Auth0 B2C Essentials: EU tenants, email providers, Actions and security-event reconciliation

Get Help
1

Hello Auth0 Community,

I’m evaluating Auth0 B2C Essentials for a small Ireland-based educational application. We’re preparing an invitation-only beta for 3–5 adult teachers and would like to clarify the technical capabilities before subscribing.

Our proposed configuration uses Auth0 Universal Login with EU-region tenants, an external transactional email provider and a separate application-managed session system.

I’d appreciate clarification on the following:

1. B2C Essentials tenant allocation

  • Does one Essentials subscription include three tenants, allowing separate EU development and beta environments?

  • Are MAU, machine-to-machine (M2M) allowances and other limits shared across tenants or allocated separately?

  • Do additional charges apply to these tenants?

2. Email verification and password resets

  • Does Essentials support external Amazon SES and native Resend integrations for verification and password-reset emails?

  • Are email templates and verification/reset workflows included, or do they require additional entitlements?

3. Actions and identity changes

  • Which Actions triggers are available for password changes and resets?

  • What execution, retry and outbound-call limits apply?

  • What supported mechanisms exist for detecting blocked, unblocked or deleted users?

4. Security-event reconciliation

This is particularly important for our application.

We need to ensure that a password reset, account block or deletion can invalidate our own application sessions.

  • Which Management APIs, logs or event streams are available on Essentials?

  • Can they provide a complete current user snapshot, including deletions, after an outage?

  • What are the pagination, event-ordering, retention, replay and rate-limit limitations?

  • Are there documented gaps that would prevent complete reconciliation?

5. EU processing and documentation

Are there specific regional limitations or additional processing considerations for EU tenants using external email providers?

Links to official documentation would be greatly appreciated, especially where features differ between Free and Essentials.

We understand that community replies are technical guidance rather than contractual commitments. We’re not requesting account changes or activation.

Thank you for your help!

2

Hi @oisinmurphy17

Welcome to the Auth0 Community!

I understand that you are evaluating the Auth0 B2C Essentials plan and are interested in clarifying some aspects to make sure it would fit your requirements.

Please allow me to outline the technical capabilities of the Auth0 B2C Essentials plan for your beta application.

Official solution for your inquiries

1. B2C Essentials Tenant Allocation

  • Included Tenants: Yes, a single Auth0 B2C Essentials subscription includes up to three tenants when linked under an Auth0 Team. This perfectly accommodates your need for separate EU development, beta/staging, and production environments.

  • Limit Sharing: Usage limits—such as Monthly Active Users (MAUs) and machine-to-machine (M2M) allowances—are shared across all linked tenants. For example, the 500 MAU base limit applies to the combined total across your three tenants.

  • Additional Charges: As long as you link these three tenants under your single Auth0 Team subscription and stay within your aggregate plan limits, no additional subscription fees apply for the secondary tenants.

2. Email Verification and Password Resets

  • Provider Integrations: Auth0 natively supports both Amazon SES and Resend (along with other providers like SendGrid and Mailgun) for sending outgoing emails, including verification and password-reset links. You configure these integrations using either API credentials or SMTP in the Auth0 Dashboard.

  • Templates and Workflows: By configuring an external email provider on the B2C Essentials plan, you unlock full support for custom email templates and custom “From” addresses. Verification and reset workflows are fully included and can be triggered via Universal Login or the Authentication API.

3. Actions and Identity Changes

  • Available Triggers: Auth0 Actions provides two specific triggers for password changes:

    • password-reset-post-challenge: A synchronous (blocking) trigger that runs during the reset process after the first challenge (e.g., email link) but before the new password is set. This is often used to enforce additional MFA.

    • post-change-password: An asynchronous (non-blocking) trigger that runs after a password is successfully changed. This is ideal for notifying your external session system to revoke old sessions.

  • Detecting State Changes: For detecting user blocks, unblocks, or deletions, Auth0 recently introduced Event Streams. Event Streams allows you to subscribe to structured lifecycle events (like user.created, user.updated, and user.deleted) and delivers them in near real-time via Webhooks or Amazon EventBridge.

4. Security-Event Reconciliation

Reconciling state (like invalidating application sessions upon a password reset or account deletion) can be achieved using Auth0’s Log Streams or the newer Event Streams:

  • Available Mechanisms: Log Streams can export tenant logs in near real-time to external services like Amazon EventBridge or custom Webhooks.

  • Retention and Replay: The B2C Essentials plan includes 5 days of log data retention. If your system experiences an outage, Log Streams allows for replay: you can recreate the stream with a “Starting Cursor” set to a specific timestamp within that 5-day window to catch up on missed events. Event Streams also automatically retry failed deliveries without interrupting new incoming events.

  • Ordering and Gaps: We explicitly recommend that you implement your own log sorting and timestamp verification on your application side to prevent race conditions during reconciliation. Furthermore, if your outage exceeds the 5-day retention limit, you will permanently lose the ability to replay missed events from Auth0.

  • User Snapshots: Event Streams will give you real-time deletion events, but for a full system snapshot (e.g., retrieving the complete list of current, non-deleted users to perform a hard sync), you would need to rely on the Management API’s user export capabilities.

5. EU Processing and Considerations

  • Regional Data Residency: When creating your tenants, you explicitly choose the EU deployment region to ensure Auth0 stores the profile data locally.

  • External Email Routing: When using an external provider like Amazon SES or Resend with an EU tenant, you must explicitly configure your email provider to allow inbound connections from Auth0’s EU-specific IP address blocks.

  • GDPR Data Portability: As an EU-hosted app, your setup fully supports GDPR Article 20 requirements, allowing you to manually or programmatically export machine-readable user profiles (JSON) at any time.

We hope these point helped provide more clarity with regards to our Auth0 B2C Essentials plan. Before committing to one of our plans, we warmly welcome you to Contact our Sales team to further discuss the best subscription for your requirements.

Have a great one!
Gerald