The 14 Auth0 security checks Black Cat runs
Black Cat SSPM evaluates 14 security policies against your Auth0 configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Auth0 — what access Black Cat needs, and why.
Identity, MFA & sign-in
7 checks · highest severity: high
Third-party & OAuth apps
3 checks · highest severity: high
Identity, MFA & sign-in (7)
- User Without MFA severity: high
- Dormant User severity: medium
- Connection MFA Disabled severity: high
- Tenant MFA Not Enforced severity: high
- Weak Connection Password Policy severity: medium
- Connection Brute Force Protection Disabled severity: high
- Long Tenant Session Lifetime severity: medium
Third-party & OAuth apps (3)
- Application Risky Grant Type severity: high
- Public Client With Confidential Grant severity: high
- Wildcard Callback URL severity: medium
Other checks (4)
severity: high Role Targets Management API fix difficulty: medium #
Review roles that grant write access to the Auth0 Management API
- Open Auth0 Dashboard > User Management > Roles and select the flagged role
- Review the Management API permissions (create/update/delete) assigned to it
- Remove unnecessary Management API write permissions or reassign members to a scoped role
- Confirm the remaining members genuinely require tenant-admin privileges
Satisfies: NIS2 Directive NIS2-21.i.4 DORA (SaaS Security) DORA-9.3
severity: low No Recent Audit Events fix difficulty: easy #
Confirm Auth0 tenant logs are being generated and retained
- Open Auth0 Dashboard > Monitoring > Logs and confirm events are present
- Verify the M2M application has the read:logs scope
- Configure a Log Stream for durable retention if required
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: info Management API Change Event fix difficulty: medium #
Review successful Management API change events for unexpected configuration changes
- Open Auth0 Dashboard > Monitoring > Logs and locate the event by its log_id
- Confirm the change was authorized and made by an expected administrator
- Investigate and revert the change if it was not authorized
Satisfies: NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1
severity: high Dynamic Client Registration Enabled fix difficulty: easy #
Disable tenant-wide Dynamic Client Registration unless explicitly required
- Open Auth0 Dashboard > Settings > Advanced
- Disable Enable Dynamic Client Registration
- If DCR is required, restrict it with the appropriate promote/scope controls
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10