Auth0

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Auth0 using read-only Management API access to collect compliance evidence automatically. DSALTA syncs your tenant users (email and blocked status) and applications, then runs access reviews. Data feeds into your Data Library modules.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Auth0 tenant.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads the Auth0 tenant user roster — names, emails, active status, MFA enrolment and creation dates, which appears on your Access page; and your Auth0 resources, which appear on your Inventory page. DSALTA does not read Auth0 role assignments, so every user is listed as a Member.It calls these Auth0 endpoints:

/oauth/token
/api/v2/users
/api/v2/clients

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Auth0 environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Auth0 card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Auth0. If you connected with a Management API token, this usually happens because the token expired — reconnect with a fresh token, or switch to the Machine-to-Machine application method for a durable connection. If you connected with a Machine-to-Machine application, confirm the Client Secret has not been rotated and the application is still authorized for the Management API.

Data is not syncing

Confirm the connected application is authorized for the Auth0 Management API with the read:users and read:clients scopes, then click Sync from integrations on the Integrations page (Connected tab) — it refreshes every connected integration at once.

Auth0 offers 2 ways to connect. Machine-to-Machine Application is recommended.

Machine-to-Machine Application (recommended)
Management API Token

Auth0 Domain + Client ID + Client Secret from a Machine-to-Machine application authorized for the Auth0 Management API. Durable — DSALTA mints a read-only Management API token as needed. No paid or enterprise plan is required.Before you begin

An Auth0 account (free tier works)
A Machine-to-Machine application authorized for the Auth0 Management API with the read:users and read:clients scopes

You will need:

Field	Where to find it	Example
Auth0 Domain	Open	`your-tenant.us.auth0.com`
Client ID	See the steps below	`Machine-to-Machine application Client ID`
Client Secret	See the steps below	`Machine-to-Machine application Client Secret`

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Auth0, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Create a Machine-to-Machine application

In the Auth0 Dashboard, go to Applications, then Applications, and click Create Application. Choose Machine to Machine Applications, then select the Auth0 Management API. When prompted for permissions (scopes), enable read:users and read:clients, then click Authorize. The free tier includes the Management API; no paid or enterprise plan is required.

Auth0 caps user search at 1,000 users — “Search returns a maximum of 1,000 users, even if more users match your query”, and Auth0 explicitly says not to use the List/Search Users endpoint to export users. If your tenant has more than 1,000 users, expect the Access page to show only the first 1,000; treat it as a sample rather than a complete roster when running an access review.

The two scopes do different jobs and fail differently. read:users is the one DSALTA validates against — without it the connection is rejected outright. read:clients only feeds the Inventory page: leave it off and the connection still succeeds and users still sync, but your Auth0 applications never appear. The permission list in Auth0’s Authorize dialog is long — use the Filter Permissions box to find each one.

Auth0 Dashboard's Create application dialog with the Name field filled in and the Machine to Machine Application type selected

Auth0's Authorize Machine to Machine Application dialog with the Auth0 Management API selected and the read:users permission checked

Copy the Domain, Client ID, and Client Secret

Open the new application’s Settings tab and copy the Domain (for example your-tenant.us.auth0.com), the Client ID, and the Client Secret.If the Client Secret is not on the Settings tab, open the application’s Credentials tab — for machine-to-machine applications Auth0 shows the authentication method and the client secret there.

Paste the canonical tenant domain shown on the application’s Settings tab (for example your-tenant.us.auth0.com), not a custom login domain. DSALTA builds the Management API audience as https://<what you pasted>/api/v2/ when it mints the token, so a custom domain produces an audience Auth0 does not recognise and the connection is rejected.

Connect Auth0

Paste the Domain, Client ID, and Client Secret, then click Connect.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Invalid credentials, or the application is not authorized for the Management API with read:users.The on-screen message is generic — see Connection error messages.

Auth0 Domain + a Management API access token. Quick to test, but the token expires — use the Machine-to-Machine Application method for a lasting connection.Before you begin

An Auth0 account (free tier works)
A Management API access token with the read:users scope (from the API Explorer)

You will need:

Field	Where to find it	Example
Auth0 Domain	Open	`your-tenant.us.auth0.com`
Management API Token	See the steps below	`Auth0 Management API access token (expires)`

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Auth0, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Get a Management API token

In the Auth0 Dashboard, go to Applications, then APIs, and open Auth0 Management API. On the API Explorer tab, copy the token (it grants read:users). Note this token expires; for a durable connection use the Machine-to-Machine Application method instead.

The 1,000-user cap applies to this method too. Auth0’s Search Users endpoint returns at most 1,000 users however many match, and Auth0 advises against using List/Search Users to export users — so on a tenant larger than 1,000 the Access page holds only the first 1,000 and should be read as a sample, not a complete roster.

Auth0 Dashboard's APIs page with the Auth0 Management API listed as a System API alongside its API Audience

Connect Auth0

Paste your Auth0 Domain and the Management API token, then click Connect.

If the connection is rejected. Invalid or expired token, or it lacks the read:users scope.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
User access to Critical System should be valid	Info	Checks that everyone with Auth0 access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active Auth0 access.

Topic	Link
Setup	Create a Machine-to-Machine application
Setup	Auth0 Management API tokens
General	Auth0 website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting