Auth0

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Microsoft Corporation
Support Tier	Microsoft
Support Link	https://support.microsoft.com
Categories	Identity
Version	3.1.5
Author	Microsoft - support@microsoft.com
First Published	2022-08-18
Last Updated	2026-04-27
Solution Folder	Auth0
Marketplace	Azure Marketplace · Popularity: 🟢 High (85%)

The Auth0 Access Management solution for Microsoft Sentinel provides the capability to ingest Auth0 log events into your Microsoft Sentinel workspace.

Underlying Microsoft Technologies used:

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

a. Azure Monitor HTTP Data Collector API

b. Azure Functions

Data Connectors
Tables Used
Content Items
Additional Documentation

Data Connectors

This solution provides 2 data connector(s):

🔶 CLv1: This connector ingests into a table that uses the legacy Custom Log V1 schema format with type-suffixed column names (e.g. _s, _d, _b, _t, _g). Note: identification is based on column name suffixes which are also permitted in CLv2, so this classification may not always be accurate.

Tables Used

This solution uses 2 table(s):

Table	Used By Connectors	Used By Content
`Auth0AM_CL` 🔶	[DEPRECATED] Auth0 Logs (using Azure Function)	-
`Auth0Logs_CL`	Auth0 Logs (via Codeless Connector Framework)	-

🔶 CLv1: This table uses the legacy Custom Log V1 schema format with type-suffixed column names (e.g. _s, _d, _b, _t, _g). Note: identification is based on column name suffixes which are also permitted in CLv2, so this classification may not always be accurate.

Content Items

This solution includes 2 content item(s):

Content Type	Count
Parsers	2

Parsers

Name	Description	Tables Used
Auth0	-	`Auth0AM_CL` (read) `Auth0_CL` (read)
Auth0AM	-	`Auth0AM_CL` (read) `Auth0Logs_CL` (read)

Additional Documentation

📄 Source: Auth0/README.md

Upgrading to the multi-host (multi-domain) Auth0 Logs connector

Starting with solution version 3.2.0, the Auth0 Logs (via Codeless Connector Framework) data connector supports collecting logs from multiple Auth0 hosts from a single connector. Each ingested record is tagged with an Auth0Domain column so you can tell the hosts apart (for example: Auth0Logs_CL | summarize count() by Auth0Domain).

What happens when you upgrade:

Update the Auth0 solution to 3.2.0 (or later) from Content Hub. Your existing Auth0 log collection keeps running during and after the update — no data is lost.
Upgrading the solution only refreshes the connector definition. It does not change the data collection rule or poller already running in your workspace, so the new multi-host experience and the Auth0Domain column are not applied automatically.
To enable multi-host collection, open Microsoft Sentinel > Data connectors > Auth0 Logs (via Codeless Connector Framework), then reconnect:
- In the connection grid, add each Auth0 host as its own connection using Add Auth0 host, providing that host's Domain, Client ID, and Client Secret.
- Reconnecting re-provisions the data collection rule (now including the Auth0Domain column) and starts a separate poller per host.
New host connections take a cycle or two to warm up (initial token fetch, first backfill window, then ingestion), so a newly added host may lag the first one before data appears.

Note: Records collected before the upgrade remain in Auth0Logs_CL with an empty Auth0Domain. Records collected after you reconnect a host are tagged with that host's domain.

Steps to Configure Auth0 app

The following are steps to be followed in Auth0 App.

Please go to applications and select application from auth0 side, Please find below screen shot for reference :-

Click on settings of the App and note down the credentials
a. Copy the domain b. Get the client id value c. Get the client secret
Under Application properties --> Select Application type as Machine to Machine. Please find below screen shot for reference :-

Under credentials tab --> Select client secret (Post). Please find below screen shot for reference :-

Under API tab, please make sure Authorized to scopes, Please find below screen shot for reference :-

[Content truncated...]

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.2.0	20-07-2026	Auth0 Logs (via Codeless Connector Framework) Data Connector now supports collecting from multiple Auth0 hosts (multi-domain) and tags each record with the Auth0Domain column
3.1.5	13-04-2026	Deprecate Auth0 Logs (using Azure Function)
3.1.4	30-03-2026	Fix space in name, Rename to Auth0 Logs (via Codeless Connector Framework)
3.1.3	20-03-2026	Rename to Auth0 Logs(via Codeless Connector Framework)
3.1.2	10-02-2025	Advancing CCP Data Connector from Public preview to Global Availability.
3.1.1	22-01-2025	Added Preview tag to CCP Data Connector
3.1.0	13-12-2024	Added new CCP Data Connector to the Solution
3.0.0	24-08-2024	Updated the Data Connector Function app python runtime version to 3.11
	11-12-2023	Added new Parser (Auth0AM)