay in touch with each other at Auth0. Those help a lot, but I won’t lie to you. Meeting my coworkers in person at our team offsite in Miami this September made a big difference in feeling bonded with them. The same was true of my onboarding at our Bellevue office, where I met folks like our CEO [Eugenio Pace](https://twitter.com/eugenio_pace) and Chief Architect [Vittorio Bertocci](https://twitter.com/vibronet) and had coffee with my teammate [Jenny O’Brien](https://twitter.com/jenny_obrien).

![Most of Auth0's Content Team at the Miami Offsite](https://images.ctfassets.net/23aumh6u8s0i/1Zb9aa4iSGcWlBfu8z9Wrq/0bdc3d5b673205487296fbca89d2e020/content-miami)

Along those same lines, it’s a heck of a lot harder to pair program remotely. Not being able to just hand the keyboard off to someone or debug directly on their machine is a pain. So far, I’ve paired with teammates by simply cloning the code and running it myself (or them doing the same). We haven’t checked out [Visual Studio Code’s Live Share](https://marketplace.visualstudio.com/items?itemName=MS-vsliveshare.vsliveshare) feature yet, but we definitely should. I have a feeling it will help a lot. It still won’t replace being able to wander over to a coworker’s desk, but at least it’s a start.

Auth0 does a great job with remote infrastructure and encouraging lots of communication between teams, but as much as I love that, I have to admit that there is no substitute for meeting coworkers in person to build relationships. That’s why I can’t wait to go to my first annual company offsite next May. It will be great to meet everyone in person!

<include src="asides/AboutAuth0" />

## Set Yourself Up for Remote Success

If you’re thinking about going remote, dreaming of days of unending focus while basking in your cave of solitude, you may want to do some thinking ahead. Look into community gyms, adult education, and new hobbies you can take up with some friends. Build some structure into your ideal calendar. Yes, even my fellow introverts should do this. Also, if you have a chance to meet your coworkers at any point in person somewhere, even if you’re just on vacation in their city, do it! You’ll be glad you spent a little time with them face-to-face.

Whether you work remote for Auth0 or someone else, I wish you the best in your journey! If you’re working remotely now, please feel free to share any tips you’ve learned in our Community post for this article.

Surprises in My Switch to Remote Work

ef2eecee7655f814bd7a9228ba0c6992?s=200 avatar

ef2eecee7655f814bd7a9228ba0c6992?s=200

I'm passionate about startup culture, leadership and employee engagement, coming from the experience of having left big corporate, packed up with my wife and kids and moved from Australia to the US to pursue startup life.

Director of Culture

Clayton Moulynox

Auziros share what remote benefits make them thankful to be part of our flourishing relationship culture.

This might sound odd &mdash; but we're not deliberately trying to build a **remote culture** at Auth0. To me, that term conjures images of Tom Hanks in the movie "Cast Away": His character in ragged underwear stranded on a deserted island with nobody to talk with except Wilson... his inanimate volleyball friend. I mean, who wants to encourage remoteness as a culture?

Instead, our focus is on building a great **relationship culture**. By building strong bonds of trust and respect, passion and transparency, we've cultivated a culture that _empowers_ remote working. When you have those things in place, then where you physically work from is less important. This has always afforded us the luxury of really focusing on hiring the best talent for the roles we need. Literally, the entire world is our talent pool.

Certainly, there's plenty of great benefits for the remote employees &mdash; many listed by our very own staff [later in this post](#remote-benefits) &mdash; but there's also a huge benefit to Auth0: it exponentially increases the diversity of talent we can hire. On our team today, we have an ex-professional women's tennis player from the USA, a Certified Practicing Accountant turned developer from Canada, a one-time junior figure skating champion from Australia, and hundreds of other people with equally interesting backgrounds and experience from over 30 other countries. In fact, over 50% of our staff work outside of our main office locations. 

I don't want to presume a list of all the typical remote working benefits you might often read. So instead, here's what our employees actually told us they find amazing about their experience of working remotely at Auth0.

<h2 id="remote-benefits">Benefits of Remote Work As Told By Auth0 Employees</h2>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/abigail-sanchez.png" name="Abigail Sanchez" title="Program Manager" team="Field Ops" location="Washington, United States" body="Leaving your desk at 9:45 AM to take your kid their forgotten lunch and making it back in time for your 10:00 AM meeting"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/andreas-christofakis.png" name="Andreas Christofakis" title="Customer Advocate Specialist" team="Marketing" location="Colorado, United States" body="You don’t have to compete with your roommate to do laundry on Sundays. Any day can be a laundry day."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/Annybell-Villarroel.png" name="Annybell Villarroel" title="Security Operations Manager" team="Security Team" location="Spain" body="Not having to spend hours commuting."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/ashley-nicholson.png" name="Ashley Nicholson" title="Customer Success Manager" team="CS Management" location="Pennsylvania, United States" body="I am thankful for less wasted time. Prior to working remotely, I was stressed about everything from daily traffic to making it home in time to put my daughters to bed. Auth0 recognizes the value of time."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/barbu-cruzado.png" name="Bárbara Muñoz Cruzado" title="Visual Designer" team="Design" location="Argentina" body="Working remotely gives me the chance to wear my pajamas all day long 😜 and I don’t have to wear any makeup. I can also spend time with my cats and be able to do passive chores that I’m used to doing during the weekend."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/caroline-nealey.jpg" name="Caroline Nealey" title="Learning Lead" team="Content & Guidance" location="Washington, United States" body="The flexibility of working remotely allowed my family to adopt a second puppy. I can work remotely when I need to or come home earlier or later when required."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/chris-schultz.png" name="Chris Schultz" title="Engineer" team="DevOps" location="Minneapolis, United States" body="Having your baby daughter smile at you when getting her up from a nap."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/dan-arias.png" name="Dan Arias" title="R&D Content Engineer" team="Marketing" location="Florida, United States" body="Being able to eat a freshly made meal from the stove."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/davide-barbato.png" name="Davide Barbato" title="Security Engineer" team="Security & Operations" location="Spain" body="Be able to explore and enjoy the city without missing a meeting."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziro/Dirceu-Tiegs.jpg" name="Dirceu Tiegs" title="Engineer" team="Site Reliability Engineering Team" location="Brazil" body="Being able to stay close to my loved ones when they are going through difficult times, for example, if my wife is sick in bed. Also, taking a nap in the middle of the day without judgment and then coming back to do more awesome work."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/dj-joyce.png" name="DJ Joyce" title="Corporate Account Executive" team="Field Sales" location="England" body="Being able to manage my animal friends..."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/eva-sarafianou.png" name="Eva Sarafianou" title="Application Security Engineer" team="Security & Operations" location="Washington, United States" body="Missing my flight from London to Seattle and deciding to stay and enjoy London for the whole week."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/guillermo-alduncin.png" name="Guillermo Alduncin" title="IT Support Engineer" team="Security & Operations" location="Argentina" body="Being able to focus on a particular task for a long period of time even when the music is super loud because you like it that way. Also, I think it's great to just wake up, get a cup of coffee, sit at your desk, and be working already! Saving the stress of commuting is the best!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/janie-greenwood.png" name="Janie Greenwood" title="Scrum Master" team="Engineering" location="Montana, United States" body="My boyfriend and I love living in Montana because it keeps us close to remote areas so we can get out in the middle of nowhere doing the things we love: like a 6-day river trip we did two weeks ago on the Smith River. Working 100% remote for Auth0 also means we can take our RV on a month-long road trip to visit family and friends. I feel very lucky to work here!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jeana-tahnk.png" name="Jeana Tahnk" title="Director, Corporate Communications" team="Marketing" location="Massachusetts, United States" body="Being home when my two older kids get out of school, and getting my littlest one off the bus!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jenny-obrien.png" name="Jenny O'Brien" title="Creative Writer" team="Marketing" location="Washington, United States" body="The ability to introduce my formerly feral rescue dogs to a wide range of voices sans stress thanks to video meetings! Dance breaks witnessed only by my sarcastic dogs."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jeremy-meiss.png" name="Jeremy Meiss" title="Dev Community Lead" team="Marketing" location="Kansas, United States" body="No showers needed."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/joan-pepin.png" name="Joan Pepin" title="CISO/VP Operations" team="Security & Operations" location="Oregon, United States" body="Cultural diversity! Every day I talk to and work with people from all around the world!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/karen-port.png" name="Karen Port" title="Developer Support Engineer" team="Technical Support" location="Pennsylvania, United States" body="No more traffic jams or commuting for over one hour one way, allowing me to spend more time with family and friends."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/katie-horne.png" name="Katie Horne" title="Technical Writer" team="Content & Guidance" location="California, United States" body="I love the flexibility to balance work and family. I am at all of my kids’ events."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/luke-oliff.png" name="Luke Oliff" title="R&D Content Engineer" team="Marketing" location="England" body="Getting to concentrate when your little boy is asleep because now your S/O also needs to tiptoe around.😂 Taking Zoom meetings on my mobile while walking/feeding/watering the dog/baby/plants. Getting through cold and flu season without being sneezed on by a co-worker — just your child."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/matt-machuga.png" name="Matt Machuga" title="Engineering Lead" team="Engineering R&D" location="Pennsylvania, United States" body="I enjoy being able to utilize my outdoor office... err, patio furniture."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/maria-paktiti.png" name="Maria Paktiti" title="Instructional Designer" team="Content & Guidance" location="Greece" body="Being able to make a 3-month trip through Latin America while working."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/marius-mogyorosi.png" name="Marius Mogyorosi" title="Application Security Engineer" team="Security & Operations" location="Ohio, United States" body="As a new dad, it's priceless for me to be able to spend much more time with my son! Also, blasting music when no one's home. 🤘"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/megan-gleason.png" name="Megan Gleason" title="Director, Product Management" team="Product Management" location="Washington, United States" body="Being able to volunteer at my son’s school during my lunch break. Hopping on the rowing machine for 20 minutes between meetings. And... not being judged for covering the walls of my office with crazy sticky notes."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/mike-kusold.png" name="Mike Kusold" title="Engineer" team="Engineering R&D" location="Colorado, United States" body="Being able to shower a brand new puppy with attention all day. I got a puppy back in February, a few months after I joined Auth0 because it was finally feasible since I wouldn’t be away from home for 10 hours a day. Now, I also love being able to walk my dog for a lunchtime break."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/peter-filias.png" name="Peter Filias" title="Customer Success Manager" team="CS Management" location="Michigan, United States" body="Being able to sleep in a little while longer while the kids are home for the summer! This tragically ends come Fall and 5:30 AM wake-ups - here we come!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/prashant-trivedy.png" name="Prashant Trivedy" title="Sr. Developer Support Engineer" team=" Technical Support" location="New Zealand" body="Getting an extra hour sleep and waking up when the rest of the household has to leave for work."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/rachel-khoriander.png" name="Rachel Khoriander" title="Technical Writer" team="Content & Guidance" location="Texas, United States" body="When your car engine throws a rod and you instantly need a new car, you can take your time and find a good deal rather than panicking about how to get to work!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/ramiro-nunez-dosio.png" name="Ramiro Nunez Dosio" title="Social Media Manager" team="Marketing" location="Argentina" body="Working from a Panamanian beach while eating a lobster caught on the same beach."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/robin-bijlani.png" name="Robin Bijlani" title="Software Engineer" team="Engineering R&D" location="Florida, United States" body="Not feeling guilty about leaving your furry companions at home alone all day."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/sam-bellen.png" name="Sam Bellen" title="Developer Evangelist" team="Marketing" location="Belgium" body="Getting my cat’s “work harder while I take a nap” look, day in day out."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/scott-mathson.png" name="Scott Mathson" title="SEO and Web Developer" team="Marketing" location="Montana, United States" body="More time and breaks with loved ones, pets, kids (if you have them), etc. Monetary savings by eating lunch at home and not doing morning commute drive-thru coffee. The ability to create a personalized office setup that you are most productive working in."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/shili-li.png" name="Shili Li" title="UX Researcher" team="Design" location="New York, United States" body="No makeup. No more worrying about what to wear. Flip flops and active shorts every day in the summer."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/siddharth-kshethrapal.png" name="Siddharth Kshethrapal" title="Engineer" team="Design R&D" location="India" body="Surprising your wife/kids at their work to pick them up."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/stacy-taylor.png" name="Stacy Taylor" title="Web UX Designer" team="Content & Guidance" location="Oregon, United States" body="I just like being able to walk my dog at lunch and to do passive chores (laundry, running dishwasher, Roomba, etc.) during work so I don't have to do them on the weekend."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/steve-hobbs.png" name="Steve Hobbs" title="R&D Content Engineer" team="Marketing" location="England" body="Being able to take some time out to do noisy DIY while your kid is in daycare! I managed to lay a whole floor today!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/sumana-malkapuram.png" name="Sumana Malkapuram" title="Solutions Architect" team="Professional Services" location="North Carolina, United States" body="Being able to get peaceful ‘me’ time and pursue my passion of playing guitar again."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/tim-ferrell.png" name="Tim Ferrell" title="Engineer" team="Engineering R&D" location="Florida, United States" body="Watching your toddler nap on the couch while waiting on the kettle."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/yvonne-wilson.png" name="Yvonne Wilson" title="Director" team="Strategic Operations and Technical Field Enablement" location="California, United States" body="I worked remotely while my children were growing up, which enabled me to be home when they came home from school and invited friends over. In addition, the increased reach of the internet and the ability to hire remote workers has enabled me to hire and work with very talented people from all over the world. It has been a privilege to get to know so many interesting people from different cultures, all working toward the same goal &mdash; secure identity management."/>

## Work is a Thing You Do, Not a Place You Go

I often push the sentiment that, for modern employees and organizations, work is a thing you do and not a place you go. Over the next few years, with the advancement of technology and the adaptation of our modern lifestyles, this will continue to be a strong guiding principle in the way we craft how work happens at Auth0.

Although [we're investing in Offices around the world](https://auth0.com/blog/auth0-supports-global-growth/) (we have offices in London, Bellevue, Buenos Aires, and Sydney) our vision is less about traditional offices and more about hubs to build relationships &mdash; places for people to work from or to come and go, to learn and network... be they Auth0 employees, customers, or industry community friends. The offices are only additive to the great relationship culture we have that empowers us to work from anywhere.

Now, someone just needs to send that message to Tom Hanks... and Wilson.

Go check out more about [how we do things at Auth0 over at our Culture page.](https://auth0.com/careers/culture)

<include src="asides/AboutAuth0" />

We Are Thankful For These Benefits of Working Remote

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Watch this recorded webinar with Garrett Bekker, principal analyst at 451 Research, where he discusses the current state of the IAM industry and the benefits of Universal Identity Management

Recently 451 Research’s Principal Analyst Garrett Bekker and Auth0 CMO Lewis Carpenter sat down to discuss solutions to the fragmented identity and access management marketplace. A variety of solutions aim at solving authentication and authorization, but each tends to focus squarely on a single audience, whether it’s consumers (B2C), business partners (B2B), employees (B2E), or IoT devices. This siloed approach makes the process both confusing and costly for those needing identity across the entire organization and beyond.

Fortunately, enterprises are realizing that a universal approach to identity is saving money, time, and most importantly, giving developers the freedom they need to focus on product innovation rather than security. Today’s marketplace demands a more adaptable solution that can handle the rigors of identity, and anticipate the needs of the future.

In this [recorded webinar](https://auth0.com/resources/webinars/need-for-universal-identity-management-webinar), you’ll learn Bekker’s take on the current state of the IAM industry and its evolution, where he believes it needs to go, as well as gain an overview of Auth0’s universal approach to identity.

<include src="asides/AboutAuth0" />

Webinar: The Need for Universal Identity Management with 451 Research

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

While it's hard to show direct returns on investment from an IAM solution, companies can't risk 2018 without one. Here are the most salient benefits to help you make a business case for an IAM budget.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---

No one needs to tell you how important Identity Access Management (IAM) is to your company. You are well aware of the security risks, operational inefficiencies and missed growth opportunities that the business will suffer without a modern IAM solution.

There's only one problem. Budgets are tight and no one wants to add a new line item to the budget that doesn't provide a guaranteed return on investment. The good news is that most IT budgets are increasing in 2018. How can you convince your company that a modern IAM solution is worth the money?

![2018 corporate IT budgets](https://images.ctfassets.net/23aumh6u8s0i/1w0HX9wIMXBulBSkgvO9p3/ccb19436f6514dc9a25536689d18c9a0/2018-it-budgets)

[Source](http://www.zdnet.com/article/infographic-2018-it-budgets-are-up-slightly-spending-focus-is-on-security-hardware-and-cloud/)

You need to have a killer business case that the budget committee can't ignore. It needs to clearly and concisely illustrate how IAM will save the company money and directly impact growth.

Here are three ways to grab management's attention and have them sipping the IAM cool-aid.

## 1. Don't Increase the Security Budget, Reallocate It

Mobile devices and cloud computing have changed the way companies approach security, yet most budget allocations have not evolved to address the new risks associated with these off-premise assets.

The reality is that most companies need to increase their overall security budgets to deal with the current barrage of cyber attacks, but if that is unlikely, you need to adjust the budget to prioritize based on threat.

For example, the average IAM spend currently represents [about 5 percent](https://www.gartner.com/newsroom/id/3836563) of the security budget, yet compromised identity and access is the cause of over [80 percent](https://www.cso.com.au/mediareleases/29642/hacked-passwords-cause-81-of-data-breaches/) of breaches. Year after year, companies invest most of their security budget in network perimeter protections.

Cybercriminals don’t care about the [Fort Knox perimeter](https://auth0.com/blog/how-poor-identity-access-management-equals-security-breaches/) you spend millions on to maintain. They simply go phishing to steal credentials or infiltrate a vulnerable web app outside the firewall. The security strategy must change, and the budgets align with this new reality.

### Major Security Breaches Start with Stolen Credentials

Equifax, Target, Deloitte, and Yahoo are just a few of the huge companies with multi-million dollar security budgets who fell at the hands of compromised usernames and passwords.

Many of these data breaches could have been prevented with a simple [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) protocol from an IAM solution. Instead, hackers caused billions of dollars worth of damage. Unfortunately, 2018 is expected to be even worse.

![Data breaches due to compromised credentials](https://images.ctfassets.net/23aumh6u8s0i/4WAKZGWTrAn9sEKIjoscpr/347e6c3511666a13f4fe7e0ba5860b11/data-breachs-due-to-compromised-denials)

Criminals are becoming more sophisticated in their phishing schemes, even using [artificial intelligence](https://www.csoonline.com/article/3244924/data-protection/2018-cybersecurity-trends-and-predictions.html) and automation to collect intelligence that will get them through any firewall.

IAM companies like Auth0 spend their time staying one step ahead of hackers who target identity and access. From [encryption](https://auth0.com/security) to [password breach detection](https://auth0.com/blog/announcing-password-breach-detection/), IAM solutions offer several layers of protection to keep your logins secure. When your login is secure, your data and customers' information is in a safer place.

### Secure Your Applications Before You're Exposed

Most enterprises have over 700 apps in use that are operating on personal mobile devices all over the world. When you have so many apps with company data outside the traditional security perimeter containing, you are extremely vulnerable to an attack.

IAM is becoming more and more complex as authentication and access to all of these applications must be managed and protected. Companies without a comprehensive IAM solution are failing with an estimated [25 percent](https://www.sans.org/reading-room/whitepapers/application/2016-state-application-security-skills-configurations-components-36917) blaming their apps as the source of breaches. The reason for [95 percent](https://blogs.gartner.com/anton-chuvakin/2015/05/18/highlights-from-verizon-data-breach-report-2015/) of these app attacks is stolen passwords.

![IAM is becoming more and more complex as authentication and access to all of these applications must be managed and protected](https://images.ctfassets.net/23aumh6u8s0i/32lcneRfrCoBVbNtsk8CnO/01ff394135754482b1db75f70e209123/how-enterprise-app-stores-work)

Auth0 offers several approaches to secure your apps without losing the convenience of accessing them on the go. Solutions like [single sign-on](https://auth0.com/learn/how-to-implement-single-sign-on/), [social login](https://auth0.com/learn/social-login/) and [passwordless](https://auth0.com/passwordless) add the necessary security to credentials and allow you to monitor login behaviors to flag suspicious activity.

It is clear that IAM is a critical piece of your company's security strategy. [Juniper Research](https://auth0.com/learn/social-login/) predicts that cybercrime will cost businesses over $2 trillion by 2019. If the past is the best predictor of the future, the majority of those crimes will come from inadequate IAM.

## 2. IAM Creates Efficiencies That Lead to Cost-Savings

IAM solutions are usually thought of as solely a security expense, but the reality is that IAM contributes to other facets of the organization that help drive efficiencies and save money. If you can quantify these cost-savings, you are more likely to secure an IAM budget.

The largest line item on an IT budget is often for utilities, which include things like hardware, help desk, network costs, and maintenance. These costs make up over 60 percent of most[IT spending](https://www.cio.com/article/2439252/budget/how-to-present-your-it-budget.html), and they cause frustration for budget managers because the numbers are huge and it's hard to explain the value.

Anytime you can reduce these dead costs, managers will listen. IAM tools can automate several labor-intensive processes that currently put a strain on IT and drive their utility budgets through the roof.

### Self-Service Access Reduces Help Desk Resources

Imagine you are locked out of your company's analytics application and you forgot your password. If your organization has an updated IAM solution, the process is easy. You reset the password and verify your identity with multi-factor authentication.

If your company does not have the right IAM solution, resetting passwords or verifying a device can be a long and frustrating experience. It usually involves emails and calls to a help desk. IT then has to waste time updating access on their end to get you back into your application. The process is unproductive and incurs unnecessary costs.

![If your company does not have the right IAM solution, resetting passwords or verifying a device can be a long and frustrating experience](https://images.ctfassets.net/23aumh6u8s0i/61BDc9hkyiQNSWITxfulTc/4dedba6f4549f54406728292e30c37b6/auth0-reset-password)

You can do a quick calculation of current help desk costs and determine how many hours were dedicated to helping customers or employees regain access from an interrupted login experience. Even a small drop in the percentage of help desk tickets might create an ROI that pays for the entire IAM investment for the year.

### Automate Certain IT Maintenance Tasks

IT departments are swamped. Some of the work they are doing can be automated, which would not only save the enterprise money on resources but also free your IT team up to focus on innovation and growth initiatives.

For example, IT routinely conducts access reviews to ensure the right employees have access to the right systems and unauthorized people are kept out. Without an IAM tool, IT managers have to do this manually which can take weeks of pulling user extracts, formatting files and going through all the data piece by piece.

![Automate Access Management with Auth0](https://images.ctfassets.net/23aumh6u8s0i/69vWW7XxWjouH6xMqmnHSW/bbc859b5e474bf89741961e590274eca/auth0-identity-access-management)

Auth0 [streamlines this process](https://auth0.com/blog/enhancing-productivity-with-identity-and-access-management/) by centralizing access control of every aspect of user ID including creating and provisioning users, password resets and blocking unauthorized employees. What once took weeks can be done in a few hours.

IT spends a lot of money on utilities that don't help drive growth for the enterprise. Showing your company how an IAM solution can remove a chunk of that budget will be well received.

## 3. Share the Budget with Sales and Marketing

There is an excellent business case to asking sales and marketing to chip in for the IAM solution. Why? IAM can help drive conversions and maintain customer profiles, driving up to [30% efficiencies](https://www.b10v.com/business-case-customer-identity-access-management-ciam/) in sales and marketing.

Successful sales and marketing rely on understanding your customers and delivering an experience that will lead to conversion. IAM solutions like Auth0 can provide customer profile data through [social sign-in](https://auth0.com/blog/customer-data-is-king-four-ways-to-know-your-customers-better/) to help improve targeting and craft [messaging](https://auth0.com/blog/5-killer-email-strategies-for-lifecycle-marketing/) around the customers' interests.

IAM also enhances the user experience by removing the barriers of registration or forgotten login credentials. In fact, when you implement a user-friendly login process, you can increase conversions by [20%](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/).

### IAM Tools Update Your Customer Contacts

Sales teams rely on their CRM to keep track of all their future and past customers. It is the salesperson's digital Rolodex and it is their lifeblood.

Unfortunately, every year about 30% of the customer data becomes outdated because people move around and change their info. When this happens year after year, your CRM becomes a big wasteland of stale information that makes tracking customer contacts a full-time job.

![Identity Access Management updates CRM data](https://images.ctfassets.net/23aumh6u8s0i/5qmLjDyVn57kabQqDMTx9f/4b8b879fced7cdfcf0610e4816df1541/auth0-identity-access-management-2)

An IAM system can help solve this problem by letting your customers manage their own identities. When a customer changes a job or a phone number, they will update their information in their single sign-on account, which is tied to your CRM system. This will ensure that you can keep track of your customers and not risk losing future sales because of bad data.

### Personalized Marketing Drives Sales

Every marketer knows the power of personalizing the customer experience. In fact, personalization affects all areas of marketing, reducing acquisition costs by as much as [50 percent](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/marketings-holy-grail-digital-personalization-at-scale) and increasing sales by up to [15 percent](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/marketings-holy-grail-digital-personalization-at-scale).

IAM tools help facilitate personalized marketing by aggregating your customer's data across various marketing channels to create a [single view](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) of your customer. This is achieved through [single sign-on](https://auth0.com/docs/sso/current), where the user logs into one account to gain access to their other application.

![Personalized website content makes customers happy!](https://images.ctfassets.net/23aumh6u8s0i/2VNY8Lqz8SygPs9MUnjlBX/70f3e2d63a0606b7e04606b4bbaeb221/personalization-stats-updated)

[Source](http://blog.whereoware.com/wp-content/uploads/2017/06/Personalization-Stats-Updated-1024x382.png)

In addition to aggregated data, Auth0 enables [social login](https://auth0.com/learn/social-login/), where users sign into their apps through a social account like Facebook or Twitter. When your customers use social login, you are able to learn more about their interests and target based on location or special events like a birthday.

Personalization requires customer data that goes beyond demographics. When an IAM solution delivers the deeper profile data and helps keep your CRM system updated, sales and marketing will realize they need an IAM tool for more than security. If you can't find the money in the IT budget, you have a valid case for asking sales and marketing for help.

## IAM Affects the Entire Enterprise

As a security tool, IAM has an extremely compelling business case for an adequate budget. With $2 Trillion on the line from cyber attacks, IAM becomes a no-brainer.

But IAM is more than a security solution, it enhances productivity and improves how users interact with your company. These use cases have tangible benefits that can be quantified. Whether it is by saving costs within IT or driving revenue by supporting sales and marketing, IAM does have a powerful ROI story.

3 Ways to Get an IAM Budget in 2018

605c451dd844eedb6b4b3f1e8619280b

Guest Author

Kyle Galbraith

Identity as a service provides lots of benefits for companies and developers looking to iterate quickly. Focus on building customer value not authentication.

The old adage goes, “don’t reinvent the wheel”. We say this over and over again as developers. Yet we are often sucked down rabbit trails where we end up doing the one thing we don’t want to do: reinventing the wheel.

Encryption is the textbook example used when we say “don’t roll your own”. Hundreds of researchers with very long names prefixed with a Ph.D. have already analyzed it. They test and verify different encryption algorithms. We trust these people because, quite frankly, encryption is hard. It is one of the higher risk things a developer can do. So we don’t roll our own encryption algorithms because it’s error-prone, we’re not experts in it, and we would rather not risk screwing it up.

The same is true for authentication and obtaining users identity in an application. It is hard, error-prone, and the risk is very high.
Yet, many developers, entrepreneurs, and indie hackers implement their own authentication flow. This shocks me. Why are you creating your own ad-hoc identity service when there are lots of better options? To be fair, some are using built-in frameworks for authentication which is less sinister than truly rolling your own. Even then you have to store user identity information often in your own databases.

Did you hear that? It’s the door of uncertainty, pending failure, and errors opening right back up.

<include src="TweetQuote" quoteText="Doing authentication correctly is as hard, error-prone, and risky as rolling your own encryption."/>

There are tools and services that exist right now that can cut your risk. They can reduce your error rate, and ease your anxiety overnight.

## Enter Identity as a Service
Where there are hard problems there is often someone that has already done it.

In this case, there are many Identity as a Service providers out there today. They aim to help developers solve the problem of authentication for their applications. Not by rolling their own but by abstracting it away. Developers no longer need to be responsible for developing their own identity service. The identity service manages authentication and the complexity associated.

[Auth0](https://auth0.com) is one of these providers. They offer identity as a service to you the developer. Users log in via your Auth0 client, land back at your application, and you now have an authenticated user that can use your application.

In this post, I am going to cover 5 benefits to leveraging Auth0 instead of rolling your own authentication service.

## Benefit 1: Decentralizing Identity from Applications
When a user goes to use your application what are some things you care about? It’s an important question and one you should think about. To simplify, the one thing every application developer cares about is that the user is associated with an identity.

Why the simplification? Because at the basic level you only want authorized users to use your application. In other words, if they are who they say they are and that identity can access the system, let them access the system.

This is a nice benefit of identity as a service like Auth0. It allows you to decentralize the identity from the application. A few benefits the developer gains from this are:

* No longer having to store user identity information in their own databases. If you don't need the user's password, then why have the overhead of storing it?

* The identity of a user is completely separate from an application. Done right, the only thing a developer will care about is a unique identifier. Nothing more.

* All the non-feature work like user CRUD, password CRUD, etc. goes away. That is all managed by the identity service.

Developers can focus on business value by moving identity and authentication to an external service. The user gains from the extra separation of concerns. Then the application can rely on a few bits of identity and nothing else. Wins all around.

## Benefit 2: Streamlined External Authentication
How much fun is it to configure Google authentication for an application? I would argue not the most fun thing to spend a few hours of my life on.

With a service like Auth0, I can enable this for my users with a few clicks of a button via their [extensive identity providers](https://auth0.com/docs/identityproviders).

Remember, application developers only care that the user is who they say they are. Remove the need for passwords at all by using external providers like Google or Facebook. By toggling the connection on users can leverage that connection to login if they choose. The key is that the user now gets to choose how they want to provide their identity, not the developer.

## Benefit 3: Ready to Go Authentication UI
As a developer, I would be alright with never having to have a username/password form on a website I maintain. Not that I mind the responsibility, but I would rather delegate that to a team that focuses on that. Provide me the ability to customize it so that it can match the “feel” of my application and I am good to go from there.

Spoiler alert, identity as a service often provides this ability as well. Auth0 offers a [hosted login page](https://auth0.com/docs/hosted-pages/login) that you can customize to match your “feel”. This makes it easy to have an authentication and sign up flow for your application in minutes.

## Benefit 4: Strong Communities
Hard problems often have communities of people that have developed best practices. These communities are great for getting help. An identity as a service provider like Auth0 has dozens of [open source projects](https://github.com/auth0/). There is an open source project for about any type of application you are building.

Not sure about something? Post a question in an issue tracker and you get a reply within a few hours. Just because identity is being abstracted away from your application doesn’t mean this is “easy”. You as a developer will have questions and the open source communities help you get answers.

## Benefit 5: Low Pricing for Most Projects
Pricing based on use is a big deal when it comes to leveraging any third-party service within your application. This is largely because we as developers only want to pay for what we actually use. If we don’t need more than 7,000 active users and two social providers than we can use Auth0 for the low price of $0. Yup, zero dollars a month if your application has under 7,000 users a month based on [Auth0 pricing](https://auth0.com/pricing).

Of course, if you have a need more logins, unlimited social providers, customization, or migration strategies then there are plans for that. Most plans are fairly inexpensive and definitely worth the monthly spend when you add up the other benefits. Often times for me I can leverage the free tier for most applications as I don’t need a lot of other bells and whistles. If you are working on enterprise applications than of course you want to reach out to the identity service.

## Conclusion
Is authentication a core business value for your product or service? Is it why your market is purchasing your product or service? Typically, the answer is no. But it is important and you can’t screw it up because then you're **out of business**. As a developer, you must take user authentication serious at all times.

Identity as a service provides developers with users identity. An identity without the code, risk, and tech debt that comes from doing it yourself. 

<include src="TweetQuote" quoteText="Now development can focus on building business value features instead of authentication."/>

User information is external from the application and developers. Remove all the code associated with login, resetting passwords, etc.

Moving your users' identity to a service that focuses on that is an all-around good idea. This doesn’t mean you are not accountable for the authentication of your application. You still are, but it becomes much simpler and far harder to screw up.

### More from Kyle Galbraith
I have begun putting a book together that focuses on learning AWS by actually using it. Instead of getting lost in the documentation, focus on a problem and learn the services that help you solve it as you are using them. If you are interested in learning more about AWS, sign up to stay updated on the progress of the book [Learning AWS By Using It](https://www.kylegalbraith.com/learn-aws).

5 Massive Benefits Of Identity As A Service For Developers

Although considered the easiest option, building has it limitations when compared to the benefits of buying.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---

The buy-vs-build battle is an eternal one for startups. With limited time, resources, and manpower, you're always weighing the relative benefits of building a piece of software in-house and buying it from a third-party vendor.

Even enterprises with access to the necessary resources face this challenge. Do they build because they can or trust someone to do it better and more efficiently than they can?

As time passes and the needs of startups and enterprises become more complex, new products and services contribute to making the decision to buy an increasingly beneficial one.

Here's a look at the history of some major technological innovations and how they changed perceptions of whether to build or buy software and platforms.

## The Rise of Relational Databases

Businesses have always been interested in the collection of data, but the introduction of the desktop computer as a mainstay of the office (and the home) brought their data collection capabilities to a whole new level.

By the 1980s, buying software like dBASE (for databases) or Lotus 1-2-3 (for spreadsheets) had become commonplace. Oracle's market-leading database software was a few years old and had already permeated thousands of businesses.

This revolution started in the early 1970's, when [E.F Codd](https://en.wikipedia.org/wiki/Edgar_F._Codd) first presented the concept of relational databases.

Before Codd's groundbreaking paper, there had been two models for how computerized databases could work: the hierarchical model and the CODASYL model (or network model). These were both based on *navigational* data models, meaning you found entries primarily through references from other entries. Numerous shortcomings with this method, including the total lack of a “search” functionality, encouraged Codd to look for a new system.

His proposed relational system proved to be far more efficient, and it enhanced the productivity of those who used it greatly. Programmers who wanted to access and use a relational database didn't need to [worry about how the data was stored](http://avant.org/project/history-of-databases/). They only needed to run the queries outlined in the emergent Structured Query Language—or SQL.

![DBMS interaction](https://images.ctfassets.net/23aumh6u8s0i/2E5aIePNI049jPoUYe6c1P/47285095f6e78886b5665df7304bac99/dbms_interaction)

While IBM fretted over how a relational database product would cut into the revenue they were generating from their navigational database product, Oracle CEO Larry Ellison had no such concerns. Within a few years, the relational database and SQL—the language used to interact with it—had become the default option. [Oracle](https://www.oracle.com/), based on the strength of their relational database product, reaped the rewards of this shift.

In the case of databases, the shift from build to buy came about as a result of the creation of **standards**. Prior to the relational takeover, there was no standout protocol, too many competing options, and no compelling reason to use any particular system over another.

With the rise of the relational database came not only standardization but the opportunity for companies to take that standard model and run with it, creating suites of applications *around* the database. With Oracle, for instance, every additional application that they released to their customers came bundled with, relied on, and expanded the utility of the customer's database. They aimed to become the hub around which a business's whole operations revolved, not just their database provider.

The standardization of the relational model made it possible for companies to begin providing truly great customer experiences. Here was a model that simply made more sense that everything that had come before—not only was it better for customers, it was better for entrepreneurs looking to solve problems for those customers.

## Access to Affordable CRM

The 1980's also marked the beginning of attempts to digitize the messy universe of *Customer Relationship Management* (CRM).

The earliest software was database-driven and was more [digital Rolodex](https://www.crmswitch.com/crm-industry/crm-industry-history/) than true relationship manager. The organization of customer contact information was its primary purpose. Siebel was born in the 1990's, becoming the first “sales force automation” product to really capture the market—but it was still limited in that it was exclusively sold to big enterprises (It's worth noting that founder Tom Siebel came from Oracle.) 

But the vast market of small to medium sized businesses remained largely without, relying on e-signatures and email to add order to the process of customer relationship management. That was until [Salesforce](https://www.salesforce.com). The *SaaS* (Software as a Service) model of Salesforce, driven home by founder Marc Benioff's guerrilla “software is dead” marketing, resulted in a product that was tailor-made (cost-wise) for *SMBs* (small and medium-sized business).

For the first time, a *CRM* tool could truly add value to the operations of an *SMB* and make buying a *CRM* a worthwhile endeavor. Their subscriber base grew rapidly.

![Salesforce growth](https://images.ctfassets.net/23aumh6u8s0i/6lfmop2ILMjtEULeQ7wnPd/13de453b39efe2bf2edce20c27c2b4b3/salesforce-subscribers)

What Hubspot's Dharmesh Shah calls their ["simple pricing and low-risk implementations"](https://www.quora.com/Why-did-Salesforce-com-succeed) allowed Salesforce to become the favored product of a massive market of *SMBs* in need of a *CRM*.

The introduction of Salesforce helped shift *CRM* from a transactional model where customers were just seen as data points to a relational model where customers were seen as business partners.

Like Oracle, they used the fact that they were becoming embedded in so many companies to begin offering add-ons that would cement their positioning. Look at their revenue today and it's clear that those add-ons—the Salesforce platform, analytics, marketing, and other services—are what drive Salesforce's [growth now](http://www.forbes.com/sites/greatspeculations/2015/11/25/here-is-the-reason-behind-salesforces-unabated-growth/):

![Salesforce Markets](https://images.ctfassets.net/23aumh6u8s0i/371gXtumfpHqexLICNif9H/5dd700fbf0575518a5e895b68b99b41d/salesforce-markets)

What those additional layers of services tell us is that once again, adding value on top of your core proposition is what can make buying (rather than building) a true no-brainer.

![Salesforce definition](https://images.ctfassets.net/23aumh6u8s0i/6NVf8PT5nn6Kln3H9GoUNL/8a8af600405d29101877542d77e58ff1/salesforce-definition)

Even today, businesses might not want to spend the money to pay for Salesforce or another kind of *CRM*. But the value being proffered now is so much greater. It's not just the *CRM* tool that you're paying for—it's a whole suite of analytics and services to help drive more value out of that data.

## The Evolution of Payments

Tech companies have never been very well served by banks, making online payments processing a tricky process. Banks were more focused on helping large enterprises manage high-return credit opportunities.

By the 2000s, new companies like Authorize.net and PayPal were working on the problem of online payments—but not truly cracking it. With Authorize, companies had to have a bank account linked to it. PayPal, on the other hand, had acquired a reputation for not being very user-friendly (by occasionally holding funds, for instance) and so payment remained a thorny problem for upstart developers.

Both eventually moved upmarket, leaving startups without a simple way to process payments just as consumer demand for it was increasing. There was no simple option—until [Stripe](https://stripe.com/).

At its start, Stripe did one thing really well. They made it incredibly easy for businesses to collect payments online. Whatever the revenue model—one-time, transactional, subscription—you could take a developer, and have they set up a working payments portal in one afternoon with just a few simple API calls. The onboarding was simple, efficient, and it got people up and running fast.

![Stripe landing page](https://images.ctfassets.net/23aumh6u8s0i/1PeAra8f1U7B4IFSFO0Yqg/e7b7c88d8cf89e35df0cfe0170f810c5/stripe-landing-page)

It's not enough to make something easy, of course.

What Stripe has done to move the tech world firmly into “buy” territory, when it comes to payments, is find the same kind of network effects that Oracle and Salesforce did.

When you use Stripe for payments, you're not just saving yourself the time it would have taken you to build a payments gateway. You're taking advantage of the fraud detection systems that Stripe has built. You're taking advantage of their massive marketplace of integrations. You're getting other features like international transfers and instant debit card payouts that are difficult to get whether your organization is small *or* large.

In other words, everyone has something to gain from buying Stripe vs. trying to build their own payments processor.

## Emergence of Identity as a Service

These technological shifts are just beginning. Every year, another industry is disrupted by the emergence of new back-end technologies that enable startups and enterprises alike to stop building and start buying. There's [Algolia](https://www.algolia.com/) for search, [SendGrid](https://sendgrid.com/) for email, [Zapier](https://zapier.com/) for workflow automation, and of course, there's *Identity and Access Management* (IAM).

When it comes to managing user identities, companies of all sizes used to build all of their own systems. This came with plenty of difficulties, like creating a flexible and secure *Single Sign-On* (SSO) system to maintaining security amidst ever-increasing threats.

These systems were also very expensive to build and maintain, but at the time, businesses had few options other than to build.

![Emergence of identity as a service](https://images.ctfassets.net/23aumh6u8s0i/4zOoUSlDg77TY3JWibMHD6/ba57cf4df6d0f0827fd10b3d484e5c26/iam)

It wasn't until *IAM* was introduced as *Identity as a Service* (IDaaS) that businesses were able to outsource to get a comprehensive identity management solution. With *IDaaS*, businesses, especially startups, can feel secure in everything from *SSO* to using cloud-based environments for access controls and compliance.

Anyone can now trust their compliance, authentication and security needs with a specialized provider. They don't have to worry about exposing themselves to vulnerabilities because of the risks involved with building their own system.

Nor do they have to worry about the cost of revisions and upgrades for an in-house product. These can be expensive, time-consuming to handle and require constant involvement, especially as a business grows.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## To Buy or Not to Buy

Products and services for enterprises and startups have come a long way in many areas of technology. While it used to make sense to build in-house, customer needs and expectations have become more complex. This change means technology has to adjust accordingly.

You don't have to use your precious time trying to figure out something if you buy a third-party solution. Even if you have the capability and resources, chances are there's something you haven't thought of.

Let companies who've put in the time and research take care of processes that they can manage more effectively. If it makes sense for you to buy, your time is best spent on growing your business and focusing on what *you* do best.

The History Behind When Build Becomes Buy

Auth0 makes it simple and easy to add authentication and authorization to any app. By localizing our marketing website, we hope to make it easier for developers and companies to implement and see the benefits of modern identity management.

**BELLEVUE, WA - Konnichiwa!** We are pleased to announce that the Auth0 marketing website has been localized for the Japanese market. Auth0 makes it simple and easy to add authentication and authorization to any app with its powerful API and SDK’s for most languages and frameworks. 

Auth0 has always championed and embraced open-source software and we hope that by localizing our vast knowledge of security best practices we can make it easier for developers and companies, regardless of industry, location, or *language*, to make the web a safer and more secure place for everyone.

![Auth0 Japan](https://images.ctfassets.net/23aumh6u8s0i/7iYJ6F6NCYo6rYEaMi42b7/a7e02e6cc8b91a632cbd34e9a3a3486a/auth0-jp)

If you are visiting the Auth0 website from a Japanese locale, you will automatically see the website presented in Japanese. If you wish to view the Japanese version of the website but are outside of the Japanese locale, you can view it by visiting [https://auth0.com/jp](https://auth0.com/jp).

<include src="asides/AboutAuth0" />

"benefits"