Using Persona Workflows to manage Auth0 users & profiles

Overview

Auth0 is an identity platform that provides authentication, authorization, and user management for web, mobile, and legacy applications. Persona’s Auth0 integration connects to your Auth0 tenant’s Management API so you can look up user profiles, manage roles, and reset MFA factors, authentication methods, and passwords directly from Persona Workflows.

This integration helps IT, Compliance, and People Ops teams manage the employee account lifecycle: looking up profiles, resetting MFA after a suspected compromise, or issuing a password-reset link, all without switching out of Persona.

Benefits

Unified User Management: Look up and update Auth0 user profiles, and manage role assignments, directly from Persona Workflows.

Faster Account Recovery: Reset a user’s MFA factors, remembered browsers, or authentication methods, and issue a self-service password-reset link, without switching into the Auth0 dashboard.

More Complete Identity Context: Use Auth0 attributes like login history, verified contact methods, linked identities, and metadata to support richer risk decisions in Persona.

Integration Features

Persona’s Auth0 integration supports 17 operations across five areas of Auth0’s Management API:

• User management: List, look up, and update Auth0 user profiles and metadata.
• Role management: List, assign, and remove a user’s roles.
• Multi-factor authentication: List a user’s MFA enrollments, reset an MFA provider, regenerate recovery codes, and invalidate remembered browsers.
• Authentication methods: List, create, replace, retrieve, update, and delete a user’s individual authentication methods, including passkeys, WebAuthn, TOTP, phone, and email.
• Password management: Create a password-change ticket so a user can self-serve a new password.

Setting up the Auth0 integration

Prerequisites

To set up the Auth0 integration, ensure you have:

• Admin access to your Auth0 tenant.
• Ability to generate a Management API access token, either manually for testing or via a machine-to-machine application for production use.

Setting up the Auth0 Credentials

Using the Auth0 integration in a Workflow

Auth0 Operations Overview

See below for a comprehensive list of available Workflow Action steps and possible configurations for the Auth0 integration, grouped by resource type.

Users

List users

Retrieves a paginated list of users from your Auth0 tenant, optionally filtered with a search query, useful for locating the right user record before you look up or update it.

Configuration Steps:

• Optionally add:
  • Page: Page of results to return (0-indexed; defaults to 0).
  • Per Page: Number of users to return per page (defaults to 50, maximum 100).
  • Include Totals: Include the total result count alongside the page of results.
  • Sort: Sort results by a field, in the form field:order (for example, email:1).
  • Connection: Limit results to users from a specific Auth0 connection.
  • Query: Lucene query string to search for users matching specific criteria (for example, by email or a metadata field). Requires the search engine to be set to v3.
  • Search Engine: Search engine version to use with Query. Currently only v3 is supported.
  • Fields / Include Fields: Limit which fields are returned, and whether the listed fields are included or excluded.

Get a user

Retrieves the full profile for a specific Auth0 user by ID.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to retrieve.
• Optionally add:
  • Fields / Include Fields: Limit which fields are returned, and whether the listed fields are included or excluded.

Update a user

Updates attributes on a specific Auth0 user, including profile fields, connection, blocked status, and app/user metadata.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to update.
• Optionally add:
  • Connection, Client ID: Required together when changing the user’s password, email, or phone number.
  • Email, Email Verified, Verify Email, Phone Number, Phone Verified, Verify Phone Number, Username, Password, Name, Nickname, Given Name, Family Name, Picture, Blocked.
  • App Metadata, User Metadata: Objects merged one level deep into the user’s existing metadata. Existing keys not included in the update are left alone.

Roles

List user roles

Lists the roles assigned to a specific user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user whose roles are listed.
• Optionally add:
  • Page, Per Page, Include Totals: Control pagination of results.

Assign user roles

Assigns one or more existing roles to a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to assign roles to.
  • Roles: One or more role IDs to assign.

Remove user roles

Removes one or more roles from a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to remove roles from.
  • Roles: One or more role IDs to remove.

Multi-Factor Authentication

List user enrollments

Lists a user’s enrolled MFA factors.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user whose enrollments are listed.

Each enrollment reports its status (pending or confirmed), type, and auth method (authenticator, guardian, sms, webauthn-platform, or webauthn-roaming).

Delete user multi-factor provider

Removes all of a user’s enrolled factors for a specific MFA provider, forcing re-enrollment with that provider at next sign-in.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Provider: The MFA provider to reset, either duo or google-authenticator.

Regenerate user recovery code

Invalidates a user’s existing MFA recovery code and generates a new one.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.

Invalidate user remembered browsers

Invalidates all of a user’s remembered browsers, so MFA is required again the next time they sign in from any browser. Useful after a suspected account compromise.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.

Authentication Methods

Authentication methods are Auth0’s newer, more detailed model for a user’s enrolled factors, covering passkeys and WebAuthn in addition to the factor types enrollments cover. See the FAQs for how the two relate.

List user authentication methods

Lists the authentication methods enrolled for a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user whose authentication methods are listed.
• Optionally add:
  • Page, Per Page, Include Totals: Control pagination of results.

Create user authentication method

Adds a new authentication method to a user. Methods created this way are automatically confirmed.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Type: phone, email, totp, webauthn-roaming, or passkey.
• Optionally add:
  • Name, Phone Number, Email, TOTP Secret, Preferred Authentication Method (voice or sms), Key ID, Public Key, AAGUID, Relying Party Identifier, Credential Device Type, Credential Backed Up, Identity User ID, User Agent, User Handle, Transports.

Replace user authentication methods

Replaces a user’s entire set of authentication methods with the list provided.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Methods: Full array of methods to set, each with a Type (phone, email, or totp) and its associated fields.

Retrieve user authentication method

Retrieves a single authentication method by ID.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Method ID: Identifier of the specific method to retrieve.

Update user authentication method

Updates the name or preferred delivery method of a single authentication method.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Method ID: Identifier of the method to update.
• Optionally add:
  • Name, Preferred Authentication Method (voice or sms).

Delete user authentication method

Deletes a single authentication method by ID, revoking that factor.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Method ID: Identifier of the method to delete.

Password Management

Create a password change ticket

Creates a one-time URL a user can visit to set a new password, without Auth0 sending them a password-reset email. Useful for handing a user a password-reset link directly from a Persona Workflow.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to create the ticket for. Alternatively, provide Email and Connection ID instead of User ID.
• Optionally add:
  • Email, Connection ID, Organization ID: Target the ticket at a user by email and connection instead of by User ID.
  • Result URL: Where the user is redirected after setting their new password.
  • New Password: Set a specific password rather than letting the user choose their own.
  • TTL (seconds): How long the ticket stays valid. Defaults to 5 days; 0 means it never expires.
  • Mark Email as Verified: Mark the user’s email as verified once the ticket is used.
  • Include Email in Redirect: Append the user’s email as a query parameter on the Result URL redirect.

FAQs

What’s the difference between enrollments and authentication methods?

Auth0 exposes two related but separate APIs for a user’s enrolled factors. Enrollments are the original MFA model; authentication methods are Auth0’s newer, more detailed model that also covers passkeys and WebAuthn. The two aren’t interchangeable views of the same records, so use whichever set of operations matches the factor type you need to inspect or manage.

Can I search for a user by email or other attributes?

Yes. The List users operation supports a Lucene search query, sorting, field selection, and pagination, which you can use to narrow down the user set to the specific record you need.

What should I keep in mind about token handling?

Auth0 warns against using manually created long-lived tokens in production applications, and recommends short expirations with rotation for manual or testing tokens. For production, use a machine-to-machine application so tokens can be issued and refreshed automatically.

Plans Explained

Auth0 Integration by plan

Learn more about pricing and plans.