How to Restrict a Microsoft Azure AD Enterprise Connection to a Specific Organization in Auth0?

Get Help
,
1

Hi team,

We’re implementing a B2B multi-tenant architecture using Auth0 Organizations and Microsoft Azure AD Enterprise Connections.

Our goal is to restrict a specific Azure AD connection (e.g., tied to a customer’s tenant) so that it is only usable by one specific organization in Auth0.

We want to ensure that:

  • The Azure AD connection is not globally available.
  • Only users who initiate login through the specific organization login flow can authenticate using this connection.
  • The application should enforce the use of the organization parameter.

Questions:

  1. What is the correct way to assign and restrict an Azure AD Enterprise connection to a specific organization?
  2. Can we ensure that this connection does not appear or function outside the context of that organization?
  3. Should we disable the connection at the application level and only allow it via organization assignments?

We’ve already enabled “Users must log in through an organization” in the app settings.

Appreciate any best practices or configuration tips!

Thanks in advance.

3

Hi @stanley.ramakrishnan,

Welcome to the Auth0 Community !

The restriction for your specific Azure AD connection can be achieved directly within the settings of the Auth0 Dashboard.

You are exactly on point with this one. You can disable the connection at the application level ( so it will not be generally available ) and only enable it for your specific Organization. Only members within that organization will be able to sign in using the specific Azure AD enterprise connection.

That’s great! This way an organization parameter needs to be present in your /authorize URL.

This can be considered best practice, but you could also opt for an alternative approach such as creating a Post-Login Action that makes a query similar to:

if(event.connection.id == "your_AzureAD_connection_id" && event.organization?.id != "your_orgID")
      api.access.deny("This connection can only be used within a specific organization");

I hope this helps, and if you have further questions please let me know!
Thanks,
Remus