I understand that you are asking what are the best approaches for migrating users from one tenant to another, so lets examine your questions one by one.
You can export user profiles from your current tenant as a JSON file using the Auth0 management API endpoint GET /api/v2/jobs/users-exports.
Afterwards import those profiles into the target client tenant using the POST /api/v2/jobs/users-imports endpoint or the user import/export extension in your dashboard.
You can migrate passwords securely using one of two methods:
Method 1: Bulk password hash import
Open a high-priority support ticket with Auth0 to request a secure, PGP-encrypted export of your current database’s password hashes.
Format these hashes into Auth0’s specific user schema (supporting algorithms like bcrypt, scrypt, pbkdf2, or sha256).
Upload them via the bulk user import API. Note that password hashes can only be set during the initial user creation import and cannot be added to existing records later.
Create a new custom database connection in the client’s tenant and toggle on the “import users to auth0” setting.
Write custom node.js login and getUser scripts that query your original tenant.
When a user logs in, Auth0 verifies their credentials against your old tenant. Once authenticated, Auth0 automatically creates their profile in the client’s tenant and securely hashes/saves their password.
Run a0deploy export from your current tenant to save all applications, APIs, connections, roles, and settings as YAML/JSON configuration files.
Run a0deploy import to instantly provision those identical resources on your client’s tenant.
Be sure to manually copy sensitive values (like client secrets and third-party API keys) since they are excluded from the export files for security.
Use the Deploy CLI to recreate all Applications, APIs, and Connections on the client’s tenant.
Turn on the Custom Database Connections(Trickle Migration) pointing back to your source database connection.
Update your applications to point their OIDC authorization endpoints to the client’s new Auth0 tenant domain.
Run both tenants concurrently for a set period (e.g., 30 days). Active users will seamlessly transition to the new database upon login.
Bulk export any remaining inactive users, import them to the target tenant (using Option A for their password hashes), and safely disable the Custom Database connection.
Yes, that is exactly correct. For security and compliance reasons, any standard bulk export you run yourself (via the API or Dashboard) will strictly return only non-password user attributes.
Submit a Support Ticket: A tenant administrator must log into the Auth0 Support Center and request a secure export of your database’s user password hashes
Plan Requirement: Please note that password hash exports are a security-controlled service and are only available to tenants on a paid subscription tier