Delivering a B2B IAM Project
An Auth0 planning guide tobusiness-to-business identity andaccess management

auth0-tfg-00001 version March 7, 2024

Introduction
This document provides guidance for integrating Auth0 within abusiness-to-business (B2B) identity and access management (IAM) project.
Based on our experience working with customers who’ve implemented Auth0 for
this type of project, we’ve developed a set of goals and milestones that will help
you plan your solution efficiently and deliver it effectively.
Before you begin, consider the following items:
1. Identify your primary objectives and determine the requirements to achievethem.
2. Use a phased approach across multiple workstreams.
3. Adopt an iterative release process.

Identify your primary objectives
Determining the key goals of your project early on will help your teams focus on
the specifics when building out your solution.
For example, if your primary objectives are to avoid disruption for end-users andprovide continuity of service, then consider adopting an iterative release processinstead of a “big-bang” approach when integrating with Auth0.

Use a phased approach
A phased approach across multiple workstreams will help your teams divide andconquer. Many implementation tasks can be completed in parallel, which will allow
you to reach milestones faster and present your project to stakeholders sooner.
This is also a good time to check if other groups within your organization havebeen working with Auth0. There may be opportunities to share first-handexperience with the product, consolidate resources, and inform the structure ofyour implementation.
We may be able to help you identify these teams and provide guidance forcollaboration.

©20242

Adopt an iterative release process
Adopting an iterative release process will help your teams reduce cognitive
overload and improve the velocity of development.
For example, if you have three or four applications you want to integrate with
Auth0, consider working on one application at a time. This way, your teams cantake what they learned from the previous iteration into the next one.
If you have multiple applications and you want Single Sign-On (SSO) support,
read Architecture to help you understand what you need to consider when using
an iterative release process.

©20243

Phase 1: Application Integration and User Authentication
Workstreams
TenantAssociation

CustomDomains

Provisioning

Provision anOrganization

User Migration

Provision
Organization
Users

User Invite

Authentication

Universal
Login

Username andPassword
Authentication

Application
Integration

Home Realm
Discovery

Universal
Login

CustomDomains

Login byOrganization

Architecture

TenantProvision

Branding

SDLC
Support

Deployment
Automation

Anomaly
Detection
Email
Templates

ChangePassword

Error Pages

Unit
Testing

Integration
Testing

Mock
Testing

Password
Reset

Account
Verification

Deployment

Quality
Assurance
ProfileManagement

Metadata

Authorization

ID TokenClaims

LogoutLogoutEmailProvider

Operations

FirewallLogging

Milestone 1

©2024

4

Milestones

Branding

Milestone 1

Authentication. Demonstration tostakeholders.

Design & Development

Milestone 2

Profiles, branding, authorization.
Demonstration to stakeholders.

Operations & Infrastructure

Milestone 3

Go-Live. Deployment toproduction.

Testing

BlockedUsers

Monitoring
Milestone 2

Audience

LegendAdmin Portal

Milestone 3

Notifications

ServiceStatus

Phase 1
The first phase focuses on integrating your application(s) with Auth0 to provide
user authentication. You’ll address the 10 key stages across three key milestones
required to go live. Ultimately, you’ll have a production-ready implementation that
integrates with Auth0 to provide user authentication across your application(s).
The workstreams, the topics they address, and the order in which you complete
them are important, so we recommend you follow the guidance as prescribed.
Some topics can be worked on by different teams in parallel, such as Provisioning,Authentication, and Branding. We’ve found that if you assign a topic to the teamthat has the most experience with it (such as your design team to Branding), you
can accelerate implementation with minimal overlap.

Architecture
The Architecture workstream must consider how your application(s) fits in yourorganization, what the user base looks like, how to structure your Auth0 assets,and if there are opportunities for cross-integration.
Topics include:●●●●

Tenant Provision
Custom Domains
Tenant Association
Software Development Life Cycle (SDLC) Support

Provisioning
The Provisioning workstream must consider how users sign up with yourapplication(s), which identity providers you will support, and how and what user
data will be stored.
The Provisioning workstream can complete their work in parallel with theAuthentication and Branding workstreams.
Topics include:● Provision an Organization● User Migration©20245

● Provision Organization Users● User Invite
The Auth0 Dashboard (along with the Delegated Administration extension)
can be used out-of-box to perform user provisioning and deprovisioning.
If you require more comprehensive deprovisioning functionality (for example,compliance reasons) then refer to the Provisioning guidance provided inPhase 2.

Authentication
The Authentication workstream must consider how users will prove their identity,
how you’ll balance user experience and security, and what levels of additional
authentication are necessary (such as Multi-factor authentication or Step-up
authentication).
The Authentication workstream can complete their work in parallel with theProvisioning and Branding workstreams.
Topics include:
●
●
●
●
●

Universal Login
Username and Password Authentication
Application Integration
Home Realm Discovery
Anomaly Detection

Branding
The Branding workstream must consider how to customize the look and feel ofAuth0 to align with your organization’s requirements and provide a consistent user
experience to instill trust in your brand.
The Branding workstream can complete their work in parallel with the Provisioning
and Authentication workstreams.
Topics include:● Universal Login Customization● Custom Domain● Login by Organization©20246

● Change Password Customization● Error Page Customization● Email Template Customization (read Operations guidance before doing so)

Deployment Automation
The Deployment Automation workstream must consider how to manage thedevelopment and release cycle for Auth0 assets, ensure a dynamic development
environment, and guarantee a stable production environment.
Topics include:● SDLC Support● Tenant-Specific Variables

Quality Assurance
The Quality Assurance workstream must consider how to detect breakages inyour Auth0 integration and mitigate the resulting impact on users.
Topics include:● Unit Testing● Mock Testing● Integration Testing

Profile Management
The Profile Management workstream must consider how to manage user profile
data, user account verification and recovery, and user account restriction.
Topics include:
●
●
●
●
●

Metadata Management
Password Reset
Account Verification
Admin Portal
Blocked Users©20247Authorization
The Authorization workstream must consider how and what user data is passedbetween the authorization server and the application(s).
Topics include:● ID Token Claims

Logout
The Logout workstream must consider how users terminate their application,Auth0, and identity provider sessions.
Topics include:●●●●

Session Layers
Session Lifetime Limits
Log Users Out of Applications
Log Users Out of Identity Providers

Operations
The Operations workstream must consider how to send emails and notifications tousers, monitor Auth0 user activity, and process Auth0 log data.
Topics include:
●
●
●
●
●

Email Provider Setup
Monitoring
Logging
Firewall Configuration
NotificationsNext steps
At this point, you’ve integrated your application(s) with Auth0, configured user
authentication, and are ready for production.

©20248Phase 2: API Authorization, Advanced Authentication, Provisioning, and Profile Management
Workstreams
Architecture

Provisioning

Authentication

Organization Admin
PortalEnterprise Sign-Up
Single Sign On (SSO)
with Legacy Auth
SystemHome Realm
Discovery

Enterprise Login

Multi-Factor
Authentication

Branding

Guardian Multi-Factor

Deployment
Automation

Deployment

Quality
Assurance

Unit Testing

Integration Testing

Mock Testing

ProfileManagement
Authorization

API Integration

Roles andPermissionsLogout

Single Logout

Federated Logout

M2M Authorization

Operations

Notifications
Milestone 1

Milestone 2

Audience

Legend9

Milestones

Branding

Milestone 1

API integration. Demonstration tostakeholders, deployment to production.

Design & Development

Milestone 2

Advanced features. Demonstration tostakeholders, deployment to production.

Operations & Infrastructure

Milestone 3

Go-Live. Deployment to production.

Testing©2024

Milestone 3

Service Status

Phase 2
The second phase focuses on integrating your API(s) with Auth0 to provide
authorization functionality and configuring enterprise federations.
Additionally, the Authentication, Deployment Automation, Provisioning, andLogout workstreams will address topics that allow for advanced functionality.
The workstreams, the topics they address, and the order in which you complete
them are important, so we recommend you follow the guidance as prescribed.

Authorization
The Authorization workstream must consider how your API(s) will be integrated
with Auth0 and how access management will be handled (policy and method).
The Authorization workstream can complete their work in parallel with theAuthentication and Deployment Automation workstreams.
Topics include:● API Integration● Roles and Permissions● M2M Authorization

Authentication
The Authentication workstream must consider how users log in to yourapplications and if there are areas for improvement.
The Authentication workstream can complete their work in parallel with theAuthorization and Deployment Automation workstreams.
Topics include:●●●●

SSO with the Legacy Auth System
Enterprise Login
Home Realm Discovery
Multi-Factor Authentication©202410

Deployment Automation
The Deployment Automation workstream must consider how to integrate Auth0with your continuous integration/continuous deployment (CI/CD) pipeline.
The Deployment Automation workstream can complete their work in parallel withthe Authorization and Authentication workstreams.
Topics include:● Deploy CLI Tool
● Auth0 Terraform Provider

Quality Assurance
The Quality Assurance workstream must consider how to detect breakages inyour Auth0 integration and how to mitigate the resulting impact on users.
Topics include:● Unit Testing● Mock Testing● Integration Testing

Provisioning
The Provisioning workstream must consider how Enterprise connections will besupported.
Topics include:● Organization Admin Portal● Enterprise Sign-UpBranding
The Branding workstream must consider how to customize the look and feel of
Auth0 to align with your organization’s requirements and provide a consistent user
experience to instill trust in your brand.
Topics include:

©2024

11

● Customize Multi-Factor Authentication Pages● Auth0 GuardianLogout
The Logout workstream must consider how users terminate their application,Auth0, and identity provider sessions.
Topics include:● Single Logout● Federated Logout

Next steps
At this point, you’ve integrated your API(s) with Auth0, configured API
authorization policies, and introduced advanced functionality in several
workstreams.

©202412Phase 3: Extended Use Cases for Authentication, Profile Management, and Operations
Workstreams
Architecture

Organizations

Authentication

Connect to Separate
Multiple IDP Org
TenantStep-upAuthentication
Branding for Separate
Tenant for Multiple
IDP Org

Branding
Deployment
Automation

Redirect
Pages

Deployment

Quality
Assurance
ProfileManagement

Self-Signup new
Organization andAdmin User

Self Signup for Users
with Approval

Provisioning

Unit Testing

Integration
Testing

Progressive
Profiling

Mock Testing
Account Link
Enterprise IDP toDatabase User

Deprovisioning withSCIM

Authorization

LogoutOperations
Milestone 1

Milestone 2

Audience

Legend13

Milestone 3

Milestones

Branding

Milestone 1

Extended use cases. Demonstration tostakeholders, deployment to production.

Design & Development

Milestone 2

Specialized customization. Demonstration
to stakeholders, deployment to production.

Operations & Infrastructure

Milestone 3

Go-Live. Deployment to production.

Testing©2024

Self Service
EnterpriseConnection Setup

Companion Application

Notifications

ServiceStatus

Phase 3
The third phase focuses on addressing complex use cases, including support for
multiple IdPs and specialized customization.
Additionally, the Authentication, Profile Management, Branding, Provisioning, andOperations workstreams will address topics that allow for advanced functionality.
The workstreams, the topics they address, and the order in which you complete
them are important, so we recommend you follow the guidance as prescribed.

Architecture
The Architecture workstream must consider how to manage tenant provisioning
for complex organizations.
Topics include:● Organizations

Authentication
The Authentication workstream must consider how to support multiple IdPs andhandle use cases that require additional user verification.
Topics include:● Connect to Separate Multiple IDP Org Tenant● Step-up Authentication

Profile Management
The Profile Management workstream must consider how to enrich user profile
data, manage user deprovisioning, and link user profiles.
Topics include:● Progressive Profiling● Deprovisioning with SCIM
● Account Link Enterprise IDP to Database User
©202414

Branding
The Branding workstream must consider how to manage the look and feel when
supporting multiple organizations and ensure a consistent user experience acrossall user journeys.
Topics include:● Branding for Separate Tenant for Multiple IDP Org● Redirect Pages

Provisioning
The Provisioning workstream must consider how to manage complex provisioning
use cases for multi-tenant applications.
Topics include:● Just-In-Time Membership for Organizations● Provisioning Organizations

Operations
The Operations workstream must consider how to manage multiple organizations
and if the development of a companion application is necessary.
A companion application provides the ability for your organization’s internal
members (such as a customer support team) to perform actions on behalf of yourusers. If you’d like more information, ask your Technical Account Manager (TAM)
for details.
Topics include:● Organization Admin Portal©202415

Conclusion
Thank you for taking the time to read this guide on integrating Auth0 within abusiness-to-business (B2B) identity and access management (IAM) project.
This guide is occasionally updated based on our continuing experiences withcustomers, and we recommend you check with our scenario guidance as you
progress.
If you require more detailed information regarding certain functionality or would
like to discuss a specific use case, please contact our Professional Services team.

©202416