How to enable an automatic requirement for a user to change their password every certain number of days?
Auth0 has added a built-in Action to force password rotation.
This integration allows you to implement a password rotation policy for your users. You may choose to do this to increase your security posture. This Action can be used in tandem with the
Password History setting available in your Database connections that can prevent users from rotating their password to values they have previously used. Learn more at Password Options in Auth0 Database Connections.
Note: Once the Action is successfully deployed, all logins for your tenant will be processed by this integration. Before activating the integration in production, install and verify this Action on a test tenant.
- Select Add Integration (at the top of this page).
- Read the necessary access requirements, and select Continue.
- Configure the integration using the following fields:
- Password Expiry In Days: Set this to the number of days a password is valid before expiry.
Error Message: Set this to what you wish to return to the calling application. This will be returned in the query string as
- Add the integration to your Library by selecting Create.
- In the modal that appears, select the Add to flow link.
- Drag the Action into the desired location in the flow.
- Select Apply Changes.
Once this Action has been deployed. Users with passwords that were set within the window you configured, will log in as usual. When users with expired passwords attempt to log in, they will be prompted with your error message and be forced to reset their password.
Ensure you provide a valid whole number for
Password Expiry In Days and remember this will only apply to users that authenticate with
Database Connections. Users who authenticate through
Social, Enterprise or Passwordless Connections will not be under the scope of this