Hi again!
You want to support both password login (with email verification) and Azure AD login (without email verification) for multiple client organizations, but creating one enterprise connection per client is expensive and not scalable.
You can use a single multi-tenant Azure AD enterprise connection with Home Realm Discovery and Tenant ID validation in a Post-Login Action. This eliminates the need to create separate connections per client while maintaining security through Azure's domain ownership verification and Auth0's tenant ID validation.
[Root Cause]
Your current approach (one connection per client) is not necessary because:
- Azure AD enforces domain ownership — A tenant cannot create users with another company's domain unless they have proven DNS ownership. This prevents cross-tenant user creation at the Azure level.
- Auth0 can validate tenant IDs — You can add an extra security layer by storing each organization's Azure Tenant ID in Auth0 and validating it during login.
- Email verification is not required for Azure AD — Users logging in via Azure AD are already verified by Azure, so
email_verified can be bypassed for this connection.
Why Your Current Approach Is Expensive:
- Creating one connection per client organization requires separate Azure AD app registrations and Auth0 connections
- This scales linearly with the number of clients
- Each connection consumes resources and increases management overhead
Recommended Solution: Single Multi-Tenant Azure AD Connection with Tenant ID Validation
Step 1: Create a Single Multi-Tenant Azure AD Application in Azure
- Go to Azure Portal → App Registrations → New Registration
- Name the app (e.g., "My SaaS Multi-Tenant App")
- Select "Accounts in any organizational directory (Any Azure AD directory - Multitenant)"
- Set Redirect URI to
https://YOUR_AUTH0_DOMAIN/login/callback
- Create a Client Secret and save it
- Note the Application (Client) ID and Tenant ID — You'll need these for Auth0
Step 2: Create a Single Azure AD Enterprise Connection in Auth0
- Navigate to Auth0 Dashboard → Connections → Enterprise → Microsoft Azure AD
- Name the connection (e.g., "Azure AD Multi-Tenant")
- Paste the Client ID and Client Secret from Azure
- Set the Domain to your primary domain (or leave it empty for multi-tenant)
- Enable "Use Common Endpoint" (this allows any Azure AD tenant to authenticate)
- Set "Always set email_verified" to
false (optional — Azure AD users are already verified by Azure)
- Save the connection
Step 3: Enable the Connection for Your Application
- Go to Applications → Your App → Connections
- Enable the Azure AD Multi-Tenant connection
- Disable the connection for any other applications that shouldn't use it
Step 4: Configure Home Realm Discovery (Optional but Recommended)
Home Realm Discovery automatically routes users to the correct Azure AD tenant based on their email domain:
- In the Azure AD connection, go to the Login Experience tab
- Add domains for each client organization (e.g.,
companyA.com, companyB.com)
- Save the configuration
Now when a user enters employee@companyA.com, Auth0 automatically routes them to Company A's Azure AD tenant.
Step 5: Store Azure Tenant IDs in Auth0 Organizations
For each client organization, store their Azure Tenant ID:
- Navigate to Organizations → Select Organization
- Go to Metadata (at the bottom)
- Add a key-value pair:
- Key:
azure_tenant_id
- Value:
<Company's Azure Tenant ID> (e.g., 12345678-1234-1234-1234-123456789012)
- Save
To find the Azure Tenant ID, ask your client or retrieve it from Azure Portal → Azure Active Directory → Properties → Tenant ID.
Step 6: Implement Tenant ID Validation in a Post-Login Action
Create a Post-Login Action to validate that the user's Azure Tenant ID matches the organization's expected Tenant ID:
- Navigate to Actions → Library → Create Action
- Name it "Validate Azure Tenant ID"
- Select "Login / Post-Login" as the trigger
- Add the following code:
exports.onExecutePostLogin = async (event, api) => {
// Only validate if the user is logging in via Azure AD and within an organization
if (event.organization && event.organization.metadata) {
const allowedTenantId = event.organization.metadata.azure_tenant_id;
if (allowedTenantId) {
// Find the Azure AD identity in the user's identities
const azureIdentity = event.user.identities.find(
(id) => id.connection === "Azure AD Multi-Tenant" // Use your connection name
);
if (!azureIdentity) {
console.log("Security Warning: User does not have an Azure AD identity.");
api.access.deny("Access Denied: Azure AD authentication required.");
return;
}
// Extract the tenant ID from the Azure AD profile data
const incomingTenantId = azureIdentity.profileData.tid || azureIdentity.profileData.tenantid;
if (!incomingTenantId) {
console.log("Security Warning: Could not find tenant ID in user profile.");
api.access.deny("Security check failed: Missing Tenant ID.");
return;
}
// Validate that the incoming tenant ID matches the organization's expected tenant ID
if (incomingTenantId !== allowedTenantId) {
console.log(
`Security Alert: Blocked login. Organization expects ${allowedTenantId}, user came from ${incomingTenantId}`
);
api.access.deny(
"Access Denied: You are logging in from an unauthorized Azure AD tenant."
);
return;
}
console.log(`Tenant ID validation passed for organization ${event.organization.id}`);
}
}
};
- Deploy the Action
- Add to Flow: Go to Actions → Flows → Login and add this Action to the flow
Step 7: Configure Email Verification for Password Login
For users logging in with password (not Azure AD), enforce email verification:
- Create a Post-Login Action named "Enforce Email Verification for Password Users"
- Add the following code:
exports.onExecutePostLogin = async (event, api) => {
// Only enforce email verification for database (password) connections
if (event.connection === "Username-Password-Authentication") {
if (!event.user.email_verified) {
api.access.deny(
"Your email address is not verified. Please check your email for the verification link."
);
return;
}
}
// Azure AD users are already verified by Azure, so no check needed
};
- Deploy and add to the Login flow
Step 8: Test the Setup
- Test password login:
- Create a test user in your database connection
- Verify email is required before login succeeds
- Test Azure AD login:
- Use an employee email from one of your client organizations
- Verify they are routed to the correct Azure AD tenant
- Verify the tenant ID validation passes
- Test cross-tenant security:
- Try logging in with an email from a different Azure AD tenant
- Verify the login is denied with "unauthorized Azure AD tenant" message
This approach is significantly more cost-effective and scalable than creating one connection per client, while maintaining strong security through Azure's domain ownership verification and Auth0's tenant ID validation.
Kind Regards,
Nik
