Is it possible to add last_ip to the deny list?

[bailey]

Hi there!

We are trying to limit the amount of user data we store in the Auth0 Database. We have reviewed the docs and this FAQ around using the connections endpoint to add profile fields to the deny list, but are not having success:

User Profile Structure

https://auth0.com/docs/secure/security-guidance/data-security/denylist

How do I prevent user profile fields from being stored in Auth0?

Question: How do I prevent user profile fields from being stored in Auth0? Answer: If you need to prevent Auth0 from storing certain user profile fields for privacy reasons, you can do so by adding the fields to the connection’s deny list. For example, if you’d like to prevent the user’s picture from being saved in Auth0 when users log in using the Google social connection you can follow these steps to add the user.picture field to the Google social connection’s deny list: [screenshot-manag…

The /api/v2/connections/{id} PATCH has a status 200 and if we call /api/v2/connections/, we can see last_ip listed in the non_persistent_attrs, however we still see the last_ip address listed under the user details in the dashboard.

We preformed the steps outlined in this FAQ:

How do I prevent user profile fields from being stored in Auth0?

Question: How do I prevent user profile fields from being stored in Auth0? Answer: If you need to prevent Auth0 from storing certain user profile fields for privacy reasons, you can do so by adding the fields to the connection’s deny list. For example, if you’d like to prevent the user’s picture from being saved in Auth0 when users log in using the Google social connection you can follow these steps to add the user.picture field to the Google social connection’s deny list: [screenshot-manag…

We have also confirmed the Management API is scoped for read:connections and update:connections

Is it possible to not persist the last IP?
If so, are we missing a step?

[spezz4]

I am experiencing the same problem, I have done several tests, but it turns out as if only some fields can be added to the deny list, like profile picture, but nothing changes for the last_ip field.

Any update?

[ale.vesga1]

Our team is going back to answer frequently asked questions.

After further tests, I was able to reproduce the same observations as you. It looks like only some root attributes can be denied, not all. Looking at the User Profile Structure more closely the last_ip root attribute cannot be updated.

User Profile Structure

Hope this helps!