william_johnson

Will Johnson is a Developer Advocate at Auth0. He loves teaching topics in a digestible way to empower more developers. He writes blog posts, records screencasts, and writes eBooks to help developers. He's also an instructor on <a target='_blank' rel='noopener noreferrer' href='https://egghead.io'>egghead.io</a>.

Developer Advocate

Will Johnson

jess-author

Jessica Temporal is a Senior Developer Advocate at Auth0 and co-founder of the first Brazilian data science podcast called <a target='_blank' href='https://pizzadedados.com'>Pizza de Dados</a>. She’s the author of <a target='_blank' href='https://www.amazon.com/dp/B0CDNX6NS7/ref=sr_1_1?&_encoding=UTF8&tag=jesstempora0e-20&linkCode=ur2&linkId=efc4229f6b816609dfce4f185781d99a&camp=1789&creative=9325' >The Big Git Microbook</a>, creator of <a target='_blank' href='https://gitfichas.com/en'>GitFichas.com</a>, and a part of <a target='_blank' href='https://www.linkedin.com/learning/instructors/jessica-temporal'>LinkedIn Learning</a> instructors team. Jessica helped develop the AI that identifies possible unlawful expenses from Brazilian politicians. She is part of the PyLadies initiative that works to improve diversity and inclusion in technology. In her free time, she likes to knit, play video games, use her 3D printer, and is learning to create 3D models.

Sr. Developer Advocate

Jessica Temporal

Learn how to use Auth0 to secure a remote MCP server built with Cloudflare Workers to access a protected API.

**TL;DR** - Auth0 is collaborating with Cloudflare to make it easier for developers building remote MCP servers to configure authentication and authorization. Remote MCP servers will allow AI applications to access external services securely. This post details how to use Auth0 to secure a remote MCP server built with Cloudflare Workers to access an external service. It uses a sample Todo API as that external service.

## What are MCP Servers?

Developers are using large language models (LLMs) and AI applications to help build and deploy their code. Those applications are great when using data LLMs have already been trained on, but what if they could connect to external services to get even more information? That’s where the [Model Context Protocol (MCP)](https://auth0.com/blog/an-introduction-to-mcp-and-authorization/) comes in. MCP is a protocol that allows LLMs to connect with external tools and APIs in a standardized way. Using MCP, AI applications can connect with external services without knowing how each API works. MCP achieves this by using a client-server model.

* **MCP Client** &mdash; A client maintains the connection to MCP servers from inside of an LLM-based application.
* **MCP Server** &mdash; A server is always running and listening to be called by an MCP Client. 

Remote MCP servers are accessible on the Internet. Users sign in, and grant permissions to MCP clients using authorization flows with which they are already familiar. This opens up new use cases for users who may not want to run a MCP server locally on their machine, but are comfortable interacting with APIs and granting access online.

## Securing a Remote MCP Server with Auth0 and Cloudflare

Auth0 has collaborated with Cloudflare to help developers secure remote MCP servers powered by [Cloudflare Workers](https://developers.cloudflare.com/workers/). With the pace of MCP adoption rapidly increasing, Cloudflare has continued to keep up with innovation - [adding features to its platform](https://blog.cloudflare.com/remote-model-context-protocol-servers-mcp/) that handle the hard parts of building remote MCP servers, like `workers-oauth-provider`, an OAuth Provider that makes authorization easy. By [securing your MCP server with Auth0](https://auth0.com/blog/an-introduction-to-mcp-and-authorization/), AI applications can now interact with an external API by connecting through the remote MCP server and make API calls on behalf of an authenticated user.

In the rest of this blog post, we will walkthrough a practical example of this. We will set up and use an AI application to connect with a sample Todos API using an MCP server secured by Auth0. The server and API are Cloudflare Workers projects and will use Auth0 to request and receive access and refresh tokens.

![Diagram of request from MCP Client to a Todo API using Auth0 and Cloudflare](https://images.ctfassets.net/23aumh6u8s0i/1ycXxkqfevcl9XgqrtAL7E/b69b63cd6936a09343f7664229e07919/mcp-8.png)

We will first create the necessary accounts and set up the Todos API, then deploy and configure an MCP server that will connect to Auth0, and finally, the MCP Client can request information from the Todos API.

## Get Started

To follow along, you will want to set up your local developer environment. To get started:

* Create an [Auth0 Account](https://auth0.com/signup?place=header&type=button&text=sign%20up).
* Create a [Cloudflare Account](https://www.cloudflare.com/).
* Install Visual Studio Code (or your favorite code editor).

Once you create those accounts, you will want to 

* Install [Node.js](https://nodejs.org/en/download) (v18+).
* Install [Git](https://git-scm.com/downloads).
* Install the Cloudflare Wrangler CLI. [Read the documentation on installing Wrangler here](https://developers.cloudflare.com/workers/wrangler/install-and-update/).

### Get the Todo API and Remote Auth0 MCP server sample applications

The sample Todos API and remote MCP server are within the [Cloudflare AI monorepo](https://github.com/cloudflare/ai). Clone the repo, navigate to each application, and install the dependencies using the following commands in the terminal.

For the **Todos API**:

```
git clone https://github.com/cloudflare/ai.git
cd ai/demos/remote-mcp-auth0/todos-api
npm install
```

The TodosAPI is built with the [Hono web framework](https://hono.dev/),

For the **remote MCP** Server:

```
cd ../mcp-auth0-oidc
npm install
```

With both of the projects available locally and dependencies installed, proceed to the next step to secure the Todos API with Auth0.

### Configure the Todos API with Auth0

Let’s configure the Todos API to be secured by Auth0. Doing this will allow the remote MCP server to receive both access and refresh tokens and perform actions on behalf of the end user. To get started, [login to your Auth0 account](https://auth0.com/api/auth/login?redirectTo=dashboard) to visit the Auth0 Dashboard.

Create an API on the Auth0 Dashboard by going to [Applications > APIs](https://manage.auth0.com/#/apis/). Then click **Create API**.

![Create API modal in Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/klUW8q2EKjmE0CnTpaTU6/bb20af2cc6123644879ec38f09c51c73/Screenshot_2025-04-10_at_3.27.31_PM.png)

Next, enter the following values in the following fields:

* In the **Name** field, enter “Todos API”.
* In the** Identifier** field, enter `urn:todos-api`. This value will be used as the audience parameter when the MCP server makes an authorization call to the Todos API.
* Press the **Create** button

The next step is to allow a refresh token to be retrieved when requested by the remote MCP server. Go to [Applications > APIs](https://manage.auth0.com/#/apis/) and click on the entry for the Todos API. Visit **Settings**, scroll down to **Access Settings**, and toggle the **Allow Offline Access** button to enable it. Then click **Save**.

![Screenshot of API Access Settings in Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/6qoFrMXPUzyt5Z6SWK9o9w/517bf73eac7a9f701c984d18aec18fdf/Screenshot_2025-04-10_at_3.33.40_PM.png)

Toggling on the Allow Offline Access, allows a [refresh token](https://auth0.com/docs/secure/tokens/refresh-tokens) to be retrieved by the MCP server, so the user doesn’t have to keep re-authenticating when an access token expires.

As a final step - the permissions (scopes) need to be configured in the Auth0 Dashboard. These will be granted when a user authorizes an application to gain access to an API. In the API settings for the Todos API, go to the **Permissions** tab and add `read:todos` and `read:billing` as permissions, add a description, and press the **+ Add** button to effectively create the permissions.

![Screenshot of API Permissions tab on Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/4KSfabe2W5eQh5TuOF2cts/3ddf1ea4fd1eceadbff80d31ad5eed6c/Screenshot_2025-04-10_at_3.37.04_PM.png)

With the permissions in place, the Todos API is created and configured within Auth0. You need to give the Todos API the information from Auth0.

Open the Todos API project in your preferred code editor, set configuration values to connect it to the API you just created in the Auth0 Dashboard, and then deploy it via the Wrangler CLI.

In the root of the Todos API project, create a `.dev.vars` file. With the following format:

```
AUTH0_DOMAIN=
AUTH0_AUDIENCE=urn:todos-api
```

Note that you already have the `AUTH0_AUDIENCE` from when you created your API. Now, you’ll need to fill in the Auth0 Domain.

Whenever a new API is created in the Auth0 Dashboard, you also get a test application that allows you to get access tokens and make requests to your protected API. You can see the test application under [Applications>Applications](https://manage.auth0.com/#/applications).

Now that you are in the Applications section of the Dashboard click on the “*Todos API (Test Application)*”, which will load the settings and copy the **Domain** value. The domain will be used in the next step when we update the Todos API project. 

![Screenshot of Todo API application settings in the Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/1tYPzi9JnFGx0UfzIIU2p9/ea37c64f67666bc254ea05e6aef3d352/Screenshot_2025-04-07_at_1.03.54_PM.png)

Update your `.dev.vars` file to contain the Domain like so:

```
AUTH0_DOMAIN=Your Auth0 domain (e.g., acme.auth0.com)
AUTH0_AUDIENCE=urn:todos-api
```

### Testing the Todos API

With the Todos API configured both in Auth0 and locally, you can make requests to it.

Run the Todos API with the following command:

```
npm run dev
```

This will start the worker and allow you to make requests to the Todos API. 

To get the `access_token` to call the API, on the Auth0 Dashboard go to **Applications > APIs, **click on the** Todos API **then select the **Test** tab. This will give you the cURL command to request the access token.

![Screenshot of Todos API Test Tab](https://images.ctfassets.net/23aumh6u8s0i/3aXJxxBRZP75mib0aGAJyS/22204edc710ede9ae7c7b4a706dbe2d8/Screenshot_2025-04-09_at_1.52.22_PM.png)

In your terminal, run the command from the **Test** tab, and be sure to use the `client_id` and `client_secret` values from Auth0.

```
curl --request POST \
 --url https://dev-aggvwbxi.us.auth0.com/oauth/token \
 --header 'content-type: application/json' \
 --data '{"client_id":".....","client_secret":".....","audience":"urn:todos-api","grant_type":"client_credentials"}'
```

The cURL command will show the response with the access token like below:

```
{
 "access_token": ".......",
 "token_type": "Bearer"
}
```

Next, make a request to the API passing the access token in the Authorization header.

```
curl --request GET \
 --url http://localhost:8788/api/me \
 --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6Im...'
```

On a successful call, you will see the claims of the JWT token in the response.

## Deploy the Todos API to Cloudflare

The Todos API is a Cloudflare Workers project, which means it can process Wrangler commands. With everything you have in place so far, you can use Wrangler to set secrets locally and deploy the API to Cloudflare. Using the terminal, navigate to your project folder and run the following commands:

```
wrangler secret put AUTH0_DOMAIN
wrangler secret put AUTH0_AUDIENCE
```

Now that the secrets are set, you can deploy the Todos API to Cloudflare with the following command:

```
wrangler deploy
```

Now that the Todos API is deployed to Cloudflare and secured by Auth0. Keep the project open as we’ll use the terminal in the next step to configure and deploy the remote MCP server.

## Configure and Deploy the Remote MCP Server

In this step, we will configure the remote MCP server secured with Auth0 and make requests to the Todos API. This includes creating an application for it in the Auth0 Dashboard and deploying it to Cloudflare.

Head back to the Auth0 Dashboard and create a web application by going to [Applications → Applications](https://manage.auth0.com/#/applications). Click **Create Application** and enter the following values:

* For the **Name** field, enter “Remote MCP Server”
* Choose **Regular Web Applications** as the Application Type
* Click the **Create** button

![Create Application Modal in Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/3HJs03fVbMD1dRZzGpcLGh/efa94e5434af3d0bc12dfd7565eae4fd/Screenshot_2025-04-07_at_1.53.58_PM.png)

Next, we will configure the callback URL, which is the URL to which the application will be redirected back to the caller after the user authenticates. To set this, head to the MCP Server application Settings, scroll to **Allowed Callback URLs** in the **Application URIs** section and add the following URL.

```
http://localhost:8788/callback
```

> *Note:* This URL will change when you deploy it to production. 

![Application URIs in application settings on Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/3VygdrL3LQBItkNhTVy7v7/fc558fd1a2492454302948c7c3d584e0/Screenshot_2025-04-10_at_4.10.52_PM.png)

Next up is creating a [Cloudflare Workers KV](https://developers.cloudflare.com/kv/) namespace. This namespace is used by the remote MCP server and `workers-oauth-provider` to handle authorization requests.

To create a **KV namespace** with Wrangler, in the terminal, run the following command:

```
wrangler kv namespace create "OAUTH_KV"
```

Open the Remote MCP Server project in your code editor and paste the resulting values in the existing `wrangler.jsonc` file using the format below:

```js
//wrangler.jsonc

{
 "kv_namespaces": [
 {
 "binding": "OAUTH_KV",
 "id": "<BINDING_ID>"
 }
 ]
}
```

Now that the KV namespace has been created, the next step is to update configuration values for Wrangler to deploy the remote MCP server to Cloudflare. To configure the application you’ll need a few values from your application settings in the Auth0 Dashboard. 

Go to [Applications → Applications](https://manage.auth0.com/#/applications), then click on the Remote MCP Server application. There, you can take note of your Auth0 Domain, Client ID, and Client Secret. 

![Auth0 application settings](https://images.ctfassets.net/23aumh6u8s0i/3HJs03fVbMD1dRZzGpcLGh/efa94e5434af3d0bc12dfd7565eae4fd/Screenshot_2025-04-07_at_1.53.58_PM.png)

With the project open in your preferred code editor, create a .dev.vars in the root of the project and add the following values:


```
AUTH0_DOMAIN=Your Auth0 domain (e.g., acme.auth0.com)
AUTH0_CLIENT_ID=The Client ID of the application created in Auth0
AUTH0_CLIENT_SECRET=The Client Secret of the application created in Auth0
AUTH0_AUDIENCE=urn:todos-api
AUTH0_SCOPE=openid email profile offline_access read:todos
NODE_ENV=development
API_BASE_URL=http://localhost:8789
```

### Deploy the MCP Server to Cloudflare

To deploy the remote MCP server to Cloudflare, you first need to set the secrets in Wrangler. To do this, run the following commands:

```
wrangler secret put AUTH0_DOMAIN
wrangler secret put AUTH0_CLIENT_ID
wrangler secret put AUTH0_CLIENT_SECRET
wrangler secret put AUTH0_AUDIENCE
wrangler secret put AUTH0_SCOPE
wrangler secret put API_BASE_URL
```

Once the secrets are set, run the following commands to deploy the MCP Server to Cloudflare.

```
wrangler deploy
```

With the MCP server deployed, we can update the **Allowed Callback URLs** in the Application settings within the Auth0 Dashboard using the deployed MCP server URL using this URL pattern.

To change the Allowed Callback URLs, on the Auth0 Dashboard go to **Applications > Applications**, click on **Settings**, scroll down to **Application URIs** and then add the following URL.

```
https://mcp-auth0-oidc.<your-subdomain>.workers.dev/callback
```

![Auth0 Application URI settings](https://images.ctfassets.net/23aumh6u8s0i/69X5vC9Cna1nKKvicpWTp6/79de976d5939062bc416d46037c550f6/app-urls-callback.png)

This will make sure that after the user authenticates, they will redirect back to the remote MCP server to make calls to the Todos API. With these steps in place, it’s now time to see the remote MCP server in action.

### Test the Remote MCP Server Call

To test making calls to the Todos API, use the Workers AI LLM Playground. Navigate to [Cloudflare’s AI Playground](https://playground.ai.cloudflare.com/) and connect to the Remote MCP Server URL:

```
https://mcp-auth0-oidc.<your-subdomain>.workers.dev/sse
```

Place the URL in the section labeled MCP Servers and click **Connect**.

![Cloudflare AI workers playground](https://images.ctfassets.net/23aumh6u8s0i/1Jwt30QY8vuTTO3ZMNTZXr/5757f0dc6a99600d8ab404eca3f97061/Screenshot_2025-04-10_at_12.33.42_PM.png)

Then you’ll go through the authorization flow; you need to allow access:

![MCP server access request](https://images.ctfassets.net/23aumh6u8s0i/57yVFkdC5sEhBIXEICo9jo/00327fda1167ae4b61f6d64582f78934/auth-request.png)

This will open the browser, have the user authenticate with Auth0, and allow the remote MCP server to access the resources of the Todos API. 

![Auth0 universal login](https://images.ctfassets.net/23aumh6u8s0i/MJX7hQveJh6BYaMKmIHDn/3ef06aa1a2a047c649278d9a0ee37de9/auth-ul.png)

Once permission is given, you can use the LLM to make requests to the MCP server to get information from the Todos API.

![cloudflare AI playground](https://images.ctfassets.net/23aumh6u8s0i/1sO7ZqO9aF7o0VzYEex9VZ/2aa6f63cf1bd01862dde09a0efdfe221/playground.png)

The Todos API allows requests for todos and billing information. Note that the billing information request will fail to show that the LLM can only make requests for information that it has permissions for.

## Configuring a Remote MCP Server in Claude

Now that you understand how to secure a remote MCP server with Auth0 and know how to deploy it to Cloudflare, it might be good to see how to set it up to your favourite MCP Host. Let’s set up your server in Claude Desktop.

Open Claude Desktop, navigate to the Settings then click on Developer and Edit Config. This will show you Claude’s folder on your computer and the file named `claude_desktop_config.json`.

![Claude Desktop Config JSON file](https://images.ctfassets.net/23aumh6u8s0i/4JAy6wjNRtCEVaLIUSJxDv/ebab95cd543009cac72cf1a22fb90e1e/claude-desktop-config-in-folder.png)

Open that file in your favorite editor, and add the following:

```json
{
 "mcpServers": {
 "math": {
 "command": "npx",
 "args": [
 "mcp-remote",
 "https://mcp-auth0-oidc.<your-subdomain>.workers.dev/sse"
 ]
 }
 }
}
```

Remember to update the URL to use your Remote MCP Server URL in the arguments list. This configuration names a “`math`” server that runs with `npx` as command and passes the package `mcp-remote` and the URL as parameters to `npx`.

[The `mcp-remote` package](https://www.npmjs.com/package/mcp-remote) is responsible for connecting an MCP Host with `stdio` like Claude Desktop and Cursor to securely access a Remote MCP Server like the one you just deployed.

Once you save the configuration and restart Claude, you’ll be able to prompt Claude about your list of todos:

![Claude using the Remote MCP Server to show the todos list](https://images.ctfassets.net/23aumh6u8s0i/7HE3fATATP2E1Mxr69V11J/84d1c2267567d095f4b9b5cf5a1bbadb/claude-todos-list-mcp-server-and-api.png)

## Conclusion

In this post we walked through the steps needed to secure a MCP Server with Auth0, and connect it to a third party API. You also learned how to deploy your MCP Server to Cloudflare. The MCP server uses Auth0 as a third party identity provider and allows AI tools to call the protected API on behalf of the user.

Remote MCP Servers offer tools that can make LLMs more convenient and give faster access to the information that matters to users. If you are building with GenAI you should check out our brand new product [Auth for GenAI](http://a0.to/ai-content), to enable AI agents to securely access tools, workflows, and data with fine-grained control and just a few lines of code.

You can take a look at the code that was used in these demos [on GitHub](https://github.com/cloudflare/ai/tree/main/demos/remote-mcp-auth0) to try it out for yourself.


---

_This blog may contain hyperlinks to non-Okta websites that are created and maintained by third parties who are solely responsible for the content on such websites._

Secure and Deploy Remote MCP Servers with Auth0 and Cloudflare

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

From tooling changes to the ascent of the hybrid event model, it’s all change, all the time.

As a seasoned engineer, you've seen your fair share of industry changes. Over the past forty years, developers have witnessed the emergence of new coding paradigms and approaches that have had a seismic change to how they work. Examples include the mainstreaming of object-oriented programming in the early 1990s and the emergence of multi-core programming in the late 2000s. 

More recently, Covid-19 has turned the development world on its head, forcing teams to adapt to a brave new distributed world. As we enter the second year of the pandemic, it is increasingly clear that these changes aren't a temporary blip but rather a long-term reality. 

So, what can we expect from 2022? We spoke to four development, product, and privacy experts at Auth0 to hear their predictions for the year ahead. 

![Remote](https://images.ctfassets.net/23aumh6u8s0i/6esbX2g2LrG3jLK1FQjRyw/a110f6422adefcbfecdc53a67141b809/separator01.jpg)

## Remote Working Drives Tooling 

It's been almost two years since the world was tipped on its head. Tech roles, from software development to system administration, moved from the cubicle farm to the home office. Slack DMs replaced the usual water cooler conversations. Although some firms have fully embraced these seismic shifts, notably Twitter and Pinterest, others are less keen. 

Several Silicon Valley giants — most notably Google and Apple — set deadlines for a return to in-person working, although these have been pushed back again and again, following the emergence of the Delta and Omicron variants. Like it or not, remote working is here to stay for the foreseeable future. As Adam Housman, Group Product Manager at Auth0, explains, this will influence how developer tools are made, configured, and used. 

"I'm excited about how the shift towards remote work is impacting the choices in tooling that design and development teams make. We see a lot more globally distributed teams, and that is directly influencing which SaaS products are gaining traction in modern software companies," said Housman. 

"Products that take the friction out of async collaboration are experiencing a massive amount of growth, but we've reached the point that even companies which may have been late to react to the initial shift with COVID are now catching up," he added. 

What does this mean in practice? Housman expects developer-facing SaaS products to compete for less on functionality but more on flexibility, interoperability, and ease of adoption. Scalability will be another key factor, Housman adds, and the most successful tools will be those that can work equally well across whole companies as with small teams. 

"Companies of all sizes are using way more SaaS products today than they did just a year ago, and we're seeing a distinct shift from top-down purchasing to autonomous teams championing the tools that they need to be effective. I am very bullish about it because that autonomy directly translates to being happier and more productive at work," he said. 

"We're experiencing a bit of a renaissance in SaaS right now; products that solve problems well, are delightful to use, and reduce friction in collaboration among distributed teams have an advantage over more traditional players that rely on top-down adoption. Those that can do all of that and also nail the land-and-expand motion – by fulfilling all of the "enterprise" requirements around single sign-on, security, compliance, and auditing – will be the clear winners."

![Privacy](https://images.ctfassets.net/23aumh6u8s0i/35plETC7j2bdsO3J2pmYJV/b3d92308ff2b6b3dd4c6fcc0ffc8efbe/separator02.jpg)

## Privacy, Engineering, and Security Teams to Work Closer Together 

For the longest time, engineering operated as its own private silo, detached from the other tech-facing sides of the business: including security, operations, privacy, and governance. Over time, that began to change. 

The real catalyst was GDPR. With a maximum possible fine of €20m or 4 percent of total global revenue, organizations were incentivized to take data privacy and security seriously. Subsequent legislation, including the California Consumer Privacy Act (CCPA), as well as the upcoming California Privacy Rights Act (CPRA), only reinforced that.

Rachel Taylor, Compliance Manager at Auth0, believes this will transform the organizational landscape, with engineering, security, and privacy teams working as a single coherent unit. These "shift left" principles are already being adopted in some workplaces, including at Auth0. 

"As privacy laws continue to expand and as the regulatory bodies that govern them continue to hold organizations accountable, companies will not just be challenged with privacy by design, but by the concept of data protection as a service," said Taylor. 

Much like secure-by-design, Privacy by Design sees engineering and design teams consider privacy and compliance requirements at the start of the development process rather than as an afterthought. Data Protection as a Service (DPaaS), meanwhile, allows organizations to rapidly harden their privacy posture through the provisioning of discrete, cloud-based services. 

"I am excited for this challenge, as I believe it offers a unique opportunity to bring teams such as privacy, security, and engineering closer together. Data privacy and data security roles will merge, as the responsibilities between them are further blurred, and the need for a cohesive unit will start to take shape," she added. 

![](https://images.ctfassets.net/23aumh6u8s0i/48rgTNxGDCDabzYHWqKyXk/57df93d97881895281ed1ef585fe3adb/separator04.jpg)

## DevSecOps Becomes More Widespread

David Telehowski, Director of Security Engineering at Auth0, echoed these sentiments, adding that he expected DevSecOps roles and approaches to become more common within organizations of a certain size. 

The National Institute of Standards and Technology defines a DevSecOps platform as where security is ingrained during the design, building, deployment, and runtime phases. "Integrating Security into DevOps practices and workflows enables vulnerabilities to be detected and quickly remediated in every phase of the DevOps lifecycle," said Telehowski. 

This doesn't just bring security and privacy benefits but is liable to accelerate the development process, as a 2020 study from GitLab found. A majority of organizations surveyed integrated DevSecOps into their workflows, and 83% reported faster code releases, with 60% able to achieve multiple daily releases. 

## Hybrid Events are Here to Stay 

The COVID-19 pandemic added dozens of new terms into our collective lexicons, including social distancing, spike protein, and viral load. But let's not forget "Zoom fatigue," referring to the widespread disaffection with virtual meetings. 

"It's fashionable to complain about how hard and alienating virtual events are and to celebrate on social media the first in-person events we are able to attend," said Vittorio Bertocci, Principal Architect at Auth0. In practice, however, virtual events are here to stay, at least as a hybrid model. 

"Conference organizers got a taste of the incredible reach they can achieve when offering an experience that doesn't require the money, time, and complexity traditionally demanded when attending an in-person event. Many conferences achieved record (paying) attendee numbers, reaching audiences traditionally off-limits. They won't give that up," said Bertocci. 

"I expect a sharp increase in hybrid events, aimed both at developers and other interest groups, in 2022. Last year was the testbed for this model, but this will be the year when the industry irons out the wrinkles and brings hybrid events into the mainstream," he added. 

This increased reach has an unavoidable cost. Large sectors of the economy support in-person events, from airlines and hotels to catering firms. These sectors will be the biggest losers from this shift. Bertocci also notes that organizers will have to create the technological underpinnings to support these hybrid events, from conference apps supporting both in-person and online attendees to virtual expo booths and lead generation tools. 

![](https://images.ctfassets.net/23aumh6u8s0i/1i5xKyG2hpADtJuntezwZp/5dd18cbb2c3806412ae6c4acdd3bc614/separator05.jpg)

## Omicron Uncertainty 

The software development sector exists in a perpetual state of change. New frameworks and technologies emerge. Coders wrestle with new paradigms. Culture continues to evolve. This has always been the case but has only felt more true over the past two years. 

The emergence of the Omicron variant offers more uncertainty, with organizations pushing back their office re-opening dates and international travel feeling riskier than ever. For the time being, remote working and socially-distanced webinars are here to stay. 

Looking ahead to 2023, it's possible that things might remain in flux. However, devs are comfortable with responding to change, and I'm personally curious to see how working models continue to evolve.

How Developers Will Work in 2022

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey



The death of the corporate network had long been predicted. You can't rely on your old corporate controls anymore &mdash; firewalls, NIDS, and WAFs don't keep attackers out; "they are a Band-aid," they said. They give you a "false sense of security," they cried. I know you think your hardened perimeter protects you, but eventually, someone will find their way past it. Once there is that single crack, an attacker can rampage around your network's soft center. Building a castle wall around your data won't stop a persistent threat.

The security industry had an answer for that; you started to hear about more and more companies pushing towards a Zero Trust security model. Then you started to read about Google's [BeyondCorp](https://cloud.google.com/beyondcorp#:~:text=BeyondCorp%20began%20as%20an%20internal,authorization%20for%20Google's%20core%20infrastructure.) implementation. And then you visited the vendor floor at a major security conference, and you found a lot of companies willing to sell you that zero trust dream. 

It all made total sense. Why should you trust a device just because it's inside your perimeter? Why do you even need a perimeter?! Do I even know what my perimeter is?!

Then, on Monday morning, you returned to your headquarters and were confronted with your reality. Most people were still in your office. They came in every day and left again. Maybe they did some work here and there outside of the building, a flex-day to work around an appointment or a school sports day. The corporate applications that kept your Business running mostly still lived in your data center, within your building, and accessed from the local network. Your perimeter was pretty hard; it was the walls of your buildings that wrapped around your employees. Adding external access outside of your corporate VPN introduced its own set of problems and risks. Then, before you could start decoupling them, they were still heavily integrated with an old legacy IAM system, which was also sitting in your data center. 

What you had was mostly fine. It's hard to get investment in the [digital transformation](https://auth0.com/blog/what-digital-transformation-is-and-what-it-isnt/) when things are static and mostly the same.

Then it wasn't the same. 

Overnight your workforce moved out of the office, off your network to their homes. And, your corporate network was no more. The process now was remote.

I've repeatedly heard this story from many Security and IT leaders. Their world has suddenly changed overnight. A scramble began to build or upgrade the infrastructure needed to move their employees into a remote environment: they quickly spun up a VPN, or in some cases, they just open applications up to the Internet. They allowed users to roam beyond their castle walls and allowed access to data in ways that would have terrified them previously.

## There Never Was a Castle Wall Around Your Data

I was having some fun in the intro, but most security professionals have had the realization that their networks were not fortresses. Unless you are able to disconnect your users from the Internet, then you were only ever one firewall rule change, misconfigured wireless access point, or a secret operations maintenance backdoor away from having unexpected and unmonitored remote access. If you issued Laptops, then unless you had locked in a mandatory full tunnel VPN, then your users were likely taking them home to work on the weekends, and you lost visibility into their activity "off-net."

The reality of [Shadow IT](https://en.wikipedia.org/wiki/Shadow_IT) in Enterprise environments is not new. People expect to move quickly, and if your infrastructure was static and restrictive, then likely your users had silently adopted a new cloud tool. This means that your data was being moved to unknown and unmonitored locations. Finding and curbing this has always been ongoing risk mitigation for IT and Security teams.

## Remote Is Here to Stay So Make It Your Strength, Not Your Weakness

In the early months of this pandemic, we thought a lot of this new infrastructure would be temporary. But we already see a changing landscape for remote work. Twitter's [announcement](https://techcrunch.com/2020/05/12/twitter-says-staff-can-continue-working-from-home-permanently/) they would permanently move to a remote model received a lot of headlines, and they were quickly joined by a number of large [companies](https://github.com/arjunmadgavkar/Newly-Remote-Companies/blob/master/List.md), including [Atlassian](https://www.smartcompany.com.au/startupsmart/news/atlassian-remote-work-permanent/), that have made it clear that this will be their new normal.

This has always been our normal at Auth0, and, in fact, we viewed our remote workforce as a competitive advantage. We could find talent anywhere in the world, offer candidates real mobility and flexibility, and attract top talent who wanted to escape expensive tech centers. Employees had been identifying remote work as a key differentiating job perk before it became a necessity.

So, your security controls need to catch-up with this new reality. Remember, being nimble with your infrastructure and policy means you can now move at the speed of the Business. You can give them what they want!

## A Remote Workforce Doesn’t Have to Reduce Your Security Posture, in Fact, the Opposite Is True as Long as You Put the Right Building Blocks in Place

This new environment changes your [Threat Model](https://en.wikipedia.org/wiki/Threat_model#:~:text=Threat%20modeling%20is%20a%20process,and%20mitigations%20can%20be%20prioritized.) and your risk. For example, a fundamental principle for our environment has always been that our employee laptops are never on a "safe" network. Sometimes, people are in the office, but likely they are at home or traveling. With this in mind, you harden them accordingly - making sure they are resistant to a colocated attacker and that you have deep visibility into their behavior.

The Zero Trust concept is itself maturing, and with NIST's publication of their [Draft ZT Paper](https://csrc.nist.gov/News/2019/zero-trust-architecture-draft-sp-800-207), an agreed definition of a Zero Trust Architecture (ZTA) is forming. This also clears the way for the Federal Government and risk-averse Enterprises to consider this approach. The security industry rallying around a standard approach is good for our users as we are all working together. And, to tie it back to our threat model, what this approach does is recognize that a lot of attacks are successful because that attacker is able to steal a credential and leverage it. So that an "outsider" immediately looks like an insider and is therefore trusted. 

This puts authentication at the forefront of your security controls and further drives home that Identity is the perimeter. And, at a minimum, this means the building blocks of:
	
1. Strong [authentication](https://auth0.com/blog/what-is-an-authentication-server/), are you using [multifactor authentication](https://auth0.com/learn/get-started-with-mfa/) everywhere in your Enterprise? Preferably use a hardware token.
2. Maintain an agile IAM solution that provides centralized SSO for all these new apps to be monitored and controlled.

2020 has forced some quick and reactive changes upon us. As we move forward, there should also be space for some positive security wins to come out of a terrible situation. This is the new normal, but we do have the building blocks to secure it, especially if you begin building with Identity at the heart of your Security Architecture.


The Death of the Corporate Network

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Deploy SSO and MFA to tackle the challenges being faced by millions of remote employees

<div class="alert alert-info alert-icon">
 
 Make remote work safer and easier today — <a href="https://auth0.com/pricing/">click here</a> to get started.</div>


As many organizations are discovering, remote working does not just mean providing employees with a laptop and expecting business to continue as usual. Instead, organizations are being confronted with new challenges - everything from Zoom etiquette (yes, your colleagues can tell you are reading Twitter) to their employees doubling as stand-in math teachers. 

An important challenge facing organizations now is authentication and authorization. Auth0 knows what it’s like to support a handful, all the way to hundreds, of remote workers. Having the capability and tools to verify that only the right employees are logging on is essential for improving everything from productivity to security. 

![Auth0 offers free workforce authentication](https://images.ctfassets.net/23aumh6u8s0i/1XCJWYdlEpVtx6HwzMCVtb/0374d37fe78ead6932a9d418aad0d3fa/value-transparency)

In addition to the recently announced [free tools for startups battling COVID-19](https://auth0.com/blog/auth0-startup-relief-helping-innovators-battle-covid-19/), Auth0 is doing more to help organizations reduce the stress of authentication and authorization of remote workers by offering internal employee authentication **free until August 31st** (up to 500 users).

As long as your admin email domain is the same as your employee domain, you can set up secure, remote logins for your employees and organization. We’ve got a simple and extensible ID Platform that can be adopted easily [in hours, not weeks](https://auth0.com/docs/protocols/saml/saml-configuration/auth0-as-identity-provider), making it suitable for _your_ workforce and _its_ requirements. As part of this free offer, businesses can take advantage of the following features:

* [Single Sign-On](https://auth0.com/single-sign-on) for ease and productivity
* [Multi-factor authentication](https://auth0.com/multifactor-authentication) for peace of mind
* [Connection to most identity providers](https://auth0.com/docs/connections/identity-providers-enterprise) for flexibility
 
 
<a href="https://auth0.com/pricing/">Find out more here about how to get started today</a>

<include src="asides/AboutAuth0" />

Auth0 Makes Workforce Authentication Free Through August 2020

ramiro

I am an internet guy who loves reading and asking questions—those are the two things that helped me the most as an autodidact 🤓. If I am not learning about the latest trends in digital marketing or listening to house music, you can probably find me watching a tennis tournament. And also, I manage Social Media at Auth0 ✌️

Manager, Social Media

Ramiro Nunez Dosio

Companies of all sizes are pivoting quickly to remote work. Here are seven lessons from our remote-friendly culture


Due to recent events, hundreds of thousands of people globally have found themselves having to work from home. But what happens when someone now finds themselves out of their daily routine, without structure, and alienated from a lack of social interaction?

Auth0 has been a remote company from Day 1, with our two founders starting the company seven years ago while living in the USA and Argentina. We grew and scaled our workforce by hiring people from all around the world. Below are the key lessons for employers and employees to smooth the transition to remote working.

## 7 Lessons for Successful Remote Working


### Lesson 1: Trust Your Peers

There are two essential components for the success of remote working. Trust is one of them — when you can't work next to each other, trust becomes primordial. You have to trust your peers will continue to give their best while working from home,  that they are doing what they say they are doing, and will deliver quality work on time.

Trust will empower them to thrive.

### Lesson 2: Clear Communication

Communication is the other essential component. Without face-to-face interactions, ensuring clear, constant, and transparent communication is of utmost importance. Maintain regular communications with your peers, whether it's via chat or video, by setting up weekly syncs, 1:1s, or brainstorm sessions.

Tools play a key role in making this an enjoyable and efficient experience. There are plenty of options, but our communications trifecta is [Slack](https://slack.com/), [Zoom](https://zoom.us/), and [Confluence](https://www.atlassian.com/software/confluence) for chat, video, and documentation. We also use [Mural](https://mural.co/) for whiteboarding, [Figma](https://www.figma.com/) for real-time collaboration between our designers, and [Lattice](https://lattice.com/) for feedback, surveys, and 1:1 conversations, just to name a few more.

![The important of clear and constant communication when remote working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Lesson 3: Respect Others' Time

Meetings can be tempting when working remotely (it's an opportunity to see a face!) but think twice before scheduling one. Ask yourself, can this be managed via message/email or maybe even a short video call? If yes, then there is no need to schedule a meeting. The meeting is needed? Ok, but make sure to set up an agenda and respect the starting and ending times.

Don't expect instant responses from colleagues. Your messages/emails don't have to be answered instantly. Everyone needs time to focus on their projects, so take into account that your requests can't be answered right away and learn to respect the 'Do Not Disturb' status.

### Lesson 4: Manage Your Time

Making the switch to remote is not easy and can have an impact on your productivity, but many things can help:

* Start by organizing your day — structure is key.
* To-Do lists are your friend.
* Plan in advance.
* Implement a time management technique — we recommend the [Pomodoro technique](https://en.wikipedia.org/wiki/Pomodoro_Technique).
* Block your calendar with focus sessions.
* Setup the don't disturb status.

### Lesson 5: WorkSpace

"It will be amazing to work from my bed or couch" is a common first thought when starting to work from home. Although the idea is very tempting, having a dedicated space for working is essential.

It doesn't have to be a fancy office with 3 screens and full of gadgets, it's about having a space that suits you, where you feel relaxed and happy, and which enables you to focus and set your creativity free.

Tips to set up a quick workspace: find a space in your house close to the internet (you don't want to lose connection during a video call) where you can work without disruptions, take your most comfortable chair and desk, order nice headphones, and you are ready to work.

### Lesson 6: Work-Life Balance

Working from home can blur the lines that divide personal and professional time. The most important thing is to set up boundaries by implementing office hours. Forget about the typical 9-5 (you are free from that), but choose what suits you best. The important thing is to divide your two lives.

Remember to take breaks during your office hours. Taking breaks doesn't come as easy when working from home, but they are important for your mental health and productivity. Try planning and scheduling your breaks in advance and most importantly: *get away from your desk*.

Another big one is exercise. Sedentarism is one of the few cons of remote working, but there are plenty of great routines you can do right there in your house.

Now you can't justify not doing exercise because of the lack of time... you have hours free because you are not commuting anymore.

![7 lessons from beignn remote working for 7 years](https://images.ctfassets.net/23aumh6u8s0i/1823ottXfMNiYotVUDWb32/8b1944d65d45be3594d1f386ddbfb79f/culture2)

### Lesson 7: Don't Overlook Security

The sudden growth of remote working comes with an increase of cybersecurity challenges: new devices to be hacked, networks to be probed, credentials to be stolen, and targeted phishing attempts, to name just a few

Here are 3 tips that can help overcome these challenges:

- *Cybersecurity Guidance*: education is the main way to overcome these challenges. Educate your organization about security by creating best practices guides and setting up training sessions.

- *Single Sign-On*: reduce password fatigue, mitigate credential theft, and make life easy for everyone by [setting up Single Sign-On](https://auth0.com/single-sign-on).

- *Multi-factor Authentication (MFA)*: the much needed extra layer of security. [Implement MFA](https://auth0.com/multifactor-authentication) and safeguard your data from unauthorized access.

## Conclusion

Welcome to the remote club. We hope these lessons based on our experience of 7 years as a remote company can help you get the best of your remote time and maintain the same productivity as working from an office.

Are you a remote worker specialist and want to share some of your lessons? Or you just started remote work and have some questions? Please go ahead and leave a comment.


Welcome to the Remote Club: 7 Lessons From 7 Years

sonny-chen

Sonny is a designer that values process, alignment, and asking the right questions. He has worked in various environments, from startups, larger companies, to design agencies. He currently lives in Pittsburgh, and previously lived in New York, San Francisco, and Northern Virginia. In his free time, Sonny enjoys playing basketball, dabbling in music production, and trying new foods.

Product Designer at Auth0

Sonny Chen

Designing remotely can be scary, but it doesn't have to be. With all this said, our tools and processes are constantly evolving.

Remote work is becoming more common now than ever before. In today's digital age, we have tools that can eliminate the need to be co-located in order to get things done.

At [Auth0](https://auth0.com/), our team of nearly twenty designers spans multiple time zones, with members distributed across Seattle, Argentina, France–even all the way to <a href="https://en.wikipedia.org/wiki/Georgia_(country)">Georgia</a> (the country, not the state next to Florida).

We take pride in our ability to not only sustain but thrive as a remote-first design team. This is because, while the ability to work remotely is a common practice in almost all companies, those that are fully remote tend to be within certain departments like engineering. For roles that may require more in-person interactions, such as design or product management, there aren't many remote options to choose from. Folks in design that consider remote opportunities are often disappointed to find out that "remote-friendly" doesn't always apply to their role.

Now, there are many reasons why companies may be reluctant to hire remote designers–even many of us who came from traditional work offices were hesitant about what this change in environment and lifestyle would mean to our day-to-day. However, being a company that empowers everyone to work from wherever they want–including designers–we wanted to share with the community some of the ways we approach and solve the challenges of designing remotely.

## Tools & Plugins

Within the design team, we've built an extensive list of tools that we rely on to stay productive, collaborative, and in constant communication. Note that this list can vary by company and teams. At Auth0, our designers are spread across thirteen product teams and marketing initiatives, with some teams working more closely than others. It's important to find tools that meet your team's specific needs and processes and to constantly challenge them as new ones come into place. Here are some of the tools that work well for us (from general to more specific):

### [Figma](http://www.figma.com/)

Figma is our design tool of choice because it enables real-time collaboration and helps us design in the open by acting as a shared repository for all our design files and libraries. We can easily organize files based on team structures and have even created cover templates for each file so that we can easily track and update the progress of projects.

It also offers a lot of benefits when working with our cross-functional partners. Figma is browser-based, so we can easily share work without worrying if people can open it or accidentally overwrites our files. Also, Figma files can be embedded as iframes. This is great for showcasing work straight from our project documents.

### [Mural](https://mural.co/)

For those that are worried about losing that magical whiteboarding experience when going remote, Mural is the tool for you. With Mural, our team can virtually huddle around a whiteboard to brainstorm and collaborate in real-time. There are many benefits to using a virtual whiteboard, and sometimes it can even be better than physical ones.

First off, everything is automatically digitized. No more transcribing or rewriting notes if you messed up or ran out of room. You can also add images, sticky notes, create flows, and drag things around as you like.

Second, we've noticed that virtual whiteboards can give everyone a better opportunity to contribute because no one person is dominating the board or conversation. This is incredibly important in giving everyone a voice so that we can drive better ideas and decision-making.

### [Slack](https://slack.com/)

The design team relies on Slack for many reasons beyond team organization. In terms of workflow, we use Slack to help us automate task management, status updates, surveys, and creating events. We even use Slack to recruit user research participants from Slack developer communities!

Slack is also crucial when it comes to team bonding and communication. A few members of the team are co-located, so we rely on Slack to ensure that no one feels left out. How else can we share our abundance of cat GIFs?

### [Trello](http://www.trello.com/)

There are many ways to use Trello, but one of our favorite ways is to use it to onboard new folks. Our Trello's contain information on design ceremonies and cadences, tools, Slack channels to join (e.g., #design-jams is where we share music), and much more. It's also great because it serves as a living board that we can continually iterate on as the team grows.

### [Zoom](http://zoom.us/)

Zoom is our video conference tool of choice because it offers some cool features along with it's incredibly simple and reliable experience. First off, as a company that relies heavily on customer feedback, Zoom is a great tool to invite and interact with external folks and lets you easily record sessions to the cloud. This makes it easy to capture and share user research sessions or all-hands. Zoom also offers a neat feature called breakout that makes facilitating brainstorms and workshops super easy and fun.

![zoom_image](https://images.ctfassets.net/23aumh6u8s0i/75hTZ7LZadWL300LgZqN2q/92c1a40c1b22bec4aadf73feb82622e8/1_zoom_image)
The design team in our monthly reviews. Can you tell we like cats?

### [Clockwise](http://www.getclockwise.com/)

We value our time to get work done, so we use Clockwise to decrease context-switching and create focus blocks on our calendars. The plugin also connects to Slack so that it can automatically update your status when you are grabbing lunch, in a meeting, or in the middle of your focus time.

### [Loom](http://www.loom.com/)

When we want to capture and share demos asynchronously or walk through an idea, we use Loom. This also makes it easy for people who weren't available to catch up on what they missed.

![loom_image](https://images.ctfassets.net/23aumh6u8s0i/7yWXZlS5xiyqZXWvLJMhkr/c01dbda64c929b03d95b48a5bf3b6a5c/loom_image)
Tony from our team using Loom to walk through how he injects data into usability prototypes

### [Krisp](http://www.krisp.ai/)

Being a remote team, we can expect to find people working from a coffee shop, the airport, or even the beach as long as there's service. For moments when the background noise can get a little distracting, we use Krisp to mute background noise in real-time calls. It's amazing!

### [Donut](http://www.donut.com/)
We use a Slack app called Donut that pairs you with random people across the company. It's a great way to get face time with those that you normally wouldn't interact with, and oftentimes people walk away with something valuable.

### [Toby Chrome Extension](http://www.gettoby.com/)

Lastly, sometimes it can get challenging to manage all the projects and documents that are in flight. We use Toby, which is a Chrome plugin that turns your browser tab into your personal collection of links. You can set collections for documents that need your attention or save a collection of good reads to share with the team.

## Communication & Process

As designers, we often serve as the connective tissue between teams as part of thinking holistically and designing a cohesive product experience. This requires strong levels of communication within the design team and with our cross-functional partners. As part of our work, we need to ensure that everyone is clear on goals, has ongoing conversations as projects develop, and share learnings across teams so that we can achieve better outcomes and reduce duplicative work.

Here are some of the ways we facilitate this type of communication:

![Remote Working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Project and temporary channels in Slack

Slack can create just as much distraction as it can create productivity. At Auth0, multiple projects can be happening at any time with many different people involved. Rather than posting all updates to team channels, we like to create project-based channels to eliminate unnecessary noise and to consolidate everything into one place.

For projects and conversations that are short-lived but still need a space for discussion, we create temporary channels by specifying "tmp" at the beginning of the channel name (e.g., #tmp-project).

### Knowledge shares

We value team diversity and recognize the amazing mix of talents and backgrounds within our design team. In order to grow, we encourage designers to hold knowledge shares where they walkthrough their process on a particular topic, whether that be creating plugins, facilitating workshops, or conducting user research.

### Pairing

Impromptu pairing sessions are a central part of our day-to-day, and we often find that they yield quicker and more valuable results than scheduled meetings with larger groups. We try to make these seamless by integrating the Zoom plugin with Slack so that you can create and join a session with a push of a button.

### Workshops and Brainstorms

We like to bring as much structure as we can into our meetings. This includes preparing slides and exercises ahead of time, having a clear agenda, designating people to take notes, and always defining action items.

![workshops](https://images.ctfassets.net/23aumh6u8s0i/7z2pn0Ywqm4kgLMx5ZPiuz/b7e14aa5cc256eac74f0870df83cbb7f/3_workshops)

The design team running through a structured ideation session with our cross-functional partners

### Ceremonies
Our design team has a set of recurring meetings where we communicate updates, share ideas, and look to each other for support. These meetings include weekly status updates, critiques, design all-hands, knowledge shares, and more. It's important to schedule these while considering everyone's time zones.

For our meetings, we like to have a show, not just tell, policy in which we prepare slides with accompanying visuals so that everyone can follow along with the proper context. We also try to systematize everything we do so that we can focus on what's important. An example of this is templatizing slide decks so that it reduces prep work while creating consistency in our presentations.

In terms of process, team members can propose changes to how we operate at any time, and we like to send out design surveys and polls through Slackbot to get pulse checks on how we feel.

### Offsites and Retreats

With all this said, sometimes it's good to just meet up in person. At Auth0, we have multiple offsites a year (including locations like Cabo!). We take advantage of these opportunities to hold strategic meetings, hear from different parts of the business, but also to bond and enjoy our time with our fellow team members.

![offsites](https://images.ctfassets.net/23aumh6u8s0i/5vtHEO6uoB5bbAany2rb4m/c46569fc26c27d6b2c1318a21baed949/4_offsites)

The Auth0 design team getting together at our Bellevue office

## Conclusion

Designing remotely can be scary, but it doesn't have to be. With all this said, our tools and processes are constantly evolving. As our team continues to grow, we face new challenges, such as scaling our design system or bringing more data into our design decisions.

If you have any thoughts or tips on anything that was mentioned, please drop them below. We would love to hear them!

Also, if you are considering remote work as a designer or any other role, check out our job page [here](https://auth0.com/careers/positions?areas=Design).

Thanks for reading!

Designing Remotely at Auth0

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

FlexJobs and Built In Seattle recognize Auth0 for industry-leading perks, benefits, and remote-friendly culture

**BELLEVUE, Wash. – January 21, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has been included on [FlexJobs’ annual list of ‘Top 100 Companies to Watch for Remote Jobs in 2020'](https://www.flexjobs.com/blog/post/100-top-companies-with-remote-jobs-2020/) and [Built In Seattle’s list of ‘Best Places to Work in 2020'](https://www.builtinseattle.com/companies/best-places-to-work-seattle-2020), both of which recognize Auth0 for its flexible, remote-friendly culture, and commitment to providing its employees with the best benefits and perks. 

Based on an analysis of more than 54,000 companies and their remote job posting histories in the FlexJobs database in 2019, Auth0 – along with companies like Amazon, Aetna, JPMorgan Chase, Dell, and Salesforce – had the highest number of remote job openings on the FlexJobs site last year. The number of people telecommuting in the U.S. has dramatically increased by [159 percent](https://www.flexjobs.com/blog/post/flexjobs-gwa-report-remote-growth/) since 2005, with remote work bringing very real benefits to both employers and workers, such as greater work-life balance, wider talent pool, higher productivity, stronger retention rates, and much more.

Auth0 was also recognized for its top employee perks and benefits on Built In Seattle’s list of Best Places to Work in 2020. Built In's ‘Best Places to Work’ list rates companies based on their employer benefits and employee submitted compensation data. 

“We pride ourselves on being a company that enables our team members to do their best work – regardless of location – at a global scale,” said Eugenio Pace, CEO, and co-founder of Auth0. “Our inclusion on the FlexJobs and Built In Seattle lists is a reflection of our dedication to providing the best culture and work-life balance for our team that spans more than 33 countries, and we’re honored for the recognition.”

Auth0 is dedicated to creating a work environment that centers around collaboration, communication, and culture. Inclusion in these listings is continued validation of this dedication and follows other ‘best places to work’ recognition, including [Inc. Magazine’s Best Workplaces 2019](https://auth0.com/blog/auth0-recognized-as-one-of-inc-magazines-best-workplaces-2019/) and Battery Ventures’ [50 Highest Rated Private Cloud Computing Companies To Work For](https://auth0.com/blog/auth0-named-one-of-50-highest-rated-private-cloud-computing-companies-to-work-for/). 

Auth0 provides a competitive total rewards package including (but not limited to): 401(k) matching, flexible paid vacation time, career development opportunities and training, competitive parental leave, diversity and inclusion initiatives, top of the line gear, an annual company-wide offsite, and other flexible and generous practices. For current job opportunities, please visit [https://auth0.com/career](https://auth0.com/careers). 

## About FlexJobs
[FlexJobs](https://www.flexjobs.com/) is a premium online job service for professionals seeking flexible work, specializing in full-time and part-time remote jobs, employee and freelance jobs, and on-site jobs with flexible, part-time, and alternative schedules. Since its start in 2007, FlexJobs has helped more than 4 million people in their job searches and has created the largest vetted database of legitimate flexible job opportunities in over 50 career categories. Besides, FlexJobs provides robust career support, including curated expert resources and career coaching services, to partner with job seekers in all phases of their journey. A trusted source in the media, FlexJobs has been cited in top national outlets such as CNN, Wall Street Journal, New York Times, CNBC, Forbes, and many others. FlexJobs' Founder & CEO Sara Sutton has also launched two additional partner sites, [Remote.co](http://remote.co/) and [1 Million for Work Flexibility](http://www.workflexibility.org/), to help provide education and awareness about the viability and benefits of flexible work. Sutton is the creator of [The TRaD* Works Forum (Telecommuting, Remote, & Distributed)](https://trad.works/), dedicated to helping companies leverage the benefits of telecommuting, remote and distributed teams.

## About Built In
Working in tech is a way of life. Built In helps people live it with purpose. Across the most vibrant tech hubs in the US, Built In helps tech professionals stay on top of tech news and trends, expand their networks and carve out futures at companies they believe in. Built In attracts a niche audience of 1 million tech professionals every month and, in 2019, the company hit a milestone, serving 1,100 companies annually. Built In recently launched BuiltIn.com, a national hub for tech trend coverage and resources to help professionals grow in their careers.

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East 
Auth0 Communications 
[press@auth0.com](mailto:press@auth0.com) 
 
Alexandria Plew 
Matter for Auth0 
[auth0@matternow.com](mailto:auth0@matternow.com)

Auth0 Honored for Excellent Workplace Culture in Two Industry ‘Best of’ Lists

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Discover why Auth0’s remote-friendly culture might suit you 



If you're looking for remote work, you might want to check us out. [Auth0](https://www.flexjobs.com/jobs/telecommuting-jobs-at-auth0) just nabbed the seven spot on [FlexJobs 2019 Top 25 Companies Hiring for Work-From-Anywhere Remote Jobs](https://www.flexjobs.com/blog/post/top-companies-work-from-anywhere-remote-jobs/) after they reviewed their database of remote listings from over 51,000 companies to see who offered the most remote-from-anywhere positions from Jan. 1, 2018 through Dec. 31, 2018.

"We are a strong believer in hiring for talent and not by location," said Auth0 Vice President of People Melinda Starbird. "When opening a search without any regional restrictions, our ability to find amazing talent increases."

While FlexJobs reports that [95% of remote jobs](https://www.flexjobs.com/blog/post/top-companies-work-from-anywhere-remote-jobs/) require workers to be based in a specific location, at Auth0, we hire for skill over location. If a job is remote, you can work from anywhere. (We also made [FlexJobs' 100 Top Companies with Remote Jobs in 2019 list](https://www.flexjobs.com/blog/post/100-top-companies-with-remote-jobs-in-2019/) alongside companies in 15 industries who offer remote work, but might require you to be based somewhere specific.)

![Flexjobs 2019 Top 100 Remote Work Company to Watch](https://images.ctfassets.net/23aumh6u8s0i/2zLavt3Uph79jJ0ynbeCUB/965d4ce5b8cda4eb9dd68e9a5fc7ba07/flexjobs-remote-work-badge)

## So Why Bring Your Talent to Auth0?

We're experiencing rapid growth, which means you have an opportunity to make a fast impact and grow your career with us. Last year, we made [Fortune's Next Billion-Dollar Startup](https://www.forbes.com/next-billion-dollar-startups/#4d886f244441) list while almost doubling our staff and [seeing a nearly 80% increase in sales and new customers](https://auth0.com/blog/auth0-closes-year-of-impressive-growth-in-2018/) --- and we're looking for people to help us double again in 2019.

## What's It like to Work Here?

- Check out our [culture and values](https://auth0.com/careers).
- Learn about the benefits of remote working [from our colleagues.](https://auth0.com/blog/we-are-thankful-for-these-benefits-of-working-remote/)
- Find out what it's like to go [from office full time to remote full time](https://auth0.com/blog/surprises-in-my-switch-to-remote-work/).
- Here are [our tips for remote success](https://auth0.com/blog/21-tips-for-remote-working/).

You can discover more about roles that are currently available at Auth0 [here](https://auth0.com/careers). For those who enjoy working with company, we may have roles open on our Bellevue, London, Buenos Aires, Sydney, and Tokyo offices.

![Auth0 group picture during Offsite 2018 in Panama](https://images.ctfassets.net/23aumh6u8s0i/XayKxJQ4nelIPWGXIavt6/14ef81c79f3f90ff137a80b59e757ced/auth0-offsite-panama-group-picture)

_NOTE: I wrote this post from my snug office during a Seattle snow day, where I am able to enjoy my friends' frosty frolicking social media posts free from envy because working remote saves me approximately 15+ hours of commute time per week._


Auth0 Snags Spots on Two of FlexJobs’ Remote Worker lists

sambiopic

I'm Director of Developer Relations and a Google Developer Expert for Angular and Web Technologies. I believe anyone who wants to learn to code should be able to learn code and I love teaching. When I'm not coding or writing, you'll find me outside hiking or camping in the beautiful Pacific Northwest.

Director of Developer Relations

Sam Julien

Auth0's Sam Julien shares some of the things that have surprised him in switching to his first remote job.

Starting my first remote job has been everything I’d hoped for, plus a bit more than I expected. When I first moved to Portland from Gainesville, Florida ([Go Gators!](https://floridagators.com/)) in November 2014, I got a job writing software at a financial company out in the western suburbs. It wasn’t ideal, but it got me out here and I was grateful for it. I quickly got tired of the commute, though — it took over an hour each way in traffic just to drive 11 miles. Ugh. Back in Gainesville I could get anywhere within 15 minutes, so this came as quite a shock.

I made it my mission to get a job downtown to reduce my commute. Before long, I started working at a small non-profit and eventually became the lead front end engineer there. I commuted downtown from Southeast Portland on public transportation in about 40 minutes for three years. It wasn’t the worst commute by any means, but it started to wear on me because it felt unnecessary. Most days, I just sat or stood at my desk wearing headphones writing code and occasionally instant-messaging coworkers. Why did I need to travel somewhere for that? Aside from some focused tech sessions with my team, I rarely felt like there was any reason for me to be physically in the office.

On snow days, furniture delivery days, or not-quite-sick-but-not-quite-well days, I was able to work from home through a VPN. Those were my most treasured and productive days. I could listen to music without headphones, I had no interruptions, and I could just get in the zone and code. Sadly, because we were such a small company — and not a software company — it wasn’t possible to make remote work permanent or even regular. We just didn’t have the infrastructure.

When I got offered a fully remote job at Auth0, I was so happy to have achieved my goal to no longer be tethered to an office or a daily commute. Most of it has been everything I’d hoped for. Since I’ve started working remotely, I’ve slept better, worked out more, cooked more, and spent more time with my friends, girlfriend, and family. Auth0 has also been super supportive of my speaking and travel responsibilities as a [Google Developer Expert for Angular](https://developers.google.com/experts/people/sam-julien). I love getting to work from anywhere.

It hasn’t all been a bowl of cherries, though. Remote work has its own set of challenges, some of which really caught me off guard. I want to share these surprises with you in case you’re looking at transitioning to a remote job (hopefully [here at Auth0](https://auth0.com/careers)!).

## What’s Surprised Me about Going Remote

Even though there are [tons of benefits to having a remote job](https://auth0.com/blog/we-are-thankful-for-these-benefits-of-working-remote/), there are some things people don’t tell you about working full time from home. An office job is kind of like having a clock speed on a processor or a governor on an engine. The office regulates your life and keeps it maintained. It provides some basic boundaries of when you need to wake up, when to work, and when to come home. It regulates your meal times and your social activities. When you remove the governor or overclock the processor, you can get a lot more performance, but you take more risk.

Most people think about the "no boss over your shoulder" and "no commute" benefits of working remote, but they’ve taken for granted the rest of the regulation: the set schedule (with a physical boundary between home and work), the regulated meal times, and the planned social interaction. Some people jump enthusiastically into remote work and quickly realize it’s too much. Their work time is blending with their home time, they’re eating too often or too much, and they’re desperately lonely.

For me, I would take being fully in control over my time any day over outsourcing that to an office. I’m also extremely introverted, despite how much I love teaching and speaking. I thought I’d be absolutely golden switching to remote, but while it has been amazing, a few things have surprised me.

### It Takes Work to Build Your Own Structure

Unlike my job at the non-profit, my role at Auth0 is fairly autonomous. I occasionally collaborate with team members or work on group projects, but the majority of my job is to write great technical content alone. This caught me a bit off guard after a life of daily stand-ups and regular team meetings. It’s back on me to set and maintain a schedule. Unlimited freedom takes a lot of discipline.

<include src="TweetQuote" quoteText="A remote job requires you to build your own structure into your day to stay productive, like regular workouts and breaks."/>

I was surprised by how long it took me to get into the "self-motivated focus" routine by building my own work day from scratch. I think part of this was due to traveling so much this fall, but it still felt like it took longer than I predicted to get into a routine. I had always imagined that, whenever I finally started working from home, I’d wake up at 5 am, hit the gym, and crank out a super productive workday every single day with no trouble.

It turns out real life is a bit more complicated than that. That surprised me because it’s not as if I haven’t had to focus in the last few years. For example, when I was making my first Angular video course, I had to force myself to crank out at least a few videos every evening after work in order to get 200+ videos finished. Or, at development jobs during the day, I had to focus to get a particular feature done or bug resolved on time. There’s a key difference with those that’s a principle of life and work: work expands to the time you give it. If you give yourself three days to work on something, guess how long it will take? Yet if your boss tells you a new feature in the application needs to be done by the end of the day, guess how long it will take?

I’ve learned that working from home and being autonomous, I have to give myself shorter deadlines and more work. I’ve also built in structure to my day through scheduled gym time and breaks. It’s certainly been a slower process than I imagined, but I’m getting into a solid routine.

### Even Introverts Get Lonely

As I said earlier, I’m a hardcore introvert. I love my alone time. Even so, I’ve been surprised by my need for social time. I worked with some really great people at the non-profit and I miss them much more than I anticipated. On top of that, when you cut out meetings, chatting with coworkers in the kitchen, commuting on public transportation, and going out for lunch or coffee during work, you end up with...a lot of alone time. That goes double when you live by yourself as I do. I'm not alone in this, either. In Buffer's [State of Remote Work 2018](https://open.buffer.com/state-remote-work-2018/) survey, they found 21% of remote workers struggled with loneliness.

->![Buffer remote work survey chart showing 21% of remote workers struggle with loneliness](https://images.ctfassets.net/23aumh6u8s0i/3fQVUgLA0xvqtRlcO6pwO2/e44787e96ed3f019dcc818d9ceb1c64f/buffer-loneliness)
[[Source](https://d2mxuefqeaa7sj.cloudfront.net/s_6A1F19D3C9C27A032B77599B390536CA1709A830CEA405B393E39F6D5868EB7B_1519662359312_Biggest+Struggle2x.png)]<-

One of the best decisions I made when I joined Auth0 was to also join a new gym that offered classes. I had been going to a 24-hour bare bones gym. The new gym has a triple benefit: it gets me out of the house, it gets me around people, and it gets me a killer workout every time. If I was still going to the 24-hour gym, I’d have yet another thing I’d be doing alone.

<include src="TweetQuote" quoteText="A great way to combat loneliness while working remotely is to take up new hobbies with friends."/>

I also run the [Angular Portland](https://www.meetup.com/ngpdxers/) meetup, so that’s another scheduled event that I go to about every month. Beyond that, it’s on me to be purposeful with scheduling time with friends. I’ve figured out that I need to see some pals about one or two times a month to retain my well-being. Of course, I still spend a bunch of time with my girlfriend, but that’s sort of a different category of social time. Everyone needs friends outside of their relationship, but especially when you’re inside alone all day!

### It’s Hard to Build Relationships Online

Finally, I’ve been surprised by how necessary occasional in-person communication is with coworkers, even when you’ve got great remote infrastructure. We use Slack and Zoom to stay in touch with each other at Auth0. Those help a lot, but I won’t lie to you. Meeting my coworkers in person at our team offsite in Miami this September made a big difference in feeling bonded with them. The same was true of my onboarding at our Bellevue office, where I met folks like our CEO [Eugenio Pace](https://twitter.com/eugenio_pace) and Chief Architect [Vittorio Bertocci](https://twitter.com/vibronet) and had coffee with my teammate [Jenny O’Brien](https://twitter.com/jenny_obrien).

![Most of Auth0's Content Team at the Miami Offsite](https://images.ctfassets.net/23aumh6u8s0i/1Zb9aa4iSGcWlBfu8z9Wrq/0bdc3d5b673205487296fbca89d2e020/content-miami)

Along those same lines, it’s a heck of a lot harder to pair program remotely. Not being able to just hand the keyboard off to someone or debug directly on their machine is a pain. So far, I’ve paired with teammates by simply cloning the code and running it myself (or them doing the same). We haven’t checked out [Visual Studio Code’s Live Share](https://marketplace.visualstudio.com/items?itemName=MS-vsliveshare.vsliveshare) feature yet, but we definitely should. I have a feeling it will help a lot. It still won’t replace being able to wander over to a coworker’s desk, but at least it’s a start.

Auth0 does a great job with remote infrastructure and encouraging lots of communication between teams, but as much as I love that, I have to admit that there is no substitute for meeting coworkers in person to build relationships. That’s why I can’t wait to go to my first annual company offsite next May. It will be great to meet everyone in person!

<include src="asides/AboutAuth0" />

## Set Yourself Up for Remote Success

If you’re thinking about going remote, dreaming of days of unending focus while basking in your cave of solitude, you may want to do some thinking ahead. Look into community gyms, adult education, and new hobbies you can take up with some friends. Build some structure into your ideal calendar. Yes, even my fellow introverts should do this. Also, if you have a chance to meet your coworkers at any point in person somewhere, even if you’re just on vacation in their city, do it! You’ll be glad you spent a little time with them face-to-face.

Whether you work remote for Auth0 or someone else, I wish you the best in your journey! If you’re working remotely now, please feel free to share any tips you’ve learned in our Community post for this article.

Surprises in My Switch to Remote Work

ef2eecee7655f814bd7a9228ba0c6992?s=200 avatar

ef2eecee7655f814bd7a9228ba0c6992?s=200

I'm passionate about startup culture, leadership and employee engagement, coming from the experience of having left big corporate, packed up with my wife and kids and moved from Australia to the US to pursue startup life.

Director of Culture

Clayton Moulynox

Auziros share what remote benefits make them thankful to be part of our flourishing relationship culture.

This might sound odd &mdash; but we're not deliberately trying to build a **remote culture** at Auth0. To me, that term conjures images of Tom Hanks in the movie "Cast Away": His character in ragged underwear stranded on a deserted island with nobody to talk with except Wilson... his inanimate volleyball friend. I mean, who wants to encourage remoteness as a culture?

Instead, our focus is on building a great **relationship culture**. By building strong bonds of trust and respect, passion and transparency, we've cultivated a culture that _empowers_ remote working. When you have those things in place, then where you physically work from is less important. This has always afforded us the luxury of really focusing on hiring the best talent for the roles we need. Literally, the entire world is our talent pool.

Certainly, there's plenty of great benefits for the remote employees &mdash; many listed by our very own staff [later in this post](#remote-benefits) &mdash; but there's also a huge benefit to Auth0: it exponentially increases the diversity of talent we can hire. On our team today, we have an ex-professional women's tennis player from the USA, a Certified Practicing Accountant turned developer from Canada, a one-time junior figure skating champion from Australia, and hundreds of other people with equally interesting backgrounds and experience from over 30 other countries. In fact, over 50% of our staff work outside of our main office locations. 

I don't want to presume a list of all the typical remote working benefits you might often read. So instead, here's what our employees actually told us they find amazing about their experience of working remotely at Auth0.

<h2 id="remote-benefits">Benefits of Remote Work As Told By Auth0 Employees</h2>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/abigail-sanchez.png" name="Abigail Sanchez" title="Program Manager" team="Field Ops" location="Washington, United States" body="Leaving your desk at 9:45 AM to take your kid their forgotten lunch and making it back in time for your 10:00 AM meeting"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/andreas-christofakis.png" name="Andreas Christofakis" title="Customer Advocate Specialist" team="Marketing" location="Colorado, United States" body="You don’t have to compete with your roommate to do laundry on Sundays. Any day can be a laundry day."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/Annybell-Villarroel.png" name="Annybell Villarroel" title="Security Operations Manager" team="Security Team" location="Spain" body="Not having to spend hours commuting."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/ashley-nicholson.png" name="Ashley Nicholson" title="Customer Success Manager" team="CS Management" location="Pennsylvania, United States" body="I am thankful for less wasted time. Prior to working remotely, I was stressed about everything from daily traffic to making it home in time to put my daughters to bed. Auth0 recognizes the value of time."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/barbu-cruzado.png" name="Bárbara Muñoz Cruzado" title="Visual Designer" team="Design" location="Argentina" body="Working remotely gives me the chance to wear my pajamas all day long 😜 and I don’t have to wear any makeup. I can also spend time with my cats and be able to do passive chores that I’m used to doing during the weekend."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/caroline-nealey.jpg" name="Caroline Nealey" title="Learning Lead" team="Content & Guidance" location="Washington, United States" body="The flexibility of working remotely allowed my family to adopt a second puppy. I can work remotely when I need to or come home earlier or later when required."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/chris-schultz.png" name="Chris Schultz" title="Engineer" team="DevOps" location="Minneapolis, United States" body="Having your baby daughter smile at you when getting her up from a nap."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/dan-arias.png" name="Dan Arias" title="R&D Content Engineer" team="Marketing" location="Florida, United States" body="Being able to eat a freshly made meal from the stove."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/davide-barbato.png" name="Davide Barbato" title="Security Engineer" team="Security & Operations" location="Spain" body="Be able to explore and enjoy the city without missing a meeting."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziro/Dirceu-Tiegs.jpg" name="Dirceu Tiegs" title="Engineer" team="Site Reliability Engineering Team" location="Brazil" body="Being able to stay close to my loved ones when they are going through difficult times, for example, if my wife is sick in bed. Also, taking a nap in the middle of the day without judgment and then coming back to do more awesome work."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/dj-joyce.png" name="DJ Joyce" title="Corporate Account Executive" team="Field Sales" location="England" body="Being able to manage my animal friends..."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/eva-sarafianou.png" name="Eva Sarafianou" title="Application Security Engineer" team="Security & Operations" location="Washington, United States" body="Missing my flight from London to Seattle and deciding to stay and enjoy London for the whole week."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/guillermo-alduncin.png" name="Guillermo Alduncin" title="IT Support Engineer" team="Security & Operations" location="Argentina" body="Being able to focus on a particular task for a long period of time even when the music is super loud because you like it that way. Also, I think it's great to just wake up, get a cup of coffee, sit at your desk, and be working already! Saving the stress of commuting is the best!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/janie-greenwood.png" name="Janie Greenwood" title="Scrum Master" team="Engineering" location="Montana, United States" body="My boyfriend and I love living in Montana because it keeps us close to remote areas so we can get out in the middle of nowhere doing the things we love: like a 6-day river trip we did two weeks ago on the Smith River. Working 100% remote for Auth0 also means we can take our RV on a month-long road trip to visit family and friends. I feel very lucky to work here!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jeana-tahnk.png" name="Jeana Tahnk" title="Director, Corporate Communications" team="Marketing" location="Massachusetts, United States" body="Being home when my two older kids get out of school, and getting my littlest one off the bus!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jenny-obrien.png" name="Jenny O'Brien" title="Creative Writer" team="Marketing" location="Washington, United States" body="The ability to introduce my formerly feral rescue dogs to a wide range of voices sans stress thanks to video meetings! Dance breaks witnessed only by my sarcastic dogs."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/jeremy-meiss.png" name="Jeremy Meiss" title="Dev Community Lead" team="Marketing" location="Kansas, United States" body="No showers needed."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/joan-pepin.png" name="Joan Pepin" title="CISO/VP Operations" team="Security & Operations" location="Oregon, United States" body="Cultural diversity! Every day I talk to and work with people from all around the world!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/karen-port.png" name="Karen Port" title="Developer Support Engineer" team="Technical Support" location="Pennsylvania, United States" body="No more traffic jams or commuting for over one hour one way, allowing me to spend more time with family and friends."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/katie-horne.png" name="Katie Horne" title="Technical Writer" team="Content & Guidance" location="California, United States" body="I love the flexibility to balance work and family. I am at all of my kids’ events."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/luke-oliff.png" name="Luke Oliff" title="R&D Content Engineer" team="Marketing" location="England" body="Getting to concentrate when your little boy is asleep because now your S/O also needs to tiptoe around.😂 Taking Zoom meetings on my mobile while walking/feeding/watering the dog/baby/plants. Getting through cold and flu season without being sneezed on by a co-worker — just your child."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/matt-machuga.png" name="Matt Machuga" title="Engineering Lead" team="Engineering R&D" location="Pennsylvania, United States" body="I enjoy being able to utilize my outdoor office... err, patio furniture."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/maria-paktiti.png" name="Maria Paktiti" title="Instructional Designer" team="Content & Guidance" location="Greece" body="Being able to make a 3-month trip through Latin America while working."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/marius-mogyorosi.png" name="Marius Mogyorosi" title="Application Security Engineer" team="Security & Operations" location="Ohio, United States" body="As a new dad, it's priceless for me to be able to spend much more time with my son! Also, blasting music when no one's home. 🤘"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/megan-gleason.png" name="Megan Gleason" title="Director, Product Management" team="Product Management" location="Washington, United States" body="Being able to volunteer at my son’s school during my lunch break. Hopping on the rowing machine for 20 minutes between meetings. And... not being judged for covering the walls of my office with crazy sticky notes."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/mike-kusold.png" name="Mike Kusold" title="Engineer" team="Engineering R&D" location="Colorado, United States" body="Being able to shower a brand new puppy with attention all day. I got a puppy back in February, a few months after I joined Auth0 because it was finally feasible since I wouldn’t be away from home for 10 hours a day. Now, I also love being able to walk my dog for a lunchtime break."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/peter-filias.png" name="Peter Filias" title="Customer Success Manager" team="CS Management" location="Michigan, United States" body="Being able to sleep in a little while longer while the kids are home for the summer! This tragically ends come Fall and 5:30 AM wake-ups - here we come!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/prashant-trivedy.png" name="Prashant Trivedy" title="Sr. Developer Support Engineer" team=" Technical Support" location="New Zealand" body="Getting an extra hour sleep and waking up when the rest of the household has to leave for work."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/rachel-khoriander.png" name="Rachel Khoriander" title="Technical Writer" team="Content & Guidance" location="Texas, United States" body="When your car engine throws a rod and you instantly need a new car, you can take your time and find a good deal rather than panicking about how to get to work!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/ramiro-nunez-dosio.png" name="Ramiro Nunez Dosio" title="Social Media Manager" team="Marketing" location="Argentina" body="Working from a Panamanian beach while eating a lobster caught on the same beach."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/robin-bijlani.png" name="Robin Bijlani" title="Software Engineer" team="Engineering R&D" location="Florida, United States" body="Not feeling guilty about leaving your furry companions at home alone all day."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/sam-bellen.png" name="Sam Bellen" title="Developer Evangelist" team="Marketing" location="Belgium" body="Getting my cat’s “work harder while I take a nap” look, day in day out."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/scott-mathson.png" name="Scott Mathson" title="SEO and Web Developer" team="Marketing" location="Montana, United States" body="More time and breaks with loved ones, pets, kids (if you have them), etc. Monetary savings by eating lunch at home and not doing morning commute drive-thru coffee. The ability to create a personalized office setup that you are most productive working in."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/shili-li.png" name="Shili Li" title="UX Researcher" team="Design" location="New York, United States" body="No makeup. No more worrying about what to wear. Flip flops and active shorts every day in the summer."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/siddharth-kshethrapal.png" name="Siddharth Kshethrapal" title="Engineer" team="Design R&D" location="India" body="Surprising your wife/kids at their work to pick them up."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/stacy-taylor.png" name="Stacy Taylor" title="Web UX Designer" team="Content & Guidance" location="Oregon, United States" body="I just like being able to walk my dog at lunch and to do passive chores (laundry, running dishwasher, Roomba, etc.) during work so I don't have to do them on the weekend."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/steve-hobbs.png" name="Steve Hobbs" title="R&D Content Engineer" team="Marketing" location="England" body="Being able to take some time out to do noisy DIY while your kid is in daycare! I managed to lay a whole floor today!"/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/sumana-malkapuram.png" name="Sumana Malkapuram" title="Solutions Architect" team="Professional Services" location="North Carolina, United States" body="Being able to get peaceful ‘me’ time and pursue my passion of playing guitar again."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/tim-ferrell.png" name="Tim Ferrell" title="Engineer" team="Engineering R&D" location="Florida, United States" body="Watching your toddler nap on the couch while waiting on the kettle."/>

<include src="ProfileCard" picture="https://cdn.auth0.com/blog/auziros/yvonne-wilson.png" name="Yvonne Wilson" title="Director" team="Strategic Operations and Technical Field Enablement" location="California, United States" body="I worked remotely while my children were growing up, which enabled me to be home when they came home from school and invited friends over. In addition, the increased reach of the internet and the ability to hire remote workers has enabled me to hire and work with very talented people from all over the world. It has been a privilege to get to know so many interesting people from different cultures, all working toward the same goal &mdash; secure identity management."/>

## Work is a Thing You Do, Not a Place You Go

I often push the sentiment that, for modern employees and organizations, work is a thing you do and not a place you go. Over the next few years, with the advancement of technology and the adaptation of our modern lifestyles, this will continue to be a strong guiding principle in the way we craft how work happens at Auth0.

Although [we're investing in Offices around the world](https://auth0.com/blog/auth0-supports-global-growth/) (we have offices in London, Bellevue, Buenos Aires, and Sydney) our vision is less about traditional offices and more about hubs to build relationships &mdash; places for people to work from or to come and go, to learn and network... be they Auth0 employees, customers, or industry community friends. The offices are only additive to the great relationship culture we have that empowers us to work from anywhere.

Now, someone just needs to send that message to Tom Hanks... and Wilson.

Go check out more about [how we do things at Auth0 over at our Culture page.](https://auth0.com/careers/culture)

<include src="asides/AboutAuth0" />

We Are Thankful For These Benefits of Working Remote

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Give your employees flexibility without compromising security

Workers want mobility and flexibility and you want to give it to them. Young people, especially, have heard the siren song of flex time, and they've [made it a priority](https://www.forbes.com/sites/katetaylor/2013/08/23/why-millennials-are-ending-the-9-to-5/#1c17d54f715d) in their job search.

Even traditional workplaces are being liberated by technology to allow work to be done outside of the office — you no longer have to be a startup to have employees asking for [remote opportunities](http://money.cnn.com/2017/06/21/pf/jobs/working-from-home/index.html), or the option to stay at home when the mood strikes.

So yes, you want to keep workers happy and be attractive to the best and the brightest of the new generation in the workforce. But you also need security, which gets harder the more your employees move around and portable devices they use. Public wifi? Work computers that leave the office? Workers traveling with a personal *and* work cell phone — it's a security nightmare.

<include src="TweetQuote" quoteText="Millenials are ending the 9am to 5pm but this don't need to be a security issue."/>

Here's how you can give employees what they want *and* stay secure to the highest available standards.

## Outsource your security management

One of the most important things you can do to enable good security for your mobile workforce is [outsource your security](https://auth0.com/blog/5-reasons-your-company-needs-identity-and-access-management/). Your enterprise company has enough on its plate without adding a robust in-house identity management system to the mix.

Let's say you did set aside engineers to work on your IAM (Identity and Access Management), months to complete the project, and the money it takes to get your security fully functional. You'd still have to:

* Stay up to date on the latest security protocol, and make changes as necessary to continually keep your IAM at the cutting edge.
* Monitor and support your security system 24/7 to ensure that there's always a responder in the event of an emergency.
* Scale immediately to encompass the needs and numbers of your entire organization, and be able to keep pace with scaling up or down as your company needs.
* Add features as new identity management is developed and allows for easier use of biotech, etc.
* Maintain the entire system to make sure that all of it is always functioning optimally.

It's not easy to build and support your own identity management system when you *need* the best possible security but aren't service built to make it. That's why sophisticated IAM systems like [Auth0](https://auth0.com) exist. They can immediately scale to the enterprise. They'll have the features you need to keep your mobile workforce secure.

And they're backed up by experts who spend each and every day thinking about nothing else but how to keep you safe.

## Automate log out

Especially when employees are using mobile devices for work, triggering an automatic log out after a certain period of inactivity for any of your work systems is a must. If a work tablet gets left in a coffee shop or in a hotel on a work trip, there's an automatic layer of protection when no accounts have active sessions on a device. You can set up these [automated logouts](https://auth0.com/docs/logout) with your IAM of choice to kick employees out of your systems.

You should also force employees to use some form of authentication every time they want to access sensitive information. Employees might be able to log into their email and project tools and stay logged in without a problem. But even if they're still logged into your system, they shouldn't be able to access sensitive documents without logging in every time:

![Employees should log in every time](https://images.ctfassets.net/23aumh6u8s0i/hGneWXzQs28T6OostR615/f1b84a8937c73b9508e33ef5533efc21/iam-mobile)

*Depending on the system function, you may want your users to be able to access it without logging in anew every time. For others, you'll want to verify their identity each and every time.*

This complicates your identity management setup. Instead of just making sure the whole system is secure, you're now trying to enact different protocols for different items, which takes more time and energy to deploy. Still, you want to structure your internal systems to protect what is most sensitive without roadblocking employees who don't want to log in *every single time* they do anything at work.

Identity management can help you add this protective layering automatically, without the hassle. This will help your employees get work done wherever they are, but put up your best defenses for your most sensitive data.

## Partition users to protect data

When you're an enterprise company with employees at all levels working in the same system, it's important that you can identify each individual and their unique permissions. Interns don't need to see everything that your CFO does, and it's likely that you're going to need to partition users regardless of how mobile your employees are.

Here's an example of how much company sales and marketing information various members of a sales department might need, with Head of Sales having access to everything, and the rest of sales working off of slightly less:

![How much information different members of save have access to.](https://images.ctfassets.net/23aumh6u8s0i/778ZbWPqTFnY4YOGiqpvmH/4be6b733e3e3fbb9b187947344fe72ad/information-access-per-role)

It may not always be the case that the information that people don't need access to for their job is highly sensitive. Still, if you give everyone the same permissions as Head of Sales, you are needlessly putting that extra information at risk.

This is especially important when employees are taking work devices with them to get work done in their own space and time. Restricting access to tools and systems means you're also protecting yourself in case one person has their account compromised — instead of getting carte blanche access to everything, you're keeping at least some of your information safe.

Auth0's system is perfectly poised to help enact this partitioning because it keeps each user stored with a [unique profile](https://auth0.com/docs/user-profile). Each user holds unique attributes, so different users can be treated in different ways, which boosts your ability to restrict access through your IAM.

## Multifactor Authentication

The world is a-buzz with companies trying to get their users to enable [multifactor authentication](https://auth0.com/docs/multifactor-authentication) (MFA), and with good reason. MFA can help you safeguard your accounts from all sorts of threats by requiring that users submit multiple forms of proof that they are who they say they are when they try to login. You'll often see MFA implemented with a code that's sent to your mobile phone that you must enter alongside your username and password, for example.

This means that even if a computer is stolen, or someone gets the password for an account — two things that become much more likely with a workforce on the move — data remains secure because there's another layer of security added.

If you're trying to implement MFA yourself, you're tacking on extra time, energy and upkeep; robust IAM systems will have multiple forms of MFA ready for you so you can choose what works best for your business. Auth0, for example, offers MFA with SMS, one-time password services and push notification through our Guardian app, [among others](https://auth0.com/docs/multifactor-authentication).

You can also use MFA to add that extra layer of security where you want it, but not for everything. The Guardian app allows you to trigger MFA for some but not all of your requests. Want access to sensitive data? You'll need to authenticate with your Guardian app. Just want to log in for the day? You're free to go.

![The Guardian app allows you to trigger MFA for some but not all of your request](https://images.ctfassets.net/23aumh6u8s0i/6IEIMNQlG8haYqzmcD1vqJ/19606060b303c86ea3c79237e8f38cb8/step-up-flow)

(*An example of the Guardian app's capability on Fabrikam Intranet's system, where anyone can sign in without MFA, but a push notification is triggered when users try to access the employees page.* | [Source](https://auth0.com/docs/multifactor-authentication/developer/step-up-with-acr))

## Refresh (and enforce) good personal habits

Make sure your employees know the best habits to use when dealing with security. A good personal refresher is *[How Not To Get Your Identity Stolen](https://auth0.com/blog/how-to-not-get-your-identity-stolen/)*, which lays out some common sense advice to keep yourself secure online. While not everything is directly applicable to work, some of the most salient points that translate to the workplace are:

* Don't use unsecured public internet connections
* Set up a password for your home wifi network, especially if you're working from home
* Don't use shared device to access sensitive material
* Always sign out of your accounts when your session is done

These are easy, no-nonsense tips, but they often fall through the cracks, especially when workers are more frequently on the move or are working from home. Refreshing common sense security protocol regularly is important.

Some suggestions you can help enforce internally. Forcing sign out, as we've seen, is something that you can automatically initiate rather than relying on employees to remember. Wherever you can nudge along good behavior lessens the risk of having a security breach. After all, employee error accounts for [2/3](https://www.foley.com/employee-error-accounts-for-most-security-breaches-06-07-2016/) of security breaches.

## Don't compromise for anyone

You simply cannot leave your company's digital security up to chance. The best way to protect your identity data, especially in today's mobile environment, is to set yourself up for success by turning to experts in identity management.

Then, you need to foster a culture of safe cyber habits to keep everything that needs to say internal, internal.

With these plans in the books, you can offer flex time or remote opportunities to your workers' desire.

"remote"