A0deploycli warnings while exporting the configs

Get Help
,
1

Hi Team,

When I am trying to export auth0 configs using cli version 8.39.0 getting below warning.

2026-07-08T05:04:40.066Z - warn: The following tenant flags have not been updated because deemed incompatible with the target tenant: allow_changing_enable_sso, allow_other_legacy_grant_types, disable_impersonation, enable_custom_domain_in_emails, new_universal_login_experience_enabled, universal_login, use_scope_descriptions_for_consent, dashboard_ui_next, include_email_in_reset_pwd_redirect, include_email_in_verify_email_redirect
These flags can likely be removed from the tenant definition file. If you believe this removal is an error, please report via a Github issue.

My question here is, I am unable to find those flags anywhere in the export and how we can keep track of ever changing deprecations list from Auth0. How certain we are the import functionality work when we use the same export dump?

Is there any page from Auth0 to refer about deprecated flags?

How we can remove these flags from our tenant configs?

Thanks
Uma

3

Hi @uma.kakumani

Welcome to the Auth0 Community!

You are asking why Auth0 CLI export version 8.39.0 warns about incompatible tenant flags, why those flags do not appear in the export output, how safe import is when using the same export dump, and where to track deprecated tenant flags. The short answer is that these warnings usually mean the flags are legacy or tenant-specific settings that Auth0 Deploy CLI intentionally skips or strips during import, and Auth0 recommends removing those flags from the tenant definition file when they appear.

To understand why this happens, we have to look at the lifecycle of Auth0 features and the Management API:

  1. The Legacy Flags: When you created your Auth0 tenant (potentially years ago), features like the “New Universal Login” or “Impersonation” were toggles. Auth0 eventually made the New Universal Login mandatory for modern tenants and permanently retired the impersonation feature.

  2. The API Response: When the Deploy CLI runs an export, it calls the GET /api/v2/tenants/settings endpoint. Auth0’s backend still returns the full JSON object containing those old flags for backward compatibility.

  3. The CLI Filter: The Deploy CLI developers maintain a hardcoded “blocklist” of deprecated and read-only flags. When the CLI sees these flags in the API response, it strips them out before writing your tenant.yaml file and prints the warning you see.

[Solution]

1. How certain are we the import functionality works when using the same export dump?
You can be highly confident. The fact that the CLI stripped these flags out is the exact reason your import will work. If the CLI had silently included disable_impersonation: true in your tenant.yaml, your next import would instantly crash because the Auth0 backend no longer accepts PATCH requests containing that flag.

2. How can we remove these flags from our tenant configs?

  • From your local files (tenant.yaml): If you cannot find them in your newly exported files, the CLI has already successfully removed them for you. If you have an older version of your configuration in source control (Git) that still has these flags listed under the tenant: flags: block, you should simply delete those lines from your codebase.

  • From the Auth0 Dashboard/Backend: You cannot manually remove these underlying flags from Auth0’s internal database. They are permanent, read-only artifacts of your tenant’s history. Auth0 handles this abstraction on their end.

3. Is there a page from Auth0 to refer about deprecated flags?
Auth0 does not maintain a single page just for “Deploy CLI Ignored Flags,” as these deprecations happen across various feature lifecycles. However, you can track them in two places:

  • The Auth0 Migrations Page: This dashboard page (and the accompanying documentation) lists major feature deprecations.

  • The Deploy CLI Source Code: Because the CLI is open-source, the most accurate, real-time list of ignored flags is maintained directly in the GitHub repository’s codebase. The maintainers update this blocklist whenever Auth0 deprecates a tenant setting.

I would recommend checking the following knowledge articles regarding the matter:

  1. Auth0 support article on payload validation errors for deprecated flags in tenant configuration
  2. Auth0 support article on Deploy CLI failing for deprecated role_users_offset_pagination_over_thousand flag

Kind Regards,
Nik

4

Thank you, @nik.baleca for such a detailed explanation. This is certainly helpful and understood now.