Michelle Agroskin

Michelle Agroskin is a Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios, driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Product Marketing Manager, Customer Identity Cloud

sam-yapkowitz

I began my career in enterprise software development and got exposure to lots of different frameworks and methodologies. I quickly realized my passion was in the architecture and design of solutions to unique problems. I now get to use these skills to help my customers build high-quality experiences using Okta. When not at work you can find me on the golf course, playing Rocket League or watching football with my friends.

Specialist Solutions Engineer

Sam Yapkowitz

Secure AI agents need more than context. MCP + Auth0 combines identity and control for safe, scalable, autonomous actions.

AI agents are moving from helpful assistants to autonomous actors. They don’t just summarize documents or answer questions—they take actions on our behalf: managing calendars, filing support tickets, and even completing purchases.

To do any of that, they need context. Who is the user? What are they allowed to do? What’s happening in the session?

Today, delivering that context to an agent is messy and ad hoc. That’s where the [Model Context Protocol (MCP)](https://modelcontextprotocol.io/specification/2025-03-26/index) comes in—a new specification designed to standardize how context is passed to AI models.

At Auth0, we believe **MCP is necessary but insufficient**.

It’s a great first step, but it **must be paired** **with robust identity and access controls**. Without them, AI agents operate on blind trust, which is a massive security and privacy risk.

This is where identity standards like OAuth 2.0 and OIDC, alongside tools like Auth0, come in.

## The Rise of Capable AI Agents (and Why Context Matters)

AI agents are growing more capable. Developers are building agents that can:

* Query internal systems and databases
* Execute transactions
* Act as customer support reps or internal assistants
* Chain together APIs and services to complete user goals

However, to act effectively and safely, these agents need access to **context**—structured information about the user, their permissions, their past behavior, and their intent. Without context, the agent is just guessing.

Today, there’s no standard way to pass that context. Developers are building custom solutions—often without a strong security model.

## MCP: A Powerful Foundation for Context

MCP is a crucial step toward solving this. Created by Anthropic, MCP provides a standardized payload format for delivering relevant information to AI agents—user identity hints, permissions, claims, and more.

We applaud the teams defining this specification. Standardization helps agents interoperate, improves developer experience, and lays the groundwork for more powerful agent behavior.

But here’s the catch:

> MCP does not secure the payload. It defines _what_ context can be sent—not _who_ can send it, whether they’re authorized, or what the agent can do with it.

This creates significant risk:

* **Anyone** could invoke an agent.
* **Any context** could be injected—true or not.
* **Any action** could be taken on behalf of a user.

MCP is the envelope. But we still need to know who can send it and what the recipient can do with it.

## The Critical Missing Layer: Identity 

Passing sensitive data or enabling agent actions without robust authentication and authorization is dangerous. We can think of MCP without security the same way as an API endpoint without security – both are just communication protocols, and security must be layered on top. The lack of security could cause:

* **Impersonation** – Malicious actors pretending to be someone else (i.e., who is really invoking the agent and providing context?)
* **Data leakage** – Agents receiving context they shouldn’t have access to (i.e., is the context provider authorized to share this specific user data?)
* **Privilege escalation** – Tricking an agent into acting beyond its scope (i.e., can the agent be tricked into performing actions the user isn’t authorized to do?)
* **Compliance violations** – handling sensitive data without proper controls (GDPR, CCPA, HIPAA, etc.)

These aren’t hypothetical. AI agents will soon be responsible for customer interactions, business workflows, and system integrations. We can’t afford to leave their security to chance. MCP needs a robust mechanism to verify the *source* of the context and authorize *what* context is shared and *what* actions the agent can subsequently take. 

Security must be built in—not bolted on.

## Identity Protocols Are the Key

Thankfully, we don’t need to invent a new solution.

> Established identity standards—OAuth 2.0 and OpenID Connect (OIDC)—are perfectly suited to solve this problem.

They are mature, well-understood standards for delegated **authorization** and **authentication** and provide the exact tools MCP needs:

* **OIDC**: Authenticates the entity (user, system, or service) interacting with the agent.
* **OAuth 2.0**: Authorizes what context can be shared and what the agent can do on the user’s behalf—using scopes, access tokens, and delegated permissions.

This makes it possible to:

* Ensure **only authenticated users or systems** can invoke the agent.
* Use **granular scopes** to control what context is sent in the MCP payload.
* Define what downstream **actions** an agent is allowed to take—based on token claims.

As Aaron Parecki notes in [his breakdown of OAuth for MCP](https://aaronparecki.com/2025/04/03/15/oauth-for-model-context-protocol), these protocols map cleanly onto the challenges MCP doesn’t solve.

## Auth0 Is the Bridge

This is where **Auth0 fits in.**

> **Auth0 is uniquely positioned to operationalize secure MCP implementations.** Our platform brings OAuth 2.0 and OIDC to agents to enable more secure and scalable workflows. 

We’re investing in new capabilities designed specifically for AI security, including:

* **User authentication** to easily implement secure login experiences for AI agents, from interactive chatbots to background workers.
* **Token Vault** to securely call APIs like Google, Slack, Spotify, and Github on users’ behalf while seamlessly integrating an application with other products.
* **Async Authorization** to enable autonomous agents to work independently while maintaining user control by getting explicit user approval for critical actions. 
* **Fine-grained authorization for RAG** to enforce granular permissions for document retrieval and helps ensure AI agents only access authorized content. 

![Capabilities and Features](https://images.ctfassets.net/23aumh6u8s0i/6SiMeLDwE0oAw9dSJnQOkF/40ebf7b7f1033880123f93597342ffe2/Capabilities_and_features.png)

And because this builds on existing identity infrastructure, you get the benefits of:

* Developer familiarity
* Reduced integration overhead
* Centralized policy management
* Better auditability and compliance

We make securing AI agents feel like a natural extension of your current Auth0 implementation—not a one-off hack.

## A Real-World Scenario

Let’s walk through what this looks like in practice:

1. A user logs into your customer support portal—powered by Auth0.
2. The app requests an access token with scopes like `read:user_profile`, `read:recent_orders`.
3. Auth0 authenticates the user and issues a signed token containing relevant claims.
4. The application constructs an MCP payload using claims from the token.
5. The AI agent receives the payload, verifies the token, and uses only the authorized context to respond.
6. Later, the user says, “Reorder my last purchase.” The agent requests a new token with the scope `execute:reorder`, prompting the user to re-consent via OAuth.
7. Auth0 issues the new token. The agent performs the action—securely, transparently, and with the user’s permission.

Every step is authenticated. Every action is authorized. Check out more examples on our [documents page](https://auth0.com/ai/docs).

## The Bottom Line: Secure AI Starts with Identity

AI agents are the next interface frontier—but only if we get security right.

> MCP is foundational—but without an Identity solution, it’s not safe for real-world use.

Auth0 provides the missing layer—bringing identity, permissioning, and governance to the world of AI agents. Our platform makes it possible to adopt MCP without compromising on trust, compliance, or control.

[Learn more](http://auth0.com/ai) about securing AI interactions, read our [documentation](https://auth0.com/ai/docs), and [contact us](https://auth0.com/contact-us) to discuss your AI security needs.


MCP + Auth0: An Agentic Match Made in Heaven

37590801?s=460&v=4

Howdy! 🤠 I do technology research at Auth0 with a focus on security and identity and develop apps to showcase the advantages or pitfalls of such technology. I also contribute to the development of our SDKs, documentation, and design systems, such as <a target='_blank' rel='noopener noreferrer' href='https://github.com/auth0/cosmos'><strong>Cosmos</strong></a>.<br /><br />The majority of my engineering work revolves around AWS, React, and Node, but my research and content development involves a wide range of topics such as Golang, performance, and cryptography. Additionally, I am one of the core maintainers of this blog. Running a blog at scale with <strong>over 600,000 unique visitors per month</strong> is quite challenging!<br /><br />I was an Auth0 customer before I became an employee, and I've always loved how much easier it is to implement authentication with Auth0. Curious to try it out? <a href='https://auth0.com/signup' data-amp-replace='CLIENT_ID' data-amp-addparams='anonId=CLIENT_ID(cid-scope-cookie-fallback-name)'><strong>Sign up for a free account</strong></a> ⚡️.

Staff Developer Advocate

Dan Arias

For developers tasked with building global applications, choosing the right authentication solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs makes it a standout choice in the crowded authentication landscape.

In today's multi-platform world, identity management isn't a one-size-fits-all solution. As developers, we need an authentication system that not only secures enterprise-level applications (B2B) but also delivers a seamless, user-friendly experience for consumer-facing products (B2C). That's why developers across the world turn to Auth0 when they feel it's time to delegate the task of building and maintaining ***authentication and authorization*** to a vendor with deep security expertise and adaptable technical capabilities. 

## The Challenge of Global Scale

Global companies with multifaceted portfolios face a unique set of challenges:

- **Multiple Platforms:** Users access their services via smartphones, PCs, consoles, and more.

- **Diverse Regulatory Requirements:** Compliance with international data privacy and security regulations is non-negotiable.

- **Customization Needs:** Every organization has its own unique workflows and integration requirements, such as compatibility with legacy authentication systems or [support for protocols like SCIM](https://auth0.com/docs/authenticate/protocols/scim).

For developers building at a global scale, the solution needs to be robust enough to handle high security and regulatory demands while remaining flexible for rapid development and global expansion.

## Why Auth0 Stands Out

Auth0's strength lies in its ability to effectively serve both B2B and B2C needs across geographical regions. Here's what makes it a compelling choice:

### Dual capability

Auth0 is built to handle both enterprise-grade integrations and consumer-friendly interfaces. While many competitors specialize in one or the other, Auth0 offers the best of both worlds.

### Robust security

With advanced features like multi-factor authentication (MFA), threat detection, and continuous monitoring, Auth0 meets stringent global security standards—critical for protecting sensitive user data and adhering to mandatory compliance requirements. Don't let regulation get in the way of expansion.

### Scalability

Whether you're serving thousands or millions of users across different regions, Auth0 scales seamlessly. This is vital for companies that operate in a global marketplace.

### Flexible customization

Auth0 allows extensive customization through robust APIs that support multiple programming languages and frameworks. This flexibility means you can tailor the authentication process to meet your specific needs, ensuring a smooth user experience regardless of the platform. Whether you are building the next top-ranking mobile game, a desktop AI application, or a streaming service, Auth0 has a solution that adapts to the user experience you want to attract, convert, and retain paying customers.

### Comprehensive support
 
Transitioning to a new authentication system can be complex. Auth0's professional services and support ensure that even challenges like regulatory compliance or cloud infrastructure migrations (e.g., AWS) are managed efficiently.

## Auth0 Is Ahead of the Competition

While there are strong contenders in the IDaaS space, they often excel in more niche areas. A competitor may be a strong option for enterprise integrations but may require extra effort to tailor it for consumer-facing applications. Some competitor platforms often focus on streamlined, developer-friendly solutions for either simple consumer apps or internal enterprise tools. However, they might not offer the same depth of customization and B2B/B2C functionality required for complex global environments or operations.

Auth0's proven track record in both B2B and B2C scenarios makes it uniquely suited for organizations that need a versatile, scalable, and secure authentication solution.

## See Auth0 in Action

Seeing is believing. Experience Auth0's power firsthand by diving into our developer resources. There, you can quickly set up secure authentication flows for both business and consumer scenarios.

### Interactive demo
   
Try out [our reference B2B SaaS application](https://saastart.app/) to experience features of multi-tenancy support, user management and access controls, security policies, self-service Single Sign-On configuration, and more out-of-the-box. Follow our [guided walkthrough](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/) to see how easily Auth0 can secure B2B SaaS applications. If you prefer to learn while reading code, check out the [Auth0 B2B SaaS Starter open-source repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

### Step-by-step developer guides

Check out our [detailed developer guides](https://developer.auth0.com/resources/guides) on integrating strong authentication using Auth0 with different frameworks and languages. These guides will show you how to implement everything from simple login pages to role-based access control in Single-Page Applications (SPAs), APIs, and web applications. Once you are done with the basics, explore our [developer labs](https://developer.auth0.com/resources/labs) to learn how to extend your authentication solution to include features such as Single-Sign On (SSO) for end-users using Google, GitHub, or X/Twitter, as well as enhancing your authorization models with Fine-Grained Authorization.

### Code samples

[Clone any of our starter projects](https://developer.auth0.com/resources/code-samples) and see practical examples of how Auth0 streamlines the implementation of authentication and authorization. Experiment with the code, tweak it to suit your needs, and accelerate your development process.

## Conclusion

For developers tasked with building global applications, choosing the right IDaaS solution is crucial. Auth0's ability to bridge the gap between enterprise and consumer needs—coupled with its robust security, scalability, and flexibility—makes it a standout choice in the crowded authentication landscape. 

If you're developing a platform that must meet both B2B and B2C demands on a global scale, Auth0 is definitely worth a closer look. [Global companies like SEGA have chosen Auth0](https://www.okta.com/jp/press-room/press-releases/sega-auth0/) as a comprehensive and compliant yet flexible authentication solution that not only enhances security and user experience but also streamlines development and operational efficiency: by opting for a ready-to-use IDaaS solution rather than maintaining an in-house system, SEGA was able to lower development friction, allowing their teams to focus more on core game development and innovation.

Authentication and Authorization For Developers Who Build at Global Scale

Matthew Pereira

Principal Product Designer

Making reliable and scalable decisions in Identity and Access Management using Auth0

## Introduction and Overview

At Auth0, we understand the importance of choosing the right architecture for applications,** especially for security-focused business customers.** The choice between single-tenant and multi-tenant models significantly impacts scalability, security, and success. Making the choice early is crucial — once customers use the application, change can be tough.

When we talk about software architecture, “tenancy” refers to how resources — like data, application logic, and infrastructure — are allocated and shared among users or customers. Software can be set up in different ways, and each instance (or “tenant”) can be occupied in various ways by customers or user groups. In this article, we’ll use the terms “isolated infrastructure” and “shared infrastructure” to be more specific — more on that in the next section.

Auth0 by Okta is built to support every possible identity and access management (IAM) scenario you might encounter when building SaaS applications. We’re here to make sure your journey is smooth, whether you’re just starting with your first login or scaling to support hundreds of business customers and millions of users around the world. The Auth0 platform can create isolated or shared environments and hybrid architectures. As your customer base grows or your product pivots to meet market demands — like adapting a B2C application to handle B2B sales — Auth0 lets you progressively add IAM capabilities and adjust your identity approach appropriately.

This guide will explore the differences between single-tenant and multi-tenant identity, especially in the context of IAM. We’ll also show you how Auth0 simplifies implementing these models and help you choose the best approach for your B2C or B2B needs.


## Understanding Single-Tenancy vs. Multi-Tenancy

### Making Sense of Single-Tenancy vs. Multi-Tenancy

Different companies, applications, and platforms discuss the topic of ‘tenancy’ in software development in different ways.

* Application developers often describe multi-tenancy as a scenario in which multiple customers (tenants) share a single application and database instance.
* Platform developers often think of a “multi-tenant” scenario as one in which a single customer is accessing multiple instances of their platform (referred to as ‘tenants’).

![Single-Tenancy vs. Multi-Tenancy](https://images.ctfassets.net/23aumh6u8s0i/7oMfZHsVewu8lO6fDudH61/c58098cd910d624d41e76f9344bea51c/single-vs-multi-tenancy.jpg)

Isolation plays a large role in evaluating the pros and cons of different tenancy strategies. Multi-tenancy isn’t usually necessary for isolating between customers or branded experiences. (If you use Auth0 Organizations — we’ll talk about that later.)

### Benefits of Isolation for B2B Applications

Traditionally, isolating each business customer to its own infrastructure in B2B scenarios was a matter of **performance** and **reliability**. But there’s more to the conversation than those two details.

1. **Enhanced Security:** Isolation ensures each organization’s sensitive data is kept separate, reducing breach risks and aiding compliance with regulations like GDPR and HIPAA.
2. **Customizability:** Isolated environments allow tailored setups, enabling unique authentication flows, integrations, and experiences that align with client needs.
3. **Performance Stability:** Isolation prevents one organization’s activities from affecting another’s performance, avoiding issues like the “noisy neighbor” effect.
4. **Dedicated Resources:** Organizations can allocate specific resources, ensuring high availability and reliability for their applications.
5. **Simplified Support:** Troubleshooting is easier in isolated environments, as issues are contained within a single tenant, reducing support complexity.

Signing up for an Auth0 account gives you one “Auth0 tenant”, and you can create additional tenants each for isolating between different:

* Environments (e.g., development, staging, or production)
* Geographic locations (e.g., EU, US, JP) 
* Branded experiences
* Customers

### Drawbacks of Isolation for B2B Applications

1. **Higher Costs**: Traditionally, isolated environments are costlier due to separate resources and infrastructure for each tenant.
2. **Increased Management Complexity**: Managing isolated tenants requires more administrative work, including updates, security compliance, and performance monitoring. Auth0 Teams is a product meant to ease the burden of managing some aspects of your organization across multiple tenants, but there are other aspects that will still be more time-consuming than a shared Auth0 tenant architecture.
3. **Reduced Resource Efficiency**: Isolation can lead to underutilized resources, unlike shared architectures that pool resources efficiently.
4. **Slower Configuration Deployment**: Isolated tenants require separate rollouts or migrating changes across multiple configurations, slowing down the development and operation process. This can also lead to version divergence, when a company has updated one environment but not others, giving different end users different experiences and making debugging and management considerably more difficult.

## Choosing the Right Model for Your Application

### Choosing the Right Model for B2C Applications

Creating a **single shared tenant** for a B2C application offers simplicity, cost-effectiveness, and scalability. Think of it as creating one big, cozy house where all your customers can live together but still have their own private rooms. It’s like magic — you get privacy and security where it matters, but one configuration to manage from one central spot. This means you will have fewer headaches and creates a smoother experience for everyone involved.

The best part? It’s simple. You’re not building and maintaining separate houses for each customer group but one efficient space that can grow as you do. Plus, it’s super flexible: You can easily add new features or tweak settings for every one of your customers at once. Just remember, while this setup is great for many scenarios, make sure it fits your specific needs before diving in. After all, you want your digital home to be just right for you and your customers.

### Choosing the Right Model for B2B Applications

When working on a B2B setup there are different approaches we can take from an architecture perspective. In this section we’ll evaluate different scenarios, and how you can leverage Auth0 to simplify your implementation.

#### Isolated Tenants in a B2B Context

Security is a top priority for business customers in 2024. Imagine giving each of your business customers their own digital fortress. That’s what creating a **separate, isolated tenant** for each business customer is like.

This approach is all about giving your business customers the royal treatment. Each one gets its own space, completely separate from the others, which can be a big selling point for companies that are extra careful about their data and security. It’s like having a series of high-security vaults, each with its own unique key. 

Isolating your business customers to separate tenants also allows for ultimate customization —  each business can have things just the way they like them, from security settings to user management. Plus, if one tenant has an issue, the others aren’t affected. It’s a bit more work on your end to manage multiple tenants, but for businesses that demand top-notch security and personalization, this could be your golden ticket.

Signing up for an Auth0 account gives you one “Auth0 tenant”, and you can create additional tenants each for isolating between different:

* Environments (e.g., development, staging, or production)
* Geographic locations (e.g., EU, US, JP) 
* Branded experiences
* Customers

#### Auth0 with Organizations in a B2B Context

Let’s chat about a useful middle-ground approach using [Auth0 Organizations](https://auth0.com/docs/manage-users/organizations) to manage B2B users in a single Auth0 tenant. This is like having a massive, secure office building where each of your business customers gets their own floor. Every floor can have its own layout, look, and feel, but as the application owner, you enjoy the simplicity of managing one building, not a whole city block. 

With this approach, B2B customers get customizable security, branding, and identity provider connections while you get to keep all the perks of managing a single tenant. It's simpler to oversee, and you can still roll out cool new features to everyone at once. Plus, you've got the flexibility to customize each “floor” to fit that particular business needs. Every customer can have their own SSO connection and their own members (or, in more complex use cases, their own distinct databases of members), managed within a single Auth0 tenant. It’s a win-win.

### Choosing a Hybrid Model with Shared B2C Tenant and Isolated B2B Tenants

Modern product development is complicated, and our software often has to play multiple roles. If you’re exploring a combination of B2C and B2B usage, you can also approach a hybrid solution to your IAM needs.

Imagine you’ve got a bustling community center (your B2C shared tenant) where all your individual consumers hang out. It’s vibrant, cost-effective, and easy to manage. But right next door, you’ve got a row of private clubhouses (your B2B isolated tenants), each tailored for a specific business client.

This hybrid approach lets you seamlessly cater to both worlds. Your B2C users get a unified, streamlined experience in their shared space — and you get the perks of managing it in a centralized fashion. Meanwhile, your B2B clients each get their own fortress of solitude, complete with custom security and features.

This setup is perfect if your product needs to juggle the different demands of individual consumers and business clients. You get to optimize your resources for the B2C crowd while still offering that extra layer of isolation and customization that B2B clients often crave.

## Implementation with Auth0

### Creating Isolated Tenants Using Auth0

In Auth0, single-tenancy can be implemented by creating separate Auth0 tenants for each customer. This allows for granular control over the IAM needs of each tenant, ensuring their data and configurations remain isolated. These tenants can be deployed to different regions or configured independently to serve different user pools or compliance needs.

[Learn more about creating tenants in the Auth0 Docs](https://auth0.com/docs/get-started/auth0-overview/create-tenants).

### Creating a Shared Tenant Using Auth0 — Introducing Organizations

Organizations in Auth0 is a feature that allows you to manage and group users who should have access to particular applications. By managing multiple organizations within one Auth0 tenant, you can:

1. Centralize user management and authentication
2. Reduce administrative overhead
3. Maintain consistent security policies
4. Simplify billing and licensing
5. Leverage shared resources and configurations to work faster without working harder

[Learn more about how Organizations work in the Auth0 Docs](https://auth0.com/docs/manage-users/organizations/organizations-overview).

## Conclusion

Whether you opt for a single shared tenant, isolated tenants for each business customer, or a hybrid approach using something like Auth0 Organizations, choosing the right tenancy model for your application is crucial for long-term success. Remember, the best solution depends on your specific needs, balancing factors like security, customization, scalability, and management complexity.

Auth0 provides the flexibility and tools to support you, whatever you choose. As you embark on your journey to build robust B2B or B2C applications, consider exploring Auth0’s comprehensive offerings:

* Learn about [Auth0 Public Cloud and Private Cloud offerings](https://auth0.com/platform/cloud-deployment) to find the right fit for your infrastructure needs.
* Try [Auth0 Organizations](https://auth0.com/organizations) to experience multi-tenancy with built-in security and scalability in an all-in-one centralized management environment.
* Kickstart your B2B SaaS development with [Auth0’s B2B SaaS Starter](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), which includes advanced B2B identity capabilities from the get-go.

By leveraging Auth0’s powerful IAM solutions, you can focus on creating value for your customers while ensuring secure, scalable, and efficient user management.

Building Single-Tenant vs. Multi-Tenant Apps with Auth0

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

Explore how tools like Auth0 Organizations, OPA, and Okta FGA can streamline your authorization strategy for secure, scalable SaaS development.

When building a multi-tenant SaaS application, selecting the right authorization model is critical to ensure the security and scalability of your system. Authorization is not only about managing user access but also about ensuring that tenants remain isolated, protected, and—where necessary—able to collaborate. The right model for your SaaS depends on the complexity of your application, the relationships between users and resources, and how dynamic or flexible your access control needs to be. This guide provides a deeper dive into how **RBAC**, **ABAC**, and **ReBAC** can be implemented for multi-tenancy, focusing on what needs to be handled in code versus what can be centralized in a system. We’ll also touch on popular services like [Auth0 Organizations](https://auth0.com/organizations), [OPA](https://www.openpolicyagent.org/), and [Okta FGA](https://fga.dev/) to streamline your implementation.

## Role-Based Access Control (RBAC)

**Role-Based Access Control (RBAC)** is often the first choice for SaaS applications that have clear roles with distinct access privileges and is often the most familiar option among developers. It’s a straightforward model where users are assigned roles (e.g., admin, editor, viewer), and those roles come with specific permissions. In a multi-tenant environment, RBAC needs some enhancements to ensure roles are properly scoped to each tenant. This way, the users' permissions are restricted to their organization.

In a multi-tenant setup, RBAC handles tenant isolation primarily by scoping roles to individual tenants. This means that roles like “admin” or “viewer” are not globally applicable across the system but are assigned on a per-tenant basis. For instance, a user might be an “admin” in “Tenant A” but only a “viewer” in “Tenant B”.

To enforce this isolation, your application will need to ensure that roles are checked **within the tenant context** before allowing access to resources.

At the **code level**, this means ensuring that the application always verifies which tenant the user is operating under when making role-based decisions. For example, when a user tries to access a resource, the system should confirm whether their “admin” role applies to that specific tenant’s resources, not to another tenant’s resources.

> Notice that when using RBAC for authorization, a user under a certain role will get access to all the resources for that tenant. Other authorization models provide ways to scope the privileges of a user to specific resources within the tenant, and we’ll cover them later in the article.

There are simpler approaches to implementing RBAC into your application; for example, when using Auth0 for authentication, Auth0 offers an **Organizations** feature, which simplifies authentication and role assignments in multi-tenant environments. Auth0 Organizations allows you to easily manage users across multiple tenants (or organizations), where each user can be assigned roles specific to the organization they belong to. By using Auth0’s built-in support for multi-tenancy, you can delegate much of the tenant-specific role management to the identity provider, reducing the amount of tenant-scoped logic that needs to be hardcoded into your app.

### Example use cases for RBAC:

- **HR Management Platform**: In an HR platform used by multiple companies, each company (tenant) has its own set of roles, such as "HR Admin" and "Employee." When an HR Admin from Company A logs in, their permissions are limited to the records of Company A, while an HR Admin from Company B has access only to their company’s records.
- **AI-Powered Customer Support Tool**: A SaaS platform for AI-powered customer support allows companies to manage their support teams. Each team has a role structure, where the "Team Lead" has access to configure the AI responses, and the "Support Agent" can only see suggestions.

## Attribute-Based Access Control (ABAC)

ABAC allows you to define access control policies based on various attributes related to the user, resource, or environment. Unlike RBAC, which assigns static roles, ABAC dynamically evaluates attributes such as the user’s department, resource sensitivity, or even contextual factors like time and location. This makes ABAC more flexible for scenarios where access decisions depend on dynamic conditions.

In multi-tenant SaaS applications, ABAC can handle tenant isolation by including the tenant ID as an attribute in access control decisions. For instance, you can create policies that grant access to users based on their `tenantId`, `role`, and `department`. This allows for more granular control over what users from each tenant can access and when.

At the **code level**, the application needs to collect the relevant attributes (e.g., `tenantId`, `userRole`, `resourceSensitivity`) and pass them to the authorization engine for evaluation. The actual logic for determining whether access is allowed is centralized in the policy engine, reducing the need for complex, tenant-specific logic in your app.

There are some caveats, though; while ABAC allows for dynamic evaluation of the information, the relationships and structure of the information are hardcoded throughout the application, and if your attributes change, it may require code changes throughout the application. This is because the relationships between a user, its role, tenant, etc, are not inferred by the policy engine, but rather specified during authorization checks. For an inferred and more fine-grained approach, there’s a different authorization model which I will cover next.

For **system-level implementation**, ABAC policies can be managed using tools like **Open Policy Agent (OPA)** or a custom policy engine. These tools evaluate attributes dynamically, ensuring that access is granted only if all conditions are met. For multi-tenancy, this would include ensuring that users are only accessing resources within their tenant.
`

### Example use cases for ABAC:

- **AI-Driven Healthcare SaaS**: A hospital management system uses ABAC to grant access to patient records based on a doctor’s role, department, and the patient’s condition. Additionally, access is restricted to working hours.
- **AI-Powered Marketing Platform**: Marketing managers can access reports based on their role, the campaign they are working on, and the region of the campaign. ABAC policies check the region, `campaignType`, and `role` attributes to ensure the user is accessing data for their tenant’s campaigns only.

## **Relationship-Based Access Control (ReBAC)**

**Relationship-Based Access Control (ReBAC)** is ideal for SaaS applications where access control is based on complex relationships between users, resources, and organizations. Instead of simply granting permissions based on roles or attributes, ReBAC models relationships (e.g., "is the owner of," "can edit") and uses these to make access decisions. This is particularly useful for collaborative SaaS platforms where permissions are based on how users interact with resources.

> If your SaaS application handles user-generated content, you’ll likely benefit from a ReBAC model)

In multi-tenant ReBAC implementations, tenant isolation is enforced by defining relationships within and across tenants. For example, a user might "own" a resource within one tenant, and another user might have "edit" permissions for that resource based on their relationship. Unlike RBAC, which assigns roles based on predefined hierarchies, ReBAC focuses on how entities (users, resources, tenants) are related.

At the **code level**, your application doesn’t need to hard-code tenant checks. Instead, all access control decisions are based on querying the relationship graph, which models how users and resources are linked. This reduces complexity, as the app doesn’t need to maintain tenant-specific logic.

For **system-level implementation**, **OktaFGA** (or **OpenFGA**, based on Google Zanzibar’s model) provides a powerful platform for managing ReBAC at scale. OktaFGA stores and manages relationships in a graph database and allows your application to query these relationships in real time. You can model tenant-specific relationships and even handle cross-tenant scenarios, such as allowing external collaborators limited access to certain resources.

### Example use cases for ReBAC:

- **AI-Enhanced Document Collaboration Platform: In this multi-tenant SaaS, users can create, share, and edit documents within their tenant. ReBAC models relationships like "owner," "editor," and "viewer" for each document.**
- **AI-Powered Learning Management System**: A university (tenant) uses the platform to manage courses and student access. Students are "enrolled" in courses, and professors "teach" those courses. ReBAC models these relationships, ensuring that only enrolled students can access course materials. If a student transfers to a new university (tenant), their access is automatically updated based on their new relationships within the system.

## Summary

When it comes to building a multi-tenant SaaS application, your choice of authorization model determines how much of the access control logic is handled by your code versus the authorization system and how wide or fine grained the access control is over the resources of the tenants.

- **RBAC** requires tenant-specific role checks in your code, but tools like **Auth0 Organizations** can offload much of this complexity by managing roles and tenants externally.
- **ABAC** offers fine-grained, context-aware access control, where the system dynamically evaluates policies based on attributes like `tenantId` and `role`. Tools like **Open Policy Agent (OPA)** can centralize these decisions, reducing the need for custom code.
- **ReBAC** excels in scenarios with complex, dynamic relationships. Solutions like **OktaFGA** allow you to manage relationships at scale without embedding tenant-specific logic in your app. Instead, the relationship engine handles access control based on real-time relationships between users and resources.

By leveraging these models and tools, you can build a secure, scalable, and maintainable multi-tenant SaaS platform that fits your unique authorization needs.

Thanks for reading!

How to Choose the Right Authorization Model for Your Multi-Tenant SaaS Application

Kapil Patil

Sr. Partner Solutions Technical Architect

Discover how combining AWS Lambda Authorizers with Okta FGA can strengthen your API security. This approach ensures precise, scalable access management across your applications with minimal overhead.

Streamlining API Security with AWS Lambda Authorizers and Okta FGA

milan-khan

Milan is the Product Manager for advanced identity security features for customers operating in highly regulated industries. Milan is especially keen on solving consumer identity problems balancing user experience, security and compliance.

Senior Product Manager

Milan Khan

An introduction to Strong Customer Authentication (SCA), a mechanism for providing a higher level of security in sensitive contexts.

Strong Customer Authentication (or SCA for short) is a versatile authorization mechanism that first made waves in the financial services industry for digital payments, and adoption is picking up pace, even for non-financial transactions.

SCA was enacted in 2019 as a requirement of the [revised European Union (EU) Payment Services Directive (PSD2)](https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html). Its main purpose is to raise security standards and reduce fraud for online and contactless payments, and it's now a part of life for millions of consumers in the EU.

PSD2 and its regulatory technical standards (RTS), along with inputs from the European Banking Authority in the form of opinions, questions, and answers, describe how SCA should be implemented by financial services organizations in EU member states. In summary and in relation to user security and authentication, this means:

- The payer needs to authenticate themselves with multi-factor authentication in order to authorize the payment.
- Multi-factor authentication (MFA) must comprise two (or more) of the following elements: knowledge, possession, and inherence.
- The payer (the consumer) gives informed consent to the payment amount and the payee's account.
- The payment transaction must be (cryptographically) linked to an amount and a payee specified by the payer (known as Dynamic Linking – this is what makes SCA different from typical “step-up MFA”).

In this blog post, we'll explore these SCA components and show how you can implement them using Auth0 by Okta! 

## Exemptions from Applying SCA

Strong Customer Authentication takes a risk-based approach, and there is a provision for exemptions to be applied to SCA. Low-risk scenarios that allow service providers not to apply SCA include:

- Payments to existing payees that have been previously authorized using SCA.
- Payments from one account to another account, where both accounts belong to the same account holder and are with the same service provider.
- The service provider has judged the payment transaction to be low risk through real-time risk and fraud analysis. The level of historic fraud will determine the threshold for amounts that can be exempted from SCA; i.e., lower levels of fraud will mean higher payment amounts can be exempt from SCA.
- Payments transactions below EUR 30 (or local equivalent) are considered "low value" and may be exempt from SCA. Service providers will have to request the payer to perform an SCA if the exemption has been used five times since the payer's last successful SCA or if the sum total of previously exempted payments exceeds EUR 100 (or local equivalent).

## Multi-Factor Authentication &mdash; Something You Know, Have, or Are

As discussed earlier, SCA mandates the use of at least two distinct authentication factors out of the three categories: knowledge, possession, and inherence.

- The **knowledge factor** is something the user knows, such as a password, a personal identification number (PIN), or an answer to a security question.
- The **possession factor** is something the user has, such as a telephone SIM card, a mobile device, or a smart card. Each of these typically has a cryptographic key, so the possession factor is essentially possession of a cryptographic key, preferably the private key of an asymmetric key pair.
- The **inherence factor** is something you are and is typically biometric verification where a user's captured biometric is compared to a reference template. This can be, for example, a fingerprint, facial, or voice biometric.

## Consent

Authorizing payments and any other sensitive transaction requires that the user know what they are authorizing and consenting to. SCA requires the user to view the payee and the payment amount before any authorization.

This concept of providing informed consent can also apply outside of payment scenarios for any sensitive transactions such as:

- Changing login and/or security settings
- Changing user profile settings, e.g., home address
- Sharing personal data

![Strong Customer Authentication user consent](https://images.ctfassets.net/23aumh6u8s0i/6kC16xojBEnAQLynhGuUM/bfb4bbeb85b87c2ab28e00faaff2a1a0/strong-customer-authentication-user-consent.jpg)

## Dynamic Linking &mdash; What Makes SCA Different

Dynamic Linking is what sets SCA apart from a regular step-up authentication prompt. Linking transaction details to the approval prompt allows users to double-check accuracy and avoid transaction tampering before approving the transaction.

When a payer (the consumer) initiates a payment, the transaction itself must be linked to the amount and payee specified by the payer. This dynamic linking generates an “authentication code,” which is unique and specific to the transaction (payee and amount). 

The authentication code is transferred through the payment and authorization processes. Any changes to the payment data (amount, payee) will invalidate the authentication code and, thus, the transaction.

> If you want to learn more about the details of SCA, here are some related documents:
>
>- Revised EU Payment Services Directive “PSD2”: [2015/2366 - EN - Payment Services Directive >- EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32015L2366) 
>- SCA Publication: [Strong customer authentication requirement of PSD2 comes into force - European Commission](https://finance.ec.europa.eu/publications/strong-customer-authentication-requirement-psd2-comes-force_en)
>- Regulatory Technical Standard for SCA: [Delegated regulation - 2018/389 - EN - EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018R0389) 
>- Amendment on the RTS for SCA: [Final Report on the amendment of the RTS on SCA & CSC](https://www.eba.europa.eu/sites/default/files/document_library/Publications/Draft%20Technical%20Standards/2022/EBA-RTS-2022-03%20RTS%20on%20SCA&CSC/1029858/Final%20Report%20on%20the%20amendment%20of%20the%20RTS%20on%20SCA&CSC.pdf) 
>- Opinion of the European Banking Authority on SCA: [Opinion of the European Banking Authority on the implementation of the RTS on SCA and CSC](https://www.eba.europa.eu/sites/default/files/documents/10180/2137845/0f525dc7-0f97-4be7-9ad7-800723365b8e/Opinion%20on%20the%20implementation%20of%20the%20RTS%20on%20SCA%20and%20CSC%20%28EBA-2018-Op-04%29.pdf) 

## Strong Customer Authentication with Auth0 by Okta

[Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity) (HRI) is a solution suite on the Customer Identity Cloud powered by Auth0 that delivers Financial Grade Identity™ that helps organizations elevate security, privacy, and user experience beyond login. HRI enables developers to meet the high levels of security required by companies operating within highly regulated industries like banking, insurance, and health care. You can also use HRI for other sensitive operations that require enhanced security, such as users updating their account information, admin or security settings, accessing sensitive data or apps, and more.

Here, we look at how Highly Regulated Identity can be used to build a Strong Customer Authentication solution.

### Solution architecture

The diagram below describes a possible architecture and interactions for a Strong Customer Authentication solution built on Auth0 by Okta using HRI features.

![Strong Customer Authentication flow in Auth0 by Okta](https://images.ctfassets.net/23aumh6u8s0i/31xqfrkhJVa87fbeplvGpz/459e46a7bcb42fd79aafbf1576eebdb6/strong-customer-authentication-flow-in-auth0-by-okta.png)

Important points to note:

- The blue  components are Okta-owned and part of Auth0 and Highly Regulated Identity solution suite.
- The green  components are built and maintained by the customer, e.g., customer mobile apps, applications, and services. 

### Sequence of operations

1. The user has initiated a payment transaction via their web browser at a digital banking web application, e.g., they may be making a payment from their bank account.

2. The digital banking web application sends the transaction request to Auth0:

   a. The transaction request may contain the “authentication code” for the amount and payee as part of the transaction. 

   b. The request is sent to the `/par` endpoint and avoids exposing sensitive transaction details at the browser.

3. Auth0 validates the request and generates: 

   a. A `linking_id` when the Consent Policy is configured as “Transactional Authorization with MFA” and the API audience is configured with this Consent Policy.

   b. A `request_uri` as a reference to the next step in the authorization process.

4. Auth0 sends the request_uri back to the calling web application .

5. The web application redirects the browser with the `redirect_uri`, which opens the login page in Auth0:

   a. The user can perform the login with their knowledge-based factor (i.e. their password). 

   b. This login step can be avoided if there is already a single sign-on session. 

   c. The user will wait here on this “holding page” until the decoupled flow completes.

6. Meanwhile, a [post-login trigger](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#login-post-login) can run custom an Action code that extracts the authorization details (e.g., amount, payee, authentication code) from the transaction request.

   a. At this point, the Action code can integrate with third-party risk and fraud engines to determine whether a step-up authentication (i.e., SCA) is needed.

7. The Action writes the `linking_id` and contextual authorization details into a message store, i.e., a data store, for future retrieval.

8. Auth0 performs a lookup for the MFA mechanism to use; here, we will use a mobile push notification to a custom mobile app which embeds the Okta [Guardian SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian):

   a. Auth0 sends a mobile push notification to the mobile app, along with the `linking_id`.

   b. No transaction details are sent over the push notification.

9. The customer mobile app receives the push notification with the transaction `linking_id` and calls the message store to retrieve the transaction details for the user to authorize and consent to.

10. The customer mobile app extracts the authorization details for the requested transaction, i.e., payment amount and payee, and displays this to the user for consent.

    a. The user reviews the transaction details and proceeds to accept or decline.

11. The customer mobile app with embedded Guardian SDK calls the Okta MFA endpoint with the result of the user authorization:

    a. Was the MFA action completed successfully or not?

    b. If the MFA was completed successfully, did the user accept or decline?

12. Once the mobile push-based MFA completes, the web browser is redirected from Auth0 and the MFA page back to the digital banking web application:

    a. The digital banking web application receives an authorization code.

13. The digital banking web application exchanges the authorization code for an access token:

    a. The access token contains the details from the original transaction request, including the payment amount and payee and “authentication code”.

14. The digital banking application uses the access token to consume APIs in order to initiate the payment transaction in the appropriate back-end systems.

15. The user is informed of the outcome of the payment transaction.

### Supported authentication mechanisms

The solution architecture describes SCA using a mobile push notification to a customer's mobile app with embedded Guardian SDK. However, there are alternative options that are also compliant with SCA:

- Authentication by one-time passcode (OTP) sent via SMS.
- Authentication by WebAuthn.

For both of these authentication options, the user performs the authentication on the login page and then is shown the transaction details to authorize and consent to.

## Final Words

The Highly Regulated Identity solution suite on Auth0 delivers Strong Customer Authentication for financial services and payments. The SCA solution also applies to non-payment use cases and can be applied to any sensitive operation where step-up authentication, user authorization, and consent are required.

You can read more about [Highly Regulated Identity on the Auth0 by Okta documentation](https://auth0.com/docs/secure/highly-regulated-identity).


Strong Customer Authentication Explained

Shreya Gupta

Shreya is the Developer Advocate for Auth0 for Startups. She previously founded a non-profit called Bit Project, worked at a YC-backed Startup as a Developer Advocate, and currently hosts The Developer Diaries podcast. Through each experience, she has found her love for building resources and tools that help move the needle for developers. Outside of work, she enjoys traveling, watching K-Dramas, and drinking boba.

Developer Advocate, Startups

How to authenticate and manage your business users in a multi-tenant app with Organizations.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b>This tutorial uses the Auth0 Organizations feature, which is <a href="https://auth0.com/startups/vip"> available to early-stage startups </a>through our Auth0 for Startups program, free for one year.</b><br> 
</div>

## The Challenge

Developers on a tight schedule need to quickly implement a secure solution. You need to build a product with scalable infrastructure that can be iterated on weeks/months/years down the line. And you need to adhere to ever-changing industry standards and regulations.

<AmpContent>
<amp-youtube
    data-videoid="8s14Nhvgnb0"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/8s14Nhvgnb0' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Building B2B applications comes with many technical challenges, not least of which is how to set up [multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices). [Multi-tenancy](https://auth0.com/docs/get-started/auth0-overview/create-tenants/multi-tenant-apps-best-practices) is when a single instance of software runs on a server that is accessible to multiple groups of users – managing this across various business communities can be broken down into three different considerations:

* Customizing the login experience for each business, from branding to SSO options,
* Managing users for each business with restricted access based on specific permissions,
* And giving businesses the ability to manage their own members.

## The Solution

Auth0 Organizations is our solution to multi-tenancy from an auth perspective – it’s a feature for developers to manage business users. **Simply put, each business is an Organization. Each Organization has members. Each member can have roles that define their permissions.**

When users log into your application, how they log in depends on the requirements defined by each business. For example, let’s say you have three customers with varying needs:

* Organization A is a small business, so they’re comfortable with letting their members log in with Google or another preferred[ Social identity provider (IdP)](https://marketplace.auth0.com/features/social-connections);
* Organization B is a larger corporation, so they’re expecting to leverage not only[ Enterprise IdPs](https://marketplace.auth0.com/features/enterprise-connections) but also multi-factor authentication (MFA) as an additional layer of security;
* Organization C is a brand new startup with only one employee – the founder – and all they want is a seamless experience.

The typical app user needs to be able to log in to the app and do some basic tasks. All of your business customers also want to distinguish a role for Admins who have additional permissions, like sending invites to cool new members or kicking problematic members out.

![Your App](https://images.ctfassets.net/23aumh6u8s0i/4y486Q5HiJbXmlVq5k71pc/57ab4fbab5c49c769a442b8e781d624e/shreyapost.jpg)

## The Process

Let’s explore what a potential solution with Organizations would look like. (Check out the video for a visual walkthrough.)

### Get Started

1. Open your [Auth0 Dashboard](https://manage.auth0.com/dashboard)
2. Select your Application (left menu) and [configure it for business users](https://auth0.com/docs/manage-users/organizations/configure-organizations/define-organization-behavior)
3. [Create Organizations](https://auth0.com/docs/manage-users/organizations/configure-organizations/create-organizations) for each business customer
4. Enable Social and Enterprise [Connections](https://auth0.com/docs/manage-users/organizations/configure-organizations/enable-connections) and [MFA](https://auth0.com/docs/secure/multi-factor-authentication/enable-mfa)
5. [Create roles](https://auth0.com/docs/manage-users/access-control/rbac), [invite members](https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members) and [assign roles](https://auth0.com/docs/manage-users/organizations/configure-organizations/add-member-roles)

### Get Technical

Integrate this login experience into your React app (or [explore other SDKs](https://auth0.com/docs/libraries)). Follow the[ React SDK quickstart](https://auth0.com/docs/quickstart/spa/react/interactive) for detailed instructions.


1. Install the Auth0 React SDK

```
cd <your-project-directory>
npm install @auth0/auth0-react
```

2. Configure the Auth0 provider component

```js
import React from 'react';
import { createRoot } from 'react-dom/client';
import { Auth0Provider } from '@auth0/auth0-react';
import App from './App';

const root = createRoot(document.getElementById('root'));

root.render(
<Auth0Provider
    domain="{yourDomain}"
    clientId="{yourClientId}"
    authorizationParams={{
      redirect_uri: window.location.origin
    }}
  >
    <App />
  </Auth0Provider>,
);

```

3. Add login to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LoginButton = () => {
  const { loginWithRedirect } = useAuth0();

  return <button onClick={() => loginWithRedirect()}>Log In</button>;
};

export default LoginButton;
```

4. Add logout to your Application

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const LogoutButton = () => {
  const { logout } = useAuth0();

  return (
    <button onClick={() => logout({ logoutParams: { returnTo: window.location.origin } })}>
      Log Out
    </button>
  );
};

export default LogoutButton;
```

5. Show user profile information

```js
import { useAuth0 } from "@auth0/auth0-react";
import React from "react";

const Profile = () => {
  const { user, isAuthenticated, isLoading } = useAuth0();

  if (isLoading) {
    return <div>Loading ...</div>;
  }

  return (
    isAuthenticated && (
      <div>
        <img src={user.picture} alt={user.name} />
        <h2>{user.name}</h2>
        <p>{user.email}</p>
      </div>
    )
  );
};

export default Profile;
```

6. If you need to retrieve the organization the user belongs to, you can use the property [`org_id` in the user object](https://auth0.com/docs/manage-users/organizations/using-tokens), for example you can add the following line of code:

```
<p>{user.org_id}</p>
```

### Go Beyond

Eventually, you may want to do more. You could:

1. [Require multi-factor authentication for users outside their corporate network](https://auth0.com/docs/customize/actions/flows-and-triggers/login-flow#enforce-custom-mfa-policy) to increase security,
2. [Assign default roles to users on sign-up](https://auth0.com/blog/assign-default-role-on-sign-up-with-actions/) or at another point in the identity flow,
3. And allow customers to self-manage their Organizations using an [admin portal](https://auth0.com/docs/get-started/architecture-scenarios/business-to-business/profile-management#admin-portal).

## The Next Step

Multi-tenancy is a common feature requirement for most B2B apps, but you shouldn’t have to spend all your time on building it. This is just the tip of the iceberg for what you can accomplish using Organizations. [Try it yourself for free](https://auth0.com/signup?utm_source=blog&utm_medium=auth0&utm_campaign=b2bsaas), and [let us know if you have any questions](https://community.auth0.com/)!

Are you an early-stage startup? [Apply now](https://auth0.com/startups/vip) to the Auth0 for Startups program, which is **free for one year** and supports 100 Organizations in prod (and much more).

## More Resources

* Get started with our [React quickstart](https://auth0.com/docs/quickstart/spa/react/interactive)
* Dive deep into the [Organizations docs](https://auth0.com/docs/manage-users/organizations)
* Read about [Solving Digital Identity Management for Your SaaS Application](https://auth0.com/blog/digital-identity-management/)
* Learn more about [Auth0 for Startups](https://auth0.com/startups)
* Ask questions in our [Community forum](https://community.auth0.com/)
* Don't have an app? Check out our [sample B2B app](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter/)

[Open a ticket](https://support.auth0.com/tickets/new) for technical support (available for customers in the Startup plan or other paid plans)


Build a Secure and Scalable B2B SaaS App in React

Your identity platform is critical to growing and scaling your SaaS application. Accelerate business growth and keep your users secured with Auth0 by Okta

For today’s SaaS builders, the pressure to rapidly innovate and seamlessly scale can be intense.

Evolving macroeconomic pressures mean companies building SaaS applications need to do more with less. And every B2C innovation amps SaaS customer expectations. AI has further transformed the competitive landscape, presenting both an opportunity for product differentiation and a threat. [There’s just more that attackers can do now](https://www.securitymagazine.com/articles/99832-study-finds-increase-in-cybersecurity-attacks-fueled-by-generative-ai) — and they can do it faster. 

SaaS companies also need to do more — and they need to see speed and security gains just so customers can keep up with the rate of change. And honestly, they need to deliver more than what’s expected in order to stay relevant in this fast-paced society. 

Since SaaS is in this ever-evolving space, companies must keep up at the business level to stay ahead of their competition. In turn, developers must continuously learn new back-end methods to keep up with the new SaaS technologies.

Let us show you how Auth0 by Okta keeps up and makes your life easier.

## How Auth0 by Okta can help your SaaS

Robust identity management is crucial for ensuring seamless user experiences, maintaining data security, and complying with regulatory requirements. Auth0, the leading identity and access management (IDaaS) platform, stands out as the ideal solution for SaaS applications due to its comprehensive features, ease of use, and robust security measures.

Auth0 simplifies the authentication and authorization process for SaaS applications, enabling developers to focus on building core functionalities rather than building their own identity solutions and managing identity infrastructure.

[Universal Login](https://auth0.com/features/universal-login) provides a centralized and unified login experience for users across all your applications, supporting a wide range of authentication flows, devices, and screen sizes. Universal Login enhances user experience and simplifies the integration process for developers. With Universal Login, users can sign in using [passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) or use their existing credentials from social media platforms, enterprise directories, or email addresses, eliminating the need to create separate accounts for each application.

In addition to Universal Login, Auth0 provides a comprehensive set of SDKs for various programming languages and frameworks, making it easy for developers to integrate Auth0 into their applications. These SDKs handle everyday authentication tasks, such as login forms and password resets, ensuring consistent and secure user experiences across applications. For more customized scenarios, Auth0's powerful APIs provide granular control over authentication and authorization flows, allowing developers to tailor them to specific requirements and integrate seamlessly with third-party services.

**Here are some specific benefits of using Auth0 for SaaS applications:**

* **Streamlined user onboarding**: Universal Login eliminates the need for users to create separate accounts for each application, making it easier for them to get started.
* **Improved user experience**: A seamless and consistent login experience across all applications enhances user satisfaction and reduces friction.
* **Customizability**: The Universal Login page can be customized to match your brand and needs. At the same time, [Auth0 Actions](https://auth0.com/features/actions) enable developers to extend Auth0 beyond its core functionality and incorporate custom logic such as integrations with APIs (CRMs, billing, email automation, marketing tools, etc) or write custom policies into the authentication and authorization flows.
* **Reduced development time**: Developers can save time and effort using pre-built Universal Login components and SDKs, simplifying the integration process.
* **Global or regional scalability**: Auth0's public and private cloud-based infrastructure scale seamlessly to accommodate user demand internationally and fluctuating traffic spikes.
* **Security Center and Log Streaming**: Auth0 provides robust security features to protect your SaaS application users and your business. With Attack protection features such as bot detection and breached password detection, you can offer comprehensive protection against credential-stuffing attacks. You can also offer streamlined security and follow compliance with MFA and RBAC. In addition, you can monitor your applications and detect identity-driven attacks with Security Center and integrate activity logs with your security toolkit with Log Streaming.
* **Expanded support for various platforms**: Universal Login and SDKs are available for various programming languages and frameworks, enabling developers to build secure and scalable SaaS applications across various platforms.
* **Future-Proof Features**: Auth0 continuously invests in innovation, incorporating the latest security and authentication technologies. By integrating with Auth0, SaaS applications can leverage these future-proof features, ensuring they remain secure and compliant with evolving industry standards.

## B2B Ready with Auth0 Organizations

For some SaaS applications, the B2B aspect is baked into the core design, with a clear understanding of the requirements for managing users from different organizations. However, for many SaaS applications, the need to support B2B scenarios may arise as a requirement that needs quick implementation. This can add complexity to development and require significant effort to integrate and maintain separate identity management systems for each organization.

Auth0 addresses this challenge with [Auth0 Organizations](https://auth0.com/organizations) by providing a unified platform for managing B2B relationships, enabling SaaS applications to efficiently onboard, manage, and secure user identities across multiple organizations.

Auth0 customers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership.
* Allow your business customers to securely manage and customize how their end-users access apps, with the ability to add as many organizations as they need to their Customer Identity Cloud (Private Cloud) tenant.
* Configure branded, federated login flows for each business.
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations.
* Supports your multi-tenant product out-of-the-box, conveniently serving from a single Customer Identity Cloud tenant.

![Organizations](https://images.ctfassets.net/23aumh6u8s0i/kZUAmaE3qFsxXaeTwxeOb/3dbe661afe612b1596fe4e990803d248/saas01.png)

## Enterprise Ready

In the realm of enterprise-grade SaaS applications, the need for comprehensive identity management extends far beyond traditional user authentication. Enterprises demand a robust solution that seamlessly integrates with existing IT infrastructure, manages complex access policies, and complies with stringent security standards.

Auth0 enables SaaS applications to connect seamlessly with enterprise systems without building custom integrations, eliminating the need for developers to maintain multiple integrations and reducing development time and effort by providing:

* **Seamless Integration with Enterprise Identity Systems**: Auth0 Organizations seamlessly integrate with existing [enterprise identity providers](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers), such as Active Directory, LDAP, and SAML IdPs.
* **Single Sign-On (SSO) for Enterprise Applications**: Auth0 Organizations supports SSO for enterprise applications, enabling employees to sign in to multiple applications using a single set of credentials. This streamlines the user experience and improves productivity.
* **Activity Auditing for Enterprise Compliance**: Auth0 provides detailed activity auditing for enterprise compliance, allowing organizations to track user activity and access patterns. This auditing functionality helps to identify suspicious activity, investigate potential security breaches, and ensure compliance with regulatory requirements.

## Built-in Security

With built-in security features and continuous innovation, Auth0 provides developers with the tools and expertise to build secure SaaS applications that safeguard user identities, sensitive data, and applications from a wide range of threats. Auth0's security features are not only beneficial to developers; they are also a key selling point for SaaS providers who want to ensure their customer’s data and applications are safe and secure.

Here are some of the built-in security features of the Auth0 platform:

### Attack Protection

Auth0's attack protection features can detect and stop malicious attempts to access your application by blocking traffic from specific IPs, displaying CAPTCHAs, and more.

Auth0 offers the following attack protection options:

* **[Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)**: Bots, automated programs often employed by malicious actors performing credential-stuffing attacks, pose a significant threat to online applications and services. Auth0's bot detection capabilities utilize sophisticated techniques to identify and block these bots, preventing them from accessing your applications and disrupting user experiences.
* **[Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)**: Blocks traffic from any IP address that rapidly attempts too many logins or signups. This helps protect your applications from high-velocity attacks that target multiple accounts.
* **[Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)**: Brute force attacks involve repeatedly attempting to guess user login credentials, often automated through scripts or botnets. To combat these attacks, Auth0's brute force protection feature limits the number of failed login attempts from a single IP address. Once a threshold of failed attempts is reached, the IP address is temporarily blocked, preventing further attempts and mitigating the risk of successful brute-force attacks.
* **[Breached Password Detection](https://auth0.com/docs/secure/attack-protection/breached-password-detection)**: Auth0 tracks large security breaches that occur on major third-party sites. If Auth0 identifies that any of your users’ credentials were part of a breach, the breached password detection security feature triggers keeping your accounts safe.

![attack protection](https://images.ctfassets.net/23aumh6u8s0i/6T8KTzpEpJ0YrNMX7qDIMM/a93051c4295c9fd66acbb752fcbdaa08/saas02.png)

Auth0's attack protection features are based on industry-standard security protocols, and they can help you protect your applications from a wide range of attack vectors. To implement Auth0's attack protection features, you can integrate Auth0 into your application. Once integrated, Auth0 will automatically protect your application from attacks.

## Extensibility

Auth0 goes beyond providing a robust authentication and authorization platform; it also offers a wide range of extensibility capabilities, enabling developers to tailor the platform to their specific application requirements and integrate it with their existing infrastructure.

### Auth0 Actions

[Auth0 Actions](https://auth0.com/features/actions) is a powerful extension mechanism that empowers developers to modify Auth0's authentication and authorization flows. These JavaScript functions can be executed at various points in the authentication process, allowing developers to:

* **Modify access tokens with custom claims**: Add, update, or remove custom claims to access tokens, enabling granular control over user permissions and data sharing.
* **Integrate with external services**: Connect to external services like CRM systems, customer data platforms, and payment gateways to enrich user profiles and facilitate seamless user journeys.
* **Enhance user experiences**: Personalize the login and registration experience, customize error messages, and provide user context-aware support.
* **Implement custom logic**: Add custom logic to handle specific scenarios, such as verifying two-factor authentication codes or managing user roles.

You can write your own custom Auth0 Actions writing JavaScript code or browse and install any Action from a curated collection at the [Auth0 Marketplace](https://marketplace.auth0.com/). In the marketplace, you can find Actions providing a wide range of functionalities, such as:

* **Social login integrations**: Connect with popular social networks like Facebook, Google, and LinkedIn to facilitate user authentication and signup.
* **Identity Proofing**: Identity proofing allows you to verify a user's real-world identity based on life history (a credit report), biometrics (a facial scan), and other factors before granting access.
* **Compliance and security solutions**: Implement compliance solutions like fraud detection and data privacy controls.

And much more...

## Get Started with Our SaaS Starter Kit

Embarking on developing a SaaS application can be an exciting yet challenging endeavor. To simplify the process and accelerate time to market, Auth0 offers a [SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) that provides a jumpstart for building secure and scalable SaaS applications.

The SaaS Starter Kit is a guide and boilerplate you can use to build a Next.js SaaS application tailored for the following use cases:

* SaaS Multi-tenancy with Auth0 Organizations in a single Auth0 tenant.
* A tiered pricing model using Auth0 Actions and User Profile[ App Metadata](https://auth0.com/docs/manage-users/user-accounts/metadata#metadata-types).
    * Support Trial, Personal, Teams, and Enterprise plans in a SaaS application.
* Trial plan expiration and user conversion using Auth0 Actions.
    * Use Actions to update user profile data, enrich an ID or Access Token with custom claims, or call 3rd-party APIs, such as the Stripe API, to manage user subscription status.
* Self-service SSO for business users using the Auth0 Management API and Enterprise connections with support for OIDC connections.
* Self-service User Management using the Auth0 Management API.

With the [Auth0 SaaS Starter Kit](https://developer.auth0.com/resources/guides/web-app/nextjs/saas-basic-authentication) as your foundation, you can build secure, scalable, and feature-rich SaaS applications that provide a seamless user experience while adhering to industry best practices for authentication and authorization.

## The Customer Identity Platform for Startups

[Auth0 for Startups](https://auth0.com/startups) is a program that provides the convenience and security of Auth0 by Okta to eligible startup customers FREE for a year, so you can get your SaaS application up and running quickly while keeping your users’ data secure.

Some of the benefits of the program are:

* Up to 100k Monthly Active Users
* Up to 5 Enterprise Connections
* All the B2B features you need to scale your business

> Learn more and apply for the program in[ the customer identity platform for startups](https://auth0.com/startups).

Solving Digital Identity Management for Your SaaS Application

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager - Developer Experience & Analytics

Introducing updated self-service plans and pricing that scale with your company

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>UPDATE:</strong><br> 
  This information was modified on December 11th, 2023. The new plans and feature offerings are now universally available for everyone.<br> 
</div>

We're excited to share with you our updated and revamped plan offerings for Auth0, which powers Okta Customer Identity Cloud.

Effective November 1st, 2023 we launched changes to our plan offerings and pricing structure. Changes listed below:

* **Our free plan now supports up to 7,500 MAUs vs the previous 7,000.**
    * More than 65,000 active tenants enjoy this plan today.
    * Our always-free plan continues to offer social login, DB connection for securely storing identity information, branded login, extensibility and security capabilities (brute force and suspicious IP throttling), and support for 5 regions (US, UK, EU, JP, AUS). 
    * We also recently added [passkeys support](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) to the free plan.
* Our pricing structure has been updated to more predictably scale as you grow:
    * B2C Essentials pricing now starts at $35/Mo for 500 Monthly Active Users (MAUs)
    * B2B Essentials pricing now starts at $150/Mo for 500 MAUs
    * You can now purchase 20,000 MAUs on B2C Essentials with your credit card.
* [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard), a new feature that aggregates usage across all tenants for seamless oversight that includes updated tenant limits with the ability to consolidate tenants.
* The below capabilities that can be added to your plan through our “[Let’s Chat](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales)” form. You will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024:
    * New multi-factor authentication (MFA) add-ons, expanding access to MFA capabilities that were previously only available to enterprise customers.
    * Increased enterprise connection limits on the B2B Professional Plan.
    * We have increased our maximum MAU tier limit on our self-service plans.

> It’s important to note that we are not making changes to any existing plans as a result of this update. However, if you make changes to your subscription, the new plan and pricing structure will be applied.

## Pricing & Payment Updates

We last updated our Essentials and Professional plan pricing in May of 2021. With the above changes the following pricing updates became effective on November 1st, 2023. **Keep in mind, this only applies to new sign ups and any subscription changes.**

* B2C Essentials pricing will now start at $35/Mo for 500 MAU, up from $23/mo for 1,000 MAU. 
* B2B Essentials prices will now start at $150/Mo up from $130/Mo for 500 MAU
* B2C Professional prices will stay the same, starting at $240/Mo for 1,000 MAU
* B2B Professional will now only be available by invoice, via our sales team, rather than credit card. 

The price adjustment on B2C Essentials creates increased transparency and price predictability as your MAUs scale on our platform, reducing the risk of customers who grow from B2C Essentials into higher plans being shocked by a price change. While the scaling rate of B2C Essentials is increasing, we’re committed to enabling customers to stay on their chosen plan for longer by making it possible to remain on a self-service plan when surpassing the previous MAU limit of 10,000.

In addition to the above plans, check out the [Auth0 for Startups program](https://auth0.com/startups), our [Auth0 for Non-Profits](https://auth0.com/nonprofits) offers, as well as our always-free plan.

### Payment options

With the above changes, we are committed and will continue to support customers that want to pay us monthly through their credit cards on plan tiers that previously supported this functionality. We will now also allow customers with a yearly spend over $10,000 to contact our sales team to purchase an annual contract paid via invoice. 

Keep in mind, any new tenants created will be subject to the new pricing structure outlined above.

![Payment options](https://images.ctfassets.net/23aumh6u8s0i/7trs7tiGY0Ea5rQ2GmU0D3/952fb21eac9f2306c58d1a3e1bb4a14a/pricing-02.jpg)

`*` Can only be purchased by contacting our Sales team directly or via the ["Contact Sales"](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) form. Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.<br> 
`**` Previously, each tenant was a separate subscription, so only one tenant of any type was allowed per plan.

## Introducing Auth0 Teams:

We understand at times it’s difficult to manage resource access, keep track of and juggle multiple tenants. Auth0 Teams aggregates usage across all tenants for seamless oversight. The addition of this feature will enable the management of administrators and multiple tenants from a single, centralized location.

### Increased tenant limits

Tenant limits are being increased as part of this update.

These new limits will be displayed on both our [pricing page](https://auth0.com/pricing) and in your tenant’s [subscription settings](https://manage.auth0.com/#/tenant/billing/subscription). 

![Increased tenant limits](https://images.ctfassets.net/23aumh6u8s0i/6c62XnCJPnWmP72v55PIlY/f33f1ad5bf8c52375a25c92f74bd73db/pricing-01.jpg)

**With the launch of Auth0 Teams, you can now link existing tenants together under one account. It’s important to note that:**

* The owner of a team and/or the admin on the tenant are the only individuals that can group tenants.
* Tenants cannot be unlinked without the assistance of Auth0 Customer Support. If you linked a tenant and need to unlink it, please contact Support by submitting a ticket in the [Auth0 Support Center.](https://support.auth0.com/)

> Keep in mind, if you choose to stay on your current plan, you will be allowed a single tenant.

### How is this different than current Auth0 offerings?

As a part of this pricing change, customers will have the opportunity to link multiple tenants to the same subscription. Usage will be aggregated across tenants and will be billed at the subscription level. This allows customers with development and staging tenants to have access to the same features within said tenants, without having to purchase additional subscriptions. Along with these changes, we’re also introducing official tenant limits that align with the positioning of our various offerings. 

### Steps on how to migrate to Auth0 Teams

Information about this process can be [found here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams). If you want to migrate to Auth0 Teams, you must upgrade your plan in your tenant’s[ subscription settings](https://manage.auth0.com/#/tenant/billing/subscription) to have Teams automatically enabled for you.

## Additional Feature Offerings:

### Enterprise MFA Add-ons:

Multi-factor authentication ([MFA](https://auth0.com/docs/secure/multi-factor-authentication)) can block 99.9% of account hacking attacks. So, without being too obvious, implementing MFA within your Identity solution is pretty important. It’s imperative to prevent credential based attacks, and we want to make this easier for our customers to have access to this security feature. And so we’re introducing** Enterprise MFA Lite.**

Auth0 now allows you to use additional MFA capabilities that were previously only available to enterprise customers. Enterprise MFA Lite allows you to add any MFA factor to [Professional Plans](https://auth0.com/pricing) for an additional fee. This includes the support of [SMS](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) and push & voice notifications (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. However, this enhancement will give broader access to additional MFA protocols to support a wider range of use cases. 

### Enterprise Connection Limits:

**[Enterprise Connection](https://auth0.com/docs/authenticate/enterprise-connections)** limits are increasing from three connections to five connections on the B2B Professional Plan. This will allow for more of our SaaS customers to scale better. As a reminder, there is no limit on Okta Enterprise Connections for customers on all of our B2B plans. 

### Monthly Active Users (MAU) Tiers:

We are introducing [Essential](https://auth0.com/pricing) and [Professional](https://auth0.com/pricing) MAU tiers above the previous 7,000 and 10,000 MAU limits on B2B and B2C Plans, respectively. This change will allow you to better evaluate cost as you anticipate scaling on the Auth0 platform. 

Again, if you would like to take advantage of these options, please contact our team by completing this [form](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales). Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.

If you have further questions, please reach out to the [Auth0 Community](https://community.auth0.com/) (free plans) or submit a ticket in the[ Auth0 Support Center](https://support.auth0.com/) (paid plans).

## FAQs

* **Will the free plan still be available after November 1st, 2023?**
    * Yes, the free plan will continue to be available.
* **What’s the benefit of grouping tenants?**
    * All of your tenants can be managed in one place.
    * Entitlements, usage, etc. will be viewed together.
    * Increased security.
* **What is an Auth0 Team?**
    * Provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale. More information about Auth0 Teams can be found [here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard). 
* **What if my tenants are already grouped?**
    * Nothing changes unless you make changes to your subscription.
    * If you make changes to your current plan, you will need to regroup your tenants since the plan structure differs.
* **What if I have multiple plans?**
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).
* **What if my company is a development agency (dev shop)?**
    * Contact [Support](https://support.auth0.com/) to request an exemption. 
* **Can I stay on my current plan?**
    * Yes, assuming you are using one tenant and are within your usage limits you can stay on your current plan.
    * We will provide you with at least 90-days notice if we decide to move existing customers that are within their usage limits to the new plan structure.
* **Where can I find the new Terms of Service?**
    * Our updated Terms of Service can be found [here.](https://www.okta.com/auth0-pss-self-service/)
* **I’m on an enterprise plan and I have a self service tenant(s) as well. Do I have to move those to my enterprise plan?**
    * Yes, and it will be more beneficial for you to manage all tenants under a single account that has enterprise capabilities.
* **Can I pay by invoice now rather than credit card?**
    * Yes, for plans above $10,000/year you can sign a contract and pay by invoice rather than by credit card. To take advantage of this, please [contact us](https://auth0.com/contact-us).
* **What happens if I have more than 7 admins?**
    * New plans released on November 1st will only get up to 7 admins.
* **Can I get more than 10K MAUs on a self service plan?**
    * Yes, we now include MAU tiers beyond 10K MAU
* **Which MFA factors can be used with the Enterprise MFA add-on on professional plans?**

* **✅ Included**
    * SMS Notifications
    * Push Notifications
    * Voice Notifications
* **❌ Not Included**
    * WebAuthn with security keys
    * WebAuthn with device biometrics
    * Email Notifications

Pricing Changes for Auth0

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Okta FGA achieves unprecedented scalability, paving the way for global authorization systems.

We believe that [Okta Fine Grained Authorization](https://fga.dev) (FGA) will fundamentally change how applications are going to be built over the next decade. At Okta, we aim to solve authorization for both application builders and workforce IT administrators, and FGA is a key piece of that strategy.

Scalability is crucial when designing a global-scale authorization system. It must be capable of delivering the performance and capacity expected from top-tier cloud services, like modern distributed databases. An authorization system capable of supporting a global scale must:

- Be highly available,
- Scale to support the most visited websites in the world,
- Provide low latency, as every millisecond you spend in authorization will impact the application’s overall latency,
- Be able to store a very large amount of data.

This [Google Zanzibar](https://research.google/pubs/pub48190/) paper describes how Google achieves those goals. We built FGA with these goals in mind, and our early tests of the Okta FGA validated that it could handle anything our beta and early access customers could throw at it.

As FGA gained traction among customers, we realized that we needed to push FGA even further to prove out this scale. 

So, we decided to run a test with **1 million Requests per Second (RPS)** and **100 billion relationship tuples** to evaluate how the system behaves. 

## Okta FGA Primer : Model + Relationship Tuples

When implementing authorization using Okta FGA, you need to define an authorization model that describes the different entities in your system that are relevant when making authorization decisions and provide the data required to instantiate the model in the form of relationship tuples.

For example, in the model below, we define groups that can contain users, documents that can have an owner, and viewers that can point to specific users or all members of a specific group:

```yaml
type user
type group
  relations
   define member : [user]

type document
 relations

   define owner : [user]
   define viewer : [user, group#member]
```

Relationship tuples would look like:

| user                   | relation | object              |
| ---------------------- | -------- | ------------------- |
| user:anne              | member   | group:marketing     |
| user:peter             | owner    | document:sales-plan |
| group:marketing#member | viewer   | document:sales-plan |

FGA defines an API method called `Check()` that will let you ask the system if a user is related to an object in a specific way. 

For example, we can call `Check(user:anne, viewer, document:sales-plan)` and we’ll get `“{ allowed: true }”` as a result, given `anne` is a member of the `marketing` group, and their members are related to the `sales-plan` document as viewers.

If you want to learn more, check out how to model with Okta FGA [here](https://docs.fga.dev/modeling).

## Modeling Authorization

When using FGA, the performance characteristics of a specific implementation will depend on the authorization model and relationship tuples in the system. 

The flexibility of FGA means that customers with varying use cases, traffic, and business models are able to harness the full power of FGA. In initial implementations, we’ve seen that customers with a Business-to-Business (B2B) use case tend to have more complex models but with far fewer active users and less traffic. And we’ve seen that customers with a Business-to-Consumer (B2C) use case tend to have less complex requirements but with more data, active users, and traffic. We decided to target these B2C use cases for our performance testing since these are the businesses that are more likely to require a scale of 1 million RPS and 100 billion tuples.

We modeled a social network where users can post content and other users can interact with it. One example of this would be publishing a tweet and commenting on it. The model is described below:

```yaml
type user
  relations
  # Users can have followers, can block specific users, 
  # and can decide if they are visible to all users or just to their followers
  define _self: [user]
  define follower: [user]
  define blocked: [user]
  define visibility: [user:*, user#follower]
  define viewer: visibility but not blocked
  # User profiles can be viewed by the user itself or by the users who have access to their profile
  define can_view: _self or viewer

type content
  relations 
  # Content is owned by the user that published it
  define owner: [user]

  # The content can be visible for anyone or just their followers, for users that are not blocked, and by the owner itself
  define visibility: [user:*, user#follower]
  define viewer: visibility but not blocked from the owner
  define can_view: owner or viewer

type interaction
  relations
  # Content iterations (e.g., comments) have a creator and a content piece as their parent
  define creator: [user]
  define parent: [content]
  # interactions can be viewed if the user can view the creator's profile and the content itself or if they are the creator of the interaction
  define viewer: can_view from creator and can_view from parent
  define can_view: creator or viewer
```

After defining the model, we had to decide how to distribute the relationship tuples in the system. We decided to use a [Pareto distribution](https://en.wikipedia.org/wiki/Pareto_distribution) where:

- 20% of users are generating 80% of content, and 80% of users are generating 20% of content
- Similarly, 20% of users are doing 80% of the interaction, and 80% of users are doing 20% of the interaction

The tests focused on the `Check()` endpoint because this endpoint is the one that will be called more often and have the most impact on the customer's applications. We checked if a user is able to view specific content, a specific user profile, or a specific interaction (e.g., `Check(user:john, can_view, interaction:1)` ).

## Modeling User Activity

Another critical decision point on how to perform the test was how to model user activity.

FGA has a cache that is set to 10 seconds. If we decide that a very small set of users is going to be active, we’d be able to serve all the requests from the cache. That would make it very easy to misrepresent the test results, as serving everything from memory would only happen in very specific use cases and won’t take into consideration the execution paths that require database access. 

We decided to run the tests in three ways:

- Disabling the caches
- With a 50% cache ratio, which seems realistic based on what we observed as an average ratio across all of our customers.
- With a 75% cache ratio, assuming that for a specific customer, ratios can be higher.

## One Million RPS and Beyond

We were very happy with the results and achieved the outcome we hoped for with only minor tweaks to the product.

We allocated three weeks to complete it, and most of the time was spent on generating the dataset, importing them into the database, and making sure we could launch all the clients that called FGA API. 

We completed the test run in just two days without any significant adjustments in our code. 

The tests ran for over 10 minutes and got 1.05M RPS. The images below are from our DataDog dashboard when we ran the tests with 0% cache ratio:

![Request rate received in FGA performance test](https://images.ctfassets.net/23aumh6u8s0i/2aWUERQeZCzKOa7FZUHB3O/cbd911fbacf051c2683221b78e032ca2/fga-rps-performance.png)

![Latency in FGA performance test](https://images.ctfassets.net/23aumh6u8s0i/D14o99yPNCvvNpFlDMDk9/c11f56a116346ee36e0980b48157eed4/fga-latency-performance.png)

The metrics above show that 50% of the calls were completed in up to 11.9 ms, 95% were completed in less than 19.5 ms, and 99% of them were completed in less than 38.5 ms.

We incrementally increased the load while executing the test, and we saw the number of FGA instances increase linearly, maintaining the latency within the same range. We felt confident that we could go way beyond 1M RPS, but we had to stop somewhere 🙂.

When running the tests with caching, the latency decreased significantly, and the number of Okta FGA nodes running too:

<style>
  table {
    width: 100%;
    border-collapse: collapse;
    font-size: 15px;
  }
  table, td, th {
    border: 1px solid;
  }
  table th {
    background-color:#eeeee4;
  }
  td {
    padding: 5px;
    text-align: center;
  }
</style>

| Cache Ratio | RPS per Okta FGA Instance (ECS Fargate 16 vCPU 32GB) | P95 Latency |
| ----------- | ---------------------------------------------------- | ----------- |
| 0%          | 3,500                                                | 19.5 ms     |
| 50%         | 6,000                                                | 9.4 ms      |
| 75%         | 18,000                                               | 5 ms        |

## Okta FGA and You

We were thrilled to have tangible proof that FGA can support the global scale it was designed for. FGA provides a highly flexible, highly available, and scalable solution to implement authorization, supported by a company that is a trusted leader in the identity space.

You can try Okta FGA today by signing up for an evaluation account [here](https://fga.dev). If you want to use it in production, you can apply to our Limited Early Access Program by reaching out to your technical account manager or account executive. 

Getting Unlimited Scalability with Okta Fine Grained Authorization

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

Over the last 6 months, Okta has delivered capabilities designed with security, scalability, and resiliency in mind. Read about what we delivered and our future roadmap.

Our teams have been heads down and focused on delivering capabilities that empower our customers to continue to provide seamless customer experiences and power their SaaS ambitions. As we are now halfway through the calendar year, I wanted to reflect on the capabilities we have delivered and give you a glimpse of what's to come next. 

## Unveiling New and Improved Product Features

We strive for innovation and resiliency in our work since we know it translates into direct value for our customers. Over the past six months, our teams have worked across domains to deliver capabilities meticulously designed with security, scalability, and resiliency in mind.

### Flexibility Focus

We continue to double down on improving our customers' ability to build great user experiences within consumer apps. The team has persistently strived to provide a flexible way to build identity flows. In the past few months, we've launched a few enhancements to support this goal further.

* [Passwordless support on New Universal Login](https://auth0.com/docs/authenticate/passwordless/passwordless-with-new-universal-login) allows users to provide an email address or phone number and receive a one-time password (OTP) to complete authentication.
* [Additional email provider support](https://auth0.com/changelog#3yVUYwYINRo7edOw8tP7kG) (Azure Communication Service & Microsoft Modern Auth) enables customers to use Outlook on Microsoft 365 or the recently released Azure Communication Services as preferred authentication methods.

### SaaS Excellence

With a keen eye for enhancing user experiences and elevating customer satisfaction, we continue to make strides that redefine and advance SaaS excellence. To that end, the teams have released several new features:

* [PKCE and attribute mapping are available on OIDC and Okta Workforce Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc), allowing customers to build more secure connections between Auth0 and your connected identity provider. With attribute mapping, you can sync more attributes from your IDP into your Auth0 tenant.
* [Improved Login Flow for SaaS Users](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations) includes options for tying identifier first Home Realm Discovery to Connections with IdP domains associated with Organizations and a New Universal Login Prompt that displays when configured for end users with multiple organization memberships. 
* [Organization Name support for launching Login flows](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api), making Organizations easier to use by enabling the Organization Name to launch login flows via the Authentication API.

### Making Security Easy

At the core of everything we do is the desire to make security seamless and straightforward. Safeguarding data should be uncomplicated yet foolproof. Our latest releases offer protection and make it intuitive, empowering our customers and their users to navigate the digital world without compromise.

* [Security Center is now available on Converged Platform](https://auth0.com/docs/secure/security-center), a new security feature that provides real-time monitoring of potential security events.
* [Bot Detection Slider for Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection#use-bot-detection-slider) provides the ability to adjust the level of friction of the "When Risky" setting on our Bot Detection model.
* [Bot Detection is Now Integrated with Friendly Captcha and hCaptcha](https://auth0.com/docs/secure/attack-protection/bot-detection#configure-bot-detection), supporting additional Captcha Providers and their capabilities. 
* [Teams: Security Policies - SSO Enforcement Early Access](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), providing the option to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Developer Experience

Our Developer Experience teams built the following enhancements with intention, care, and a complete developer experience in mind. With streamlined workflows and a suite of tools, developers quickly translate their application experience vision into reality.

* [Node 18 is now available for Actions, Rules, and Hooks](https://auth0.com/changelog#2xzzvhZDXiRbThfc7XsfO). You can start using Node 18 in your tenants' settings and/or when creating new Actions in the Auth0 Manage Dashboard.
* [Auth0 Terraform Provider V1 - BETA](https://auth0.com/changelog#515sGCwZW2u6bD06rzS1uC), with the v1 release, managing your Auth0 resources using Terraform has never been easier. 
* [Auth0 Management API](https://auth0.com/docs/api/management/v2) launched, which includes numerous new features and enhancements for the UI experience.
* [Teams: Security Policies - SSO Enforcement](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), allowing you to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Customer Delight

We obsess over giving customers the complete capabilities to deliver a delightful customer experience. Every interaction and every touchpoint is an opportunity to elevate the customer journey. Our latest achievements stand as a testament to our dedication to not only meeting but exceeding the expectations that define customer delight.

* [Guardian App Localization](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian): The Guardian app is available as an authenticator to deliver push notifications to a user's pre-registered device (mobile phone or tablet) and supports English - US (en-us), French - Canada (fr-ca), French - France (fr), Portuguese - Brazil (pt-br), and Spanish - Argentina (es-ar).
* [Universal Login: New Language Support](https://auth0.com/docs/customize/internationalization-and-localization/universal-login-internationalization): Six new languages are now available as supported translations for Universal Login: Basque: eu-ES; Catalan: ca-ES; Galician: gl-ES; Norwegian: no; Norwegian Nynorsk: nn; and Welsh: cy.
* [Custom Domains in Guardian SDKs](https://auth0.com/changelog#7brExNHNLtHshVHvayBm6L), building your users' confidence that they are providing their credentials to the proper party. Custom Domains allow authentication to happen within the context of your brand.

The [Auth0 Changelog](https://auth0.com/changelog) has the full details and documentation on these updates and serves as the real-time release center. 

## Looking Forward to the Next Half

We've made good progress on delivering our roadmap and have steadily released capabilities that help our customers deliver seamless and secure experiences for their customers. 

A big thank you to all of our teams, and looking forward to penning another post full of releases in the next six months. 

[Oktane](https://www.okta.com/oktane/) is just around the corner, where we'll pull back the curtain on what's still to come! Registration is now open, and we hope to see you there.

Unveiling New and Improved Product Features — 6 Month Lookback

Calah Vargas

Calah Vargas is the Associate Manager of Product Led Growth, focusing on nonprofits, startups, and partnerships. She works on product marketing and customer marketing initiatives. Outside work, you can find her cooking, trying new restaurants, and traveling with friends and family.

Associate Manager, PLG

Customer Growth platform [Catalyst](https://catalyst.io/) helps their customers upsell and retain customers with precision. Their product includes tools that empower sales and success teams to analyze customer revenue, churn, and segmentation. Their [Customer-Led Growth](https://catalyst.io/customer-led-growth) (CLG) methodology enables revenue growth by focusing on current customers and embracing retention and expansion. 

<include src="QuoteCard" body="The best way to grow as a company is to take a look at the customers that you already have strong relationships with and expand on those..." name="Corey Finley" title="Engineering Manager" team="" company="Catalyst" />

In our sit-down with the team, [Corey Finley](https://www.linkedin.com/in/corey-finley-1403b165), Engineering Manager, shared more about how putting customer success (CS) at the center of an organization has been important to Catalyst, rather than looking at it as just the handoff in the post-sales cycle. He continued explaining that CS should play a central role in organizations in determining where product direction should go and by giving in-depth feedback on what customers are experiencing. “There’s a missed opportunity if you’re not focusing on the customers you already have.”

## Securing Future Growth Opportunities with Auth0 

Before Auth0, Catalyst had only one login method; utilizing OmniAuth to internally build a Google OAuth connection. As their prospect base grew and they targeted more enterprise-level companies, they encountered some that were not on Google Workspace and could not utilize Google OAuth. Authentication became a blocker in these conversations, and the team needed to take action.

With these new requirements and the need for additional login methods, Corey was tasked with finding a solution that wasn’t resource heavy and that would provide a wide range of options. He found that Auth0 could plug into the library they were already using, acting like a single provider while servicing many providers. 

> “If we could get this tool that will not only fix the Azure login problem but also leave the door open for future [SAML](https://auth0.com/docs/authenticate/protocols/saml/saml-configuration) implementations, then that would be perfect.”

> Corey will be providing more insight into Catalyst’s story and their implementation at [Developer Days 2023](https://developerday.com/), and we hope you’ll join us! Presented in-person and online on May 16, 2023, this event is free to attend. Please register [here](https://developerday.com/register). 

![Why Auth0?](https://images.ctfassets.net/23aumh6u8s0i/NbdrqE1lwkcJYIXb40vlz/72900ad7ccf2ddc065153edbcea03069/Catalyst_Checklist_-1.png)

## Join Catalyst and the Other 1700+ Startups That Benefit from Auth0

The [Auth0 for Startups](https://auth0.com/startups/profiles) program brings the simplicity, extensibility, and scalability of Auth0 to qualifying startups – **all free for one year**. We are passionate about helping startups get their applications up and running while we take care of identity needs. So much so that we recently [expanded our eligibility](https://auth0.com/blog/auth0-for-startups-expands-eligibility/) by increasing the funding limit to $5M, doubling our previous cap. If you have any questions, you can find us at [startups@auth0.com](mailto:startups@auth0.com) or apply [here](https://autheco.atlassian.net/servicedesk/customer/portal/4/group/9/create/101). 

A special thank you to Corey and the entire Catalyst team. If your organization wants to fine-tune your CLG strategy, schedule a demo [today](https://catalyst.io/lp/request-demo). P.S. Enjoy some excellent [CS memes](https://www.csmemes.io/) curated by the Catalyst team. 

_This profile is the third installment in our series highlighting members of the Auth0 for Startups program. The Auth0 for Startups program began in 2020 and has since worked with 1700+ startups._

Startup Stories: Catalyst

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

When it comes to SaaS applications, performance matters. Private Cloud SaaS helps you scale the performance of your growing SasS applications.

Performance matters. You know this, of course. Every second of additional latency translates into [lower conversions and tougher customer retention](https://businessmondays.co.uk/tackling-cart-abandonment-with-improved-login-experiences/). It's why you agonize over every individual detail, why your cloud infrastructure vibrates with the well-oiled efficiency of a Formula One engine.

As your business scales, staying fast becomes much harder. Essential SaaS (software-as-a-service) components that worked well when you were a smaller company now struggle to contend with your higher traffic volumes. 

Fortunately, there's an alternative. Private cloud SaaS offers the flexibility of a self-hosted application with none of the downsides. And, for performance-sensitive applications, it offers the boost necessary to deliver an incredible, slick user experience. 


## The Need for Speed 

Virtually every company and public sector organization uses SaaS in some form. Why? It's often the most practical and affordable option. Hiring and training someone to operate and provision a system takes time, money, and resources. With SaaS, the vendor handles long-term maintenance and upgrades. As most use a subscription model, there are no major upfront costs.

Most SaaS applications, by design, are multi-tenant environments. Multiple customers — whether individuals or organizations — share the same computational resources. This model is cheaper but has several trade-offs. Customers have little choice in where the application is deployed. They lose control. They can't make the subtle tweaks that ultimately result in faster, more responsive applications. 

Private cloud SaaS applications are different. They combine the benefits of a SaaS app (low costs, low maintenance, faster time-to-market) with the flexibility and autonomy of a self-hosted application. Customers can choose where, how, and with whom to deploy their application. They are the sole tenants, and they set the rules.

This control helps organizations comply with the ever-increasing number of data residency laws worldwide. But it can also deliver meaningful performance benefits, resulting in more responsive applications and better user experience outcomes.


## Reducing Latency One Millisecond at a Time

Have you ever wondered why Google only shows you ten results for each page? It seems counterintuitive, doesn't it? Google is a search engine. Its job is to show you relevant results for your queries. More is better, surely?

Not necessarily. In 2006, Marissa Mayer, then the company's Vice President of Search, [shared the results of an internal experiment](http://glinden.blogspot.com/2006/11/marissa-mayer-at-web-20.html) at the Web 2.0 Conference. Google asked a select group of users if they wanted to see more results with their queries. Most said yes. 

In response, Google provided random users (not just those in the focus group) with 30 results per page — triple the normal amount. 

What happened next? Frustration. Load times more than doubled for those in the test cohort, soaring from 0.4 seconds to 0.9 seconds. That 0.5-second delay had a measurable effect on user activity and satisfaction. Traffic and revenue from the test group dropped 20%. As Mayer said at the time: "Users really respond to speed." 

How does this relate to private cloud SaaS? Well, there are limits to how far you can optimize an application for speed with efficient coding and generous resourcing alone. 

If your primary application is located in Amsterdam but relies upon a component hosted in Los Angeles, you'll find a measurable delay as packets make their long journey through a network of submarine cables. You add 135ms to your load times – give or take 10ms.

You can't speed this process up. You are constrained by the speed of light. That's fast, but when you are trying to deliver an incredible experience to your customers, it feels like an eternity. 

You have only one solution: bring that component physically closer to your core application. 

The private cloud SaaS model lets you deploy resources in the same continent, country, and even data center. By eliminating performance bottlenecks in your product, your customers will benefit from a faster, more responsive experience. 


## How Private Cloud SaaS Can Help You Scale 

As your business grows, you may feel constrained by the limitations of multi-tenant, public cloud SaaS applications. Many vendors limit the number of requests that can be made per second (RPS) in order to preserve the quality of the service. While most SaaS companies are prepared to oblige larger customers with bespoke plans, this isn't always a given. 

And you cannot always predict when demand will spike. Take lab-testing and diagnostic services provider (and Auth0 customer) [BioReference Labs](https://auth0.com/case-studies/bioreference), for example. BioReference had begun transitioning to a patient-centric model, where customers could access their lab results without going through an intermediary — like their physician. As a result, it invested in Auth0's multi-tenant customer identity and access management (CIAM) platform. 

At the start of the COVID-19 pandemic, demand for its services jumped 25 times. Its monthly active users increased from 8,000 to 148,000. In response, the company migrated its identity infrastructure to a private instance of Auth0's Identity Platform, giving it essential breathing room to meet existing demand and add more customers in the future.

By opting for a private cloud SaaS application, you can provision your environments with the resources necessary to meet existing demand. And you have the flexibility to change your environment as circumstances dictate. 


## Becoming Resilient with Private Cloud SaaS 

Nobody likes downtime. Not your customers, who rely on your product. And certainly not you. 

Performance issues can devastate your bottom line. As load times and instability increase, conversion rates drop. Unfortunately, these problems are often beyond your control. In a multi-tenant SaaS environment, seasonal demand spikes — like those during the holiday shopping season — can result in longer wait times and instability for your customers. 

The private cloud SaaS model can insulate your business from any disruption in the public cloud SaaS application. With control over the environment, you can structure your SaaS infrastructure to be highly resilient, with custom disaster recovery protocols and redundant failover systems. 

You can establish custom backup and restore procedures. Mitigating against data center-level disruption becomes easy. Should the underlying cloud infrastructure fail, you can automatically switch operations to an unaffected environment, keeping downtime to a minimum. And with bespoke update rules, you can deploy patches and new features at a time when your customers are least active. 


## Nimble SaaS, Happy Customers

For most companies, it makes sense to use a multi-tenant public cloud SaaS product. But as your needs increase, you may find it sensible to switch to a dedicated environment. 

Private Cloud SaaS offers the best of both worlds. It requires little maintenance but offers the flexibility of a self-hosted application. You become able to make the choices necessary to deliver a lightning-fast, highly resilient product.

The Auth0 Identity Platform is available in both multi-tenant and private cloud versions. When you opt for a private environment, you get all the benefits of our industry-leading CIAM platform, but with the flexibility to choose how and where it's deployed. To find out how it can benefit your company, reach out to our team.

How Private Cloud SaaS Can Boost Application Performance

Fine grained authorization-at-scale, available for everyone

[A few months ago](https://auth0.com/blog/auth0-fine-grained-authorization-developer-community-preview-release/) we announced a Developer Preview of Auth0 Fine Grained Authorization (FGA), our upcoming SaaS product to solve authorization-at-scale for developers. Today we’re announcing [OpenFGA](https://openfga.dev/), the open-source engine that powers Auth0 FGA.

OpenFGA is a fast, flexible Fine-Grained Authorization System inspired by [Google's Zanzibar](https://research.google/pubs/pub48190/) paper, and has been designed for reliability and low latency at a high scale. It makes it easy for application developers to model their access control layer, and to add and integrate fine-grained authorization in a way that is consistent across all of their applications. It’s designed, built, and sponsored by Okta/Auth0.

## Why Is Fine-Grained Authorization Important?

Modern applications have evolved in a way that end-users now drive permission management. This makes fine-grained authorization an increasingly critical element in software. For example:

**Collaboration** and **Social** features are things users expect. These features range from the **‘Share’** button where users proactively grant specific permissions to a set of users for a specific resource, to **‘Request Access’** workflows that allow users to reactively grant access on demand. These features are useful both for business-related assets such as documents or project boards, as well as social sharing personal content like photo albums, social media posts, and even IoT devices.

**Security, compliance and privacy** are mandatory problems to solve for any software application from day one, and authorization is a big part of any solution. In fact, the top [2021 OWASP risk is broken access control.](https://owasp.org/Top10/)

Organizations like Airbnb and Carta have built Zanzibar-like systems to solve their authorization needs. We don’t think organizations should have to keep building the same authorization tools, again and again, so we set out to build one version that any developer can use. 

## How Does It Work?

As an example, we’ll use OpenFGA to model a simple expense management system. Imagine expense reports have the following requirements:

* Can be submitted by any employee.
* Can be approved by the submitter’s manager, or by the manager’s manager (or their manager, etc..).
* Can be viewed by the submitter, the approver, and anyone else that got the report shared with them.

To solve this problem in OpenFGA you would define the following authorization model:

```go
// There are reports in the system
type report
 relations
   // Reports have submitters (user who have submitted that report)
  define submitter as self
   // Reports have approvers (users who can approve reports)
   // A report's approvers are the managers of the submitter
   // of that report
  define approver as manager from submitter
   // Reports have viewers (user who can view that report)
   // The users who can view a report are the submitter,
   // the users who can approve it, anyone it has been shared directly with
  define viewer as self or submitter or approver

// There are employees in the system
type employee
 relations
   // Employees have managers, managers are those directly assigned
   // or anyone who's a manager of a manager
  define manager as self or manager from manager
```

The OpenFGA language uses `self` to indicate that the relationship can be assigned.

* Submitters and viewers of a report can be directly assigned.
* Direct managers of an employee can be directly assigned.

Definitions without `self` can not be assigned directly but can be inherited.

In addition to defining an authorization model, OpenFGA requires you to provide the actual data to instantiate these permissions. In this example, we’ll have 4 participants:

* Daniel, who is Sam’s manager
* Matt, who is Daniel’s manager
* Sam, who will submit an expense report
* Peter, who works in the same team as Sam. Sam wants to share the report with him.

You would provide this data by using the [OpenFGA’s Write API](http://openfga.dev/api/service/#/Tuples/Write) and a few “tuples”. 

Some of the tuples will define the direct reports. This data will probably be synchronized automatically from an HR system (e.g. Workday):

```json
{ 
    "user": "employee:daniel",  
    "relation": "manager", 
    "object": "employee:sam" 
}
```

```json
{ 
    "user": "employee:matt",  
    "relation": "manager", 
    "object": "employee:daniel" 
}
```

Whenever Sam submits an expense report (in this example, ‘sam-trip’), the following tuple should be created:

```json
{ 
    "user": "employee:sam",  
    "relation": "submitter", 
    "object": "report:sam-trip" 
}
```

When Sam later shares the report with Peter, the following tuple should be created:

```json
{ 
    "user": "employee:peter",  
    "relation": "viewer", 
    "object": "report:sam-trip" 
}
```

With the above information now in the system, we can now ask OpenFGA if a specific user has a specific relation with a particular object. We do that by using [OpenFGA’s Check API,](https://openfga.dev/api/service#/Tuples/Check) which will return true or false. For example, if we check:

```json
{ 
    "user": "employee:matt",  
    "relation": "approver", 
    "object": "report:sam-trip" 
}
```

OpenFGA will return **TRUE**, as Matt is the manager of Sam’s manager, and Sam is the submitter of the expense report.

You can also use the [‘Expand’ API](https://openfga.dev/api/service#/Relationship%20Queries/Expand) to understand why OpenFGA returns that result. The Auth0 FGA Playground provides a visualization of the results of calling that API:

![OpenFGA](https://images.ctfassets.net/23aumh6u8s0i/1eSifra3BxJLVtV6XtR4xv/58c1a82f8770c9a2555b9632dbc80507/OpenFGA.jpg)

It needs to answer “is `employee:matt` related to `report:sam-trip` as approver”. To do that, OpenFGA:

1. Expands the “approver” relationship for Sam’s report
2. Finds out that the approver needs to be Sam's manager (the report submitter’s manager), and finds out who the managers are <br>
    **a**. Daniel is Sam’s assigned manager, but Daniel is not the one we are looking for <br>
    **b**. Daniel's managers are also Sam's managers, so OpenFGA needs to expand them <br>
3. Expands the “manager” relationship for Daniel <br>
    **a**. Matt is Daniel's manager, which is what we were looking for! <br>
    **b**. Matt's managers would also be Sam's managers, but there's no manager defined for Matt <br>

To summarize, you need to:

* Define a domain-specific authorization model.
* Use the `Write()` API to add relationship tuples.
* Use the `Check()` API to check for permissions.
* Use the `Expand()` API in cases where you need a detailed understanding of the `Check()` results instead of a simple `TRUE` or `FALSE` response

## Why Open Source?

Both Auth0 and Okta maintain a large number of open source projects and use a myriad of open source products internally. This time we are going one step further than usual and open-sourcing a core Auth0 product. We’ll continue to offer [Auth0 FGA](https://fga.dev/) as a SaaS offering, but also strive to build the best open source implementation of a Zanzibar-style authorization system.

We’re doing this for several reasons:

* We believe there’s an opportunity to create a large ecosystem around a fine-grained authorization system, and that making our FGA offering open source will maximize the chances for this to happen. We expect OpenFGA integrations for authorization policies products like [OPA](https://www.openpolicyagent.org/), proxies like [Envoy](https://www.envoyproxy.io/), API gateways like [Kong](https://konghq.com/); identity providers ([Auth0](https://auth0.com/es), [Okta](https://www.okta.com/), [AzureAD](https://azure.microsoft.com/es-es/services/active-directory/)), SDKs for platforms and frameworks (Python, Java, [Spring](https://spring.io/), [Next.js](https://nextjs.org/)), etc. 
* We want to enable customers that require deploying in different cloud providers,  on-premise, in multiple regions, with FedRAMP compliance, or those that have a low tolerance to the risk of delegating authorization to a third party provider. From our experience with Auth0, we know those are difficult problems for a SaaS product.
* The industry will benefit by having a common way to manage Fine Grained Authorization. We believe Auth0/Okta is the company that can make this happen. It’s a leader in the Identity Access Management space, is trusted by thousands of customers, is cloud-agnostic, and has the financial capacity to invest in the product long-term.

## What Are We Open Sourcing?

We are open sourcing the engine that drives our SaaS product, and the SDKs that make it so easy to use. 

You can find all of these projects hosted in an [OpenFGA organization on Github.](https://github.com/openfga)

* [OpenFGA Server](https://github.com/openfga/openfga): the core FGA server which provides:
   * An expressive language to define your authorization model.
   * HTTP APIs for checking and granting permission, authoring models, query tuples.
   * A graph querying implementation inspired by Google Zanzibar
   * Pluggable storage adapters, with support for an in-memory database and PostgreSQL
   * OpenTelemetry tracing, metrics, and structured logging
* [Website and Docs](https://github.com/openfga/openfga.dev): The openfga.dev website, which includes our product documentation.
* [SDK Generator](https://github.com/openfga/sdk-generator): Tooling to generate SDKs based on OpenAPI definitions.
* [Go SDK](https://github.com/openfga/go-sdk), [.NET SDK](https://github.com/openfga/dotnet-sdk), [Javascript SDK](https://github.com/openfga/js-sdk): SDKs for different languages, with more to come soon!
* [Auth0’s FGA Playground](https://play.fga.dev/), which is not open source now but it will be in the following weeks.

## OpenFGA and the Cloud Native Computing Foundation

The Cloud Native Computing Foundation (CNCF) is an open-source software foundation that promotes the adoption of cloud-native computing. It hosts projects like Kubernetes, Envoy, and Open Policy Agent, along with a hundred others.

As we mentioned earlier, we believe there needs to be an open source version of a Zanzibar-inspired Fine Grained Authorization product. Creating such a product requires an initiative that early adopters can trust. To further accelerate this process, **we submitted OpenFGA to the Cloud Native Computing Foundation sandbox**. 

By joining the CNCF, the OpenFGA project will find a larger, vibrant community that will help this initiative to continue growing and attract more users and developers.

## Try It!

An open source project is only as good as its community, so we are extending a warm welcome to everyone that wants to get involved.

You can help by simply trying the product, providing feedback, and engaging with other OpenFGA users in [Discord](https://discord.gg/6xzMMuU8YR) / [Github Discussions](https://github.com/orgs/openfga/discussions), attending our bi-monthly office hours, or [contributing](https://github.com/openfga/.github/blob/main/CONTRIBUTING.md) to the project. 

Find out more by visiting [openfga.dev](https://openfga.dev/), and learn how to use it in our [awesome documentation](http://openfga.dev/docs). Keep up to date with the latest news by following us on [Twitter](https://twitter.com/openfga).

Announcing OpenFGA - Auth0’s Open Source Fine Grained Authorization System

ryan cobb

As a patent attorney, I thoroughly enjoy providing counsel relating to the intersection between technology and law. In my current role as the IP counsel for Okta, I advise the company on a all IP matters (including supporting various roles including product, employment, M&A, Okta Ventures, and commercial legal) and help create and manage policies and workflows to enable the business and engineering teams to succeed in the marketplace.

Director, IP Counsel

Ryan Cobb

Developers contributing to Auth0 and Okta projects are provided with a simple way to complete our industry-standard agreement in just a few clicks

We’re going to soon be implementing a Contributor License Agreement (CLA for short) on our open source projects to allow us to continue providing as many open source offerings as we can. 

What’s a CLA, you may be asking? Well, in short, it provides licenses to us and the rest of the community to use the Intellectual Property (IP) you create when you contribute to one or more of our open source projects. But more on the nuts and bolts of that later… 

Why are we doing a CLA now? As we grow, we increasingly see a need to protect our open-source projects at Auth0 and Okta so that we can freely accept contributions and our projects can grow. Additionally, the CLA process at Okta was cumbersome, and we wanted to relax that, so we decided to use CLA Assistant to streamline the signing process for our fantastic community of contributors. 

To create our CLA, we looked around the industry and based our CLA on similar language found in those from the [Apache Foundation](https://www.apache.org/licenses/icla.pdf), [.NET Foundation](https://github.com/dotnet-foundation/foundation/blob/master/guidance/net-foundation-contribution-license-agreement.pdf), [CNCF](https://github.com/cncf/cla/blob/master/individual-cla.pdf), [Google](https://cla.developers.google.com/about/google-individual?csw=1), the [Eclipse Foundation](https://eclipse.org/legal/ECA.php), and [Salesforce](https://cla.salesforce.com/sign-cla), to name a few. You can check out the text of our CLA [here](https://cdn.auth0.com/blog/okta_cla.pdf). If you’ve signed a CLA with Okta in the past, we’re going to ask you to sign a new one via the CLA Assistant (don’t worry… you don’t need to print anything out… you just sign right in Github!). This way, we have all the agreements in the same place and organized by your Github handle. It’s just a few clicks! 

If you want to contribute to one or more of our Open Source projects, what it means to you is: 

* License grant - you grant a copyright and patent license to your contribution so that others using the open-source project can use it without fear of infringement issues. 
* We ask that you represent that the contributions are yours to be made, and you can grant the associated rights to those contributions. 
* We don’t expect you to provide any support for your work unless you want to. 
* The agreement is retroactive to cover your past contributions to ensure we have the most up-to-date protections. 
* Suppose you’ve made contributions in the past but don’t want to sign our CLA, no problem. You don’t need to sign it for any of your past work. But, if you want to make contributions from now on, we will ask you to sign the CLA so that we can make sure we continue offering our best to the community. 

We hope these changes will make the experience of contributing to our Open Source projects better, more straightforward, and safer for everyone. If you have any questions or concerns on this, please reach out to our developer forum, where we will do our best to get you the answers and address your needs. Thank you for your past and future contributions! We appreciate them and look forward to continuing building together!

<include src="asides/AboutAuth0" />

Scaling Our Open Source Projects: Implementing a Contributor License Agreement

leonardo

Leonardo is a Senior Software Architect at Okta, working on the new Auth0 platform and cutting-edge product features. He is a seasoned technical leader with 17 years of experience in a wide range of segments, from enterprise to SaaS systems. As an Apache committer, he has contributed to various open-source projects. He is a self-learner, passionate about new technology, and has spoken at several developer events.

Senior Software Architect

Leonardo Zanivan

Replatforming to enhance agility, productivity, scalability, reliability, and security.

**TL;DR:** Auth0’s private and public cloud offerings are converging on a single platform to deliver an increase in business agility, developer productivity, scalability, reliability, and security for our customers and Auth0 by using industry-leading tools and fully automated operations.

Initially, Auth0 evolved our public and private cloud offerings as separate platforms because we could go fast and innovate on the public cloud and then work through the greater performance, compliance, and control expected by our private cloud customers. But over time, this led to feature discrepancies and, frankly, just wasn’t that efficient to maintain, scale, or innovate.

So we began an ambitious replatforming project. How could we re-architect all of Auth0 into a single platform? Could we support deployments on both Amazon Web Services (AWS) and Microsoft Azure? What about increasing geo-failover options? And we needed to continue our 99.99% SLA across both public and private clouds.

Let’s not forget that private cloud customers may also require extra add-ons like data residency, private links, and dedicated performance. This post will walk you through our approach to rearchitecting Auth0 to address those challenges.

## The Convergence Starting Point

While both platforms worked exclusively on AWS cloud, the private cloud was not using cloud-native solutions. It had three tiers — Basic, Perf, and Perf+ — available as environment sizes. These were selected based on the number of users and requests per second, versus an elastic scalable public cloud environment shared by multiple customers. The main difference is that private deployment usefully isolated and dedicated resources in any region. In comparison, public deployment uses shared resources for multiple customers in specific regions (United States, Europe, Japan, and Australia).

Our public cloud saw new features delivered on a weekly basis, but due to limited automation, our private cloud required high-touch operations for upgrading to new releases that rolled out on a bi-weekly cadence. 

Requirements for private cloud deployments set it up as a superset of the public cloud offering that already guarantees a 99.99% SLA, with a track record of 99.99+% over the last three years. This was across three availability zones and a geo-failover for regional redundancy and availability.

But we knew we also wanted to include extra add-ons like private links, [PCI compliance](), and meet the customer requests for [Azure Cloud]() support.

## New Cloud-Native Architecture

On a high level, the new cloud-native architecture delivers an increase in business agility, developer productivity, scalability, reliability, and security for our customers and Auth0 by using industry-leading tools and fully automated operations.

It closes the gap between Auth0 public and private deployments by packaging all the product features in a single software version and making them available depending on the customer subscription and add-ons. 

The ideation for the new platform is based on the following premises:

* **Multi-cloud: **AWS and Azure cloud support through a common interface
* **Container orchestrated:** use of container images instead of installing packages
* **Stateless**: scalable and replaceable by design
* **Immutable**: run only trusted code and configuration
* **Fully automated:** provisioning, upgrades, and decommissioning are done by machines
* **GitOps:** enhanced DevOps, push code and safely reproduce it thousands of times  

This removes the worry about the underlying infrastructure, allowing Auth0 developers to place their focus on our customers. This can be represented by the layers in the box below:

![Aplication Layer](https://images.ctfassets.net/23aumh6u8s0i/3yX9TOMT8XC0UPPKK6N57h/41dbdb93833d8c2e20e7c2be1bb445ef/88133_Private_Cloud_Campaign_Auth0.png)

* **Infrastructure layer**: It builds the infrastructure using AWS and Azure cloud services such as networking, virtual machines, key management, load balancers, container repositories, Kubernetes, and managed datastores (Mongo, PostgreSQL, Redis, Kafka).
* **Interface layer**: [Terraform](https://www.terraform.io/) is used for bootstrapping the infrastructure using code on different clouds. [Vault](https://www.vaultproject.io/) is used for platform secrets management and [Kubernetes](https://kubernetes.io/) as de-facto technology for application runtime along with custom plugins to describe services manifest, configuration, and secrets using the platform control plane component. [Argo CD](https://argoproj.github.io/cd/) is a GitOps continuous delivery tool used for applying for new software releases while [Argo Workflows](https://argoproj.github.io/workflows) is used for orchestrating the provisioning, upgrades, and decommissioning steps. This layer also contains integrations and agents for managing service discovery/DNS, logs, metrics, security audit, and datastores.
* **Application layer**: It is where the containers run. The Auth0 Identity Platform is built to allow multiple stacks with different sets of containers deployed accordingly to their usage. Auth0 products, PoP, Control Plane, and Central Services use a promotion pipeline for validating new releases and configurable release schedules. Everything is managed by control plane API and developers interact with the new platform CLI or Hub (web interface). One might wonder how identity is managed to access Kubernetes resources, it uses [Pomerium with Auth0 Identity Provider](https://www.pomerium.com/docs/identity-providers/auth0.html), dogfooding our own product.

Before we go deep into the technical details, the blog [A Primer on the New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/) provides more details about the Space, PoP, Control Plane and Central components of the new platform.

## The Components—A Ten Thousand Foot View

The diagram below demonstrates the main components of the platform and its links, including data flows and cloud regions. Internal services and network details are omitted.

![The Components—A Ten Thousand Foot View](https://images.ctfassets.net/23aumh6u8s0i/2bmBmIoidTViCeyw2dInNB/26a1c8a5cd9ac8a556488585edbb35d4/Arquitecture.png)

**Edge Network**: The global network provider, used by Auth0 for DNS, edge computing, CDN, DDoS protection, web application firewall, custom domain certificates, and speed-up end-user experience.

**Space**: Customer environment containing the dedicated application and datastores resources, deployed in any cloud region, maintaining security and data residency through tight access control for operators. Datastores use dedicated private networks isolated from the applications. New application deployments spin a whole new application cluster containing the new version and then slowly switch the traffic using a 'canary deployment' strategy. In addition to that, 'Data Shield' component is responsible for receiving a variety of data such as application logs and then scrubbing it, removing any PII or sensitive information. Only the clean logs are ingested and clean data is forwarded to Auth0 data analytics and detection & response teams for monitoring the system. The customer data never leaves the cloud region (e.g. Azure EastUS).

**PoP**: Point of presence of the platform in a given cloud region (same as the Space), required to host the container registry of software stacks used by the Kubernetes cluster. This component runs a set of shared services to support the platform, including the OpenSearch stack used by operation engineers to troubleshoot issues. It also runs regional services, shared between Spaces to support platform operations, such as forwarding data analytics, and internal Auth0 system supporting services requiring low network latency for fulfilling requests. It is important to note though that PoP doesn't have access to the Spaces network, it acts as a regional endpoint.

**Central & Control Plane**: A region in the European Union (EU) where the control plane services are deployed. They are internal to Auth0 operators and are used to interact with the customer Spaces and PoPs. It is secured by Zero Trust model and manages platform secrets and metadata using Terraform, Vault, and Argo. In addition to the control plane services, the central component is also designed to run other completely isolated application stacks to host global services accessible by customers and support engineers.

**Auth0**: The analytics aggregated data is sent to Auth0 headquarters and other global systems such as DataDog and Snowflake to be consumed by internal teams in many different departments, such as business analytics, customer support, and engineering teams. The data is categorized into different levels of access and doesn't identify any customer-sensitive information such as personally identifiable information (PII). The Detection & Response team is an exception and runs security software to analyze production traffic and usage patterns to actively detect & mitigate attacks.

## High Availability and Geo-failover

Auth0 guarantees a 99.99% SLA for production deployments. On a high level, the infrastructure is fully redundant, and all components are deployed into multiple availability zones, using at least 3 availability zones (AZ) combined primary and secondary regions, either in clustered mode or standby replicas. 

For web applications, the traffic is distributed across multiple Kubernetes nodes using load balancing. For datastores, Mongo and PostgreSQL are considered the system of record, i.e. the authoritative source of data, deployed in the primary region with a writer and at least a reader node for splitting write/read traffic and replicating the data to a secondary (failover) region in real-time. The caching (Redis) and stream (Kafka) components are deployed using sharding and failover capabilities, always providing high availability for runtime and data.

As for central services, control plane, and PoPs, they also run on high availability infrastructure and have the ability to failover, while this process is executing or in case of temporary or permanent network connectivity issues, the Spaces continue functioning as expected without any disruption. Spaces are isolated from each other and are fault-tolerant to other tiers' failures. 

The geo-failover is a fully automated process and is manually triggered by an operator during incident response for disaster recovery in case a cloud region is fully or partially unavailable. The process redirects all the traffic to the secondary region (determined by the customer) which switches the DNS of the cluster ingress and promotes the secondary region replicas to become the primary writer; there's no dependency on the primary region for the disaster recovery to successfully execute. 

The target RPO (Recovery Point Objective) is less than a minute, the time period in which data and events can be lost due to the disaster recovery procedure. At the same time, the RTO (Recovery Time Objective) is less than 15 minutes for the amount of downtime tolerated during the disaster recovery process.

The process of failback (revert the failover) from the secondary to the primary region is the same and can be triggered once the situation resolves.

The diagram below shows the Auth0 deployment containing a primary and a secondary warm standby region with high available datastores, and for simplifying purposes other AZs running only applications are omitted:

![Azure servers](https://images.ctfassets.net/23aumh6u8s0i/7f96vQ2UJukSjYJYc5flNt/a406ca7bac6ad54dc5e2bfc75c754dd8/Azure_servers.png)

We are publishing a series of technical posts on how and why we replatformed. They’ll be linked at the bottom of this post as they publish and are also findable on our blog. If you have technical questions or ideas for future posts, please reach out to us via the [Auth0 Community](https://community.auth0.com/). (Our marketing team also tells us we would be remiss if we didn’t include a link to talk to Sales so that is [here](https://auth0.com/contact-us), too.)

The Architect’s View of Auth0’s New Private Cloud Platform

Salman Ladha

As a Product Marketing Manager, I’m responsible for communicating the value of identity for SaaS application builders and our public sector vertical. I’m particularly passionate about the role identity plays in accelerating business growth, promoting product adoption, and establishing trust. Outside of work, you can catch me reading, working out, or watching the latest Marvel movie.

Senior Product Marketing Manager

How identity can help startups scale up-market to win bigger deals.

Most (not all) founders at Business-to-Business (B2B) and Software-as-a-Service (SaaS) startups dream of becoming the next industry-defining enterprise application like Salesforce, Slack, or Atlassian.

To have millions of daily active users, billions of dollars in market capitalization, and the comfort of being a staple in the technology stack of another business, is a revered status that [fuels the ambition of hungry startups](https://auth0.com/blog/so-you-want-to-be-a-unicorn/).  

An important step to attaining such scale is the difficult journey of moving upmarket to acquire enterprise customers. From both a go-to-market (GTM) and product perspective, enterprise customers come with their own unique set of [requirements](https://www.enterpriseready.io/), which can overwhelm even the most disciplined teams. As a burgeoning startup, pursuing these opportunities may feel like a double-edged sword.

On the one hand, adding a large, recognizable brand to your customer base would improve your company’s standing in the market. On the other, it would mean diverting most (if not all) development resources towards building capabilities that aren’t central to your business’s core value proposition.

The good news is that business customer identity solutions can help provide startup teams with the necessary tools to incorporate standard enterprise-ready capabilities early on in their product development, thus unlocking future growth. In doing so, identity can support GTM motions without bogging down technical teams in the long run. 


## 670 Billion Reasons to Move Upmarket 

The enterprise market is an attractive space for SaaS companies for one main reason: there’s a lot of money on the table.

Digital transformation continues to change the way businesses operate, particularly related to the adoption of cloud applications. Investments into SaaS products were up [50% in 2020](https://www.blissfully.com/saas-trends/2020-annual-report/) compared to the previous year and showed no signs of slowing down. [According to a Gartner®](https://www.gartner.com/en/newsroom/press-releases/2022-01-18-gartner-forecasts-worldwide-it-spending-to-grow-five-point-1-percent-in-2022) report, worldwide spending on Enterprise Software is projected to reach almost 670 billion dollars this year alone, representing an 11% growth rate. 

For startups, entering this segment of the market not only signals a level of product maturity but also supports long-term, sustainable growth by widening the total addressable market (TAM) of the business and increasing profitability in a few ways. 

First, the average selling price (ASP) for an enterprise customer is typically much larger than others. As an example, let’s consider Shopify, the Canadian E-commerce company that helps businesses sell, ship, and process payments online. Their core platform, geared towards small and medium-sized businesses (SMB), has an upper price point of $299/month. In stark contrast, Shopify Plus, their enterprise offering, is nearly ten times that, starting at $2000/month. This is why enterprise deals can grow revenues from [10 to 30](https://www.saastr.com/why-tilting-just-a-smidge-from-self-service-can-grow-your-revenue-30x/) times the original product’s value depending on the market, product, and offers. 

Secondly, enterprise clients are [less likely to churn](https://www.cmswire.com/analytics/enterprise-saas-churn-rates-whats-acceptable/#:~:text=According%20to%20Lincoln%20Murphy%20of,would%20be%20approximately%200.4%20percent.) from your service. Due to the higher ASP, longer contract lengths, and less price sensitivity, the average churn for enterprise customers can range anywhere from 1% to 5% compared to the 20% - 25% churn seen from their SMB counterparts. 

Finally, adding a recognizable brand to your customer base exerts a form of gravity that other GTM teams can leverage as it signals a degree of credibility for your offering. As an example, look at the customers cited on your favorite SaaS applications home page. You’ll likely find larger, established companies. For what it’s worth, AMD, Pfizer, and American Airlines are just a few of the global brands you’ll find on the Auth0 [home page](https://auth0.com/). 

When you combine all of those factors, the benefit on pipeline generation, top-line revenue, and net dollar retention paint a compelling picture of the financial benefit of moving upmarket. 


## The Challenges of Building for Enterprise 

The natural question is if the enterprise space is so lucrative, why doesn’t every company race towards it like their valuation depends on it? 

Though a SaaS company may demonstrate market viability with its customers in the SMB segment, the needs of the enterprise are significantly more complex, often stressing functionality around user provisioning, administration, and security at scale. They’re inherently risk-averse and rely on well-established patterns to vet the security of the SaaS applications they adopt. Common requirements of doing business with larger customers include: 

* **Single Sign-On —** so that administrators can easily manage user provisioning and de-provisioning via their own IdP while making it simple for employees to access an application. 
* **Multi-Factor Authentication —** to align with security policies and validate the owner of the account is the one actually trying to access the application. 
* **Role-Based Access Control (RBAC) —** so that appropriate levels of user permissions can be granted throughout an application.  
* **Compliance Accreditations —** certifications such as [SOC2](https://auth0.com/blog/soc-2-compliance-and-certification-what-saas-businesses-need-to-know/), [ISO27001](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/), and [PCI](https://auth0.com/blog/what-is-pci-a-business-guide-to-compliance/) DSS that are granted by a third party and assert a professional standard.
* **Data Privacy Compliance —** adherence to privacy laws and regulations such as GDPR, LGPD, APPI, and CCPA. 

It’s not _impossible_ to build these capabilities with developers in-house, but it is challenging and requires subject matter expertise in identity, security, and protocols. 

However, just because developers _can_ build something doesn’t mean they _should_. When it comes to platform capabilities like authentication, startups should weigh their decision against two key criteria:

1. The opportunity cost of doing it yourself 
2. The potential cost of getting it wrong  

B2B buyers have never had more options for the SaaS solutions they adopt. Consider the marketing technology landscape, with over [8,000 products](https://chiefmartec.com/2020/04/marketing-technology-landscape-2020-martech-5000/) that promise some variation of the same value proposition. Building a single sign-on solution from scratch might meet the requirements of the enterprise customer you’re trying to close a deal with, but it also takes away from your team’s ability to work on the core customer problems your technology aims to solve. While you’re bogged down learning the nuances of SAML protocols, competitors can double down on product innovation and focus on delivering differentiated value from your offering. 

Additionally, putting the responsibility of building mission-critical infrastructure onto developers whose core expertise lies outside of security is a risky proposition because the financial and social costs of getting it wrong are severe. Identity is increasingly becoming a target for bad actors. According to Verizon’s 2021 Data Breach Investigations Report, [80% of web application breaches](https://www.verizon.com/business/resources/reports/dbir/) involves using stolen credentials. On average, credential stuffing attacks cost businesses upwards of [4 million dollars](https://www.information-age.com/credential-stuffing-123482099/) a year. Sifting through protocols and leveraging open source code—which has also been shown to have [vulnerabilities](https://www.sonatype.com/resources/white-paper-state-of-the-software-supply-chain-2020)—might feel like an easy option, but it’s highly stressful for internal teams, requires constant attention in the form of maintenance, and if something does go wrong, it can leave your business in tatters. 

## Becoming _Identity_ Ready to Fuel Growth   

Your identity platform should be a crucial tool in your efforts to grow and land larger customers. Auth0’s Business Customer Identity solution is purpose-built for the unique needs of B2B SaaS organizations. With it, customer requirements around Enterprise SSO and Multi-Factor Authentication are available out-of-the-box. Coupled with our high availability cloud services that ensure a [99.99%](https://status.auth0.com/) SLA, you’ll have another great reason for that larger customer to sign on the dotted line.

Development teams can quickly implement Auth0 into your application with well-documented APIs and SDKs. In fact, many of our customers go live in [less than a month](https://auth0.com/case-studies/innit-inc/) and have been able to [shorten their time to market](https://auth0.com/resources/whitepapers/how-development-teams-purchase-saas?utm_content=dsa&gclid=Cj0KCQiAosmPBhCPARIsAHOen-NkJJirZcFB7dOkaSL7_S3nBwgTP9G1yZ-pxJ0pK8Eal8ZKRncqI_IaAszlEALw_wcB) for other key product capabilities. 

You’ll also have the peace of mind of having an on-demand, identity security system in place. Secure the data of your business customers by quickly adding protection against some of the most common attacks on identity systems out of the box. From bot attacks to credential stuffing, Auth0 takes the burden of identity security off your internal teams so that they can focus on shipping new features for your product.

Importantly, all of this can be managed programmatically and at scale using Auth0 Organizations, which can help you represent all your business customers in your multi-tenant application.  

If you’re interested in learning how other SaaS businesses used Auth0 to move upmarket and nab larger customers, check out our [Sendoso case study](https://auth0.com/case-studies/sendoso/). 

## Gartner Trademark
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

<include src="asides/AboutAuth0" />

Identity is the First Step Towards Enterprise Readiness

Nabeel-Saeed

Nabeel is a product marketer focused on all things security and identity. He has contributed to publications like Wirecutter, Information Age, and Professional Security. He has also been a guest speaker at the Bay Area Cybersecurity Meetup, and delivered talks on IAM across the US, Canada, Israel, and Singapore. He is passionate about helping build secure auth experiences that amaze users and delight businesses.

Product Marketing

Nabeel Saeed

Secure apps and protect users with enterprise scale account takeover protection

It’s 2022, yet passwords still remain the [most common form of authentication](https://www.idrnd.ai/5-authentication-methods-that-can-prevent-the-next-breach/) online. Like it or not, they are not going away anytime soon. Even if they’re becoming riskier than ever. The very fact that there are so many more applications that users have to register for and log in to makes password reuse across multiple sites even more likely for all but the most security-conscious users. No wonder that the threat of account takeovers (ATOs) [nearly doubled in 2020](https://www.techrepublic.com/article/account-takeover-attacks-spiked-in-2020-kaspersky-says/).

Breaches impact everybody. The average email address is now associated with [130 online accounts](https://www.linkedin.com/pulse/b2b-identity-software-deep-dive-clement-vouillon/?trackingId=C11skBW3qNhNTv25nHkiEQ%3D%3D). Chances are that a significant portion of your users are using the same or similar usernames and passwords as they use on other sites. So when a password gets leaked in a data breach, that same password, or a slight variation thereof, has a high chance of being successful at multiple other online accounts that the user owns. Even if your own site hasn’t been breached, there’s still a good chance that your users' information may be compromised due to a leak that occurred elsewhere. 

![Improve Detection Response](https://images.ctfassets.net/23aumh6u8s0i/KbvD9MBeJw2z9YfGaC2Rv/567a40c8cb1cf8cdf565aa3827030351/Credential-Guard_crop1.jpg)

With [Auth0 Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), you can protect your applications from bad actors logging in with stolen credentials. You can alert the user about their compromised password, challenge the user using an additional factor, or block access by forcing a password reset. Typical breached password detection relies on breach data released to the public. From the time when a breach happens to when it’s announced, there is a gap (typically months) during which your users and business remain at risk. Credential Guard eliminates this gap: a team of dedicated security experts infiltrates criminal communities and gains access to exposed data as soon as breaches occur. With this advantage, you can better protect your users and secure your applications by resetting stolen passwords sooner.

## Improve Detection Response

A typical account takeover attempt is performed using bots that hit login screens that use credentials obtained in data dumps that follow breaches. These indiscriminate attacks account for [90% of ATO attempts](https://spycloud.com/resource/targeted-vs-automated-ato/), yet only inflict 20% of the losses that business incur due to breaches. Targeted attacks, on the other hand, are disproportionately costly, even though they are far fewer in number. These attacks use sophisticated and clandestine methods of obtaining passwords, using these compromised credentials to inflict damage long before there is any traceable record of the breach. Traditional breach detection services that use scanners and scrapers to identify leaked credentials are therefore of no use when it comes to these types of attacks.

Credential Guard counters this threat with a team of security experts that infiltrate the dark web to mine out the exposed information before criminals can monetize it. This unique capability allows us to identify ATO risks months, even years before breach data is made public. Given importance of timeliness in identifying targeted attacks, companies can secure their applications during login by detecting and resetting stolen passwords as soon as breaches happen

![Expand Reach Globally](https://images.ctfassets.net/23aumh6u8s0i/5lO6E741lPvTK11haSvP5Z/1c5d39145aa0fbc1741f624bb50041c9/Credential-Guard_crop2.jpg)

## Expand Reach Globally

Breached passwords are not only a threat to the companies’ applications but also their users. As mentioned above, users reuse passwords across multiple sites, so it’s not just an account that’s at risk but their entire online identity. 

Credential Guard automates the detection and remediation of breached passwords across more than 35 languages and 200+ countries and territories for global account protection.

## Improve Security Posture 

We all have heard ad nauseum about the trade-off between user experience (UX) and security. Human psychology tells us that we make choices based on perceived threat. When a threat goes from being abstract to real, we’re much more likely to take it seriously and adjust our behavior to account for it. The same user that scoffs at stronger authentication methods when there is no perceived risk might enthusiastically sign up for the same measure if the choice is presented at a time when the alternative was to lose control of their account. Companies can alert a user that their password has been leaked in a data breach, and then offer to improve their security posture enrolling in MFA, without risking conversion, impacting UX or retention.

![Secure Your Login Box, Protect Your Users](https://images.ctfassets.net/23aumh6u8s0i/1sJJusx7kMMHjOgw5Bv4zY/c889e692d0bb0be2a2d35a230f0fa4bc/Credential-Guard_crop3.jpg)

## Secure Your Login Box, Protect Your Users

As security enthusiasts, we know that passwords worry both users and app owners alike. Yet they persist, and will likely do so for the foreseeable future. Using Auth0 Credential Guard, companies can stay ahead of criminals trying to exploit breached passwords. It protects companies as well as users’ online identities, which are increasingly bound up with a single, widely used password. While password protection is no silver bullet, making password protection part of a strategy to improve authentication choices, companies can reduce chances of being breached by [up to 89%.](https://www.verizon.com/business/resources/reports/dbir/) 

Learn more about implementing Credential Guard [here](https://auth0.com/docs/secure/attack-protection/breached-password-detection).

<include src="asides/AboutAuth0" />

Detect Breached Passwords Faster with Auth0 Credential Guard

tonycamp

Tom Camp is a DevRel Engineer at <b><a href="https://ably.com/">Ably</a></b>. His recent interest lies in open realtime data and ways of representing and sharing it. He’s also a member of the Open API and Async API communities which work towards standardizing specifications and capabilities of APIs. In his spare time, Tom loves to play strategy-based games and modding them.

DevRel Engineer at Ably Realtime

Thomas Camp

Creating a Universal Authentication System with Auth0 for Ably's scalable chat application.

This is the second part of [Ably’s Fully Featured Scalable Chat App](https://ably.com/blog/fully-featured-scalable-chat-app) series. We have been working on creating a prototype for an open-source chat application that anyone could use at real-world scales of traffic, with many of the bells and whistles one would expect from a modern chat application. This means integrated media, notifications, and more.

If you want to try out this application yourself, you can get the code from [GitHub](https://github.com/ably-labs/fully-featured-scalable-chat-app) and follow the [README](https://github.com/ably-labs/fully-featured-scalable-chat-app#readme) on the steps for local setup.

Our goal is for you to be able to take the code and create your own scalable chat application or mix and match elements from it into other applications that need a chat element.

Ably handles the complexity of distributed messaging between clients, presence checks, and authorization of messages. By making use of [WebSockets](https://ably.com/topic/websockets) we can have persisted, realtime communication. Making use of Ably as a [Pub/Sub broker](https://ably.com/pub-sub-messaging), we will be able to have the consistent ordering of messages and reliable message ordering. You can try out these features by [signing up for a free Ably account](https://ably.com/signup).

Before starting on these elements, however, we need the absolute fundamentals of chat. One of the most crucial things to get right is the authentication of users.

Authentication requires:

*   All information we store on users to be secure
*   We should provide 2FA and reasonable methods to recover an account should login credentials be forgotten
*   Password resetting should be possible
*   We need to be able to assign permissions, user information, and more to a user

## 

## Starting Off

Prior to starting on our authentication system, we already have a few things in place.

We have a frontend server that is hosting a [ReactJS](https://reactjs.org/) application, compiled using [Snowpack](https://www.snowpack.dev/). On this, we have a basic page as seen below which allows for a user to set a username for themselves.

![Starting Off](https://images.ctfassets.net/23aumh6u8s0i/10HfnKU3xmw1aTcBXfQNwP/36fc8f2a57b7a7dc1f323cfd090c7ea8/Uploaded_from_Fully_Functional_Scalable_Chat_App)

Once a user sets their username, they’ll be taken to the main chat application page, which has the available hard-coded chat channels on the left, which you can click on to load a [React Component](https://reactjs.org/docs/react-component.html) on the right of the screen for chatting within that channel.

![Starting Off](https://images.ctfassets.net/23aumh6u8s0i/6UCmezwQzxO2oDofbC3JaX/5433dd6b9b2d8409fb4a6f79b599c8e5/ably-chat.png)

The chat uses Ably. When a user clicks on one of the chat channels on the left of the screen, we use the [Ably React Hooks](https://ably.com/blog/ably-react-hooks-npm-package) library to connect to one of Ably’s servers and subscribe to its associated [Ably Channel](https://ably.com/documentation/realtime/channels). For example, to subscribe to the Ably Channel for the ‘global-welcome’ chat room:

```javascript
[ channel ] = useChannel(“global-welcome”, (message) => {
// Append message to our chat box component
});
```

If we want to publish a message to this channel, we can make use of the channel object returned by the `useChannel` function:

```javascript
channel.publish("message", messageFromChatBox);
```

We do both of these within the FFS app inside our [ChatContainer](https://github.com/ably-labs/fully-featured-scalable-chat-app/blob/main/app/src/components/Chat/ChatContainer.jsx) code, which you can check if you’d like to see real examples.

With the above, we’re able to allow for non-authenticated usage of some hard-coded chat rooms with a username. However, we have no form of authentication at this stage. We trust the user to set themselves to have any name, even if it’s the same as someone else. We have no way to uniquely identify a user, which is something that is crucial for having any form of permissioning, private discussions, notifications, and more.

## Creating a Basic Authentication System

For an absolutely rudimentary authentication system, we need to have:

*   A signup page where users can create a username and password
*   A database to store these, with the password being encrypted
*   A backend system that can authenticate a user when logging in by checking their login details to the database, and return a token that the user can use for any actions which require authentication
*   An endpoint that can be used to get authentication credentials to be used with Ably

<br>
In addition, we’d want:

*   2-Factor Authentication
*   Password Resetting
*   Social media logins

Each would be complex to implement, with many edge-cases and many security concerns to address. However, we thankfully knew of an existing solution for this, which [we’ve used in numerous projects](https://auth0.com/blog/dependable-and-secure-realtime-in-spring-boot-with-auth0-and-ably/) before, known as [Auth0](https://auth0.com/).

Auth0, an authentication and authorization platform, simplifies this process immensely. Not only does it allow for easy integration with your login systems, but it also makes integrating other login services such as Google and Twitter simple. It allows for a quick setup of permissions, roles with set permissions attached, and these roles to be assigned to users. These users can then use various login systems to access the same account and thus have the same permissions.

### Setting up Auth0

To make use of Auth0, you firstly need to create and configure an account with them. To do this, firstly, [sign up to Auth0](https://auth0.com/signup) on their website. Go through the signup process, setting whatever [tenant name and region you'd like](https://auth0.com/docs/get-started/create-tenants). Once you’re signed up, go to the ‘Applications’ part of the website. You should see ‘Default App’ here, which you can use for this tutorial, or you can create a new app if you so wish.

![Setting up Auth0](https://images.ctfassets.net/23aumh6u8s0i/62NYAkeQ25FA41mP2aspir/c6b325272a4447284036388fcae8a51c/Uploaded_from_Fully_Functional_Scalable_Chat_App)

If you go to your app, you should arrive on the ‘Settings’ page for the app. From here, you should make a note of the **Domain**, **Client** **ID**, and **Client Secret**.

![Setting up Auth0](https://images.ctfassets.net/23aumh6u8s0i/5ksyxBrksEBwQSeCkZe5VP/945e24c31578d98a6425b52c61eefbe0/Uploaded_from_Fully_Functional_Scalable_Chat_App)

On this _settings_ tab, scroll down to the section called ‘Application URIs.’ In it, you should see a field for ‘Allowed Callback URLs’ and ‘Allowed Logout URLs.’ For context, the flow of a webpage using Auth0 is:

*   Your site links a user to your Auth0 app’s login page, where they sign in
*   The Auth0 page redirects the user back to your website’s ‘callback’ page
*   When the user wants to log out, they are directed to the Auth0 app’s logout page and then redirected back to the page specified in the ‘returnTo’ query passed to the logout page

To avoid potential misuse and abuse, you need to specify what URLs Auth0 can redirect to. When hosting this chat app locally, it is hosted on localhost:8080, so set the **Allowed Callback URLs** to ‘[http://localhost:8080/auth0-landing](http://localhost:8080/auth0-landing)’. When a user logs out, we’ll have the user redirected back to our main page, so set the **Allowed Logout URLs** to ‘[http://localhost:8080/](http://localhost:8080/)’.

### Using an Auth0 application from the chat application

With the Auth0 application set up, the actual chat application needs to make use of it. When someone attempts to sign up or log in via Auth0, we will need to redirect a user to the appropriate Auth0 endpoint, and the same needs to occur when a user logs out.

Auth0 provides both a [React library](https://www.npmjs.com/package/@auth0/auth0-react) as well as a standard node module. Both work well, and in most cases, you’d probably want to use the React library as it will automatically handle a lot of authentication state sharing between different components.

For this project, however, we decided to go with the node module. This was due to a few reasons:

*   We want the code to be easily understood, and as we will need to use the node module version from the [Serverless Functions](https://azure.microsoft.com/en-gb/services/functions/) we’re using for our database, it makes sense to keep consistency between both frontend and backend
*   To use the Auth0 library, it needs to have specific details such as the endpoint name specified as part of a compilation. To have these details adjustable by anyone using the project, we’d need to set this as part of the environment variables. This variable would be required at two different stages, the compilation (which we do on GitHub using [GitHub Actions](https://github.com/features/actions)) and at runtime (for the Serverless Functions which we’re hosting on Azure), we’d need to specify it in 2 separate environments.

To avoid these complications, we decided only to store these Auth0 variables on the Serverless Functions and make them available via a Serverless Function to clients to use. We couldn’t use the React library to do this, as it has no method for asynchronous instantiation of details.

Using the node library, we just need to fetch the Auth0 configuration details from the appropriate Serverless Function endpoint, and then use those to instantiate an Auth0 client:

```javascript
import createAuth0Client from "@auth0/auth0-spa-js";

const response = await fetch("/api/oauth/config");
const configuration = await response.json();
cachedClient = await createAuth0Client(configuration);
```

The Serverless Function at `/api/oauth/config` simply responds with the configuration details we obtained earlier when setting up Auth0:

```javascript
  context.res = {
	status: 200,
	body: JSON.stringify({
  		domain: process.env.AUTH0_DOMAIN,
  		clientID: process.env.AUTH0_CLIENTID,
  		client_id: process.env.AUTH0_CLIENTID,
  		redirect_uri: process.env.AUTH0_REDIRECT_URI
	})
  };
```

Now we can add a button to our chat application which will instantiate our Auth0 client as seen above, and then use the Auth0 library’s login method to redirect the user to the Auth0 login page for our app:

```javascript
export async function loginWithRedirect(event) {
  event.preventDefault();
  const auth0 = await useAuth0();
  await auth0.loginWithRedirect();
}
```

![Setting up Auth0](https://images.ctfassets.net/23aumh6u8s0i/Ce4CuRSlp8zXsf3nNvzmG/896b959bb5619c99cad5234d4d18f8f7/Uploaded_from_Fully_Functional_Scalable_Chat_App)

When the user either signs up or enters valid credentials for logging in via Auth0, they need to be redirected to the page we specified when setting up Auth0, `localhost:8080/auth0-landing`.

With that, Auth0 is now up and running and we can use it as an authentication method!

## Storing user credentials

We now have login credentials of our users stored in Auth0, but we need that data to be accessible and associated with data in our CosmosDB database as well. Ideally we’d [migrate our database’s contents over to Auth0](https://auth0.com/docs/users/import-and-export-users/configure-automatic-migration-from-your-database) to avoid duplication of information, however for the time being we decided to keep data in CosmosDB.

As we will be treating our own database as the definitive location of data, we will want to also have our Auth0 users stored in our database as well. To do this, we can just intercept the response of signup via Auth0, and get the Auth0 ID and other details to store in our database.

Our CosmosDB will thus end up with a data structure for Users, defined in our [Users.ts](https://github.com/ably-labs/fully-featured-scalable-chat-app/blob/main/api/common/metadata/User.ts) file, of:

*   id: Unique ID for the User in our database
*   username: the login name they use if using our custom login system
*   oauthSub: The unique Auth0 ID if the user has an Auth0 login method associated with them
*   firstName: The user’s first name
*   lastName: The user’s last name
*   profileImgUrl: User’s profile image

With the above, we can provide users with login methods for both Auth0. We will also have representations of all our users within our database.

## Conclusion

With that, we have a way to authenticate users. With Auth0 we’re able to have 2FA, password recovery, and a smooth signup process handled for us. We have additional user information stored within CosmosDB, which we can use for providing additional information on users, which we can potentially use for profile pages, attaching details to messages.

With authentication done now, we still need to be able to authorize these users. We may know who someone is when they’re logged in, but we’re yet to define what permissions they should have, and how we’ll control them.

Next, we’ll be diving into how we can make use of a combination of Role-based Access Control (RBAC) and fine-grained permissions to define an authorization structure for users, as well as how to apply these permissions to both our backend as well as our real-time communications over WebSockets using Ably.

If you have any questions or thoughts about this project, please get in touch on [Twitter](https://twitter.com/ablyrealtime/) or via [email](mailto:devrel@ably.com) and we’d love to talk with you!

Ably's Fully Featured Scalable Chat App

Damian Schenkelman

Damian was one of Auth0's earliest employees. He loves building products for developers and taking things from 0 to 1.
<br><br>
He played key roles in implementing product features and growing the engineering organization in the early stages, and later on defining Auth0's architecture for scale and creating new products. Today he helps shape Auth0's long term strategy and leads Auth0Lab, a small and amazing team doing research and development of forward-looking products.
<br><br>
He spends his spare time with family, and friends, exercising, and catching up on all things NBA.

VP R&D (Auth0Lab)

We are excited to announce the Developer Community Preview for Auth0 Fine Grained Authorization (FGA), our upcoming SaaS to solve authorization-at-scale for developers.

## What Is Fine Grained Authorization?

[Authentication is about who the user is. Authorization is about what they can do.](https://auth0.com/intro-to-iam/authentication-vs-authorization/)

Historically, software applications have, in general, handled [authorization](https://auth0.com/intro-to-iam/what-is-authorization/) in a coarse grained manner. A user has one or more roles in an application, which grants them permissions to perform certain actions across the application. This worked well for a while because users didn't create content in systems. As social and work collaboration applications become mainstream, a different kind of authorization became necessary: fine grained authorization.

An application implements fine grained authorization when it can determine a user's permission to perform actions on any object in the application, and users can create objects in the application and manage permissions to those objects.

This is "fine grained" because there is no lower limit to the granularity at which builders of the system can make authorization decisions. It is up to the builders of the system to determine how granular they want authorization to be, and up to the users of the system to determine who has specific permissions on objects.

## Why Is Fine Grained Authorization Important?

Fine grained authorization is increasingly becoming a critical element in software. For example:

*   **Collaboration and social** features are things users expect, such as the ‘Share’ button you see in so many applications. This applies to both business-related assets, such as documents and project boards, and personal assets like pictures and home IoT devices. Specifically sharing one of these objects with another user is a Fine Grained Authorization use case.
*   **Security, compliance, and privacy** are musts for any software application from day 1, and authorization is a big part of solving those concerns. In fact, the [TOP OWASP 2021 risk is broken access control](https://owasp.org/Top10/).

However, solving authorization in an application is not a trivial matter. We believe applications solve authorization correctly if their authorization solution has the following characteristics:

1.  **Reviewable:** It should be easy to determine "who can access what," essentially understand the rules used to enforce access control.
2.  **Easy to manage change:** Authorization related changes must be explicit and traceable. Change management control for authorization is important.
3.  **Auditable:** It should be possible to know what happened with regards to authorization, in essence "who tried to access what, and when?".
4.  **Reliable:** Authorization decisions are made as part of most flows/requests, so authorization components need to always be running and returning the expected results.
5.  **Fast:** Authorization decisions are made as part of most flows/requests, so they need to be fast. If authorization decisions are slow, then the end-user experience is slow as a whole.

Implementing all of the above is complex, even with expertise. So we looked at how we could solve authorization for our customers, and allow them to focus on their core business. This is what led us to create **Auth0 Fine Grained Authorization.**

## What Is Auth0 Fine Grained Authorization?

Auth0 Fine Grained Authorization (FGA) is a SaaS to solve **fine grained authorization at scale for developers**. It is inspired by [Google Zanzibar](http://zanzibar.academy), the [system Google uses to solve authorization](https://auth0.com/blog/auth0-introduces-zanzibar-academy/) across all their products, such as Google Drive, Youtube, Google Cloud, and others.

Auth0 FGA does not require you to be using Auth0 already. You can use Auth0 FGA with any identity provider: your own user database (e.g. MySQL, PostgreSQL), Auth0, Okta or anything else.

Auth0 FGA centralizes your authorization. It becomes your "authorization (micro)service" if you will. It's a single place for you to define your authorization model, store your authorization data and make your authorization decisions, across all your apps and products.

Centralizing your authorization logic and decisions into a single service that has the flexibility to handle use cases across your different products gives you distinct advantages:

*   **Simplify security auditing:** Explicit authorization rules are easier to audit by internal and external parties.
*   **Lower costs:** Standardizing how authorization is done across your company makes it easier for developers to switch teams.
*   **Deliver faster:** You’ll be able to ship features and products faster, as the system is easily extensible to new requirements.
*   **Security logging:** The Auth0 FGA service generates logs for all operations out-of-the-box, both reads and writes.
*   **Empower your users:** Allow users to take control of granting access to their data directly in your application.
*   **Fast and reliable at scale:** A centralized service dedicated to fine grained authorization should scale as your business and products grow. Since Auth0 FGA specializes in fine grained authorization and nothing else, it can be particularly optimized for access control patterns and use cases, improving the latency and reliability of your authorization approach.

<br>
Auth0 FGA supports granting access at an atomic object level in any system, easily enabling collaboration between users, going far beyond typical role-based access control (RBAC). It also supports building custom roles into any system, empowering your customers to define how to manage access. Auditing capabilities provide fundamental building blocks for security and compliance teams. The more we’ve spoken to customers about it, the more we’ve learned just how many use cases it can solve for.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/21LaMJQrrDSNHmIEP2oWhO/17fd5e2a825a937590557973d59678b3/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

Organizations like [AirBNB](https://medium.com/airbnb-engineering/himeji-a-scalable-centralized-system-for-authorization-at-airbnb-341664924574) and [Carta](https://medium.com/building-carta/authz-cartas-highly-scalable-permissions-system-782a7f2c840f) have built [Zanzibar-like](https://zanzibar.academy/) systems to solve their authorization needs. We don’t think organizations should build the same authorization tooling, again and again, so we set out to build one version everyone can use. We developed Auth0 FGA as a service so you don't have to.

## How Do I Get Started?

To start using Auth0 FGA you need to do three things:

1.  Define your authorization model ([docs](https://docs.fga.dev/modeling))
2.  Write authorization data from your system to Auth0 FGA ([docs](https://docs.fga.dev/writing-data))
3.  Add authorization to your API by adding access control checks to your system ([docs](https://docs.fga.dev/integration))


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <b>The Developer Community Preview is meant to help us learn how customers use the product. If you have feedback, reach out on our <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>.<br> 
</div>

From that point on, all authorization decisions are centralized and made by Auth0 FGA. You can think of it as your "authorization microservice."

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/tROyM1vl5FzzqImS1xjNU/d6a4a8f07e6aca48aed81f4aafadd821/Uploaded_from_Auth0_Fine_Grained_Authorization__Developer_Community_Preview_Release)

### A brief example

Let's say you were to start from a Node.js API to manage projects. That API doesn't have authorization capabilities yet, but it does have authentication.

You have an endpoint that would return a particular project given its project ID. In that endpoint, you might have code like the one from the following snippet. The second line verifies the [JSON Web Token](https://jwt.io/) (JWT) sent as part of the request to perform [authentication](https://auth0.com/intro-to-iam/what-is-authentication/), using [express-jwt](https://www.npmjs.com/package/express-jwt).

```js
app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    // authorize access
    async function(req, res, next) {
        // your business logic
    }
);
```

Now we want to add [authorization](https://auth0.com/docs/authorization) so only users that can **read** a project can call this endpoint.

First, we would install and setup the Auth0 Fine Grained Authorization Node.js SDK. You would need to obtain some data from your Auth0 Fine Grained Authorization account, and follow [these steps](https://docs.fga.dev/integration/getting-your-api-keys) to get it.

```js
const { Auth0FgaApi } = require('@auth0/fga');

const auth0Fga = new Auth0FgaApi({
  environment: AUTH0_FGA_ENVIRONMENT,
  storeId: AUTH0_FGA_STORE_ID,
  clientId: AUTH0_FGA_CLIENT_ID,
  clientSecret: AUTH0_FGA_CLIENT_SECRET,
});

...

app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    function(req, res) {
        // your business logic
    }
);
```


You would then add a new middleware that calls Auth0 Fine Grained Authorization to perform authorization on every request, after authentication has taken place. You know who the user is (authentication), now you want to check what they can do (authorization):

```js
app.get('/project/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    async function(req, res, next) {
        try {
            const result = await auth0Fga.check({
              tuple_key: {
                user: req.user.sub,
                relation: 'read',
                object: `project:${req.params.id}`,
              },
            });

            if (!result || !result.allowed) {
                return res.status(403)
                	.send({ code: 'missing_permissions', message: `ForbiddenError: Not allowed to access object ${req.params.id}` });
            }

            next();
        }  catch (err) {
            // handle error
            return next(err);
        }
    },
    function(req, res) {
        // your business logic
    }
);
```

The key part of the new middleware is this one, where we call the Auth0 Fine Grained Authorization API:

```js
const result = await auth0Fga.check({
  tuple_key: {
    user: req.user.sub,
    relation: "read",
    object: `project:${req.params.id}`,
  },
});
```

We are conceptually asking the question **"can the {user} read project:{id}"?**:

*   The **user** identifier is obtained from the JWT [sub (subject) claim](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.2), as the JWT validation middleware sets all claims for the JWT in the **req.user** object as properties. Whatever your existing authentication method is, you can easily integrate it with Auth0 FGA.
*   The **relation** is "read" because the endpoint is a **GET**, it allows the caller to "**read"** one project. For **PUT** or **PATCH** you would use **"write"**.
*   The **object** is made up of the object type (project) and the project ID. The **object** **ID** comes from the request parameters (the path). A full URL for the request might be GET {API\_URL}/projects/1234, so the **object** would be **project:1234**.

You can learn about **CHECK** requests in depth [here](https://docs.fga.dev/intro/auth0-fga-concepts#what-is-a-check-request).

The previous example is intentionally verbose to show you the inner workings of things. You can imagine having SDKs for any web framework, API Gateway, and even policy languages that easily allow you to configure authorization per endpoint. For example:

```js
app.get('/projects/:id',
    jwt({ secret: PUBLIC_KEY, algorithms: ['RS256'] }),
    authorize(req => ({
        user: req.user.sub,
        relation: 'read',
        object: `project:${req.params.id}`
    })),
    function(req, res) {
        // your business logic
    }
);
```

## What's in the Developer Community Preview?

The Auth0 FGA Developer Community Preview is completely free and includes the features below. This is a chance for you and your teams to try the product out, assess how you'd integrate it with your apps, and give us your feedback.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>Note:</strong><br> 
  <b>The rate limits in the API are intentionally set low and there are no SLAs, as the Developer Community Preview is meant to help us learn how customers use the product. For additional inquires, please reach out on the <a href="https://discord.gg/6jsgXhVBu6">Community Discord</a>.<br> 
</div>

### Management dashboard

The management dashboard ([https://dashboard.fga.dev/](https://dashboard.fga.dev/)) allows you to create an account and a store. You can use the dashboard to define your authorization model, write authorization data, and perform authorization checks.

![Management dashboard](https://images.ctfassets.net/23aumh6u8s0i/3BFXmCWtMBx8Bqtrrj2sh0/91674dba44c3c779518b3421a2f16df1/02.jpg)

### Documentation

We have written extensive documentation ([https://docs.fga.dev/](https://docs.fga.dev/)) to help you learn the main concepts, get started, and explore advanced use cases.

![Documentation](https://images.ctfassets.net/23aumh6u8s0i/7wFQjqES9oqiEXTYOpshM1/aa3e08e49cdb20a80d6b24b9ca2639b0/01.jpg)

### HTTP API and SDKs

Auth0 FGA is a product built for developers. We’ve created an API for developers to integrate Auth0 FGA into their systems. Everything you can do with the dashboard you can also do with the API.

At launch, we are shipping with SDKs for [Javascript](https://github.com/auth0-lab/fga-js-sdk) and [Golang](https://github.com/auth0-lab/fga-go-sdk). If you'd like an SDK for another language let us know in [Discord](https://discord.gg/6jsgXhVBu6). We can easily generate it from our OpenAPI definitions.

![Auth0 FGA](https://images.ctfassets.net/23aumh6u8s0i/5Tdtrh6uySJPvMPsH2ms6/54517d4f5b1749909bce5f32c529a806/03.jpg)

## What's Next?

We are excited about the capabilities that Auth0 FGA will unlock for our customers. We want to make sure our roadmap items are driven by customer feedback and input. So if you’re interested in the product, please let us know your thoughts by joining our Auth0 Lab community [here](https://discord.gg/6jsgXhVBu6).

We are also looking forward to the future, especially the "better together" use cases that Auth0 Fine Grained Authorization will enable for both Auth0 and Okta customers.

We hope you'll join us on this journey and are eager to hear your thoughts on what we’ve built so far.

Take a look, try it out at [https://auth0.com/developers/lab/fine-grained-authorization](https://auth0.com/developers/lab/fine-grained-authorization), and let's learn together!

Auth0 Fine Grained Authorization: Developer Community Preview Release

How text messaging scams work and why a ‘skeptical pause’ can save you

You know _all_ about phishing. From time to time, emails purporting to be from Facebook or your bank drift into your inbox and insist you “verify your account.” Look closer and you spot the telltale signs of a scam: a sketchy-looking sender address, sloppy writing, and a complete lack of personalization. You sigh and hit delete.

It’s easy to be cynical about opportunistic, mass-mailed phishing attempts. Although some look genuine to even the most cautious eye, others feel decidedly amateurish and are readily identifiable. Billions of emails are sent each month, with over 245,000 phishing-related websites created in January alone [according to the Anti-Phishing Working Group (APWG)](https://docs.apwg.org/reports/apwg_trends_report_q1_2021.pdf). But when it comes to SMS-based phishing, or ‘smishing,’ things are a little different.

Smishing is when a malicious actor harvests credentials and credit card details by pretending to be someone else over text. This novel spin on phishing has grown exponentially in recent years, with the volume of messages sent to North American phones [increasing by 328% in Q3 2020 alone](https://www.proofpoint.com/us/blog/threat-protection/mobile-phishing-increases-more-300-2020-chaos-continues). Similar trends can be found in other territories. In the UK, one survey found 61% of respondents received [at least one smishing text during 2020](https://www.which.co.uk/news/2021/06/three-in-five-people-have-received-a-scam-delivery-text-in-the-last-year/).

For the perpetrators, smishing can prove incredibly lucrative. For the victims, it can be financially devastating. This article will explain how the scam works, why it’s effective, and how individuals and organizations can fight back.

## How a Smishing Scam Works

If you’re reasonably tech-savvy — or have listened to the dire warnings issued by tech companies, financial institutions, and governments — chances are high you understand the risk posed by traditional email-based phishing.

You know that email accounts can be created and hijacked. Spammers can even spoof the origins of an email. And, after countless high-profile data breaches, you may have grudgingly reconciled with the reality that your personal information is irrevocably available online.

Smishing scams, on the other hand, feel comparatively opaque. How do attackers successfully impersonate well-known brands? How do they operate at such a large scale, sending tens of thousands of messages at a time?

Let’s start by looking at the methodology. Attackers have plenty of options when it comes to the bulk distribution of text messages. They may choose to buy a device created explicitly for that purpose, with examples available online for just a few hundred dollars. Alternatively, they can use a standard mobile phone or USB cellular modem, combined with an automation program that costs just $69.

This isn't the most inconspicuous method. In June, UK law enforcement were [called to a hotel in Manchester](https://www.gmp.police.uk/news/greater-manchester/news/news/2021/june/man-arrested-in-manchester-hotel-after-over-25000-phishing-messages-sent-in-one-day/) after staff became suspicious of a guest carrying a bag filled with unusual-looking wires and electrical devices. Upon inspecting his room, police found a laptop containing 44,000 mobile numbers, as well as an SMS hardware gateway. They later determined the device was used to send 26,000 messages in the previous day alone.

Alternatively, as pointed out by veteran cybersecurity journalist Brian Krebs, attackers may choose a provider to send the messages out on their behalf. Earlier this year, UK authorities arrested the 20-year-old operator [behind the SMS Bandits gateway](https://krebsonsecurity.com/2021/02/u-k-arrest-in-sms-bandits-phishing-service/#comment-527047), which he marketed within criminal circles as “spam friendly.” Messages sent via SMS Bandits impersonated government agencies, financial services organizations, and telecommunications providers.

Now, let's talk about the composition of the text. SMS messaging is a relatively ‘flat’ medium. There is no room for a visual flair or branding. This works to the advantage of attackers, as they don’t have to painstakingly recreate the style of the organizations being impersonated. And many phishing approaches works

Within the body of the text, the attacker faithfully adheres to the phishing playbook. One common tactic is to create a false sense of urgency. They want the recipient to be anxious, as they’ll be more likely to hand over their credentials without scrutinizing the message too closely.

The pandemic has provided many examples of this. In May, a UK man was sentenced to 4 years and three months imprisonment after perpetrating a scam where [victims were asked to provide their bank details](https://www.cps.gov.uk/cps/news/covid-19-fraudster-jailed-mass-cyber-scam) in order to verify their eligibility for a Covid vaccine.

Another SMS phishing campaign [identified in South Africa in March 2020](https://www.f-secure.com/gb-en/consulting/our-thinking/how-smishing-uses-urgency-to-manipulate-victims-during-lockdown) purported to be from local financial institutions and warned the recipient that their account would be terminated if they didn’t verify their credentials.

It’s interesting to note that this campaign began during the early months of the first lockdown, at a point when many contact centers were operating at a vastly reduced capacity. The ensuing long wait times ultimately disincentivized recipients from trying to independently verify the message with their bank, which contributed to its success.

## Why is Smishing so Effective?

It's hard to find solid data on the financial cost of smishing. In most cases, it is grouped together with traditional email phishing and ‘vishing’ (voice phishing), rather than a standalone category. However, police reports and testimony from victims suggest it can be hugely profitable for the perpetrators.

One [gang made at least £20m over just eight years](https://inews.co.uk/news/pair-jailed-for-text-message-fraud-that-swindled-20m-from-bank-customers-and-funded-luxury-shopping-sprees-911561), allowing them to live a celebrity lifestyle of five-star hotels and designer clothing brands. Another man, [a 22-year-old computer science student from London](https://www.ukfinance.org.uk/press/press-releases/enfield-student-behind-scam-texts-jailed-22-months), made £125,000 before his arrest. In 2019, a Georgia federal court convicted three Romanian men for their role in a smishing scheme that [cost individuals and institutions an estimated $21M](https://www.justice.gov/usao-ndga/pr/three-romanian-citizens-plead-guilty-participating-multi-million-dollar-vishing-and).

And then there are the victims. One Hong Kong flight attendant saw [her $10,000 life savings](https://www.scmp.com/news/hong-kong/law-and-crime/article/3141567/hong-kong-sees-sharp-rise-phishing-scams-victims) drained after she clicked through a text purporting to be from her bank. A student in the UK was pushed [into her overdraft after receiving a text ostensibly from Barclays Bank](https://www.bbc.co.uk/news/uk-england-birmingham-56500599). Another woman in Topeka, Kansas [lost $600](https://www.ksnt.com/news/local-news/topeka-woman-falls-victim-to-text-message-scam-warning-others-what-to-look-for/).

So, why is it so effective? It falls down to a number of reasons.

*   Smishing is a relatively novel phenomenon, especially when compared to traditional email phishing, and much of its growth has occurred in recent years. In the UK, the volume of smishing messages [grew 700% in the first six months of 2021 alone](https://news.sky.com/story/smishing-reports-increase-nearly-700-in-first-six-months-of-this-year-12407504). There isn't the same level of awareness, and therefore, skepticism, among the wider populace.
*   Text messages have a visibility advantage over emails. While your Gmail inbox may contain thousands of unread messages, odds are good you read every single text that shows up on your phone.
*   For scammers hoping to establish credibility, SMS messages are hard to get wrong. As mentioned, it is a purely plaintext medium, with no visual flair to mimic.
*   This simplicity allows scammers to quickly respond to events. Delivery scams — which account for over half of all smishing attempts in the UK — are a good example, having proliferated after the UK concluded its withdrawal from the EU. In the US, smishing epidemics have coincided with the distribution of stimulus checks, tax season, and the widespread difficulties in obtaining unemployment insurance during the early months of the pandemic.
*   Finally, many of the tactics that make traditional email phishing successful also work over text, such as the creation of a false sense of urgency.

## Fighting Back

It’s easy to dismiss smishing as a purely consumer problem. That would be a mistake. First, there is an overlap between the tools and services used by the general public, and those used by the public and private sectors. Gmail is a good example. You might also use the same bank or the same social media platforms.

Additionally, there are many examples of text messages being used to distribute malware, or as the basis for a spear-phishing campaign. This raises the prospect of smishing becoming a major headache for public and private-sector organizations.

That all said, SMS remains a prime mode of communication due to its ease of use and sheer ubiquity. Although services like WhatsApp and Facebook Messenger offer more functionality, you can’t beat the humble text message for sheer universality.

An [estimated 96% of US adults](https://www.smscomparison.com/mass-text-messaging/2021-statistics/) own a device capable of receiving text messages, while 95% of SMS messages are read and responded to within three minutes of receipt.

It's therefore crucial that organizations proactively develop a strategy for combating smishing, with awareness at the heart of any such strategy. Employees and partners must understand that text messages are not inherently safe. They should be treated with the same level of cautiousness as email.

Employees should also feel empowered to report suspected smishing scams targeting the business. The sooner an organization becomes aware of an attack in progress, the quicker it can act.

Auth0 Security Culture Manager Annybell Villarroel notes that we’re seeing an increase in smishing attempts and recommends creating a culture of security and awareness for employees and partners through regular training.

But the biggest thing for all of us is just to learn to take a “skeptical pause,” says Annybell. “Pausing to ask yourself if the message makes sense can make a big difference. It can take you out of an emotional response back to logic. That extra few seconds can save you from a smishing click.”

What is Smishing?

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

New private cloud deployment option offers customers greater choice, scalability, and reliability

**BELLEVUE, Wash. – Oct. 13, 2021 –** The [Auth0 Identity Platform](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced the launch of the [Auth0 Identity Platform on Microsoft Azure](https://auth0.com/cloud/azure). The launch gives customers the ability to choose Azure as their cloud deployment option from Auth0. The addition of Azure as an Auth0 private cloud platform option unlocks a secure cloud deployment option for organizations seeking strategic fit with their technology stack, supporting regional data residency capabilities and higher control over customer data.

Today, organizations moving to the cloud and selecting a [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) solution require significant control over sensitive customer data and may require local data residency capabilities. They often have to make a hard choice of selecting either a CIAM solution that supports their product differentiation goals or one that meets their technical requirements and regulatory needs. Auth0’s modern identity platform eliminates the need to choose by providing organizations with tools designed to support security, compliance, and data residency needs that may apply to them across multiple regions globally. The platform’s design can accelerate their time to value and go-to-market strategies to meet their long-term growth goals. 

Key benefits of the Auth0 Identity Platform on Azure include:

* **Technology Stack Alignment:** Organizations have the flexibility to choose Azure as their preferred cloud vendor for greater technology stack alignment with existing investments in Azure. 
* **Data Residency:** Improved data residency capabilities for Auth0 customers with Azure’s widespread geographic infrastructure.
* **Streamlined Experience with Private Cloud:** A modern, cloud-native platform built with a focus on security and compliance at every level. Organizations requiring data residency options can take advantage of periodic feature updates while maintaining control over the timing and the ability to roll back without the hassle of having to maintain them — resulting in faster time to market and a more seamless experience for organizations and their customers.

“As more applications move to the cloud and expand globally, organizations depend on their identity service to protect and manage access for their most critical users, applications, and data,” said Shiv Ramji, Chief Product Officer at Auth0. “The Auth0 Identity Platform on Azure can help unlock a secure and compliant cloud deployment experience for organizations seeking support across CIAM use cases. This is especially true for organizations in industries like retail or financial services where selecting vendors that are not competitive to their business is top priority, organizations operating in regions where certain cloud providers have higher geographic availability, and those that have existing technology investments in Azure.”

“Companies like Auth0 add value by integrating their solutions with Microsoft Azure,” said Mandana Javaheri, Global Senior Director, SCI Business Development at Microsoft Corp. “With Azure, Auth0 customers have ultimate performance capabilities and control over their environment without the hassle of maintaining it, allowing customers to focus more on their core business proposition.”

More detailed information on the Auth0 Identity Platform on Azure can be found on [Auth0’s blog](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option). Auth0 will discuss this offering in greater detail with Okta at Showcase21 taking place today, Oct. 13, 2021. To learn more, visit: [https://www.okta.com/showcase/register](https://www.okta.com/showcase/register)  

<include src="asides/AboutAuth0" />
### Media Contacts:

Global Communications<br />
Auth0<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter Communications for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

### Investor Contact:
Investor Relations<br />
[investor@okta.com](mailto:investor@okta.com)<br />

Auth0 Identity Platform Now Available on Microsoft Azure

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Why Naranja and Wabi turned to Auth0 to ensure identity expertise and scaling

The market in Latin America is growing faster than ever, with new venture capital deals nearly doubling to 488 between 2017 and 2020, according to [Bloomberg](https://www.bloomberg.com/news/articles/2021-03-16/latin-american-startups-had-record-venture-capital-deals-in-2020). Beyond VC, a [study by IDB lab](https://publications.iadb.org/publications/english/document/Tecnolatinas-2021-The-LAC-Startup-Ecosystem-Comes-of-Age.pdf) revealed that the tech-enabled startup market hit a valuation of more than $220 billion USD in 2020.

![LATAM](https://images.ctfassets.net/23aumh6u8s0i/Gz6t31FLxbPc7r8T996gE/caed742f057acf90192df17560dbf527/Latam11.jpg)

Globally, the pandemic has [accelerated digital road maps across industries](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/) and businesses now have to respond to changes in digital expectations and buying patterns.
<include src="QuoteCard" body="Companies cannot predict exactly what their business and customers will need tomorrow, especially in response to today’s rapidly changing digital environment." name="Gabriel Camargo" title="Product Director" team="" company="CLM" />

Partnering with [CLM](https://auth0.com/blog/auth0-expands-global-partner-network-in-latin-america-with-clm/) on distribution in Latin America (LATAM) extends Auth0’s reach into Brazil, Colombia, Ecuador, and Peru.

Over the years of working within Latin America, we’ve learned that [identity expertise](https://auth0.com/blog/building-an-identity-solution-quantity-doesnt-equal-quality) and [scalability](https://auth0.com/blog/can-your-identity-solution-grow-with-your-company) are two critical areas of concern for businesses in the region. You can check out our earlier posts in this series for details, but here, we wanted to look more closely at how we were able to help two companies within the region.

## Naranja — From Leading Credit Card Issuer in Argentina, To Complete Consumer Ecosystem

[Fintech leader Naranja](https://auth0.com/case-studies/naranja/) has been providing credit cards to the Argentinian market for over 30 years. In that time, they’ve grown to cover over 5 million customers by keeping those customers’ needs their top priority. As they grew, Naranja also began to integrate additional verticals into their business model. Pretty soon, they were offering payment services, financing, travel, media, and other services beyond their credit card programs.

As they added these verticals, Naranja’s head of engineering Javier Voos soon realized they would need to consolidate their identity solution to cover all aspects of their growing ecosystem. He knew that in order to continue putting the customer experience first, they would need to find the right IDaaS provider that would be able to scale along with their planned expansion.

[link to video](https://www.youtube.com/watch?v=kqouiuVk07Q&feature=emb_imp_woyt)

<iframe width="560" height="315" src="https://www.youtube.com/embed/kqouiuVk07Q" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

<include src="QuoteCard" body="The main idea behind the Naranja ecosystem is to provide the best experience to our customers, making sure that our digital platform provides all the resources that an online business needs for success, and hence support the ecosystem evolution." name="Javier Voos" title="Head of Engineerin" team="" company="Naranja" />

Voos’ priority was to find a platform that provided secure APIs for identity so they could focus their expansion efforts on B2B services alongside their expanded consumer offerings. Finding Auth0 meant that his team could implement one identity solution that would allow both B2B and B2C customers access to the platforms they needed access to while ensuring data privacy and a low-friction user experience.
<include src="QuoteCard" body="Auth0 gave our company the tools to secure the access to our API for first- and third-party consumers, in a way that can scale through time and put us in a better position to ally with new partners and work our way to a fully functional Naranja API Market." name="Danilo Asis" title="Solution Architect" team="" company="Naranja" />

## WABI — South America’s E-Commerce Portal

With a half-dozen offerings already on offer, [WABI](https://auth0.com/case-studies/wabipay/) is looking to the future. Their ambitious goal is to become Latin America’s go-to e-commerce portal. Their offerings already include WABI, a smartphone-based grocery service; Wabipay, an e-wallet app; and four additional applications. The end-goal WABI envisions is for customers to log in one time and have access to a complete, end-to-end e-commerce experience. They’ll be able to shop, pay, and track delivery all in one place.

Juan Manuel Mingo, former WABI Business Manager, sums up the hurdle they faced when it came to identity and customer authentication, “We had different platforms with different user registration processes,” he says. “Our aim was to unify all the user registration of the different platforms in order to get a better user experience and to have a more organized user database.” The disjointed customer experience was the first thing WABI knew they would have to solve before they could continue growing and expanding their e-commerce ecosystem. 

<include src="QuoteCard" body="Our endgame is that you enter the ecosystem through Wabi. You log in to Wabi, order your things, and when you want to pay, you simply go to WabiPay, and you’re already logged in." name="Frederico Galli" title="General Manager" team="" company="WABI" />

Like Naranja, WABI has always had a customer-first attitude. That meant that customer-facing features like single sign-on were top priorities. As Frederico Galli stated, their endgame is for customers to sign in once and have access to the entire ecosystem of WABI offerings. Not only that, but with further expansion plans in the works, they needed an identity solution that was with them for the long haul. Juan Manual Mingo put it like this, “WABI is scalable, and we need a partner that is, too. We believe Auth0 will support us in getting there.”

![LATAM](https://images.ctfassets.net/23aumh6u8s0i/P45m9X6Z8ag9oOTv8R4kW/cc92f6325cb89fd84f233aa6c6992218/Latam12.jpg)

## Learn how Auth0 can help your business

[Argentinian talent Eugenio Pace and Matias Wolowski](https://www.forbesargentina.com/editorial/la-increible-historia-auth0-cliente-us-27-quinto-unicornio-hoy-vale-us-1100-n1352) founded Auth0, so we know the ins and outs of the South American market. When you’re ready to bring your identity solution in line with your broader organizational expansion goals, reach out to our [market experts](https://auth0.com/contact-us) to start the discussion about how we can help.

<include src="asides/AboutAuth0" />

LATAM Response to Rapid Digital Change

jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. <br>
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

The consumer speaks — how readiness to scale wins the security and privacy battle for the customer

If you sped through your digital road map during the pandemic and are looking to fill security and privacy gaps right now, go back and check out my earlier posts:

* [Accelerated Your Road Map? Go Fix Workforce and App Security](https://auth0.com/blog/accelerated-your-road-map-go-fix-workforce-and-app-security)
* [Workforce and App Privacy Have Changed, So Should You](https://auth0.com/blog/workforce-and-app-privacy-have-changed-so-should-you)

<br>
This post is about making the shift from reaction to preparation so that you are ready for the next moment that requires speed – and set up to scale.

## Find Your Balance

In all of these posts, we mention speed and imply pressure. There is always going to be a business reason to get an app to market as quickly as possible. You will discover vulnerabilities that require your immediate attention. And regulations will set deadlines for you. 

So there is always going to be more you could do to improve security for your customers, your business, and the rest of the internet. Even for veteran security professionals, the pandemic was a reminder that we still need to pick and choose priorities. If you have an internal security team, lean into their expertise. Give them the time and space to guide you on priorities. Listen to their assessments of risk and let them set a pace that works for your business.

Longer-term security and privacy improvements can have big payoffs. Like the previous posts, these things require action. You’re also going to need to support your existing security team or create one. By support, I mean backing conversations about risks with budget for tools, external vendors, and hiring internal talent.

If you don’t currently have security or privacy teams, we’ll cover a bit of advice on what to look for as well.

## Consumers Expect and Deserve Strong Security and Privacy

Let’s also set some context.

There was a time when businesses leaned heavily into just shipping the product. Speed often won over security or privacy.

> Consumers are telling us that time is over.

In a [recent global survey](https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative), McKinsey found that 87% of consumer respondents said security practice concerns would mean they wouldn’t do business with a company, and 71% would stop doing business if it gave away sensitive data without their permission. 

> The more secure and private app is now the one that keeps and attracts customers. 

## Security: Longer-Term Planning

If you’re looking to make a dramatic improvement in your cybersecurity, these best practices will help get you there.

* **Increase pen test frequency.** Penetration testing (pen testing) includes hiring an external vendor to test your application and site for vulnerabilities and provide you with a report cataloged by severity. Many companies do this once a year and call it good. In today’s evolving threat environment, that’s not enough. If you can up your pen testing to every quarter — and take action on what you learn — you’ll see a big increase in security. Adding a pen test after every major operating system upgrade, library update, or major code push will do even more.
* **Improve your software development life cycle (SLDC).** Many shops are still doing security after the product is completely coded, but this creates an automatic security backlog that can not only slow getting your product to market it can put pressure on your execs to allow unnecessary risks into the wild. Involving security and privacy teams as software is being developed allows them to raise questions that influence architecture before burning hours of engineering time. Few people like to put hours and hours into something only to have to take it apart, so your devs are rarely pleased to see this analysis tacked on at the end of the SLDC., which leads me to my next point.
* **Encourage ownership and collaboration between devs and security.** How you introduce the idea of static and dynamic code analysis as well as overall participation of security in the SLDC matters. Explaining that humans are fallible, so all code is going to have vulnerabilities, and there are going to be remote code executions (RCEs) is a good place to start. As a dev, they don’t want RCEs creating headaches, and they don’t want to get paged and work nights because problems have been discovered and exploited. You can encourage ownership by asking your dev team to review the security team handling analyses. Ultimately, this can go a long way towards establishing security-dev collaboration, leading to apps that get to market more securely as well quickly.
* **Create a golden image.** A [golden Image](https://www.cisecurity.org/cis-hardened-images/)is a single machine image that has been tested and hardened. When there is an operating system or library update, the AMI gets updated and tested. This allows you to see how your customers might be impacted before you push that patch update out to thousands of users. It also provides an approved starting point for new business units or apps. The time it takes to create and maintain this image pays off in protected services and reduced downtimes. Using [hardened](https://en.wikipedia.org/wiki/Hardening_(computing)) images also increases reliability and consistency.

## Hiring Security Talent

Security can seem like an area that is purely technical — and your team does need to have a deep understanding of your product and how it works, but sooner or later, a human is going to touch or use your product. Strong security talent needs to understand human behavior from bad actors to customers. Your chief information security officer (CISO) also needs to be able to explain technical risks and benefits to non-technical executive teams.

There’s a cybersecurity talent shortage globally. According to an International Information System Security Certification Consortium (ISC)² [report](https://www.isc2.org/Research/Workforce-Study#), that shortage shrank slightly during the pandemic, from 4 million open jobs in 2019 to 3.1 million. You’re going to need to compete for talent.

Your new CISO also needs to understand your industry because threats are often industry-specific. Here are some questions to ask your hiring team when considering a potential candidate:

* Are they passionate about not only security but also your company?
* Do they have experience in your industry? If not, how adept are they at cross-applying knowledge?
* Areas of expertise? If you need them to be a generalist, do they understand how to source third-party support (and are you willing to fund that support)?
* Do they welcome diversity? 
* Do they contribute to open source security? 
* Do they regularly attend and speak at conferences?
* Can they explain the business case for your product?

## Privacy: Longer-Term Planning

Consumers are demanding a secure and contextual private experience — and we’re seeing regulators back them up with a variety of data privacy regulations.
 
"_By industry, consumers are most comfortable sharing data with providers in healthcare and financial services, though no industry reached a trust rating of 50 percent for data protection,_” notes [McKinsey](https://www.mckinsey.com/business-functions/risk/our-insights/the-consumer-data-opportunity-and-the-privacy-imperative).

This isn’t one of those things that is going away, says Auth0’s Vice President of Privacy Lucy McGrath. Globally, we’re seeing consumer groups becoming more vocal about data privacy concerns and violations with filings against companies like [What’sApp](https://www.beuc.eu/publications/consumer-groups-file-complaint-against-whatsapp-unfairly-pressuring-users-accept-its/html). 

“_Data privacy is going to continue to evolve with consumers’ awareness and expectations,_” says Lucy. “_To adapt, companies are going to have to think beyond just meeting the bare minimum of legal requirements. They need to ask themselves hard questions about what protections are appropriate given the context and the humans you’re interacting with and work through the answers. We need to be building proactive privacy programs that reflect these data privacy conversations. Creating consumer trust requires listening and deliberate action._”

Start with these questions:

* Have I taken the time to understand the relationship my digital properties (app, site) create with my customers? How do I want them to feel at login? What about as they continue through my app or site? 
* Am I encouraging or discouraging trust by how I gather consent and data? 
* Have I created a transparent customer experience (CX) with clear consent and options? 
* If I am really honest with myself, do I need to change something? Do I really need this data?
* Who are my customers? What does privacy mean to them in the context of my services? 
* Do I have appropriate basic security and data governance processes in place? 
* Have I invested extra resources and time to protect the most sensitive/high-risk data such as health, financial, religious, or sexual orientation information? 
* Do I have any customers in regulated jurisdictions such as the European Union (EU) or California? If so, when was the last time I checked in with my legal counsel to make sure I’m in line with current requirements?

## Provide Cues for Safety and Trust

[Apple’s nutrition labels for data privacy](https://www.wired.com/story/apple-app-privacy-labels/) make good on efforts that have been around since the 2010s. If your new app is going to be in the App Store, Apple requires that you report publicly on data you’re using to track your customers, data linked to them, and data gathered but not linked to them. Even though Apple is relying on app developers to self-report, the labels increase consumer awareness and expectation, says Lucy. Given Apple’s size ($274.5 billion reported revenue in 2020 makes it the world’s largest company), these nutrition labels signal that data privacy is now an everyday consumer concern.

“_Businesses who don’t respond could miss out_”, says Lucy. “_The threats of data privacy fines and unhappy customers are real, but so is the opportunity to create customer experiences (CX) that drive brand loyalty. The entire tech industry is coming together to work on these data privacy challenges. Companies that act on the side of the consumer stand out._”

## Hiring Data Privacy Talent

Like security, data privacy professionals need to understand and express the intersection of humans and technology. They need to be able to communicate risks and benefits across an entire organization, with an emphasis on engineering, marketing, and senior leadership. Critical and analytical thinking, empathy, and consideration of different motivations and perspectives are key. Technical knowledge around privacy laws can be taught, but an ability to engage, listen and understand the context of the business and their customers is essential. Privacy isn’t “done” by privacy professionals - they support all parts of the business to build privacy protections into their individual business processes.

Lucy recommends that you ask candidates questions to show how they think about privacy issues in the context of the businesses in which they work. Examples of such questions include: 

* How would you demonstrate the value of good privacy practices to the chief financial officer (CFO)?
* How do you respond to the statement: privacy slows the business down? 
* What can you do to support developers to integrate privacy controls into their development lifecycle?
* Provide examples of when you have translated legal obligations into plain English requirements that the business can implement?
* Which company does privacy well? Why? How would you implement similar standards here?
* What are the key privacy risks that need to be prioritized? What actions are required to mitigate these risks?

## You’re Helping Make the Internet Safer

Thank you for checking out this series. One of the things that came up while working on this content is how the pandemic has made everything even more connected. The [threat landscape](https://auth0.com/resources/whitepapers/state-of-security-identity-report) and regulatory requirements can seem overwhelming, but taking the time to secure your personal data, your customer’s data, and your businesses make it harder for bad actors.

Identity can be a weak spot for both security and privacy if it’s not handled by experts. A strong Customer Identity Access Management (CIAM) solution like Auth0 can increase your security, support your data privacy strategy, and comes with certifications for various compliance requirements like [ISO 27001:2013](https://auth0.com/blog/what-is-iso-27001-2013-a-guide-for-businesses/) and [ISO 27018:2019](https://auth0.com/blog/what-is-iso-27018-2019-everything-executives-need-to-know/) and [CSA Star](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/). If you’d like to learn more about how Auth0 can help make your business more secure and stay ahead of your customers’ evolving expectations, please [reach out to the team at Auth0](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales).

<include src="asides/AboutAuth0" />

Time to Prepare: Be Ready to Scale Your Workforce and App

The tech market in Latin America is growing; Auth0 can help you keep up with a scalable identity solution.

The number of Venture Capital deals signed in Latin America hit a record high of 488 in 2020. That’s nearly double the 2017 number according to [Bloomberg](https://www.bloomberg.com/news/articles/2021-03-16/latin-american-startups-had-record-venture-capital-deals-in-2020). The growth in the tech market in LatAm isn’t only apparent in new startup deals; companies who already have a presence in the region are expanding both through mergers and acquisitions and by looking into new countries to grow their footprint in the region. 

Each scenario brings its own challenges for your IT infrastructure, particularly your[ identity solution](https://auth0.com/blog/how-to-scale-quickly-with-identity/). If you’re expanding into a new country, there’s likely to be a different data privacy regulation you’ll have to comply with. And that startup you’re eyeing probably has a vastly different infrastructure than yours, whether private or public cloud or even legacy on-prem. An Identity management solution has to be able to expand and flex in order to grow with your company, regardless of the specific scenario.

![Business Expansion](https://images.ctfassets.net/23aumh6u8s0i/1HnNeEEQ4hCBb2M4y2ZerT/5b5a1de004ea8021fdc38d042a85a672/Latam05.jpg)

## With Business Expansion Come Business Questions

Let’s take a look at those two potential growth scenarios and what they mean for your business’s identity solution. First up is the acquisition of a competitor or related smaller entity. [Mergers and acquisitions](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) (M&A) always bring an array of unique challenges, but for this article, we’re going to focus on the identity challenges associated with the merging of IT infrastructure.

Your web app may be hosted on a public cloud, but the company you just bought has been in business for a while and is still using on-prem hosting for theirs. In order for you to bring both properties together under one identity solution, you need one that can bridge the gap between the two, allowing your new audience access to both apps without managing multiple sets of credentials.

In our second scenario, your organization is considering an expansion into a neighboring country to take advantage of the easing of business restrictions and the growing market for your product that your marketing team has identified. You already comply with the privacy regulations in your country, but are you ready to comply with those abroad? 

Is your organization ready to answer questions like these:

* Can our existing in-house identity platform scale to include our hybrid-cloud infrastructure and the legacy system our latest acquisition uses?
* Is our identity solution ready to handle the influx of new user accounts and login requests when we roll out to our new market?
* Is our consent gathering process in compliance with the regulations in the country we’re expanding into?

If not, or if the answer to any of these questions is “no,” it may be time to consult with an identity specialist. 

<include src="TweetQuote" quoteText="Auth0 recommends you always consult legal counsel when it comes to complying with data privacy regulations." />

## Auth0 Is the Identity Solution That Scales With You

Both of these scenarios mean you’re going to be scaling your infrastructure, adding users to existing web apps, and even adding new web apps. Having an identity solution in place that can easily expand to include controlling access to these new properties can help reign in costs and speed your time to market post-expansion. Our customers tell us that by using Auth0 for their authentication and identity needs, they took their time-to-value from months or years down to weeks or even days.

Credit card company [Visa reported](https://www.marketwatch.com/story/visa-sees-massive-digital-acceleration-with-millions-trying-e-commerce-for-the-first-time-2020-05-13) that during just the first month of the COVID-19 pandemic, more than 13 million cardholders in Latin America made their very first e-commerce transaction. That’s 13 million new accounts being created, 13 million new logins, and 13 million opportunities for identity to go wrong if your solution isn’t scalable. There are many aspects to what makes something scalable. When it comes to identity, we see five as being the most important.

1. **Bridging legacy and cloud systems**

One of the downsides to M&A is that your IT department inherits the backend infrastructure of the other company, for better or worse. Auth0’s extensive SDK libraries and robust APIs mean it’s a simple matter to bridge the gap between legacy systems and modern cloud-first ones. One login box can take your current and new customers to both web apps, no matter where they’re hosted. This ability also speeds your time to value because your developers can maintain focus on their core product delivery rather than piecing together connectivity solutions that may only work for a short time.

2. **Single source of truth for customer data**

Bringing all of your customer data together into one single source of truth (SSoT) makes it that much easier to protect. It also speeds access when a user logs in, as no matter which property they’re using, it has only one place to look to find their credentials, rather than scouring multiple data silos.

3. **Single sign-on**

Customers want low-friction experiences online, and being able to create an account using credentials they already have is a great way to win them over. Single sign-on (using account information from a provider like Apple, Facebook, or Twitter) allows a customer to create an account on your site quickly and easily, and without the need to create and remember a new password.

4. **Breach protection**

The issue of passwords brings us to a major sticking point for many identity solutions, protecting user information from data breaches. According to the most recent [IBM/Ponemon Cost of a Data Breach Study](https://www.ibm.com/security/data-breach), the global average cost of a breach is now $3.86 million (USD). And Verizon reports in their [2021 Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) that 61% of breaches involve misuse of credentials. Put those together, and you see why protecting your customers’ information is such a major piece of scaling your online business presence and why a robust identity solution needs to take this aspect into account.

5. **Protection from staffing fluctuations**

An often overlooked aspect of identity projects is the simple fact that people change jobs. If you have an identity tool that was developed in-house two years ago, there’s a good chance you won’t have anyone on staff who can expand it to cover your new properties. That will delay roll-out and extend your time-to-market. 

[Auth0 customer WABI](https://auth0.com/case-studies/wabipay/) is modernizing e-commerce in Latin America. They’re currently active in 11 countries and have expansion plans to add four more in 2021. And they’re trusting Auth0 to scale their identity solution to match these ambitious plans. “WABI is scalable, and we need a partner that is, too. We believe Auth0 will support us in getting there.” Says WABI Business Manager Juan Manuel Mingo. With their planned expansion opening their market to millions of potential new customers, WABI knows they need a robust identity platform that’s ready to handle the influx of new users.

## Auth0 Brings Global Experience to Your Latin America Growth Plans

Our founders are from Argentina, the company was started in the United States, and we currently have people in 30+ countries with more being added every day. Our [international team](https://auth0.com/blog/auth0-expands-global-partner-network-in-latin-america-with-clm/) of identity specialists can help you work out your identity needs and help get you set up with an identity as a service (IDaaS) platform that is ready to grow with your company, no matter what your expansion plans look like. We know that having an identity solution designed to be extensible and flexible to move with your business can mean the difference between a successful rollout or a failed acquisition attempt. 

Auth0 is built on open standards, making it easy to connect with existing systems and varying infrastructure scenarios. Bridging the gap between a public cloud-based web app and an on-prem user database is only the beginning. Our extensive marketplace of integrations means you can connect with your existing business software solutions as well.

Our breach protection includes features such as [bot detection](https://auth0.com/docs/attack-protection/bot-detection), [adaptive MFA](https://auth0.com/multifactor-authentication), [single sign-on](https://auth0.com/single-sign-on), and [passwordless](https://auth0.com/passwordless) flows. And the [Auth0 Marketplace](https://marketplace.auth0.com/) has what you need to handle everything from consent management to business process software integrations. The protections and extensibility we offer is a key factor in our scalability. 

When the time comes to expand across borders, Auth0 is ready. We’re certified by a third party as compliant with the International Standards Organization (ISO) standards [ISO27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [ISO27018](https://www.iso.org/standard/61498.html) for handling information security and personally identifiable information (PII) as a cloud provider.

![Growing](https://images.ctfassets.net/23aumh6u8s0i/1sBMtrIri0sAw0OBkWE4QV/41d7fc8b0740ac05ec3c82145fd1478f/Latam06.jpg)

## Auth0 is the Identity Solution That Can Keep Up With The Growing LatAm Market

To provide your customers with a continuous, low-friction, and intuitive login flow requires a robust identity solution. Whether you’re scaling internationally or your growth plans call for staying closer to home, Auth0 can provide the IDaaS platform you need to maintain a great customer experience while ensuring the security and privacy of your customer data. And don’t worry if you’ve already started an identity project and hit a stumbling block, [our experts can help](https://auth0.com/contact-us). 

<include src="asides/AboutAuth0" />

Can Your Identity Solution Grow With Your Company?

Hear from Auth0 customers how CIAM supports scalability and drives transformation

With people not only working but also shopping, banking, socializing, and receiving healthcare via digital platforms, identity management has become not just [a competitive advantage](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/) but a requirement. Organizations across industries need to manage identity in a secure, scalable, and seamless way. Part of the challenge is that identity is disseminated across multiple applications and devices, effectively making [identity itself the perimeter](https://auth0.com/resources/whitepapers/identity-perimeter). To satisfy user expectations and meet business needs in this new ecosystem, organizations are embracing third-party [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) solutions like Auth0.

At the core of the IDaaS space is [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/), which involves authenticating users’ identities and controlling their access to online resources. A key enabler for organizations undergoing digital transformation, IAM encompasses:

* **Authentication**, or how you determine whether someone’s claimed identity matches their actual identity. [Multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication) is increasingly recognized as the standard method of authenticating identity.
* **Authorization**, or the allocation of permissions to individual users or types of users. For instance, if an administrator leaves your organization, you can revoke their permissions; you can also add users or expand permissions according to your needs.

Typically, organizations have to manage identity for different types of users: customers, employees, and enterprise partners. Because each type of user has different priorities and expectations of your platform, each type demands its own carefully calibrated balance of convenience, privacy, and security. For example, your employees and contractors will probably put up with time-consuming, headache-inducing processes to get paid and access other benefits because they have few alternatives. Customers, on the other hand, have lots of choices, and if you can’t deliver a swift, effortless login experience, they’ll find one of your competitors who can.

[Customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) platforms are built to optimize the balance between convenience, privacy, and security for each type of user. With the right CIAM platform, you can:

* Deliver a secure and frictionless login experience
* Guide compliance with data privacy laws
* Protect data assets against malicious intrusion
* Derive more specific, meaningful insights from customer data

Using four Auth0 customers as examples, let’s explore how CIAM can help you allocate resources more effectively, secure identity across your entire infrastructure, and deliver more value to your users. 

In [our new whitepaper](https://auth0.com/resources/whitepapers/ciam-transformation), we delve more deeply into each of these customer stories and suggest strategies for choosing and implementing the right CIAM platform. If you find this content useful, be sure to [download the full whitepaper](https://auth0.com/resources/) or check out some of our other [identity resources](https://auth0.com/resources/).

## Enable Expanding Use Cases

With 170 superstores across the UK, furniture retailer [Dunelm](https://auth0.com/case-studies/dunelm/) describes themselves as “product-obsessed.” In 2018, they began a massive digital overhaul of their existing internal infrastructure in favor of a modern, flexible cloud data platform that would transform the digital experience for their customers, employees, and external vendors.

> A key aspect of Dunelm’s [buy-rather-than-build](https://auth0.com/resources/whitepapers/build-vs-buy-for-b2b-evaluating-identity-management) approach to their digital infrastructure was replacing their in-house identity system with Auth0. This move has saved them significant time, effort, and staffing costs.

Initially, Dunelm planned to use Auth0 for straightforward customer authentication, but they soon incorporated the service into multiple business operations serving customers, employees, and partners.

From here, Dunelm plans to further expand its Auth0 use case and add more customer value through personalized, frictionless shopping experiences.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/5rQhP0U1KzmX0aJfsAuZh3/dbc28afb39fa3f557119114372a086bc/CIAM_ecommer_e_recorte1.png)

## Centralize Identity across Platforms

UK-based conditioning brand [Gymshark](https://auth0.com/case-studies/gymshark/) is one of the most recognizable functional training apparel brands in the world, with a social media following of 10+ million and customers in over 170 countries. During the development process for their conditioning app, Gymshark realized they needed a centralized authentication solution that worked across both their online and mobile applications. They had one major priority: a seamless customer experience.

While they briefly considered building their own solution, Gymshark ultimately decided to entrust Auth0 with their CIAM needs. With Auth0 handing IAM for customers and employees, Gymshark can focus on creating apps and other technology that advances their core mission. Auth0 is a critical enabler for Gymshark’s tech-powered, user-centric future. 

## Replatform and Eliminate Legacy Code

[Kiva](https://auth0.com/case-studies/kiva-implements-auth0-rules-mfa/) is an international crowdfunding nonprofit focused on expanding financial access to help underserved communities around the world thrive. Kiva had built their own authentication solution in-house over time, adding functionality when they needed it to meet business requirements, but they knew they needed to replatform to a microservice architecture with a dedicated identity service to support future growth.

With Auth0, Kiva was able to eliminate more than 22,000 lines of legacy code, freeing up engineering resources considerably and allowing the company to focus its efforts on core business functions rather than on managing identity. Investing in CIAM now also prepares Kiva for successful mobile implementation, which is key to their growth strategy. The bottom line: CIAM enables Kiva to shift and scale securely and with minimal friction. 

## Achieve Smooth Scalability

[TVNZ](https://auth0.com/case-studies/tvnz-cs/), New Zealand’s state-owned, commercially funded broadcaster, reaches more than two million New Zealanders every day. TVNZ also offers OnDemand streaming services that reach up to half of the country’s five million citizens with 2.5 million registered accounts. At a moment in history when a trustworthy news source is more important than ever, the broadcaster needed a CIAM partner who could help them rapidly scale, migrate users, and maintain their reputation.

When they signed on with Auth0 to handle authentication for their OnDemand streaming web and mobile platforms, TVNZ was faced with the task of migrating data for 2.5 million accounts. To avoid forcing all of their customers into a password reset, TVNZ opted for an automatic migration in which customer data was migrated only when a person logged in.

But another challenge lay ahead. TVNZ’s digital platforms faced unprecedented demand during the pandemic lockdown, with weekly streaming rates jumped by 50% and tens of thousands of users logging in more or less simultaneously to watch Prime Minister Jacinda Ardern’s daily addresses. With Auth0 handling their identity needs, TVNZ experienced “no real issues,” reported [Michael Robinson](https://www.linkedin.com/in/faceleg/?originalSubdomain=nz), Head of Digital Capability at TVNZ. Entrusting CIAM to Auth0 allows TVNZ to stay on mission and maximize the value of their development resources.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/1fjzGfRtdlHhMCsxgeDZdp/86223bf45b185cfa9ddee428eefa28b6/CIAM_ecommerce_recorte2.png)

## What Challenges Could CIAM Solve for You?

Is your login process so painless that customers barely register it? Do your customers trust you to handle their personal information? Do you have all the insights into customer behavior you need? Are you confident that your customer identity solution can scale in response to escalating demand without lags or outages? Unless the answer to all of these questions is an unambiguous “Yes!” (in which case, nice work!), investing in CIAM is a sound decision.

Ask yourself what your team could accomplish if they didn’t have to worry about managing customer identity and access. For a closer look at the customer stories we’ve summarized here, and to learn more about how CIAM can enable digital transformation at your organization, [download the whitepaper](https://auth0.com/resources/whitepapers/ciam-transformation).

<include src="asides/AboutAuth0" />

Four Ways CIAM Empowers Your Business

Enable agile scalability with customer identity and access management (CIAM)

In the last few years, identity has become a familiar concept to business decision-makers seeking to fortify their security, unlock efficiency gains, and outpace competitors.

[Customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) is a set of solutions built to help organizations balance convenience, privacy, and security for every type of user who needs access to their platform. At Auth0, we’ve heard from our customers that investing in third-party CIAM solutions can benefit the entire organization, especially by:

* Providing a seamless, secure customer experience
* Protecting against expensive data breaches
* Guiding compliance with data privacy laws
* Gathering customer data into a single source of truth
* Increasing the success of digital transformation projects

Another major advantage to CIAM is that centralizing customer identity helps you build more scalable solutions — and scalability is both a benefit of and a requirement for the advantages listed above. Simply put, CIAM gives you the tools you need to scale identity quickly.

![The Business Value of Scalability](https://images.ctfassets.net/23aumh6u8s0i/BXZTiwu81LfqqP7O3yEmj/a66340c22f87e48739da621e7e46cdf6/02_B_power.jpg)

## The Business Value of Scalability

Scalability refers to a system’s ability to increase its capacity and functionality based on the evolving demands of its users. Your industry may be volatile, but scalable software allows your platform to remain stable in the face of infrastructure changes, updates, overhauls, and resource reductions/additions.

Laggard legacy systems are inflexible and resource-intensive to maintain, which for many companies is reason enough to prioritize digital transformation. Critically, legacy systems also fall short of modern scaling demand and user expectations. 

In contrast, building scalable solutions helps your organization increase predictability; trim maintenance and upgrade costs; and become more agile, so you can meet customers’ dynamic demands.

> Scalable software also shortens time-to-value. Your teams will bring products to market more quickly and deliver more value to your customers if they don’t have to worry about scaling your identity solution.

### Increase reliability

Scalable software systems increase reliability, so you can avoid outages and maintain continuous uptime. The ability to provide a smooth, consistent customer experience even in the face of demand spikes is a key competitive advantage enabled by CIAM. When circumstances like a major news broadcast or a big sporting event cause your platform to be flooded with requests, you don’t want to experience lags or outages. The bottom line: Lack of scalability leads to reduced reliability, which can drive users to another service. 

### Protect against data breaches

A scalable identity solution helps protect customer data from breaches and exposures that can occur as your organization scales. [A 2020 IBM-Ponemon study](https://www.ibm.com/security/data-breach) found that data breaches cost an average of $3.86 million per incident globally, with the number rising to $8.64 million on average in the United States. Breach-related costs include actual fines and reputation erosion that can lead to customers shifting to competing brands.

<include src="TweetQuote" quoteText="With CIAM, you can offer your customers the convenience of rapid authentication without introducing security vulnerabilities that make you more susceptible to a data breach." />

### Be ready for mergers and acquisitions

If you want to enhance your appeal as an acquisition target, or if you’re evaluating other companies to acquire, a solid CIAM strategy is critical. [Implementing CIAM before a merger or acquisition](https://auth0.com/blog/why-iam-is-essential-to-m-a-and-replatforming/) can prevent you from spending months integrating applications struggling to reconcile a high volume of user data, exposing security vulnerabilities, or introducing friction that drives customers away. 

CIAM goes a long way toward minimizing the disruption of M&A activity: before, during, and after integration. Managing post-M&A integration in-house is a difficult, time-consuming job that keeps your developers from devoting their full attention to your core solutions — which is more important than ever when you need to mitigate churn. [As Auth0 customer Cimpress discovered](https://auth0.com/case-studies/cimpress/), the right approach to customer identity management allows you to connect companies with divergent systems to your platform quickly and easily.

## How Does CIAM Enable Scalable Identity?

Identity touches every function of your business. Typically, organizations have to manage identity for different types of users: customers, employees, and enterprise partners. Each user type has different requirements for your platform depending on how they use it. CIAM not only helps you provide the right balance of convenience, privacy, and security to each type of user; it also gives you superior insight and a single source of truth to drive better strategic decision-making. 

### Give customers the frictionless experience they want

When a seamless customer experience is your first priority, scalability is an absolute requirement. And with customer-facing applications, ease of experience is everything. If your CIAM solution doesn’t scale, your users will abandon you for another service.

As a customer, you’ve probably experienced this impatience. If you’re trying to order dinner and your first-choice food delivery platform is overwhelmed and experiencing lags, you’ll switch over to another platform — and that platform might be your first choice from then on.

CIAM also allows companies to unify their login experience across apps, creating a consistent experience that benefits both user and brand. UK-based conditioning company [Gymshark](https://auth0.com/case-studies/gymshark/), an Auth0 customer, is a great example of how CIAM enables an exceptionally smooth, secure login experience across platforms. Gymshark needed a universal login solution that could authenticate customers across 15 different online stores and mobile apps. With Auth0, they’re able to manage access for 250,000 monthly users while securing their platform against [credential stuffing attacks](https://auth0.com/resources/whitepapers/credential-stuffing-attacks) and other threats to the login box.

### Cultivate customer trust with strong security

Your customers trust you to keep their personal information private; to be transparent and responsible with how you collect, store, and use their data; and to comply with regulations designed to protect customer privacy. CIAM enables you to uphold this trust as your solution scales, and your integration ecosystem expands.

Data privacy laws like [GDPR](https://auth0.com/docs/compliance/gdpr), [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/), and [APPI](https://auth0.com/resources/whitepapers/amended-appi) require companies to understand how third-party providers manage the collection, use, and storage of data in their systems. CIAM solutions help guide compliance with these regulations, so you don’t lose sleep over non-compliance fines or expensive data breaches.

Implementing CIAM shows customers that you are literally invested in ensuring their privacy and security. Similarly, essential [certifications](https://auth0.com/docs/compliance) like HIPAA, CSA STAR, and ISO 27001/27018 also signify to customers and regulators that you’re not just claiming a strong security posture; you’re undergoing regular, rigorous security checks by an expert third party.

### Accelerate time-to-market and solve for future problems

Implementing CIAM lets your developers focus on supporting your core solutions instead of also having to manage identity in-house. As a result, you’ll bring products to market faster and deliver more value to your customers.

At Auth0, we recommend that companies make decisions around CIAM based not on where their business _is_, but on where they want it to be. You need identity management capable of scaling to meet future business needs, not just the pain points you encounter today. Where do you want your business to be in five years? How will that drive your scalability needs? Think strategically about your desired future state. If you get overly focused on the pain points you’re encountering right now; you may be inviting incompatibility and tech debt into your business infrastructure.

![Manage Identity Complexity with CIAM](https://images.ctfassets.net/23aumh6u8s0i/5jPq4nBdhF6cZtBAJYb2xM/2cafa607686a3a828b43b9d3161cdd8d/02_C_power.jpg)

## Manage Identity Complexity with CIAM

Since identity touches every aspect of your business, the functionality and scalability of your identity solution will tend to match the functionality and scalability of your organization as a whole. With CIAM, you can deliver the secure, frictionless experience your customers expect as you scale and integrate your ecosystem. That’s why many of our customers have opted to manage the complexity of identity with CIAM.

To learn more about how CIAM can help you reach your milestones, [get in touch](https://auth0.com/contact-us) with the experts at Auth0.

<include src="asides/AboutAuth0" />

How to Scale Quickly with Identity

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

From scalability to CX, CIAM unlocks business-wide benefits

Customer experiences happen primarily online. If this wasn’t completely true for your business before 2020, it’s probably true now. Companies have come to understand that a seamless digital experience is no longer a competitive differentiator; it’s a baseline requirement.

Moreover, pressure-cooker economic conditions during the pandemic have shown that [companies that understand their customers’ needs on a deep level](https://digitally.cognizant.com/customer-identity-and-access-management-in-the-age-of-covid-19-codex5721/) are better-positioned to succeed. One way organizations are trying to do this is [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/).

CIAM refers to a set of solutions intended to create the optimal balance between convenience, privacy, and security for each type of user. While [identity and access management (IAM)](https://auth0.com/blog/what-is-iam/) is focused on managing identity and access for employees and partners, CIAM centers on customers.

CIAM exists at the intersection of customer experience, security, and analytics. It enables a smooth onboarding/login experience to build customer loyalty and increase conversion rates, guides compliance with data privacy laws and empowers companies to prevent data breaches. Crucially, CIAM encompasses not only how companies control end-users’ access to digital assets but also how they collect, analyze, and store data related to those users.

## A Centralized Source of Truth

CIAM enables companies to compile siloed user data into a single source of truth that helps you make better strategic decisions. If your user data is disorganized, siloed, and inaccurate, you can’t generate a clear picture of your customers. Without clear insight into your users, you can’t offer highly personalized offers and product recommendations that drive additional revenue and create more value for your customers.

> Duplicate and siloed data also create barriers to compliance with data privacy laws. A centralized view of your customers gives you the tools you need to meet the requirements of laws like [GDPR](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) and [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/).

### Can’t we build it ourselves?

Some organizations manage part or all of CIAM themselves, but that’s a big challenge, and it gets bigger as you scale. Given the complexity and dynamism of CIAM, forward-thinking companies are entrusting CIAM to one or more third-party [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) experts. Outsourcing CIAM to a third party is a wiser use of your resources than asking your developers to manage customer identity in-house. [Buying rather than building your CIAM solution](https://auth0.com/resources/whitepapers/ciam-buyers-guide) saves time and money, and it gives you the agility and expertise you need to respond to evolving use cases, new or updated privacy laws, and other variables that can make identity management more complicated.

## Business Benefits of CIAM

Centralizing user data on one platform unlocks company-wide benefits even beyond creating a single source of truth. Here’s an overview of the organizational rewards you can realize with CIAM.

### Scalability

On the list of advantages of CIAM, scalability is near the top. Unlike B2B and workforce identity solutions that support users with static access to preassigned applications, CIAM platforms must be able to support millions, even billions, of users. In addition, CIAM solutions must be able to scale in response to not only anticipated events (like the holiday shopping season or the World Cup) but also to unanticipated events that can dramatically increase demand (like [viewers eager for official updates during the pandemic](https://auth0.com/case-studies/tvnz-cs/)).

### Customer experience

When customer experience is a priority, features like [single sign-on (SSO)](https://auth0.com/docs/sso) and adaptive [multi-factor authentication (MFA)](https://auth0.com/learn/social-login/) help you deliver the frictionless CIAM experience your customers expect.

CIAM platforms also enable event-driven personalization tactics, such as progressive profiling, in which user data is collected incrementally in a series of interactions over time. The goal is to build a trusting, mutually beneficial relationship between the company and customers. Users recognize that by providing more information (such as rating a purchase or filling out demographic information), they can get more value in the form of personalized offers and relevant recommendations. And by cultivating the trust of their customers, companies ultimately realize more value in terms of both reputation and revenue.

### Security

Customer data is among your organization’s most prized assets. In the wrong hands, however, data becomes a liability. That’s why the best CIAM solutions have robust security features built to defend against malicious attacks on any front.

For many organizations, the login box is the front line of defense against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/resources/whitepapers/credential-stuffing-attacks). A CIAM solution with MFA and brute force protection is an important part of your defense strategy. MFA ensures that one stolen credential won’t allow automatic access to your users’ other accounts, while brute force protection keeps attackers from barraging your application with fraudulent login attempts that can crash your site.

### Privacy and compliance

Centralized user management is necessary to meet the reporting and erasure requirements of data privacy laws like [GDPR](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), [CPRA](https://auth0.com/blog/cpra-passed-what-s-changing-in-ccpa-2-0/), APPI, and LGPD. These laws are literally rewriting the rules for how organizations are permitted to collect, store, and leverage user data. CIAM helps you meet these legal requirements by enabling the encryption of sensitive data, controlling access to digital resources, and collecting data, and [managing consent](https://auth0.com/blog/what-you-need-to-understand-about-consent-management/) in compliance with applicable laws.

## Create More Value with CIAM

As organizations initiate and accelerate digital transformation projects to meet sky-high demand for digital services, CIAM is becoming indispensable across industries, from [retail](https://auth0.com/case-studies/dunelm/) to [tech-powered fitness](https://auth0.com/case-studies/gymshark/). 

In our whitepaper, we explore in depth the capabilities you should look for in a CIAM platform, from scalability and agility to personalization and compliance. You can also [reach out to the Auth0 team](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us) to learn more about how CIAM could benefit your organization.

<include src="asides/AboutAuth0" />

Why do you need CIAM?

The bcrypt hashing function allows us to build a password security platform that scales with computation power and always hashes every password with a salt.

Hashing in Action: Understanding bcrypt

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Salesforce's Next Generation Identity demands the scalability, agility, and connected digital experiences that Auth0 offers



**BELLEVUE, Wash. – November 17, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced it has been selected as the identity provider to power authentication for Salesforce Customer 360 Identity, its best-in-class consumer identity and access management (CIAM) technology, providing a single, trusted identity for more streamlined user management. Salesforce Customer 360 Identity will go into a pilot phase at the end of the year and will be generally available in early 2021. 

Salesforce Customer 360 Identity is one of four products that comprise [Customer 360 Truth](https://www.salesforce.com/products/platform/features/customer-360-truth/), a set of data and identity services that enable companies to build a single source of truth for relevant and lasting customer relationships. The leading CIAM, data management, customer data platform, and privacy tools available in Customer 360 Truth provides a unified customer view to maintain customer privacy, security, connect siloed data systems, and harness new digital business.

Driving the frictionless login experiences for all Customer 360 Identity users, Auth0 will provide a seamless signup to drive better conversions, the ability to scale to any size, and a single customer login across all users' digital properties, eliminating siloed data and providing a single source of truth for IT departments. 

"The need for digital transformation has reached new heights, challenging companies to deliver simple, connected, and trusted experiences online," said Patrick Stokes, EVP, Platform Shared Services at Salesforce. "Customer 360 Truth delivers just that. And, combined with Auth0, companies will be able to engage with their customers like never have before—authenticating millions of users quickly and securely."

"Customer data is the cornerstone of Customer Success and hinges on the ability to have a comprehensive view of your customers," said Nick Mehta, CEO of Gainsight. "As a customer of both Auth0 and Salesforce, I'm excited about their integration to help streamline how we access and map user data."

Auth0's deep developer roots and the ability to provide a superior pro-code developer experience offers a natural integration into Salesforce's platform. Auth0's platform provides the out-of-box experience that most customers need and also allows their developers to easily customize their login flows via code and the large library of integrations readily available from the Marketplace. 

"Persistent challenges B2C customers face&mdash;scale, needing a holistic view of the customer, and enhanced security&mdash;are consistent across the industry, especially with the urgent speed in which companies are prioritizing their transformation efforts," said Shiven Ramji, Chief Product Officer at Auth0. "We believe this need will intensify as more businesses are forced to transform and we look forward to working with Salesforce customers going through this process."

In July 2020, Salesforce Ventures was the lead investor in Auth0's $120 million Series F round, bringing Auth0's valuation to $1.92 billion and total capital raised to more than $330 million. 

<include src="asides/AboutAuth0" />

### Media Contacts
Global Communications <br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Hannah Carroll <br />
Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />


Auth0 Selected as Identity Vendor of Choice for Salesforce Customer 360 Identity

Tech platform supporting more than 13,000 local pizzerias nationwide relies on scalability and login security with Auth0



**BELLEVUE, Wash. – October 15, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has been selected as the sole identity and authentication provider for [Slice](https://slicelife.com/), the innovative tech platform powering America’s local pizzerias. Having recently closed a successful [round of Series C funding](https://blog.slicelife.com/slice-raised-43m-in-series-c-funding-to-power-local-pizza/), Slice will use Auth0’s platform to provide a secure login experience for Slice’s five million customers as it continues to scale. 

Slice transforms independent pizzerias with the specialized technology, data insights, and shared services needed to serve today’s digital-minded consumers. Its vast network of more than 13,000 local pizzerias enables these small businesses to compete against major corporate chains and form the nation’s largest marketplace for authentic pizza across 3,000 cities in all 50 states. 

As its network of pizzerias and customers continues to grow, Slice looked to Auth0 to provide authentication for its growing consumer base, already over five million users. After a thorough review of solutions, Auth0 was determined to be a much better fit for scale, security, and lower ongoing maintenance costs. Another big factor in selecting Auth0 was its ability to support bulk migration, eliminating the hassle for end-users to have to reset their passwords.

“Auth0 is the only identity management platform that offers the level of flexibility, security, and customization we need,” said Jason Ordway, CTO for Slice. “Our goal is to provide our users across the country with easy access to their favorite local pizzerias. Auth0 will be a great partner in enabling that while also setting us up for success for our continued growth.”

“Slice is transforming the pizza business, and is helping local businesses move online to keep up with today’s digital demands, especially during the pandemic,” said Ghazi Masood, SVP of Americas for Auth0. “We are thrilled to support Slice’s identity needs and help them seamlessly scale to continue expanding their network.” 

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications <br />
[press@auth0.com](mailto:press@auth0.com) <br />

Matter for Auth0 <br />
[auth0@matternow.com](mailto:auth0@matternow.com) <br />


Auth0 Delivers Secure Authentication for Slice

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Auth0 enables SSO and Social Logins to save months of development time and help scale for expansion



**SINGAPORE – 28 May 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that it has partnered with a digital signage software company, ScreenCloud, to provide authentication for its growing enterprise offering. [ScreenCloud](https://screen.cloud/) will use Auth0 for enterprise federation, Single Sign On (SSO), and Social Logins to help its enterprise customers securely create and control content from anywhere. 

ScreenCloud helps leading brands transform how they communicate with employees and customers using simple, smart, and secure digital signage software. Its digital signage solution is trusted by more than 9,000 customers around the world, including Amazon, Uber, and Dropbox.

As the company sets its sights on significant international growth for its enterprise offering, ScreenCloud chose Auth0 as its primary identity management platform that offers the best combination of versatility, security, and ease of implementation. Auth0 will help support the diverse authentication and access management requirements of ScreenCloud’s enterprise customers, including SSO and Social Logins.

“Many of our customers store highly confidential data on our platform, so they demand secure authentication, and Auth0 makes it very easy for us to seamlessly tailor the authentication experience to suit each customers’ requirements,” said Brian Dewangga, Enterprise Product Manager at ScreenCloud, Thailand. “From a time-saving standpoint, it’s not just the big investment of time to build the solution, but also the long-term maintenance of the system.
By using Auth0, we also save significant resources on maintaining and updating identity management, which provides enormous value for us.”  

“Our growth in the region is marked by exciting fast-growth companies like ScreenCloud,” said Richard Marr, General Manager for Asia Pacific at Auth0. “Their pace of innovation and growing global demand required an identity solution that they could onboard and implement quickly to serve their customers better. We look forward to supporting their ongoing expansion.” 

Auth0 is helping ScreenCloud quickly build resiliency and scale for expansion. With a growing user base around the world working remotely due to COVID-19, ScreenCloud is developing new features to support the remote workforce and anticipates a significant increase in logins. 

“The world looks very different now to what it did a few months ago. We want to help remote workers interact with their company without needing to be in the physical presence of a company-owned screen,” said Dewangga. “It’s increasingly important for us to allow distributed teams to log on easily, without exposing sensitive company information. We feel we’re in good hands with Auth0.”

ScreenCloud believes using Auth0 will deliver a return on investment in the form of saved developer time and peace of mind, allowing them to focus on their core product.

<include src="asides/AboutAuth0" />


ScreenCloud Chooses Auth0 for Global Enterprise Offering

sonny-chen

Sonny is a designer that values process, alignment, and asking the right questions. He has worked in various environments, from startups, larger companies, to design agencies. He currently lives in Pittsburgh, and previously lived in New York, San Francisco, and Northern Virginia. In his free time, Sonny enjoys playing basketball, dabbling in music production, and trying new foods.

Product Designer at Auth0

Sonny Chen

Designing remotely can be scary, but it doesn't have to be. With all this said, our tools and processes are constantly evolving.



Remote work is becoming more common now than ever before. In today's digital age, we have tools that can eliminate the need to be co-located in order to get things done.

At [Auth0](https://auth0.com/), our team of nearly twenty designers spans multiple time zones, with members distributed across Seattle, Argentina, France–even all the way to <a href="https://en.wikipedia.org/wiki/Georgia_(country)">Georgia</a> (the country, not the state next to Florida).

We take pride in our ability to not only sustain but thrive as a remote-first design team. This is because, while the ability to work remotely is a common practice in almost all companies, those that are fully remote tend to be within certain departments like engineering. For roles that may require more in-person interactions, such as design or product management, there aren't many remote options to choose from. Folks in design that consider remote opportunities are often disappointed to find out that "remote-friendly" doesn't always apply to their role.

Now, there are many reasons why companies may be reluctant to hire remote designers–even many of us who came from traditional work offices were hesitant about what this change in environment and lifestyle would mean to our day-to-day. However, being a company that empowers everyone to work from wherever they want–including designers–we wanted to share with the community some of the ways we approach and solve the challenges of designing remotely.

## Tools & Plugins

Within the design team, we've built an extensive list of tools that we rely on to stay productive, collaborative, and in constant communication. Note that this list can vary by company and teams. At Auth0, our designers are spread across thirteen product teams and marketing initiatives, with some teams working more closely than others. It's important to find tools that meet your team's specific needs and processes and to constantly challenge them as new ones come into place. Here are some of the tools that work well for us (from general to more specific):

### [Figma](http://www.figma.com/)

Figma is our design tool of choice because it enables real-time collaboration and helps us design in the open by acting as a shared repository for all our design files and libraries. We can easily organize files based on team structures and have even created cover templates for each file so that we can easily track and update the progress of projects.

It also offers a lot of benefits when working with our cross-functional partners. Figma is browser-based, so we can easily share work without worrying if people can open it or accidentally overwrites our files. Also, Figma files can be embedded as iframes. This is great for showcasing work straight from our project documents.

### [Mural](https://mural.co/)

For those that are worried about losing that magical whiteboarding experience when going remote, Mural is the tool for you. With Mural, our team can virtually huddle around a whiteboard to brainstorm and collaborate in real-time. There are many benefits to using a virtual whiteboard, and sometimes it can even be better than physical ones.

First off, everything is automatically digitized. No more transcribing or rewriting notes if you messed up or ran out of room. You can also add images, sticky notes, create flows, and drag things around as you like.

Second, we've noticed that virtual whiteboards can give everyone a better opportunity to contribute because no one person is dominating the board or conversation. This is incredibly important in giving everyone a voice so that we can drive better ideas and decision-making.

### [Slack](https://slack.com/)

The design team relies on Slack for many reasons beyond team organization. In terms of workflow, we use Slack to help us automate task management, status updates, surveys, and creating events. We even use Slack to recruit user research participants from Slack developer communities!

Slack is also crucial when it comes to team bonding and communication. A few members of the team are co-located, so we rely on Slack to ensure that no one feels left out. How else can we share our abundance of cat GIFs?

### [Trello](http://www.trello.com/)

There are many ways to use Trello, but one of our favorite ways is to use it to onboard new folks. Our Trello's contain information on design ceremonies and cadences, tools, Slack channels to join (e.g., #design-jams is where we share music), and much more. It's also great because it serves as a living board that we can continually iterate on as the team grows.

### [Zoom](http://zoom.us/)

Zoom is our video conference tool of choice because it offers some cool features along with it's incredibly simple and reliable experience. First off, as a company that relies heavily on customer feedback, Zoom is a great tool to invite and interact with external folks and lets you easily record sessions to the cloud. This makes it easy to capture and share user research sessions or all-hands. Zoom also offers a neat feature called breakout that makes facilitating brainstorms and workshops super easy and fun.

![zoom_image](https://images.ctfassets.net/23aumh6u8s0i/75hTZ7LZadWL300LgZqN2q/92c1a40c1b22bec4aadf73feb82622e8/1_zoom_image)
<p style="text-align: center"><i>The design team in our monthly reviews. Can you tell we like cats?</i></p>

### [Clockwise](http://www.getclockwise.com/)

We value our time to get work done, so we use Clockwise to decrease context-switching and create focus blocks on our calendars. The plugin also connects to Slack so that it can automatically update your status when you are grabbing lunch, in a meeting, or in the middle of your focus time.

### [Loom](http://www.loom.com/)

When we want to capture and share demos asynchronously or walk through an idea, we use Loom. This also makes it easy for people who weren't available to catch up on what they missed.

![loom_image](https://images.ctfassets.net/23aumh6u8s0i/7yWXZlS5xiyqZXWvLJMhkr/c01dbda64c929b03d95b48a5bf3b6a5c/loom_image)
<p style="text-align: center"><i>Tony from our team using Loom to walk through how he injects data into usability prototypes</i></p>

### [Krisp](http://www.krisp.ai/)

Being a remote team, we can expect to find people working from a coffee shop, the airport, or even the beach as long as there's service. For moments when the background noise can get a little distracting, we use Krisp to mute background noise in real-time calls. It's amazing!

### [Donut](http://www.donut.com/)
We use a Slack app called Donut that pairs you with random people across the company. It's a great way to get face time with those that you normally wouldn't interact with, and oftentimes people walk away with something valuable.

### [Toby Chrome Extension](http://www.gettoby.com/)

Lastly, sometimes it can get challenging to manage all the projects and documents that are in flight. We use Toby, which is a Chrome plugin that turns your browser tab into your personal collection of links. You can set collections for documents that need your attention or save a collection of good reads to share with the team.

## Communication & Process

As designers, we often serve as the connective tissue between teams as part of thinking holistically and designing a cohesive product experience. This requires strong levels of communication within the design team and with our cross-functional partners. As part of our work, we need to ensure that everyone is clear on goals, has ongoing conversations as projects develop, and share learnings across teams so that we can achieve better outcomes and reduce duplicative work.

Here are some of the ways we facilitate this type of communication:

![Remote Working](https://images.ctfassets.net/23aumh6u8s0i/1a1S0WICPdXHF78I3S3ysT/23b698a239d8a43d7d800794cae2620f/0_hero)

### Project and temporary channels in Slack

Slack can create just as much distraction as it can create productivity. At Auth0, multiple projects can be happening at any time with many different people involved. Rather than posting all updates to team channels, we like to create project-based channels to eliminate unnecessary noise and to consolidate everything into one place.

For projects and conversations that are short-lived but still need a space for discussion, we create temporary channels by specifying "tmp" at the beginning of the channel name (e.g., #tmp-project).

### Knowledge shares

We value team diversity and recognize the amazing mix of talents and backgrounds within our design team. In order to grow, we encourage designers to hold knowledge shares where they walkthrough their process on a particular topic, whether that be creating plugins, facilitating workshops, or conducting user research.

### Pairing

Impromptu pairing sessions are a central part of our day-to-day, and we often find that they yield quicker and more valuable results than scheduled meetings with larger groups. We try to make these seamless by integrating the Zoom plugin with Slack so that you can create and join a session with a push of a button.

### Workshops and Brainstorms

We like to bring as much structure as we can into our meetings. This includes preparing slides and exercises ahead of time, having a clear agenda, designating people to take notes, and always defining action items.

![workshops](https://images.ctfassets.net/23aumh6u8s0i/7z2pn0Ywqm4kgLMx5ZPiuz/b7e14aa5cc256eac74f0870df83cbb7f/3_workshops)

<p style="text-align: center"><i>The design team running through a structured ideation session with our cross-functional partners</i></p>

### Ceremonies
Our design team has a set of recurring meetings where we communicate updates, share ideas, and look to each other for support. These meetings include weekly status updates, critiques, design all-hands, knowledge shares, and more. It's important to schedule these while considering everyone's time zones.

For our meetings, we like to have a show, not just tell, policy in which we prepare slides with accompanying visuals so that everyone can follow along with the proper context. We also try to systematize everything we do so that we can focus on what's important. An example of this is templatizing slide decks so that it reduces prep work while creating consistency in our presentations.

In terms of process, team members can propose changes to how we operate at any time, and we like to send out design surveys and polls through Slackbot to get pulse checks on how we feel.

### Offsites and Retreats

With all this said, sometimes it's good to just meet up in person. At Auth0, we have multiple offsites a year (including locations like Cabo!). We take advantage of these opportunities to hold strategic meetings, hear from different parts of the business, but also to bond and enjoy our time with our fellow team members.

![offsites](https://images.ctfassets.net/23aumh6u8s0i/5vtHEO6uoB5bbAany2rb4m/c46569fc26c27d6b2c1318a21baed949/4_offsites)

<p style="text-align: center"><i>The Auth0 design team getting together at our Bellevue office</i></p>

## Conclusion

Designing remotely can be scary, but it doesn't have to be. With all this said, our tools and processes are constantly evolving. As our team continues to grow, we face new challenges, such as scaling our design system or bringing more data into our design decisions.

If you have any thoughts or tips on anything that was mentioned, please drop them below. We would love to hear them!

Also, if you are considering remote work as a designer or any other role, check out our job page [here](https://auth0.com/careers/positions?areas=Design).

Thanks for reading!


Designing Remotely at Auth0

fikayo-adepoju

Fikayo Adepoju is a Full-stack developer, technical writer and tech content creator proficient in Web and Mobile technologies and DevOps with over 10 years experience developing scalable distributed applications. With over 40 articles written for CircleCI, Twilio, Auth0 and The New Stack blogs and also on his personal Medium page, he loves to share his knowledge to as many developers as would benefit from it. You can also check out his video courses on <a href="https://www.udemy.com/user/fikayo-adepoju/">Udemy</a>.

Full-Stack Developer

Fikayo Adepoju

Using Google Vision API, build a game where the user scans an image to match an emoji displayed.

Creating an Emoji Game with Vue, Auth0, and Google Vision API

alejandro-ortuno

Alejandro is a Security Engineer in Auth0's Detection & Response team with a passion for automation and the cloud. Initiated as a software developer, he has experience working on AppSec, network security and cloud security for startups and enterprise companies such as Cisco or Rackspace. He spends his spare time learning newer technologies, playing padel and breaking things.

Security Engineer

Alejandro Ortuno

Discover how Auth0 uses security automation to respond to GuardDuty events at scale and our learnings in the process



Cloud adoption is occurring at a rapid pace and so are the risks and challenges in maintaining those secured environments. Doing it at scale requires the extensive use of automation and tooling. DevSecOps methodologies can also be applied to the detection and response of threats, decreasing the time to respond and preventing potential breaches. Logging pipelines, Slack bots, orchestration tools, and serverless technologies empower operation teams in a way that traditional security operations centers (SOC) can’t. Services such as AWS GuardDuty provide indispensable threat detection to continuously monitor for malicious activity and unauthorized access on cloud resources.

At Auth0, we have embraced the cloud since our inception, and with cloud resources in numerous AWS accounts in our organization, strong defenses and timely response to security events in the cloud are an absolute priority for us. That is why our Detection and Response team has embraced technologies to automate the response to security events in the cloud to scale for our [future organizational growth](https://techcrunch.com/2019/05/20/auth0-billion-dollar-unicorn/).

In this blog, we will provide an overview of the implemented architecture for the alert analysis, triage, user notification, and automated response of the AWS GuardDuty security findings on all of our AWS accounts.

## AWS GuardDuty Service

[_Amazon GuardDuty_](https://aws.amazon.com/guardduty/) is a threat detection paid service that continuously monitors for malicious activity and unauthorized behavior on AWS accounts and workloads. The service consumes CloudTrail, VPC Flow, and DNS logs and then enriches them with threat intel from AWS and other third-party services (such as CrowdStrike). GuardDuty also uses machine learning techniques to detect malicious activity on an AWS account. The service is regional (needs to be enabled on a per-region basis) and has a 30-day free trial. GuardDuty findings, if any, will start populating just a few minutes after the service is enabled.

At Auth0, we enable the GuardDuty service at account creation in all regions. Configuration follows a [_master/member_](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_accounts.html) setup where every new AWS account becomes a new member of the master GuardDuty account.
From there, a combination of regional CloudWatch event rules and AWS Lambda functions ships all GuardDuty events into our security information and event management (SIEM) system.

We also monitor the health of this ecosystem closely as any failure would mean a critical gap in our alerting systems. As an example, we monitor specific [_GuardDuty API calls_](https://docs.aws.amazon.com/guardduty/latest/ug/logging-using-cloudtrail.html) (such as `Disassociate`, `StopMonitoring`, `DeleteDetector`, and many more) that could tamper with our infrastructure resulting in a page notification to our team.

Also, we have subscribed to the [_GuardDuty Announcements SNS Topic_](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_sns.html) and integrated the alerts with our bot, so we get Slack notifications when there are new GuardDuty findings or updates to the existing ones that require our attention.

## SecurityBot

At Auth0, we rely heavily on Slack as our main communication channel. On top of it, [we have created Slack Bots](https://auth0.com/blog/auth0-internal-dev-tools-unleashing-engineering-potential/) that can automate our common tasks and help us scale and better respond to security events.

One of those bots is the SecurityBot, developed by the Detection and Response team on top of our Security Orchestration, Automation, and Response (SOAR) system. Auth0’s SecurityBot was inspired by the awesome work of the security teams at both [_Slack_](https://slack.engineering/distributed-security-alerting-c89414c992d6) and [_Dropbox_](https://github.com/dropbox/securitybot).
The SecurityBot helps us in two main tasks:

- As a ChatOps function, we can ask the bot to create an incident response channel, add all necessary members to it, initiate the documentation for an incident, or perform an investigation on specific IPs and Domains.

- As our main channel to communicate with employees. The bot can send notifications or inquiry messages (that require a confirmation) to our employees, ask for MFA confirmation, or even page our team if an employee responds negatively to a specific event.

![A message notification from SecurityBot](https://images.ctfassets.net/23aumh6u8s0i/3heWkQLOzq6ehvjVSDE5a1/967048353b36f46ce89be46c3ea7be00/a-message-notification-from-securitybot)

## AWS Incident Response Tool (aws-ir)

Especially important when dealing with an incident is to have a timely response. For that reason, our team has developed an internal tool to make investigation and response on AWS a much easier and repeatable task.

AWS IR is an API built on a serverless infrastructure that allows our team to take necessary forensic artifacts and response options on a specific machine in any of our AWS accounts. Those actions are mainly:

- Take a snapshot of the instance volume.

- Run a set of [_osquery_](https://osquery.io/) commands.

- Take a memory dump.

- Take a `tcpdump` of the network traffic.

- Isolate an instance.

We have integrated this tool with the response to GuardDuty events so we can collect artifacts and perform response actions depending on the severity of the alerts.

## The Hive Project

Keeping records for the actions taken and the artifacts collected is sometimes a “boring” but necessary task to do while performing a response to an incident. [_The Hive Project_](https://thehive-project.org/) is our main ticketing and artifacts collection platform that we use to perform our investigations.

We rely on its APIs to create alerts, promote them to cases, and to upload the artifacts that we automatically collect.

## Automating the Response Like a Pro

Now that we have explained all the different elements that compose our architecture let’s see how we glue them together.

We partner with the security automation company [_Tines_](https://tines.io/) in this regard. Every alert from our detection stack, whether it’s from SIEM, GuardDuty, Phishing, or custom tooling we’ve built, first goes through Tines where it is enriched, prioritized, and ticketed. We also use Tines to automate the response to the GuardDuty alerts.

One of the most common observations after enabling GuardDuty is that it can be daunting at the beginning and that it requires a significant amount of time to tune it to make it serviceable for your environment. Let’s take a look at a few examples of what this tuning looks like and some associated caveats:

### Network Load Balancer: Port Probe Alert False Positives 

Receiving a GuardDuty event of an instance which have a random port that is being probed by a malicious IP from the internet can be concerning. But the story changes if the instance has no public IP, and is behind a load balancer which has port 443 open to the internet. The reason for this is that the Network Load Balancer, by default, offers "Source IP Preservation" and the source IP addresses of the clients are preserved and provided to your backend applications. This is documented in the following [_public article_](https://mysteriouscode.io/blog/dont-panic-false-positives-from-guardduty-and-network-load-balancer-nlb/) as well. Later we will discuss how we have overcome this limitation when making changes on the load balancer is not an option.

### Alerting on harmless customer provided domains

If your service takes or ingests domains supplied by your customers and queries them (as is the case for us), GuardDuty can flag some of this legit activity as malicious. We encountered false positive "Backdoor and Trojan" alerts that happened due to customers providing flagged domains into our service.

### Detecting anomalies while employees are on the move

Machine learning is great, and we definitely believe in this technology for detection purposes (we want to further expand on this technology for our own sake). Still, it doesn’t cope well on a remote-friendly company where employees are on the move, continuously changing their locations and source IPs.

### GuardDuty events for already terminated EC2 Instances

We have received GuardDuty events where the instance state is “terminated” (this information is contained on the GuardDuty event). On an ephemeral infrastructure where instances are spun up and torn down on demand, and there are no long-running services, this can limit our capabilities to respond to incidents or to perform live investigations.

### Visibility gaps in cloud environments

There is a lack of visibility for Digital Forensics and Incident Response (DFIR) with GuardDuty for containers/microservices, especially if they are running on the same EC2 instance. Alerts will come from the same EC2, and additional logging/tooling will be needed to respond to those alerts.

<include src="TweetQuote" quoteText="Learn how to tune GuardDuty to make it serviceable for your environment and the associated caveats."/>

So let’s dig deeper into how we have automated the response for those GuardDuty findings and overcome some of those challenges. We have grouped the different GuardDuty events and their responses mostly into four different categories:

1. EC2 PortProbe alerts

2. IAM User non-critical alerts

3. IAM User critical alerts

4. EC2 Other alerts

Let's go over the response for each of them.

## PortProbe Alerts

The first group of alerts involves inbound port probing, which means potentially malicious IPs probing ports that are open on the internet. We do have PortProbe type of events (_Recon:EC2/PortProbeUnprotectedPort_) and also SSH and RDP brute force events included in this group.

Initially, we filter out common ports that we know are open and are commonly attacked (for example, port 443). Also, as mentioned before, we do not want instances that are behind a network load balancer to trigger events if the load balancer is opening common ports such as 443. For that reason, we have built an [_AWS Step function_](https://aws.amazon.com/step-functions/) that maps network load balancer ports against instance ports and dumps this information on a DynamoDB database. From Tines, we query the database to filter out alerts on instances behind a network load balancer from which the listening port is 80 or 443.

![AWS Step function to collect network load balancer information](https://images.ctfassets.net/23aumh6u8s0i/6ApTwxb12qBo36xQ3tlpVc/a22e10551f48604894d5ef8326394160/aws-step-function-to-collect-network-load-balancer-information)

Finally, if the event is not filtered and has not been notified before, we send a notification via SecurityBot to the resource owner (based on Instance tags).

## IAM User Non-Critical Alerts

In this group, we cover GuardDuty `IAMUser` events that we have deemed non-critical. These events typically suggest suspicious API calls made by AWS principals. Our main action with those alerts is to first automatically determine the mapping of the Principal to an employee and their endpoint machine. From there, we check their device IP and compare it to the IP in the alert. If there is any mismatch, we trigger a SecurityBot Inquiry message to ask the employee for confirmation that they made the AWS API call.

![SecurityBot Inquiry Message](https://images.ctfassets.net/23aumh6u8s0i/3urYXdOgk6xG4F2nOp2L1B/53a2bf233268ff3b2f95a9c14ee28ab2/securitybot-inquiry-message)

## IAM User Critical Alerts

In this group, we cover the GuardDuty IAMUser events that we have deemed critical, and as such, they trigger a PagerDuty alert to our team. These events include modification to CloudTrail, password policy changes, credential exfiltration, or the [_latest S3 specific alerts_](https://aws.amazon.com/about-aws/whats-new/2019/10/amazon-guardduty-adds-three-new-threat-detections/) among others.

We also enrich the alerts with the following information:

- List of employees seen under the same offending IP over the last 24 hours

- CloudTrail API calls made by the offending IP

## EC2 Alerts

Within this group, we have the following event types:

- EC2 Outbound network connection

- EC2 DNS request

- EC2 PortScanning

There is an important filtering layer that we needed to implement for our network scanner, and also for services that query customer provided domains which caused false positives to trigger. We initiate the AWS Incident Response tool to collect specific artifacts on the instance so we can better perform timely forensics investigation on the machines.

<include src="TweetQuote" quoteText="Dig deep into how Auth0 has automated the response to GuardDuty events and the associated challenges."/>

## Conclusions

We have no doubt as to the incredible value and visibility the AWS GuardDuty service provides to our team. Enabling it is incredibly simple, and we have decided to include it on each of our AWS accounts.

Automating our response to the GuardDuty alerts has helped us focus on what is important to us, filtering out some of the noise it generates and customizing it to our environments. We have evolved from processing hundreds of GuardDuty events per week (that would completely consume our team’s time to review and respond to these alerts) into just a few events per week needing our manual review. To add to this, with SecurityBot, we empower our employees to provide valuable real-time data relating to potential security incidents, making them aware of the alerts and also adding them to the front line of our security team.

For future work, we will continue to improve the automation for our incident response process. We also want to include other sources of information into our alerts, such as the events provided by agents like [_osquery_](https://osquery.io/) or information specific to containers and Kubernetes infrastructures. On top of that, we will expand our threat model to include attacks vectors such as compromised employee machines, malicious insiders, etc.

<include src="asides/AboutAuth0" />


"sca"