How to mark email_verified always true with self-service Enterprise configurations

Get Help
, ,
1

Is there a way to set an attribute value to a default value, like email_verified value as true when setting up a “Self-Service Enterprise Configuration & User Attribute Profile mapping”

While onboarding an SSO cconnection for our B2B login, not all the organizations do provide a claim for this email_verified attribute for us to rely on, and at the same time there is an explicit trust requried for us to set this to true always.

At the moment we only have an option to come back to the enterpise config and modify the mapping to set this as True always. In an entra ID case there’s a dropdown and if it a generic OIDC then just the mapping update,
From: "email_verified": "${context.tokenset.email_verified}"
To: "email_verified": "true"

3

Hi @karuissobusy

Thank you for reaching out to us!

I understand you are looking to set the email_verified attribute to true by default during the onboarding.

This flow is possible to achieve by creating and attaching a custom User Attribute Profile (UAP) to your Self-Service Enterprise Configuration (SSEC) profile.

Recommended Solution

By default, Auth0’s standard UAP maps this attribute dynamically (e.g., ${context.tokenset.email_verified} for OIDC). By overriding this with a static string in a custom UAP, any new B2B SSO connection generated via your self-service assistant will automatically inherit the "email_verified": "true" mapping, eliminating the need to manually update the enterprise config afterward.

Here is how you can implement this:

  1. Update the Mapping via the Auth0 Dashboard

If you are configuring this through the Auth0 Dashboard UI:

  • Navigate to Authentication > Enterprise > Self-Service Enterprise Configuration.

  • Select your existing Self-Service Profile (or click + Create Profile).

  • Go to the User Profile tab and choose to + Create New User Attribute Profile (or edit an existing custom one).

  • Add or edit the attribute mapping for email_verified.

  • Under the OIDC Mapping configuration (and SAML Mapping if applicable), replace the default claim reference (${context.tokenset.email_verified}) with the static value "true".

  • Save the User Attribute Profile.

  1. Update the Mapping via the Management API

If you automate your configurations, you can use the Management API to create or patch the User Attribute Profile (POST or PATCH /api/v2/user-attribute-profiles).

When defining your user_attributes array, ensure the email_verified object statically assigns "true" in the oidc_mapping block:

{
  "name": "B2B SSO UAP Profile",
  "user_attributes": [
    {
      "name": "email_verified",
      "description": "Email Verified",
      "auth0_mapping": "email_verified",
      "profile_required": true,
      "oidc_mapping": {
        "mapping": "true",
        "display_name": "email_verified"
      },
      "saml_mapping": [
        "true"
      ]
    }
    // ... include your other standard attributes (email, name, etc.)
  ]
}

Key Takeaway

Once this customized UAP is attached to your Self-Service Profile, any access ticket generated for a customer will use these predefined mapping rules. When the customer completes the self-service setup for a generic OIDC (or SAML) connection, Auth0 will automatically apply the "email_verified": "true" override to the resulting enterprise connection.

Hope the above steps helped you achieve the desired flow! Please reach out to us for any other issues or requests, we will gladly look into it.

Have a great one,
Gerald