https://cybertoolchain.io/tools/auth0 New releases and features in Auth0, tracked by The Cyber Toolchain. en Fri, 30 Oct 2026 00:00:00 GMT https://auth0.com/changelog#25z5IDDY8h57bTw1soVdUe https://auth0.com/changelog#25z5IDDY8h57bTw1soVdUe Fri, 30 Oct 2026 00:00:00 GMT Auth0 adds SMS Fraud Protection with Exponential Backoff for Phone MFA on Enterprise plans to replace static rate limits with progressive delays⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Auth0 now logs throttled SMS send attempts as `limit_phone` tenant log events, including remaining cooldown durations, for audit visibility into fraud-throttling activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • An initial buffer of immediate retry attempts accommodates typos or delivery delays before progressive wait times take effect. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#IjtX2rgnCrMxBcfYhTuuL https://auth0.com/changelog#IjtX2rgnCrMxBcfYhTuuL Thu, 29 Oct 2026 00:00:00 GMT Auth0 adds RFC 9421 HTTP Message Signatures to Tenant Network ACLs for cryptographic origin verification via the Management API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Observe key-rotation activity and verification events via `acls_summary` Tenant Log events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Auth0 Tenant Network ACLs now support RFC 9421 HTTP Message Signatures via the Management API, letting enterprise tenants enforce HMAC-SHA256 request verification at the network boundary to block direct tenant bypass. • Validate that incoming requests originate only from authorized reverse proxies or gateways, dropping unverified direct traffic. • Rotate signing keys with zero downtime by configuring multiple active signing keys per rule. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Wed, 28 Oct 2026 07:53:54 GMT Auth0 adds Agent Mode to CLI, CIMD dynamic registration, Identity Conversion Suite, Application Profiles, and FGA Permissions Index EA⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--agent-mode` flag (or `AUTH0_AGENT_MODE=true` env var) for structured JSON output, prompt-free operation, guaranteed non-zero exit on failure, and stable error `code`/`reason` fields (auto-detected for recognized agent clients); `auth0 commands --flat` (with optional `--detailed`) for full CLI discovery in a single call; `--schema` to print the exact JSON payload a command expects (sourced live from the OpenAPI spec) and `--data` to send a whole payload as one JSON object with local validation before it reaches the API; `auth0 docs search` for searching Auth0 documentation from the terminal without login; and `auth0 agent skills install` to install the Auth0 skill into Claude Code, Cursor, or all supported assistants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces CIMD (Client ID Metadata Document) with dynamic registration in Early Access, allowing MCP clients and AI agents to connect to a tenant via just-in-time registration using a metadata URL — no pre-registration required. • Introduces Application Profiles in Early Access, enabling centralized governance of security settings (refresh token lifetimes, leeway, DPoP, B2B login behavior) across all CIMD-registered applications from a single configuration point in the Auth0 Dashboard under the Applications section. • Adds an `Unblock Behavior` setting to Brute-Force Protection (`Auth0 Dashboard > Security > Attack Protection > Brute-Force Protection`), with `Automatic` (default) and `Manual` modes — Manual mode prevents email security scanners from consuming recovery links before the user opens them. • Graduates the FGA Permissions Index from Developer Preview to Early Access, with self-service build/monitor/manage inside the FGA Dashboard; Enterprise subscriptions include one index with up to 10 million expansions, with a paid add-on scaling to 10 indexes and higher expansion limits. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#4KAJcZF0wcFnG8Yln9SugQ https://auth0.com/changelog#4KAJcZF0wcFnG8Yln9SugQ Tue, 27 Oct 2026 00:00:00 GMT Auth0 adds Universal Portals in Developer Preview — hosted self-service portals for end users and organization admins, built from pre-built components and served on your doma⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Auth0 now offers consumer portals where end users can update their profile, enroll MFA factors and passkeys, and review security settings — hosted by Auth0 on your domain with no interface to build or maintain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Auth0 now offers business portals where organization administrators can edit organization details and verify domains, without custom development. • Build portal pages visually using Universal Components, Auth0 Forms, and layout components such as headings, rich text, sections, separators, and images. • Add an Auth0 Form to any portal page to collect or update information, including profile updates, policy acceptance, and communication preferences. • Portals inherit your tenant's logo, colors, and fonts — or switch to an organization's branding when opened in an organization context. • Portal servers hold access and refresh tokens server-side; the browser receives only a secure session cookie. • Portals automatically trigger an MFA step-up challenge when Auth0 requires MFA for an operation, then retry the operation once the user completes it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#5C8lUdlgOoptJ0dLnFdR0T https://auth0.com/changelog#5C8lUdlgOoptJ0dLnFdR0T Mon, 26 Oct 2026 00:00:00 GMT Auth0 launches Identity Conversion Suite in Early Access, bundling Anonymous Sessions and Experiment Center for Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Anonymous Sessions to maintain session context for visitors before they sign up or log in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Experiment Center to A/B test login experiences and review results in metrics dashboards. • Introduces the Identity Conversion Suite as a paid add-on for Enterprise plans, combining Anonymous Sessions and Experiment Center. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#5tM7A32Ytnk1JlK29f0rDO https://auth0.com/changelog#5tM7A32Ytnk1JlK29f0rDO Thu, 22 Oct 2026 00:00:00 GMT Auth0 Early Access: Application Profiles centralize security settings for DCIMD apps used by AI agents in one config point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Application Profiles (Early Access) to govern security settings — refresh token lifetimes, leeway, and DPoP — across all DCIMD applications from a single configuration point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds B2B behaviour configuration for DCIMD applications via Application Profiles, controlling whether applications serve individuals, organizations, or both, along with login experience settings. • Enables centralized management of third-party applications created and used by AI agents through Application Profiles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#1tZgllWxrRu1H5aLnyRbCp https://auth0.com/changelog#1tZgllWxrRu1H5aLnyRbCp Thu, 22 Oct 2026 00:00:00 GMT Auth0 adds CIMD with dynamic registration (Early Access): MCP clients and AI agents self-register via metadata URL at OAuth time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports Client ID Metadata Document (CIMD) with dynamic registration (Early Access): MCP clients and AI agents present an HTTPS metadata URL during the OAuth authorization flow and are discovered and registered just-in-time — no administrator pre-registration required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Picks up changes to a client's metadata and public signing keys automatically, without manual syncing. • Introduces Application Profiles (Early Access) to centrally manage refresh token policies, DPoP, and Organizations for dynamically registered CIMD clients. • Supports optional manual pre-registration flow: an administrator submits the client metadata URL, reviews it, and approves the client before creation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#E3VrkNOAtDXK2dKD7awpv https://auth0.com/changelog#E3VrkNOAtDXK2dKD7awpv Thu, 22 Oct 2026 00:00:00 GMT Auth0 Brute-Force Protection gains a Manual Unblock Behavior mode to prevent email scanners from auto-consuming recovery links.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Unblock Behavior` setting to Brute-Force Protection with `Automatic` (default) and `Manual` modes — Manual mode presents a confirmation page so headless email scanners (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Microsoft 365 Defender) cannot silently consume the recovery link before the user opens it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#1FcrCTfE0s6q19SKASSQx9 https://auth0.com/changelog#1FcrCTfE0s6q19SKASSQx9 Wed, 21 Oct 2026 00:00:00 GMT Auth0 CLI gains Agent Mode: structured JSON output, full CLI discovery, schema-validated payloads, and one-command AI assistant setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--agent-mode` flag (or `AUTH0_AGENT_MODE=true` env var) to enable structured JSON output, disable prompts and color, and guarantee non-zero exit codes on failure — auto-detected for recognized agent clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `auth0 commands --flat` subcommand for full CLI discovery in one call; append `--detailed` for complete invocation shapes. • Adds `--schema` flag to print the exact payload a command expects, sourced live from the OpenAPI spec. • Adds `--data` flag to send an entire payload as one JSON object, validated locally before it reaches the API. • Adds `auth0 docs search` subcommand to search Auth0 documentation from the terminal without requiring login. • Adds `auth0 agent skills install` subcommand to install the Auth0 skill into Claude Code, Cursor, or all supported AI assistants in one command. • Structured errors now carry a stable `code`, a finer `reason`, and field-level detail on validation errors instead of a free-text sentence. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Tue, 20 Oct 2026 07:55:07 GMT Auth0 adds phone-country controls and a guided ACL rule builder to Universal Login and Tenant Access Control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds tenant-level include/exclude lists via tenant settings to configure which phone countries are supported in Universal Login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds theme API controls for identifier presentation (type-specific 'Continue with' buttons vs. unified field) in Universal Login. • Adds updated Universal Login phone entry UI with country selection, regional formatting, numeric keyboard, and phone number suggestions on supported devices — available in Early Access on all plans. • Adds a Guided Rule Builder under `Security > Access Control` for constructing complex Tenant ACL policies using step-by-step prompts for scope, entity, and action selection. • Adds Visual Rule Sequencing — an interactive canvas to reorder Tenant ACL policy priorities and inspect exact rule execution order. • Adds Instant Status Toggles to enable or disable individual Tenant ACL rules with a single click from the dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#4V2KLeS754BaqpApjLAE5b https://auth0.com/changelog#4V2KLeS754BaqpApjLAE5b Tue, 20 Oct 2026 00:00:00 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#6nXqRQE3p5dS9cVMrbpwpr https://auth0.com/changelog#6nXqRQE3p5dS9cVMrbpwpr Fri, 16 Oct 2026 00:00:00 GMT Auth0 Universal Login gains type-specific 'Continue with' buttons and tenant-level phone country include/exclude controls in Early Access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds tenant-level include/exclude lists for supported phone countries, configurable via the `PATCH /api/v2/tenants/settings` endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds identifier presentation controls (type-specific `Continue with` buttons vs. unified field) configurable via the `PATCH /api/v2/branding/theme` endpoint. • Adds an updated phone entry UI for Universal Login with country selection, regional formatting, numeric keyboard, and phone number suggestions on supported devices. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#HTiKAsmSY7oHPP7EJKeqB https://auth0.com/changelog#HTiKAsmSY7oHPP7EJKeqB Mon, 12 Oct 2026 00:00:00 GMT Auth0 adds a guided dashboard UI for building, sequencing, and toggling Tenant ACL rules without manual syntax.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Guided Rule Builder under 'Security > Access Control' with step-by-step prompts for scope, entity, and action selection to construct Tenant ACL policies without syntax errors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Visual Rule Sequencing canvas to reorder Tenant ACL policy priorities and inspect exact rule execution order. • Adds Instant Status Toggles to enable or disable individual Tenant ACL rules in a single click while Auth0 handles the underlying API calls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#1XGBthpxlSgDVxlWVGehN2 https://auth0.com/changelog#1XGBthpxlSgDVxlWVGehN2 Fri, 09 Oct 2026 00:00:00 GMT Auth0 Actions gain GA-level access token scope customization with Post Login support and read/write scope interfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Exposes `event.transaction.target_scopes` in Actions to read the live target scope list, reflecting every change across chained Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds api.accessToken.addScope() restriction for third-party applications, where it is no longer available to prevent consent bypass. • Promotes Access Token Scope Customization for Actions — including Add, Remove, Set, and Clear scope interfaces — to General Availability for Credentials Exchange Actions. • Extends target scope interfaces (Add, Remove, Set, Clear) to Post Login Actions, in addition to Credentials Exchange Actions. Breaking changes: • api.accessToken.addScope() is no longer available in Actions executed for third-party applications; any existing Action relying on it for third-party apps will need to be migrated to the target scope interfaces. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Sat, 26 Sep 2026 07:48:40 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Fri, 25 Sep 2026 07:51:43 GMT Auth0: Adds a member access level model (none, readonly, limited, full) that computes each member's permissions automatically from their organization connection access levels. • Activate the My Organization API by navigating to `Applications > APIs` in the Auth0 Dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Thu, 24 Sep 2026 07:52:22 GMT Auth0 adds Action Modules, B2B Member Management API, custom user IDs at signup, and real-time enterprise connection events⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds api.user.setUserId() method in `onExecutePreUserRegistration` Actions to assign custom user IDs (UUIDs, domain-specific, or legacy-compatible formats) to new database-connection users at signup, replacing the need for self-hosted signup pages or bulk import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `connection.created`, `connection.updated`, and `connection.deleted` events for enterprise connections (Azure AD, ADFS, Google Workspace, Active Directory, LDAP, Ping), deliverable to a webhook or Amazon EventBridge as CloudEvents-formatted JSON. • Adds Action Modules, enabling reuse of custom functions across multiple Actions and Triggers, with independent secrets and dependencies per module. • Adds unit testing support for Action Modules via helpers in the `@auth0/actions` package. • Adds IntelliSense autocompletion and type hints for Action Modules in the Auth0 Dashboard and external editors via `@auth0/actions`. • Adds the My Organization API and Embeddable UI Components for B2B member management, supporting member invitations (bulk up to 10 per request), role assignment, and a four-tier access level model (`none`, `readonly`, `limited`, `full`). • Adds permission-aware UI components that show or hide actions based on the authenticated user's effective permissions surfaced from the ID token, with no additional API call required. • Adds tenant log events for all member, invitation, and role operations for B2B observability. • Extends B2B Connect (Early Access) to support automatic session termination when an enterprise IdP ends a session, email-domain-based enterprise connection discovery, and direct application connections to Auth0 without an external authorization server. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#IEtKos3D7EXQYFieg95jE https://auth0.com/changelog#IEtKos3D7EXQYFieg95jE Fri, 18 Sep 2026 00:00:00 GMT Auth0 Actions Modules reaches GA, enabling reusable code, independent secrets, and unit testing across Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `@auth0/actions` npm package providing unit-testing helpers and IntelliSense (autocompletion and type hints) for Actions Modules in any editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces Actions Modules — create, manage, and share reusable code across multiple Actions and Triggers within an Auth0 Tenant. • Supports independent secrets and dependencies defined per Action Module, decoupled from the Actions that import them. • Enables cross-trigger reuse of custom functions by importing a single Module into any Action regardless of which Trigger it is bound to. • Improves execution performance by moving expensive initialization logic into a Module that is initialized once and reused across Action invocations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#RGWWqahrwFtycXhPate8b https://auth0.com/changelog#RGWWqahrwFtycXhPate8b Thu, 17 Sep 2026 00:00:00 GMT Auth0 Actions can now assign custom user_id values at signup via api.user.setUserId() in pre-user-registration hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds api.user.setUserId() method callable inside a `pre-user-registration` Action to assign a custom `user_id` — UUIDs, domain-specific IDs, or legacy-compatible IDs — to new database-connection users at signup, replacing the automatic `auth0|<id>` format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports custom user IDs across Database connections (including custom databases with automatic migration), Universal Login sign-up, the Authentication API signup endpoint, and the Management API Create User endpoint. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#QVyBUwb38zOqMQuF5Rohm https://auth0.com/changelog#QVyBUwb38zOqMQuF5Rohm Thu, 17 Sep 2026 00:00:00 GMT Auth0 My Organization API adds Member Management in Early Access: bulk invitations, role assignment, and embeddable UI components for B2B SaaS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds bulk member invitation via the My Organization API, supporting up to 10 invitees in a single atomic request with pre-assigned roles and routing through a specific identity provider or user store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds member listing and retrieval through the My Organization API with field projection and checkpoint-based pagination for large organizations. • Adds role assignment and removal for organization members directly through the My Organization API or embeddable UI components, with permission guardrails preventing delegated administrators from assigning roles exceeding their own. • Introduces a new `none`, `readonly`, `limited`, and `full` access level model for organization members, computed automatically from the member's organization connection access levels. • Adds permission-aware embeddable UI components that show or hide actions based on the authenticated user's effective permissions sourced from the ID token, requiring no additional API call. • Emits tenant log events for all member, invitation, and role operations for full B2B observability of administrative activity. • Enables the My Organization API via the `Applications > APIs` section of the Auth0 Dashboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Wed, 16 Sep 2026 07:42:28 GMT Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#2KAdg9LxvB5CiN8O5KR4PI https://auth0.com/changelog#2KAdg9LxvB5CiN8O5KR4PI Wed, 16 Sep 2026 00:00:00 GMT Auth0 B2B Connect Early Access adds real-time connection event streaming, automatic IdP-driven session termination, email-domain SSO resolution, and direct Auth0 connections without an external authorization server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Streams enterprise connection events (created, updated, deleted) to a webhook, Amazon EventBridge, or a custom event pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Automatically terminates active application sessions when the enterprise IdP ends the corresponding session, keeping app and IdP session state in sync. • Supports connecting an application directly to Auth0 without an external authorization server, with new quickstart guides to get started. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#4eYFRh9yN93NXhkOqBSpRT https://auth0.com/changelog#4eYFRh9yN93NXhkOqBSpRT Wed, 16 Sep 2026 00:00:00 GMT Auth0 adds real-time enterprise connection events — subscribe to created, updated, and deleted via webhook or Amazon EventBridge, no polling required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `connection.created`, `connection.updated`, and `connection.deleted` event subscriptions for enterprise connections (Azure AD, ADFS, Google Workspace, Active Directory, LDAP, and Ping), eliminating the need to poll the Management API for connection changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Delivers connection events to a webhook or Amazon EventBridge as CloudEvents-formatted JSON. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Tue, 15 Sep 2026 13:01:35 GMT Auth0 adds `match_all: true` to Tenant ACL for a blanket Deny All rule across the full tenant scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `match_all: true` attribute to Tenant Access Control List (ACL) rules, enabling a Deny All rule that rejects all incoming traffic across the full tenant scope without requiring specific signal matching (IP, geolocation, etc.).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Tue, 08 Sep 2026 07:44:44 GMT Auth0 adds self-service XAA config via My Organization API, Advanced MFA GA, and Cross-App Access Requesting App in Early Access • Adds self-service configuration of Third-Party Application Access and Cross App Access (XAA) through the My Organization API and Embeddable UI Components (Open Early Access), letting Organization Admins configure third-party app access, connection-level third-party access, and XAA Resource Application roles without routing changes through the Auth0 Dashboard. • Advanced MFA Configurations is now Generally Available, enabling configurable 'Remember this device' idle lifetimes (1 hour to 30 days) and absolute lifetimes (up to 90 days), OTP lengths for SMS and email factors (4–10 digits), OTP lifetime for SMS MFA (30 seconds to 1 hour), and OTP lifetime for email MFA (5 minutes to 1 hour). • Auth0 now supports acting as a requesting application in Cross-App Access flows (Early Access), built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol, allowing apps to fetch third-party API tokens for enterprise users without requiring manual 'Connect your account' steps; supported on OIDC and Okta Workforce connections with org-aware resolution via `org_id`. • Adds a new Dashboard toggle to enable Cross-App Access Requesting App on enterprise connections. • Dashboard Navigation and IA Refresh is available in Early Access, featuring a redesigned sidebar, improved information architecture, consistent breadcrumbs, and a modernized visual experience, toggled per user account from the profile menu. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#7dJ5YPKicyyo9i3J6kXxEK https://auth0.com/changelog#7dJ5YPKicyyo9i3J6kXxEK Tue, 08 Sep 2026 00:00:00 GMT Auth0 Tenant ACL gains a `match_all: true` Deny All rule to block all incoming traffic without signal-specific matching. • Adds `match_all: true` attribute to Tenant ACL rules, enabling a Deny All rule that rejects all incoming traffic to the assigned scope without requiring IP or geolocation signal matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#5NIDxNg8vU1INTYh0U1Fxd https://auth0.com/changelog#5NIDxNg8vU1INTYh0U1Fxd Thu, 03 Sep 2026 00:00:00 GMT Auth0 My Organization API and Embeddable UI Components now support self-service XAA and third-party app access configuration in Open Early Access. • Adds self-service configuration of third-party application access for an Organization via the My Organization API and Embeddable UI Components, so Organization Admins can manage access without routing changes through the Auth0 Dashboard. • Adds self-service configuration of third-party application access for a specific connection of an Organization through the My Organization API and Embeddable UI Components. • Adds self-service configuration of the Cross App Access (XAA) Resource Application role for a connection via the My Organization API and Embeddable UI Components. • Enables XAA configuration with a domain-verification guardrail: the connection's identity provider must use a domain verified for the associated Organization, scoping cross-app authorization to providers the customer controls. • Each delegated setting is independently controllable, allowing platform teams to choose which settings and values are exposed to Organization Admins. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#8H6iglbATvGeKPScsVEWj https://auth0.com/changelog#8H6iglbATvGeKPScsVEWj Wed, 02 Sep 2026 00:00:00 GMT Auth0 Dashboard gets a redesigned sidebar and improved information architecture in Early Access opt-in. • New Early Access opt-in redesigns the Auth0 Dashboard sidebar with improved information architecture, consistent breadcrumbs, and a modernized visual experience. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#2ppxbGFzafbJk1UtENDTG1 https://auth0.com/changelog#2ppxbGFzafbJk1UtENDTG1 Tue, 01 Sep 2026 00:00:00 GMT Auth0 Advanced MFA Configurations are now GA, enabling customizable OTP lengths, lifetimes, and device-remember windows. • Configurable OTP lifetime for SMS MFA (30 seconds to 1 hour) and email MFA (5 minutes to 1 hour). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Mon, 31 Aug 2026 20:46:26 GMT Custom Token Exchange hits GA with Dashboard management, shared transaction context, and WebAuthn biometrics as a first factor. • Custom Token Exchange is now Generally Available for Enterprise, B2B Professional, and B2C Professional customers and during Trial periods — lets applications exchange an existing Auth0 or external-IdP token for Auth0 access, ID, and refresh tokens via custom Action logic. • Adds shared transaction context between Custom Token Exchange Actions and Post-Login Actions via transaction metadata, enabling token customization based on subject or actor token information. • Enables Session Delegation through Custom Token Exchange, allowing a service, AI agent, or support agent to establish a web session on behalf of a user. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#5Ki3dgMvxKBIofMldOI1ie https://auth0.com/changelog#5Ki3dgMvxKBIofMldOI1ie Mon, 31 Aug 2026 00:00:00 GMT Auth0 adds Cross-App Access Requesting App (Early Access): fetch third-party API tokens via IdP trust, no manual user consent per integration. • New Dashboard toggle on enterprise connections enables the Cross-App Access Requesting App flow, letting apps silently fetch third-party API tokens for authenticated users without requiring per-integration 'Connect your account' clicks. • Built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol; currently supported on OIDC and Okta Workforce connections. • Org-aware token resolution: in multi-org tenants, requests are scoped by `org_id` and rejected if the enterprise connection or target resource app is not enabled for that organization, or if the org context is ambiguous across multiple identities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#2yG3A8gOmC84RAUhJGovAq https://auth0.com/changelog#2yG3A8gOmC84RAUhJGovAq Fri, 28 Aug 2026 00:00:00 GMT Auth0 Custom Token Exchange is now GA, enabling token-for-token swaps with custom Action logic for enterprise and professional tenants. • Introduces Custom Token Exchange (GA), allowing applications to exchange an existing token — issued by Auth0 or an external identity provider — for Auth0 access, ID, and refresh tokens, validated by a Custom Token Exchange Action. • Supports delegated authorization so a service, AI agent, or support agent can act on behalf of a user, including calling APIs on their behalf or establishing a web session via Session Delegation. • Adds Dashboard support to create and manage Custom Token Exchange Profiles and their associated Actions directly from the Auth0 Dashboard. • Adds shared transaction context: set transaction metadata in a Custom Token Exchange Action and read it from a Post-Login Action to customize resulting tokens based on subject or actor token information. • Available to all Enterprise, B2B Professional, and B2C Professional customers, and included in the Trial period for free tenants. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Mon, 24 Aug 2026 14:30:55 GMT Auth0 adds Custom Rate Limits (Early Access) for per-client Authentication API throttling with block or notify enforcement modes. • Adds API-based self-service configuration of Custom Rate Limit Policies to cap Authentication API OAuth request consumption per individual client, all third-party apps, or CIMD apps. • Adds configurable Rate Limit Policy enforcement modes: block requests outright, or trigger non-blocking notifications for safer policy rollout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Mon, 17 Aug 2026 09:39:16 GMT Auth0 GA's Flexible Password Policy with unified `options.password_options` object and extends Custom Prompts to Social and Enterprise connections. • Adds `options.password_options` object to database connections, replacing legacy fields (`passwordPolicy`, `password_complexity_options`, `password_history`, `password_no_personal_info`, `password_dictionary`) with granular controls for composition, history, dictionary (10,000- or 100,000-word lists plus custom entries), and profile-data blocking — configurable via the Auth0 Dashboard under Authentication > Database > [your connection] > Authentication Methods > Password, or through the Management API. • New database connections created from July 2026 onward default to Flexible Password Policy with a minimum password length of 15, no required character types, and no legacy fields — applies whether the connection is created via Dashboard, Management API, Deploy CLI, Terraform, or an Auth0 SDK. • Custom Prompts (custom signup/login fields and consent checkboxes configured in Universal Login) now capture data on Social and Enterprise connections in addition to database and passwordless connections, with no configuration changes required — reviewable under Branding → Universal Login → Enhance screens with partials, or via the Management API. Breaking changes: • `PATCH /api/v2/connections/{id}` returns `400 invalid_body` if the request body includes both `password_options` and legacy password fields (`passwordPolicy`, `password_complexity_options`, `password_history`, `password_no_personal_info`, `password_dictionary`). Automations that read a connection and write it back with legacy fields appended must be updated to send only `password_options`. • New database connections created from July 2026 default to Flexible Password Policy (minimum length 15, no required character types) rather than legacy password policy defaults. Automations that create connections without specifying a password configuration will receive these new defaults instead of the previous legacy behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#2oiLhtKTJdjJ6GXkRTOvnl https://auth0.com/changelog#2oiLhtKTJdjJ6GXkRTOvnl Mon, 17 Aug 2026 00:00:00 GMT Auth0 adds Custom Rate Limits (Early Access) to cap per-client Authentication API RPS via API-driven policy configuration. • Adds Custom Rate Limit Policies (Early Access) enabling API-based self-service configuration to cap the number of Authentication API / OAuth requests consumable by individual clients or groups (all third-party apps, or CIMD apps), preventing any single client from exhausting a tenant's rate limit entitlement. • Supports two enforcement modes per Custom Rate Limit Policy: blocking (reject requests that exceed the limit) or non-blocking (trigger notifications only), allowing safer staged rollouts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#366lKZ4amhNan0IEljCtYL https://auth0.com/changelog#366lKZ4amhNan0IEljCtYL Thu, 13 Aug 2026 00:00:00 GMT Auth0 Flexible Password Policy reaches GA, replacing legacy fields with a single `options.password_options` object for database connections. • Adds granular composition controls in `options.password_options`: minimum length, required character types, and blocking of sequential or repeated characters. • Adds password history enforcement in `options.password_options` to prevent reuse across a configurable number of previous passwords. • Adds dictionary blocking in `options.password_options` using a 10,000- or 100,000-word built-in list plus custom entries. • Adds profile-data blocking in `options.password_options` to reject passwords containing values from user profile fields, with a configurable field list. • New database connections created as of July 2026 default to the Flexible Password Policy with a 15-character minimum length and no required character types, aligning with NIST guidance — applies when creating via Dashboard, Management API, Deploy CLI, Terraform, or an Auth0 SDK. Breaking changes: • `PATCH /api/v2/connections/{id}` returns `400 invalid_body` if a request contains both `password_options` and any legacy password field (`passwordPolicy`, `password_complexity_options`, `password_history`, `password_no_personal_info`, `password_dictionary`) simultaneously — automation that reads a connection and writes it back with legacy fields appended will break and must be updated to send only `password_options`. • New database connections created without an explicit password configuration now default to `options.password_options` with a minimum password length of 15 (up from legacy defaults) — pipelines that create connections and expect legacy defaults will receive the new NIST-aligned defaults instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#3MmWnmhpwRradIv0TpieUW https://auth0.com/changelog#3MmWnmhpwRradIv0TpieUW Mon, 10 Aug 2026 00:00:00 GMT Auth0 Custom Prompts now enforce signup fields and consent checkboxes for Social and Enterprise connections, not just database/passwordless. • Custom signup/login fields and consent checkboxes configured in Universal Login now apply to Social and Enterprise connections, closing the gap where users could bypass those prompts entirely when signing in via a social button or enterprise identity provider. • No configuration changes required — existing Custom Prompts setups automatically extend to all connection types; review or update via Dashboard under Branding → Universal Login → 'Enhance screens with partials', or via the Management API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Sun, 09 Aug 2026 09:29:03 GMT Auth0 adds Session Delegation via Custom Token Exchange, GA Google Workspace Group Sync, and advanced Organizations Search filtering. • Adds Session Delegation via Custom Token Exchange: requesting a Custom Token Exchange token with a `session_transfer` audience returns a Session Transfer Token, preserving both `sub` (the delegated user) and the RFC 8693 `act` claim (the acting party) throughout the session. • Google Workspace Inbound Directory Sync for Groups and Group Membership is now Generally Available for all Auth0 customers. • New paginated, searchable table in the Auth0 Management Dashboard lets tenant admins browse, filter, and search synced Google Workspace groups. • Self-Service Selective Group Sync lets enterprise IT admins independently configure Google Workspace Directory Sync and choose which groups to sync via the self-service assistant flow. • Organizations Search now supports advanced filtering on Name, Display Name, ID, Metadata (custom key-value pairs), third-party client access policy (allow or block), and app entitlement status. • Up to 5 organization filters can be combined simultaneously using AND/OR logic, with filter state persisted in the URL for sharing or bookmarking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#6QmD2FnBjqCIE4tjKGAh1L https://auth0.com/changelog#6QmD2FnBjqCIE4tjKGAh1L Fri, 07 Aug 2026 00:00:00 GMT Auth0 adds Session Delegation via Custom Token Exchange, letting authorized actors establish web sessions as another user with full audit trails. • Requesting a Custom Token Exchange token with a `session_transfer` audience returns a Session Transfer Token instead of an access token, authorized by the same Action logic already controlling delegation. • Delegated sessions are redeemed through the standard `/authorize` endpoint — no extra login step required for the target user. • Both identities are preserved throughout: the `sub` claim identifies the user the session belongs to, while the `act` claim (RFC 8693) identifies the acting party (e.g. support agent). • Dedicated tenant log events for delegated logins, separate from regular logins, support compliance and traceability. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#1rdFIM9tbfYZHbwNaM1c54 https://auth0.com/changelog#1rdFIM9tbfYZHbwNaM1c54 Thu, 06 Aug 2026 00:00:00 GMT Google Workspace Group and Group Membership sync is now GA in Auth0, with paginated dashboard UI and self-service selective group sync. • Adds paginated, searchable, filterable table in the Auth0 Management Dashboard for browsing and selecting Google Workspace groups to sync. • Enables self-service selective Google Workspace Directory Sync for Groups via the Self-Service assistant flow, letting enterprise IT admins choose all or a subset of groups to synchronize. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#392kMd0XrNg9JSyiq8DubD https://auth0.com/changelog#392kMd0XrNg9JSyiq8DubD Tue, 04 Aug 2026 00:00:00 GMT Auth0 Organizations Search gains metadata, third-party client access, and app entitlement filters with AND/OR logic. • Adds filtering by Name, Display name, ID, Metadata (custom key-value pairs), Third-party client access (allow or block), and App entitlement active status in the Organizations Search interface. • Supports combining up to 5 filters simultaneously with AND/OR logic. • Filter pills persist in the URL, enabling shareable and bookmarkable filtered Organization views. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog https://auth0.com/changelog Sat, 01 Aug 2026 19:06:57 GMT Auth0 adds AI agent identity, curated IP blocklists, org-scoped roles, cross-app access, and enterprise federation in a wave of new capabilities. • Adds Global Search (Beta) to the Command Palette (Cmd+K), enabling real-time tenant-wide search across Applications, APIs, Organizations, and Users by name, ID, email, or identifier with one-click ID copying. • Introduces Enterprise Connect (Beta), letting you federate existing SAML or OIDC authorization servers (including Okta) into Auth0 and layer on enterprise SSO, SCIM user provisioning, and self-service B2B onboarding with Actions-based claim enrichment and connection lifecycle events. • Launches Curated Blocklists in Tenant ACLs (GA), integrating dynamically updated Auth0 Threat Intel categories — `auth0.low_reputation`, `auth0.tor`, `auth0.proxy`, `auth0.vpn`, `auth0.icloud_relay_proxy` — into Network ACL rules via the `auth0_managed` matcher block in the Management API. • Introduces Agents as Principal (Early Access), giving AI agents a unique first-class identity with their own credentials, audit trail, and delegation chain encoding in tokens — separate from human users and shared clients. • Adds Token Vault Privileged Worker (Early Access), allowing background agents to authenticate via Private Key JWT or mTLS and retrieve a specific user's third-party tokens (Gmail, Drive, Slack, etc.) from Token Vault without an active user session, with per-connection and per-scope credential pinning. • Adds real-time Dashboard Search for Organization Members (Public Beta), supporting search by name, email, ID, and filtering by blocked status. • Publishes an Actions Reference Catalog at auth0.com/docs/actions/reference, documenting all trigger-specific Event and API objects available in custom Actions code. • Introduces Organization-Level Roles (Early Access), enabling creation, update, deletion, and assignment of roles scoped to individual organizations via the Management API or Dashboard, including pre-assignment during user invitations. • Adds Organization-to-Application Entitlement (Early Access), allowing per-org control over which applications organization members can access — enforced natively in Auth0 without custom Actions or metadata logic, opt-in and disabled by default. • Launches Cross App Access (XAA) for Resource Applications (Open Early Access), implementing an open standard for passing authorization across domains to support agent-to-app and app-to-app connections with centralized IT policy enforcement, supporting SAML and OIDC enterprise IdPs including Okta, with no code changes required. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#40KS8Q8mYuySx8GeHYq427 https://auth0.com/changelog#40KS8Q8mYuySx8GeHYq427 Fri, 31 Jul 2026 00:00:00 GMT Auth0 adds Global Search to the Command Palette (Cmd+K), enabling real-time tenant-wide entity lookup in Beta. • New Global Search in Command Palette (Cmd+K) lets you search Applications, APIs, Organizations, and Users by name, ID, email, or identifier in real time. • One-click identifier copying from search results lets you instantly grab entity IDs without navigating to detail pages. • "View more" links from search results navigate directly to filtered entity lists for deeper exploration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#7cWok8ec4tujGeC6si1yiN https://auth0.com/changelog#7cWok8ec4tujGeC6si1yiN Thu, 30 Jul 2026 00:00:00 GMT Auth0 launches Agents as Principal in Early Access, giving AI agents their own identity, credentials, and audit trail. • Introduces Agents as Principal: every AI agent gets a unique identity distinct from human users and shared clients, with its own credentials and audit trail. • Enables end-to-end delegation tracking: when an agent acts on a user's behalf, the full delegation chain (who delegated, to which agent, through which app) is encoded in the token and auditable at every hop. • Supports associating existing external agent identifiers (from your own registry, an MCP server, or elsewhere) with an Auth0 client, avoiding re-provisioning of already-built agents. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#3qvd2EJvV52InnJhPx4lS1 https://auth0.com/changelog#3qvd2EJvV52InnJhPx4lS1 Thu, 30 Jul 2026 00:00:00 GMT Auth0 Curated Blocklists for Tenant ACLs are now GA, enabling automated IP threat blocking via Auth0-managed threat intelligence. • Adds Curated Blocklists to Tenant Access Control Lists (ACLs), letting Attack Protection customers delegate IP risk management to Auth0 Threat Intel instead of manually maintaining IP/ASN lists. • Supports five Auth0-managed threat categories: `auth0.low_reputation`, `auth0.tor`, `auth0.proxy`, `auth0.vpn`, and `auth0.icloud_relay_proxy` for precise traffic-origin blocking. • Introduces the `auth0_managed` array within the Network ACLs Management API `match` object to reference dynamically updated curated lists in ACL rule definitions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#7tP8Zqm27Hp3qORKgIaNwT https://auth0.com/changelog#7tP8Zqm27Hp3qORKgIaNwT Thu, 30 Jul 2026 00:00:00 GMT Auth0 Enterprise Connect (Beta) adds modular B2B identity federation with SSO, SCIM provisioning, and self-service onboarding. • Federate existing SAML or OIDC authorization servers (including Okta) to Auth0 as a modular B2B identity layer. • Layer enterprise SSO and self-service onboarding/setup flows on top of federated connections for B2B customers. • Provision users outbound via SCIM wired to federated connections. • Inject user profile claims into ID tokens using Actions code during federated authentication. • Subscribe to connection lifecycle events (`connection.created`, `connection.updated`, `connection.deleted`) to keep local domain maps in sync as customers onboard. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#3Ehpq3QsDRBlkNWDb91Hly https://auth0.com/changelog#3Ehpq3QsDRBlkNWDb91Hly Thu, 30 Jul 2026 00:00:00 GMT Auth0 Token Vault Privileged Worker (Early Access) lets background agents fetch user tokens without an active session. • Adds Token Vault Privileged Worker, enabling autonomous/background agents to retrieve a user's third-party tokens (Gmail, Drive, Slack, etc.) from Token Vault without requiring an active user session. • Supports Private Key JWT and mTLS authentication for trusted worker identities authorizing token exchanges. • Enables pinning each worker credential to specific connections and scopes to limit blast radius of a compromised credential. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#6qR4dKCHuPJGUEPiIrhM05 https://auth0.com/changelog#6qR4dKCHuPJGUEPiIrhM05 Wed, 29 Jul 2026 00:00:00 GMT Auth0 Dashboard gains real-time search for Organization members by name, email, ID, and blocked status (Public Beta). • Search Organization members in real time by name, email, or ID directly from the Auth0 Dashboard — no more paginating through full member lists. • Filter Organization members by blocked status from the Dashboard member search interface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#5TucoIC8w6Z2O5hhGseJa0 https://auth0.com/changelog#5TucoIC8w6Z2O5hhGseJa0 Wed, 29 Jul 2026 00:00:00 GMT Auth0 adds organization-scoped roles in Early Access, enabling per-org RBAC without tenant-wide role sharing or custom workarounds. • Adds organization-scoped roles so each Auth0 Organization can have its own independent role definitions and permission assignments. • Supports creating, updating, and deleting org-scoped roles via the Management API or Dashboard. • Enables assigning org-scoped roles to users and enterprise groups within a specific organization. • Supports pre-assigning an org-scoped role when sending a user invitation to an organization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0 https://auth0.com/changelog#4y94FiFLqM5Hrwi47LVUc7 https://auth0.com/changelog#4y94FiFLqM5Hrwi47LVUc7 Wed, 29 Jul 2026 00:00:00 GMT Auth0 adds native Organization-to-Application Entitlement, letting you restrict which apps org members can access without custom code. • Adds Organization-to-Application Entitlement (Early Access): natively enforce which applications members of an organization can access, with automatic denial on unauthorized login attempts — no Actions, metadata checks, or custom logic required. • Supports per-org, opt-in enforcement so entitlements can be configured and tested before going live, with no risk of disrupting existing login flows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/auth0