Using Persona Workflows to manage Auth0 users & profiles

Overview

Auth0 is an identity platform. It gives authentication, authorization, and user management for web, mobile, and legacy applications. The Persona Auth0 integration connects to the Management API of your Auth0 tenant. You can then find user profiles, manage roles, and reset MFA factors, authentication methods, and passwords directly from Persona Workflows.

This integration helps IT, Compliance, and People Ops teams manage the employee account lifecycle in Persona. They can find profiles, reset MFA after a possible compromise, or issue a password-reset link.

Benefits

Unified User Management: Find and update Auth0 user profiles, and manage role assignments, directly from Persona Workflows.

Faster Account Recovery: Reset the MFA factors, remembered browsers, or authentication methods of a user. Issue a self-service password-reset link. You do not have to go to the Auth0 dashboard.

More Complete Identity Context: Use Auth0 attributes, for example login history, verified contact methods, linked identities, and metadata, to make better risk decisions in Persona.

Integration Features

The Persona Auth0 integration supports 17 operations across five areas of the Auth0 Management API:

• User management: List, look up, and update Auth0 user profiles and metadata.
• Role management: List, assign, and remove the roles of a user.
• Multi-factor authentication: List the MFA enrollments of a user, reset an MFA provider, generate new recovery codes, and invalidate remembered browsers.
• Authentication methods: List, create, replace, get, update, and delete the individual authentication methods of a user, including passkeys, WebAuthn, TOTP, phone, and email.
• Password management: Create a password-change ticket, so that a user can set a new password without help.

Setting up the Auth0 integration

Prerequisites

To set up the Auth0 integration, make sure that you have:

• Admin access to your Auth0 tenant.
• The permission to generate a Management API access token. For tests, you can generate it manually. For production, use a machine-to-machine application.

Setting up the Auth0 Credentials

Using the Auth0 integration in a Workflow

Auth0 Operations Overview

Below is a full list of the Workflow Action steps and configurations for the Auth0 integration, in groups by resource type.

Users

List users

Gets a list of users from your Auth0 tenant, one page at a time. You can filter the list with a search query. Use it to find the correct user record before you get or update it.

Configuration Steps:

• Optionally add:
  • Page: Page of results to return (0-indexed; defaults to 0).
  • Per Page: Number of users to return per page (defaults to 50, maximum 100).
  • Include Totals: Include the total result count alongside the page of results.
  • Sort: Sort results by a field, in the form field:order (for example, email:1).
  • Connection: Limit results to users from a specific Auth0 connection.
  • Query: Lucene query string to search for users that match specific criteria (for example, by email or a metadata field). The search engine must be v3.
  • Search Engine: Search engine version to use with Query. At this time, only v3 is supported.
  • Fields / Include Fields: Limit which fields are returned, and whether the listed fields are included or excluded.

Get a user

Gets the full profile of a specific Auth0 user with the user ID.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to retrieve.
• Optionally add:
  • Fields / Include Fields: Limit which fields are returned, and whether the listed fields are included or excluded.

Update a user

Updates attributes on a specific Auth0 user, including profile fields, connection, blocked status, and app/user metadata.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to update.
• Optionally add:
  • Connection, Client ID: You must give these two together when you change the password, email, or phone number of the user.
  • Email, Email Verified, Verify Email, Phone Number, Phone Verified, Verify Phone Number, Username, Password, Name, Nickname, Given Name, Family Name, Picture, Blocked.
  • App Metadata, User Metadata: Objects that are merged one level deep into the current metadata of the user. Current keys that are not in the update do not change.

Roles

List user roles

Lists the roles assigned to a specific user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user whose roles are listed.
• Optionally add:
  • Page, Per Page, Include Totals: Control pagination of results.

Assign user roles

Assigns one or more existing roles to a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to assign roles to.
  • Roles: One or more role IDs to assign.

Remove user roles

Removes one or more roles from a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to remove roles from.
  • Roles: One or more role IDs to remove.

Multi-Factor Authentication

List user enrollments

Lists the enrolled MFA factors of a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user whose enrollments are listed.

Each enrollment reports its status (pending or confirmed), type, and auth method (authenticator, guardian, sms, webauthn-platform, or webauthn-roaming).

Delete user multi-factor provider

Removes all enrolled factors of a user for a specific MFA provider. The user must then enroll with that provider again at the next sign-in.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Provider: The MFA provider to reset, either duo or google-authenticator.

Regenerate user recovery code

Invalidates the current MFA recovery code of a user and generates a new one.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.

Invalidate user remembered browsers

Invalidates all remembered browsers of a user. The next time the user signs in from a browser, MFA is required again. This is useful after a possible account compromise.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.

Authentication Methods

Authentication methods are the newer, more detailed Auth0 model for the enrolled factors of a user. They include passkeys and WebAuthn, and also the factor types that enrollments include. For how the two models are related, read the FAQs.

List user authentication methods

Lists the authentication methods enrolled for a user.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user whose authentication methods are listed.
• Optionally add:
  • Page, Per Page, Include Totals: Control pagination of results.

Create user authentication method

Adds a new authentication method to a user. Methods that you create this way are automatically confirmed.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Type: phone, email, totp, webauthn-roaming, or passkey.
• Optionally add:
  • Name, Phone Number, Email, TOTP Secret, Preferred Authentication Method (voice or sms), Key ID, Public Key, AAGUID, Relying Party Identifier, Credential Device Type, Credential Backed Up, Identity User ID, User Agent, User Handle, Transports.

Replace user authentication methods

Replaces all authentication methods of a user with the list that you give.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Methods: Full array of methods to set, each with a Type (phone, email, or totp) and its associated fields.

Retrieve user authentication method

Gets one authentication method with its ID.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Method ID: Identifier of the specific method to retrieve.

Update user authentication method

Updates the name or preferred delivery method of one authentication method.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Method ID: Identifier of the method to update.
• Optionally add:
  • Name, Preferred Authentication Method (voice or sms).

Delete user authentication method

Deletes one authentication method with its ID. This revokes that factor.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user.
  • Authentication Method ID: Identifier of the method to delete.

Password Management

Create a password change ticket

Creates a one-time URL that a user can open to set a new password. Auth0 does not send a password-reset email. This is useful to give a user a password-reset link directly from a Persona Workflow.

Configuration Steps:

• Provide values for required fields:
  • User ID: Identifier of the user to create the ticket for. As an alternative, give Email and Connection ID instead of User ID.
• Optionally add:
  • Email, Connection ID, Organization ID: Identify the user of the ticket by email and connection, not by User ID.
  • Result URL: The page that the user goes to after they set their new password.
  • New Password: Set a specific password. The user does not select their own password.
  • TTL (seconds): How long the ticket stays valid. The default is 5 days. 0 means that it never expires.
  • Mark Email as Verified: Mark the email of the user as verified after the ticket is used.
  • Include Email in Redirect: Add the email of the user as a query parameter on the Result URL redirect.

FAQs

What’s the difference between enrollments and authentication methods?

Auth0 has two related but separate APIs for the enrolled factors of a user. Enrollments are the original MFA model. Authentication methods are the newer, more detailed Auth0 model that also includes passkeys and WebAuthn. The two APIs do not show the same records. Thus, use the set of operations that matches the factor type that you must examine or manage.

Can I search for a user by email or other attributes?

Yes. The List users operation supports a Lucene search query, sorting, field selection, and pagination. Use these to find the specific record that you need.

What should I keep in mind about token handling?

Auth0 tells you not to use long-lived tokens that you create manually in production applications. For manual or test tokens, Auth0 recommends short expirations with rotation. For production, use a machine-to-machine application, so that tokens are issued and refreshed automatically.

Plans Explained

Auth0 Integration by plan

Learn more about pricing and plans.