Auth0 identity, MFA & sign-in security checks
Who can sign in, how strongly they authenticate, and whether sessions, passwords and sign-in locations meet the baseline every admin account should clear.
On Auth0, Black Cat runs 7 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Auth0 connector needs.
Checks (7)
severity: high User Without MFA fix difficulty: medium #
Enroll Auth0 users in multi-factor authentication
- Open Auth0 Dashboard > Security > Multi-factor Auth and enable a factor (e.g. Auth0 Guardian, WebAuthn)
- Set the MFA policy to require enrollment for all users
- Notify affected users to complete enrollment
- Note: mfa_enrolled is a best-effort signal — the user's multifactor[] list can remain stale after an admin MFA reset; confirm in the user's profile if in doubt
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Dormant User fix difficulty: easy #
Block or remove Auth0 accounts inactive for 90+ days
- Open Auth0 Dashboard > User Management > Users
- Filter by last login to identify dormant accounts
- Block or delete accounts that are no longer needed
- Document the review decision for compliance records
Satisfies: NIS2 Directive NIS2-21.i.2 DORA (SaaS Security) DORA-9.6
severity: high Connection MFA Disabled fix difficulty: medium #
Enable MFA on database connections
- Open Auth0 Dashboard > Authentication > Database and select the connection
- Enable multi-factor authentication for the connection
- Verify enrollment for users authenticating through this connection
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: high Tenant MFA Not Enforced fix difficulty: medium #
Enforce MFA at the tenant level via a Guardian policy
- Open Auth0 Dashboard > Security > Multi-factor Auth
- Set the MFA policy to require MFA for all applications (or use Adaptive MFA on supported tiers)
- Save and verify the Guardian policy is active
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Weak Connection Password Policy fix difficulty: easy #
Raise the password policy on database connections to good or excellent
- Open Auth0 Dashboard > Authentication > Database and select the connection
- Open Password Policy and set strength to Good or Excellent
- Configure password history and dictionary checks
- Save and re-scan to confirm
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: high Connection Brute Force Protection Disabled fix difficulty: easy #
Enable brute-force protection on database connections
- Open Auth0 Dashboard > Security > Attack Protection > Brute-force Protection
- Enable brute-force protection and configure the block threshold
- Verify it applies to the affected database connection
Satisfies: NIS2 Directive NIS2-21.j DORA (SaaS Security) DORA-9.4
severity: medium Long Tenant Session Lifetime fix difficulty: easy #
Reduce the tenant session lifetime to 168 hours (7 days) or less
- Open Auth0 Dashboard > Settings > Advanced > Login Session Management
- Set the Inactivity timeout and Require log in after to a value of 168 hours or less
- Save and verify the new session limits
Satisfies: NIS2 Directive NIS2-21.i.5 DORA (SaaS Security) DORA-9.5