Static IP Addresses for Allowlisting

Knowledge Articles
,
1

Last Updated: Oct 2, 2024

Overview

The article provides details on static IP addresses for allowlisting.

Applies To

  • Static IP address
  • Allowlisting

Solution

There are several parts of Auth0:

  • Allowing Auth0 IPs in the user’s firewall at the network level cannot be done, as Auth0 uses a dynamic set of IP Addresses and is subject to change at any time for canonical domains (domains with auth0.com) and Auth0-managed custom domains. It is recommended to implement an allow listing with the domain name instead of the IP. Enterprise customers can alternatively use the self-managed custom domains to manage the IP addresses of the domains. Then, it may be possible to implement an allow listing with the IPs managed on the customer’s proxy.
  • If allowing Auth0 in the user’s firewall at the network level (outbound) as the identity service, that cannot be done as Auth0 uses a dynamic set of IP Addresses and is subject to change at any time. It is recommended to allow the domain hostname instead.
  • For inbound connections like the calls made to the databases and servers by Auth0 Rules 90, Hooks 33, or Custom Database Scripts 81, the list of IP addresses may be found at the footer section of the Custom Database Editor and the header for the Rules Editor.

In addition, when using AD Connector 49, it works by creating an outbound connection so no inbound IPs need to be allowlisted.