samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

Find out how you can improve your customers' security and authentication experience using CIBA.

Imagine you're a customer trying to resolve an urgent issue over the phone—for example, a bank transaction, an online order, or a technical support request. Before the agent can help, they need to verify your identity. They ask you for your security passcode, which you’ve forgotten. Then come the security questions: your birthday, your last bank transaction, your best friend's name. These questions are easily compromised and create security concerns.

This frustrating experience is all too common across industries. From financial services to retail, organizations face the challenge of verifying customers securely and efficiently for online, over-the-phone, and in-person interactions. That's where CIBA comes in.

In this blog post, we’ll explore how our new [**Client-Initiated Backchannel Authentication (CIBA**](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-initiated-backchannel-authentication-flow/user-authentication-with-ciba)**)** feature, part of Auth0, improves customer authentication for call centers and in-person interactions. CIBA makes authentication faster, more secure, and eliminates the need for outdated PINs or security questions.

## Moving Beyond Less Secure Security Questions and OTPs

Call centers are just one out-of-band scenario currently burdened with inconvenient and insecure authentication protocols. Say you’re trying to verify your Identity so you can personalize the settings in your new car, but in order to do so you need to go through a cumbersome process: open the car’s app, scan a QR code, open a browser and log in –all before you can update your personal settings. Or maybe you’re trying to pick up a retail order in person, but in order to do so, you need to authenticate yourself with security questions or personal information. The problem is that these questions are vulnerable to data breaches and phishing attacks (just like passwords) and revealing private information directly to agents creates obvious privacy concerns that customers shouldn’t have to deal with.

Some organizations may try to get around this by using SMS or emailing one-time passwords (OTPs). However, these methods often introduce an additional, cumbersome step into the authentication process and present security challenges. SMS for example is vulnerable to SIM Swapping, which allows attackers to intercept SMS OTPs. Email OTP assumes that the email account is secure, which may not be the case. Plus, both email and SMS OTPs are vulnerable to the typical phishing and social engineering attacks that trick people into compromising their OTP, and they lack biometric authentication methods (e.g. face ID, fingerprint, etc.).

CIBA offers a more consumer-friendly and secure way of authenticating “out-of-band” customers.

## CIBA: A Superior Approach to Out-of-Band Authentication

Safe, seamless brand experiences go beyond the login box. They extend to critical customer touchpoints—like when customers seek support over the phone, online, or in person. CIBA empowers businesses to deliver **both enhanced security and a smoother user experience**, leading to stronger customer satisfaction and better business outcomes. Let’s unpack what CIBA is and how it drives business success:

**Client Initiated Backchannel Authentication (CIBA)**—also known as a **decoupled authentication flow**—is a protocol that enables a client application (e.g., call center systems, POS terminals, in-person service tools, or autonomous AI Agents) to initiate the authentication process on behalf of the customer.

Let’s walk through an example workflow.

A user would like to withdraw from their bank and agrees to initiate the CIBA mobile app verification process.

![Initiate the CIBA verification process](https://images.ctfassets.net/23aumh6u8s0i/4Z2y3Etq6z8cYdxMHwEHDJ/636c00a03bb28fc64e73e1daebff455d/Uploaded_from_Okta_CIBA_blog_v1)

Right away, the user gets a notification on their phone to approve the request and authenticates with biometrics through the app.

![CIBA flow: the user gets a notification on your device](https://images.ctfassets.net/23aumh6u8s0i/3F7yYxI2qaHLys12sLQcuB/dcb6b0227f0388a95f369023b95f69f3/Uploaded_from_Okta_CIBA_blog_v1)

Lastly, the user approves the request and seamlessly and securely continues their withdrawal.

![CIBA flow: User approves the authentication request](https://images.ctfassets.net/23aumh6u8s0i/QOu1PqIN7gV6Bn5Mars8Q/bd13772e469354c82bfb62a0c780c77a/Uploaded_from_Okta_CIBA_blog_v1)

## Achieving Better Business with CIBA

CIBA improves your business and your customer experience with some great features:

### Stronger Security and Privacy

Traditional out-of-band authentication methods, like security questions or email/SMS one-time passwords (OTPs), are insecure and frustrating. CIBA replaces these outdated approaches with **secure, seamless in-app biometric authentication** (e.g., Face ID or fingerprint). A simple push notification lets customers verify their identity effortlessly with **just one tap**, without sharing sensitive personal information.

### A Financial-Grade Protocol

Trusted by financial institutions, CIBA is a **financial-grade protocol** that provides stronger safeguards against phishing and data breaches. By securing highly sensitive customer interactions, CIBA acts as a **robust fraud prevention tool**, protecting both businesses and customers from scams and breaches.

### Non-Repudiation for Trust

A CIBA authentication flow with the [Guardian mobile SDK](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian) supports **non-repudiation**—so that neither party in a communication can deny their involvement. For example, in a call center scenario, this prevents customers or agents from disputing that certain information was exchanged. Non-repudiation builds trust and ensures authenticity for sensitive interactions.

### Enhanced Customer Experience (CX)

CIBA delivers smoother CX with **one-tap in-app authentication** —no browser redirects. This simple, efficient flow reduces abandonment rates, increases app engagement, and empowers customer-facing teams to drive satisfaction and business growth.

With [**Auth0 Guardian SDK**](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian), you can further enhance CX by customizing every aspect of the CIBA customer journey to reflect your brand and meet unique business needs—creating an experience that’s as secure as it is smooth.

## CIBA in Action: Real-World Examples

A decoupled authentication flow leveraging CIBA adds a much-needed security boost to sensitive interactions, all while supporting seamless customer experiences across a number of different scenarios and use cases:

*   **Call center verification**.
Say you’re a financial services institution, and a customer is calling in to request help with their bank account. Using CIBA, the bank teller can authenticate the customer by sending a push notification to the banking app your customer has installed on their phone. There, they can confirm their identity using the already-enabled biometric sign-in. No more asking customers to share SMS passcodes or make their social security numbers, and (forgotten!) answers to security questions vulnerable by speaking them out loud.

*   **In-person verification**.
In all kinds of in-person scenarios (e.g., withdrawing money at a bank, checking into a hospital, picking up meds at the pharmacy) CIBA gives employees the option of confirming customers’ Identity in real-time by initiating a push notification sent immediately to their phone. The alternative in these situations is often asking customers to present physical documentation such as utility bills or their driver's licenses––an insecure authentication method that can leave customers vulnerable to fraud if they are stolen or compromised.

*   **Connected device verification**.
CIBA also allows internet-connected devices to initiate push notifications in IoT scenarios. For example, if a customer is registering a new car and customizing their settings, CIBA lets them kick off this process in an easy, authenticated manner by confirming their Identity through a push sent directly to a consumer app. Not only is this a more secure means of authentication, it also allows customers to avoid clunky options currently on the market, e.g., scanning a QR code that redirects to the app.

*   **POS terminal**.
In a retail environment that increasingly favors hybrid shopping experiences (e.g. ordering furniture online and picking it up in person) a CIBA flow allows customers to confirm their Identity on-site through self-serve kiosks that initiate a push notification sent to the customer’s phone. This not only keeps the transaction secure, but it also eases any labor constraints retailers might be experiencing by preventing employees from getting roped into the authentication process.

**Better security. Better CX. Better business.**.
CIBA represents a new addition to the security toolbelt for organizations looking for a more secure, more seamless way of authenticating users in call center scenarios and beyond.

Curious about where CIBA can improve your operations––and your bottom line? [Schedule a demo with your account rep](https://auth0.com/contact-us) to see it in action.

CIBA: Authenticate Customers in Call Centers and Other Out-of-Band Scenarios

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

SaaStart allows devs to easily explore, gain experience with, and demonstrate key Customer Identity functionality

Getting started with Customer Identity and Access Management (CIAM) — especially for B2B SaaS apps — can be intimidating. What began as a fairly straightforward login box has grown into a comprehensive set of capabilities encompassing authentication, authorization, user lifecycle management, federation, and Identity security — all of which must comply with [a daunting array of ever-evolving regulations and standards](https://auth0.com/security).

At the same time, there’s no substitute for learning through hands-on experience. But the reality is that devs are already under enough time constraints and don’t always have the luxury of building sandboxes or proofs-of-concept from scratch.

That’s why we’re excited to unveil [SaaStart](https://saastart.app/), a reference B2B SaaS application built using Next.js and Auth0 by Okta.

Intended primarily for developers building B2B SaaS apps, [SaaStart](https://saastart.app/) provides a fast, safe, and accessible way for devs to explore, experiment, and get up and running with Customer Identity. You can easily deploy a sample Auth0 template from within [the SaaStart GitHub repository](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

## Get Hands-on with Customer Identity

In Identity terms, essential features of an effective B2B CIAM solution include:

* **User registration**, to create the record that makes everything else possible
* **Authentication,** to establish with confidence that the users logging into accounts are who they say they are, using one or more factors to do so
* **Authorization,** to help organizations provide a user with the appropriate level of access to resources or applications
* **Delegated administration,** to enable customers and administrators to make updates and changes to users’ data and access

But — just as describing a car as a combination of engine, drivetrain, wheels, and steering mechanism is woefully insufficient at capturing what you can do with one or how to build one — simply summarizing these Identity elements doesn’t come close to telling the CIAM story.

To help fill in the blanks with practical experience, [SaaStart](https://saastart.app/) allows devs to explore CIAM within the look, feel, and functionality of a modern B2B SaaS application.

Using [SaaStart](https://saastart.app/), devs can get hands-on with:

* **Multi-tenant access control,** including administrative roles with control over the app’s configuration

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/19r62j5wQAyA9WaC03j62T/d4bc78054cbb4e4843d5154a4b8261be/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/2g4TA8C7AkVObsBT9LTx4t/57a14e32fb52f571d52db9503c9b0653/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

 

* **Log-in options for the modern extended workforce,** including Single Sign-On (SSO) for enterprise employees and email-based authentication for early adopters and smaller customers without their own Identity Providers

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/2HdILnTFaOOb7jfePCuJhG/57087f523ecea46c6a8ee89e5f13d6f0/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

* **Security policies,** from enforcing a range of Multi-Factor Authentication (MFA) options and domain-based SSO to configuring session timeouts

![SaaStart](https://images.ctfassets.net/23aumh6u8s0i/35qq2OrUXesaKoxdSyX3ww/5990471670bd41b204cfe0b8d742ba8f/Uploaded_from_Speed_up_Your_Customer_Identity_Journey_with_Auth0_SaaStart)

* **User provisioning,** including just-in-time provisioning or automated user management using the System for Cross-Domain Identity Management (SCIM) - _coming soon_

* **API client management** with self-service create/delete capabilities - _coming soon_

## Everything Developers Need to Implement Customer Identity

SaaStart is just a taste of what’s possible with Auth0 by Okta.

With 10+ years as a pioneer in the CIAM space, we’ve leveraged cutting-edge technologies and architectures to create [a modern solution with an impressive collection of features and functions](https://auth0.com/blog/why-auth0-by-okta/).

Whether you’re building a B2C, B2B, or Hybrid application, Auth0 provides the foundational requirements out of the box with broad support for [open standards](https://auth0.com/learn/how-auth0-uses-identity-industry-standards) and a range of developer resources — including [Quickstarts](https://auth0.com/docs/quickstarts), [APIs](https://auth0.com/docs/api), and [30+ SDKs](https://auth0.com/docs/libraries).

In fact, with a few lines of code, you can integrate Auth0 into any app written in any language and any framework.

Plus, we’re proud to offer a number of discounted offerings that can help you get started and — thanks to a long list of features — are often sufficient for the longer term:

* Self-service options, including a [free trial plan](https://auth0.com/signup) that lets you get off the ground with up to 7,500 active users and unlimited logins — while also including social login, DB connection for securely storing Identity information, branded login, extensibility, and security capabilities (brute force and suspicious IP throttling), support for five regions (US, UK, EU, JP, AUS), and even passkeys
* [Auth0 for Startups](https://auth0.com/startups), which brings the convenience and security of Auth0 to eligible startup customers so they can focus on their core value propositions rather than spending more time than is necessary on Identity
* Our [Nonprofit Offering](https://auth0.com/nonprofits/get-started), which provides preferential pricing that makes the leading Identity service even more accessible to organizations on a mission to make the world a better place

## Speed up Time-to-Market with Auth0

We understand that developers would rather spend their time solving hard problems and leveraging their creative side to build really fun solutions. Auth0 enables you to do those by offloading some of the more mundane and frankly dull parts of creating a standards-based CIAM solution.

And [there’s ample evidence](https://auth0.com/customers) that outsourcing Customer Identity is the prudent approach. For instance, Okta’s 2023 report [How Development Teams Purchase SaaS](https://www.okta.com/resources/whitepaper-how-development-teams-purchase-saas-report/thankyou/) revealed that:

* **Authentication takes the third-most time and work to build and maintain in-house**, behind only “data management and storage” and “DevOps tooling and automation.”
* **Third-party authentication reduces time to market more than any other SaaS component** — 88% of organizations that use a third-party SaaS platform for authentication report reducing time to market

We invite you to visit our [Developer Center](https://developer.auth0.com/) to learn about Auth0, explore tutorials, download code samples, connect with us, find resources, and more.

If you have feedback about SaaStart or suggest other features to explore in future versions or new apps, please drop us a comment or open an issue on [the GitHub repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter).

<include 
 src="LinkCard" 
 title="A B2B SaaS Application Primer Using Auth0" 
 link="https://auth0.com/blog/b2b-saas-application-primer-using-auth0/" 
 description="Are you building a B2B SaaS application using Auth0? Then check out our primer for more on delivering IAM functionality using the Auth0 Organizations feature."
img="https://images.ctfassets.net/23aumh6u8s0i/44Jbuzdh6CvHDaCJ6LJNLh/2a8d0114b1bd7b03a92a386cced73e6b/square-hero.jpg"
/>

Speed up Your Customer Identity Journey with Auth0 SaaStart

1Vitor de Sousa_Auth0

As Regional Vice President, Vitor de Sousa supports Okta and Auth0's German customers in achieving their Identity and Access Management goals. With more than 20 years of experience in the consumer goods industry, as well as in technology and software sales, he develops strategically smart and creative solutions for the interplay of identity authentication, customer experience, and data protection.

Regional Vice President, Enterprise Sales - Germany

Vitor de Sousa

Partnering with a provider to centralize identity lets you maintain control over your data without compromising user experience

Consumers expect the web apps and services they use to be intuitive while also requiring secure and private transactions and a low-friction experience. A good example of this is the increasing demand for biometrics, the use of a person’s physical attributes like a fingerprint or face scan to prove identity and control access. Consumers have become accustomed to the security and convenience that using a fingerprint to unlock their smartphone offers, so using the same technology to secure your web app is an intuitive way to help secure their account data.

[Auth0’s recent global survey](https://info.auth0.com/erwartungen-und-realitat.html), including more than 2,000 consumers and 200 IT/marketing decision-makers in Germany, found that 31% of German consumers are more likely to sign up for a service if it offers biometric authentication. Yet only 17% of German businesses offer this feature. SO biometric authentication is one way for businesses in the DACH region to better align themselves with their customers’ expectations for security without compromising their customer experience (CX). 

Partnering with an [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider who understands how to combine an intuitive user interface with strong security measures like that offered by biometrics can bring additional benefits to your organization. For example: freeing your in-house development talent to focus on your core product, helping you meet regional data privacy regulations, and maintaining active control over your user data.

## Let Your Internal Talent Focus on Your Core Product

Germany is not only the largest economy in the EU; it is also home to the largest software developer talent pool in the region. [As of 2019](https://www.cbi.eu/market-information/outsourcing-itobpo/software-development-services/market-potential), there were more than 900,000 developers in the country, with a majority describing themselves as [Full-Stack front-end developers](https://insights.stackoverflow.com/survey/2021). To ensure your in-house dev teams can focus on those strengths, don’t distract them with an identity project. At Auth0, identity is our core product. Our teams built, maintained, and enhanced a Customer Identity and Access Management (CIAM) platform that incorporates industry security standards, an expert understanding of regional data privacy regulations, and a highly customizable set of integrations to bring you exactly the right mix of security, privacy, and CX.

Our identity specialists bring their expertise and knowledge to secure your authentication and authorization processes while also bringing your customers the tailored, low-friction CX they expect. That allows us to help you build a solution that will be capable of incorporating your needs in the present — while remaining extensible enough to scale with your plans for the future. 

The centralized identity solution you build will unify authentication for your platforms, services, and web apps. This single source of truth (SSoT) for your customer identity data is easier to secure than disparate, siloed data stores for each system. It also limits your attack surface by eliminating multiple access points and login boxes. 

By partnering with Auth0, you get a centralized identity platform that’s ready to be customized by your developers to meet your precise requirements. And our extensibility allows that platform to be readily extended to cover all of your existing properties, whether they’re modern cloud-based apps or legacy on-prem systems.

## Understanding Data Privacy Regulations in The DACH Region

EU Member States are allowed to enact national privacy rules to supplement, specify, and modify the GDPR rules as applied to their citizens. It’s important that companies familiarise themselves with these rules that often govern specific situations.

This document is not intended to act as legal advice. Please consult your legal counsel to ensure you are in compliance with all applicable data privacy laws and regulations.

The right to privacy is well established and respected in the DACH region, where such legislation existed long before the GDPR. Today there are additional rules such as the new German Privacy Act (BDSG-new) along with industry-specific regulations for, e.g., telecommunications, banking, and energy. In Austria, too, we see local regulations like the [Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (DSG)](https://www.dataguidance.com/notes/austria-data-protection-overview), all designed to put the privacy rights of citizens first.

[Switzerland](https://www.dataguidance.com/notes/switzerland-data-protection-overview) has a slightly different take on data protection regulations as well. In addition to GDPR, there are two additional laws that impact data collection and processing there. The first is Article 13 of the Swiss Constitution, which protects Swiss citizens’ rights to privacy in personal and family life, as well as within the home. Meanwhile, the Federal Act on Data Protection (FADP) solidified the language governing how those rights are protected in regards to digital data. Unless you have a team of lawyers and governance specialists for your developers to work with, making sure you’re in full compliance with all of these regulations will soak up a lot of internal resources. Partnering with an IDaaS provider can alleviate these additional strains by taking on the task of helping to assure compliance.

The DACH data privacy landscape can seem complex, and the responsibility for coding privacy into your applications often falls to the people building them. By partnering with Auth0, your developers can help you protect your customer’s personal information without becoming privacy experts themselves. Auth0’s key privacy-enabling features include:

* Easy access to user profiles to enable removal requests
* To export a user’s data in JSON format for data portability
* To enable Log Streaming for continuous security monitoring
* The knowledge that your data is stored locally at an AWS facility in Frankfurt

## Great Customer Experience Includes Choices for Data Location

Part of ensuring your customers get the experience they expect is maintaining control over the data they share when they create an account. Consolidating that data into an SSoT simplifies continuously monitoring its security and detecting threats and other anomalies. Having choices with respect to the location where your data is stored is another asset of partnering with an IDaaS provider like Auth0.

### Data security certification

Auth0 brings knowledge of [regional privacy regulations](https://auth0.com/docs/compliance/gdpr), along with internationally recognized certifications from organizations such as the International Standards Organization (ISO) [27001](https://www.iso.org/obp/ui/#iso:std:iso-iec:27001:ed-2:v1:en) and [27018](https://www.iso.org/standard/61498.html), along with a[ SOC 2 Type II audit](https://auth0.com/blog/auth0-achieves-soc-2-certification/). These are third-party verified certifications, meaning a specialized auditing body has signed off on the security of our processes, infrastructure, [platform](https://assets.ctfassets.net/kbkgmx9upatd/2KxmM5BICQ4GKgeIwA0sKu/d4f59bd579803593edcd571f1aa92ef0/Auth0_Platform_Operations.pdf), policies, and continuous monitoring framework. Auth0 complies with [additional regulations](https://auth0.com/de/security) as well, BaFin, EBA, and HIPAA for example. 

### Customizable user interfaces

[Auth0 Marketplace](https://marketplace.auth0.com/) offers integrations with major line-of-business software, while our [Actions](https://auth0.com/actions) capability allows your developers to work with these integrations with everything from drag and drop to a full Javascript editor. This ease of integration and customization means you can create your login box once and use it across properties.

### All your user data in one place

Being cloud-native gives Auth0 the flexibility to offer multiple data storage options. Access is a key piece of data residency. For organizations in the DACH region, we offer [private cloud deployment options on Microsoft Azure](https://auth0.com/blog/auth0-on-microsoft-azure-as-a-private-cloud-deployment-option/) or AWS infrastructure, as well as public cloud options using an AWS facility in multiple regions such as Frankfurt to help our customers achieve compliance. 

### Iterative deployment to ensure buy-in across the organization

Deploying a new identity and access management system can be a lengthy and complex process from a business perspective. Partnering with Auth0 and taking advantage of our identity experts allows for an iterative deployment and a smooth migration that does not jeopardize the user experience by offering frictionless user migrations without password resets. That way, each department or product team can witness a successful roll-out before giving their buy-in without straining your in-house talent. Cross-departmental collaboration is key to any software project, particularly when that software controls data access, and having a successful proof-of-concept (POC) in hand can help secure buy-in as you move forward.

Work with an identity partner that understands your need for a great digital experience without compromising the security and privacy of your customer data. [Reach out to our identity experts](https://auth0.com/contact-us) when you’re ready to continue the conversation or to find out how to start working with Auth0 today.


Centralize Identity For Security and Customer Experience

richard-marr

GM, APAC

Richard Marr

A robust CIAM solution helps you find the right balance of security without sacrificing customer experience

A recent PwC study found that [32% of the public will abandon a company](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) after a single bad customer experience. What if that frustrating experience is your login? If you turn up the security measures too high, customers won’t bother navigating the hurdles to create an account or log in to an existing one. The flip side is if you dial the security down too far in favor of an easy login flow, malicious actors will take advantage of the fact that while the majority of people (91%) know reusing passwords is a bad practice, [66% admit to doing it anyway](https://www.logmeininc.com/newsroom/press-release/2020/lastpass-psychology-of-passwords-report-reveals-91-of-people-know-password-reuse-is-insecure-yet-two-thirds-do-it-anyway). Those numbers are courtesy of a study conducted by LogMeIn, makers of the password manager LastPass.

Login pages are often the first point of interaction between customers and the companies they do business with. Of course, that means those login pages are often the first point of contact for malicious actors, as well. For any company doing business online, there’s a line to walk between keeping data secure and providing a low-friction login experience for legitimate customers. [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) is the solution that allows for successful navigation of this line.

From a business standpoint, having too few security measures leaves you open to regulatory penalties should a data breach occur and the high financial costs of recovering from a breach, not to mention the damage to your brand that can extend far beyond the recovery period. Too much security can result in lost conversions when customers abandon the process due to friction. A strong CIAM solution lets you consolidate the onboarding, organizing, and managing of user accounts — all while helping mitigate the chances of a breach with defensive measures like Bot Detection and brute force protection.

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/2opPstgbMTWBqurQhYT22U/fbe55b99b77219db5cee29b29972a62a/CIAM_recorte1.png)

## User Account Flow and How CIAM Manages Each Stage

A robust CIAM platform provides you with an identity Single Source of Truth (SSoT). SSoT is a data organization framework that says it’s easier to protect data in one place rather than data in multiple siloed locations spread across multiple platforms (like on-prem and cloud). Beyond that, strong CIAM provides customers a single login window for all of your properties. Even if you’re expanding your presence and adding new tools and apps, users will only ever have to login once to access them all. CIAM provides similar ease-of-use solutions throughout the user account lifecycle.


### Account creation

When a new customer decides to create an account, they’re telling you that they trust you with their data and that they’re ready to become a customer. Rewarding them with easy, low-friction processes is key to showing them that their trust is well placed. A CIAM solution that offers multiple first-factor sign-on options, such as [passwordless](https://auth0.com/intro-to-iam/what-is-passwordless-authentication/), [biometrics](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), or [single sign-on](https://auth0.com/blog/what-is-single-sign-on-a-non-developer-s-guide/) to create an account means they don’t have to create or reuse an existing password. This streamlines the customer experience while adding security by removing passwords from the login flow.


### Account maintenance

At this stage, automation is CIAM’s biggest benefit. Automated password resets, and the ability to combine accounts in cases where a person accidentally creates a duplicate reduces the backend workload on your team while keeping customer friction low. While such automatic password resets are one of the stronger benefits of a CIAM solution, it’s important to note that malicious attackers often seek to exploit these recovery flows. These attacks can be thwarted by having strong security in place that offers a range of protections, including Bot Detection and the ability to spot suspicious IP throttling.


### Account end-of-life

Should a user abandon their account, you need a process in place that deactivates these accounts and eventually deletes them. This will prevent those credentials from being used in future attack scenarios, as well as keeping your user account database clean and free of dead accounts.


## The Business Impact of Data Security

There are a variety of attack vectors available to malicious actors once account credentials are stolen. We go into more detail in a [whitepaper](https://auth0.com/resources/whitepapers/secure-ciam) on this topic, but what follows is a brief summary of the most prevalent of these vectors.


### Credential stuffing attacks

When an attacker takes a list of breached credentials and runs all of these combinations through a login flow until they find a combination that unlocks the login box, it’s called [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/). These attacks prove efficient for the attackers due to password reuse. Lists of breached username/password combinations are available on the dark web, making credential stuffing attacks a low-effort way to instigate a breach. 


### Business email compromise (BEC) attacks

Usually beginning with spearphishing emails sent in the guise of a trusted partner account, BEC attacks are targeted at busy executives with the goal of obtaining a money transfer to an account owned by the attacker. Once again, breached credentials often play a key role in these attacks.


### Bot-based brute force attacks

Bot attacks can take several forms. Most often, they are automated credential stuffing or what are called swarm attacks: when a malicious actor uses automation tools to flood a site with traffic either to cause the site to crash in a distributed denial-of-service (DDoS) attack or to buy up available retail stock to inflate the price on the aftermarket.

The business impact of these attacks can be dramatic, ranging from the financial impact of lost business to increased churn due to customers losing trust in the business to long-lasting damage to brand reputation. For these reasons, finding the right balance of[ security and customer experience](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/) is a business priority. 

![CIAM](https://images.ctfassets.net/23aumh6u8s0i/2cpWz1sTXnXL7Da3rGAWJ0/e96fb924653277fe241211e3e15fa396/CIAM_recorte2.png)

## Data Security Is a Moving Target

According to the 2020 edition of the IBM/Ponemon Institute’s Cost of a Data Breach report, lost business after a data breach averages out to more than [$1.5 million per breach](https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/). That works out to approximately 40% of the total average cost of a data breach, which the same report puts at $3.86 million.

PwC has found that [87% of consumers](https://www.pwc.com/us/en/services/consulting/cybersecurity-privacy-forensics/library/global-digital-trust-insights.html) will take their business elsewhere if they feel a company is not treating their data with due care. The takeaway is to be open and honest with your customers about your data use policies. After collecting their consent to use their information, tell them what you’re using it for, how you’re caring for it, and what your policy is regarding data destruction when you’re done with it. This transparency will go a long way toward mitigating these potential impacts.

Data security needs are in constant flux with changing regulatory requirements, evolving attack vectors, and increasingly data-savvy consumers. Auth0 research has found that [83% of apps in development will require authentication](https://auth0.com/resources/whitepapers/state-app-assembly-2020), yet only 58% of companies are availing themselves of the Identity-as-a-Service (IDaaS) option. Let our experts keep up with those ever-evolving security needs and handle what they do best, identity, while yours do what they do best, creating and enhancing your core product. 

A company’s digital identity is of increasing importance in today’s crowded marketplace, and managing customer experience from the login page is key to creating the trusting relationships needed to thrive. If it’s time for your business to pay more attention to your access management solution, [get in touch with our team of identity specialists](https://auth0.com/contact-us) today to start the conversation.

<include src="asides/AboutAuth0" />

CIAM: Balancing Security with Customer Experience

randy_nasson

Director of Product Management for Customer Identity Cloud (formerly Auth0) in our Identity and Access Management (IAM) domain. I joined Auth0 in 2018 and assembled a world-class IAM product team dedicated to delivering customer value and enabling developers to quickly implement secure, robust, and seamless identity solutions. In addition to my current work with CIC, I regularly work with our Auth0 Lab team on greenfield initiatives and with our Strategic and Technical Partner teams on opportunities to drive revenue.

Director, Product Management (IAM)

Randy Nasson

antoniofuentes

Antonio is a Product Manager in charge of features and functions used by thousands of customers implementing identity systems to keep their users safe and prevent malicious activity.

Product Manager, Continuous Auth

Antonio Fuentes

Adaptive MFA Improves Security and Customer Experience



## Key takeaways

* [Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) provides added security for protected content, but usability concerns can adversely affect the user experience.
* Using [custom MFA options](https://auth0.com/docs/mfa/customize-mfa-user-pages) can help reduce friction, but custom MFA requires [writing rules](https://auth0.com/docs/rules) (coding) or explicit user opt-in to minimize prompts for secondary factors.
* Auth0 now offers Adaptive MFA, which only prompts users for secondary authentication factors if the login or authorization attempt is considered risky.

## The Password Problem

The rapid growth of internet and software services means that user accounts are growing at a dizzying rate. According to [Dashlane](https://blog.dashlane.com/world-password-day/), the average US internet user has over 150 online accounts, with that number projected to double by 2022. That’s a ridiculous number of passwords to remember and an equally ridiculous amount of personal data to protect. 

Given the [rampant password reuse problem](https://securityboulevard.com/2020/04/8-scary-statistics-about-the-password-reuse-problem/) (65% of people reuse passwords across multiple sites), when data breaches occur, a vast number of accounts are vulnerable. While protective measures like [Breached Password Detection](https://auth0.com/docs/attack-protection/breached-password-detection) can help minimize risks associated with known stolen credentials, there nevertheless remains a substantial risk for potential credential theft in the future.

### Securing accounts with MFA

Fortunately, [MFA](https://auth0.com/docs/mfa) offers an excellent defense against password-related account compromise. [According to Open Web Application Security Project (OWASP)](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html), MFA is “by far the best defense against the majority of password-related attacks.” 

MFA is used to protect accounts and resources across a variety of industries and comes in myriad forms to accommodate various use cases. However, it remains woefully under-adopted in many areas, especially in consumer products and services. With some solutions, MFA can be overly complex or prohibitively costly to implement. And even when it is offered, many end-users reject it because they don’t want to worry about having access to the secondary factor when they are just trying to shop online, access an article behind a paywall, play a game, or stream music. Even for developer tools like NPM, [fewer than 10% of developers use secondary factors](https://www.zdnet.com/article/only-9-27-of-all-npm-developers-use-2fa/).

Balancing security and usability has historically been very difficult, with industry trends often overcompensating in one direction, then the other, causing even more user frustration. Fortunately, Auth0 makes it easy for you to provide the security of MFA without the poor user experience of having to provide a second factor with each login attempt.

![Introducing Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/40V8USPBHCJ0K9SxZHISMw/b7488bb599ce8d9f83a3aeea0e4334fa/adaptive-mfa-sep1)

## Introducing Adaptive MFA

Adaptive MFA bridges the gap between user experience and account security by providing a secondary factor for end-users but only prompting them for secondary verification when the primary factor login looks suspicious or unusual. For example, if the user logs in from a new device or logs in from previously unseen geolocation, these signals can indicate low confidence that a login attempt is legitimate and that the user should be prompted to authenticate via the second factor.

![AMFA How it works](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

By only prompting for second-factor authentication when confidence is low, users who access applications on a regular basis from the same device and location never have to be interrupted with a second-factor prompt.

Auth0 is pleased to announce that Adaptive MFA is available for all hosted customers as of December 15, with Private Cloud availability in the first quarter of 2021. 

### How it works

Traditional MFA prompts users to authenticate using first a primary factor, often a username/password, and then a secondary factor, such as a code sent via SMS or push notification. This ensures that the individual logging in using the primary credentials has possession of or access to the secondary factor as well.

Adaptive MFA assesses the confidence level of each login and, based on that level, decides whether to prompt the user for a secondary factor or not. The confidence level is assessed using:

* The reputation of the requesting IP address
* The frequency of requests from differing geolocations (impossible travel)
* Whether the device is known or not

Assessing these data points for every login attempt, Auth0 determines the confidence of a legitimate login attempt and then:

* Allows the primary authentication to succeed, or
* Challenges the user with an additional factor, or
* Prompts the user to enroll a secondary factor if they currently don’t have one, or 
* Denies the login and blocks the user account

![AMFA How to enable it](https://images.ctfassets.net/23aumh6u8s0i/34gC9R0va1Kd15JtBNdHUd/ec80c9b34f6232ee44410027d8e7aaf4/adaptive-mfa-graphic-3)

### What’s included

With Adaptive MFA, you will have access to a number of tools to help you define flexible policies and make the right tradeoff between security and user experience:

* An Adaptive MFA flow that triggers MFA only when a login attempt appears to be risky
* Risk assessments that can be used to build your own rules to trigger MFA
* Support for managing the feature programmatically via the Management API
* Rule templates to get you started in case you want to write your own custom business logic
* Tenant log metadata to help you understand the risk levels and impact on user experience

### How to enable it

Using Auth0’s updated Admin Dashboard, you can easily configure Adaptive MFA for applications by selecting the **Use Adaptive MFA** option in the **Security > Multi-factor Auth > Define policies** section.

![Use Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Supported configurations

Adaptive MFA can be enabled for all MFA-supported flows and applications where an email address is available. This is because an email address is required to keep the login flow safe in scenarios where the risk is high, and an end-user has no registered additional authenticators. Most connection types fit this category.  

Connection types where an email address is not available are not supported:

* Social connections, if the email claim is not requested
* Azure AD, if the identifier is a username and no email is available
* Passwordless connections, which do not use email

Adaptive MFA is supported in the most commonly used login configurations:

* New Universal Login
* Classic Universal Login (except for passwordless flow)
* Web or Native apps using the latest SDKs
* Flows hosted by a customer using cross-origin authentication

### Fine-tuned control with policies and rules

Auth0’s Adaptive MFA lets you define how to handle low-risk and high-risk login scenarios, including whether to prompt for an additional factor or prompt the user to enroll an additional factor if they don’t have one. In addition, Auth0 enables customization of those policies through the use of rules.

![Adaptive MFA rule](https://images.ctfassets.net/23aumh6u8s0i/3X31s04spm3rcZHMbsjkli/3d974e2b7075f5c5ffc3cf4c37fe4f89/adaptive-mfa-sep2)

#### Adaptive MFA rule templates

Auth0 provides two rule templates out of the box to enable your business to tailor Adaptive MFA behavior to support your needs. 

If you want to prompt users who haven’t enrolled a secondary factor to enroll one during their next login, you can use the **Require MFA Enrollment** rule template. 

```
function requireMfaEnrollment(user, context, callback) {

  const enrolledFactors = user.multifactor || [];
  if (enrolledFactors.length === 0) {
    // The user has not enrolled in any MFA factor yet, trigger an MFA enrollment
    context.multifactor = {
    provider: 'any'
    };
  }

  callback(null, user, context);
}
```

Let’s take a look at the **Adaptive MFA** rule template. The way this rule is written, Adaptive MFA will only be triggered when the confidence level for Impossible Travel is either `medium` or `low`. It provides an example of how you can selectively apply Adaptive MFA to particular assessors and confidence levels.

```
function adaptiveMfa(user, context, callback) {
  const riskAssessment = context.riskAssessment;

  // Example condition: prompt MFA only based on the ImpossibleTravel confidence level.
  let shouldPromptMfa;
  switch (riskAssessment.assessments.ImpossibleTravel.confidence) {
    case 'low':
    case 'medium':
      shouldPromptMfa = true;
      break;
    case 'high':
      shouldPromptMfa = false;
      break;
    case 'neutral':
      // When this assessor has no useful information about the confidence, do not prompt MFA.
      shouldPromptMfa = false;
      break;
  }
```

Then, the code checks if the user is enrolled in MFA using user multi-factor. If the user is enrolled in MFA, then throw the MFA challenge.

```
  // It only makes sense to prompt for MFA when the user has at least one enrolled MFA factor.
  const userEnrolledFactors = user.multifactor || [];
  const canPromptMfa = userEnrolledFactors.length > 0;

  if (shouldPromptMfa && canPromptMfa) {
    context.multifactor = {
      provider: 'any',
      // ensure that we will prompt MFA, even if the end-user has selected to remember the browser.
      allowRememberBrowser: false
    };
  }

  callback(null, user, context);
}
```

### Let’s get started

Ready to learn more about Adaptive MFA and how to enable it to secure your applications and protected resources? Adaptive MFA is available as part of Auth0’s new [Adaptive MFA Security Bundle](https://auth0.com/pricing/). We invite you to learn more by reading the [documentation](https://auth0.com/docs/mfa/adaptive-mfa) and [contact us](https://auth0.com/contact-us) if you have any questions.

Stay safe. And keep your protected resources safe too!


Auth0 Introduces Adaptive MFA

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Cloud-based identity management enables safe and convenient digital experiences for financial customers

**LONDON – 7 December 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Ninety One](https://ninetyone.com/en/south-africa/) has deployed its solution to authenticate retail fund investors in South Africa. Started in South Africa as Investec Asset Management, the firm spun out from parent Investec and rebranded as Ninety One this year. Ninety One replaced their on-premises identity solution with Auth0 as part to provide customers with a seamless login experience across its investment products.

Following the demerger and listing, Ninety One required its own [Customer Identity and Access Management (CIAM)](https://auth0.com/blog/what-is-ciam/) infrastructure, including Single Sign On, Multi-factor Authentication, and self-service password reset features. Ninety One’s own development team and a local transfer agency and administrative outsourcing partner, Silica, recommended Auth0 for ease of integration and the ability to host in the cloud while migrating users gradually from the previous on-premises system. 

“The move to Auth0 is indicative of our journey in other parts of the organization,” says Scott Carr, IT platforms manager at Ninety One. “We have embraced Auth0 as essential for our success as a new brand because they enable us to provide the caliber of safe and convenient digital experiences our financial services clients demand.”

IT security spending in the META region (Middle East, Turkey, and Africa) will cross $3.4B in 2023, driven by a focus on [digital identities and shifts to the cloud](https://www.biznesstransform.com/idc-predicts-major-spending-on-digital-transformation-by-the-ict-industry-in-meta/) (Source: IDC)[1]. Auth0 has been recognized as a top private cloud company in identity management on the [Forbes Cloud 100](https://auth0.com/blog/auth0-is-named-to-the-2020-forbes-cloud-100/) and by industry analysts for serving as a key enabler in customers’ [digital transformation](https://auth0.com/forrester-total-economic-impact) efforts.

“Digital transformation shouldn’t be underestimated, but it doesn’t have to be feared either,” said Steven Rees-Pullman, SVP International at Auth0. “Ninety One is looking to the cloud and replacing legacy systems with building blocks like Auth0 to be more adaptable and resilient while delivering great experiences for their clients. We’re pleased to help power their journey.”

[1] IDC Worldwide Black Book Live Edition, July 2020

## About Ninety One

Ninety One is an independent, active investment manager dedicated to delivering compelling outcomes for its clients, managing more than £119 billion/R2.6 trillion in assets (as at 30.09.20).

Established in South Africa in 1991, as Investec Asset Management, the firm started offering domestic investments in an emerging market. In 2020, almost three decades of organic growth later, the firm demerged from Investec Group and became Ninety One. Today the firm offers distinctive active strategies across equities, fixed income, multi-asset, and alternatives to institutions, advisors, and individual investors around the world.

[www.ninetyone.com](https://ninetyone.com/international) 

<include src="asides/AboutAuth0" />

### Media Contacts

Media Contacts 
McKenzie Mayer 
PR Manager, EMEA 
press@auth0.com 

Kotie Basson 
Head of Marketing, Africa Client Group 
Ninety One 
kotie.basson@ninetyone.com

Ninety One Chooses Auth0 as Foundation for Digital Transformation

jessica-sealby

Jessica drives public relations and global communications efforts for Auth0 across Asia Pacific. Outside Auth0, she frequents Melbourne’s live music venues and chases after her two energetic dogs.

PR Manager - APAC

Jessica Sealby

Identity management serves as essential technology for a global car manufacturer to streamline customer experience

**BELLEVUE, Wash. – November 16, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that Subaru Corporation has chosen Auth0 to provide secure identity management for its newly launched online customer experience, “My Subaru.” Auth0’s secure and frictionless customer authentication experience serves as an essential element in Subaru’s leading approach to customer engagement and meeting the demands of shifting consumer behavior. 

“My Subaru” was designed to support the corporation’s digital transformation efforts and appeal to the industry trend of consumers researching cars online more than ever before. Auth0 will serve as the primary authentication provider for Subaru and will provide assistance in creating a foundational CRM and identity system for managing customer information in a secure manner. Driven by Japan’s Personal Information Protection Act&mdash;which requires companies to show how customer information is being received and managed&mdash;there is a widespread need for proper authentication and digital ID management solutions across the region. Auth0 will assist in compliance with this regulation. 

For Subaru, customer experience could not exist without advanced security, and keeping customers’ personal information safeguarded was paramount. Auth0 was chosen for its ease-of-use, speed of deployment, and extensibility, together with its ability to provide multi-factor authentication (MFA) for even more secure digital engagement. 

“Auth0 is a key factor in our ability to enhance our customers’ online experience, and also provides us with secure identity management. In the near future, we plan to launch a portal service compliant with the Personal Information Protection Act through Auth0’s technology,” said Atsushi Yasumuro, Chief of Business Innovation at Subaru Corporation. “Auth0 is exactly the kind of authentication solution that allows us to achieve Subaru’s vision of ‘Peace of mind & enjoyment,’ giving us the confidence that we are securing customers’ data while offering them the best experience possible.”

The automotive industry is facing a major transition in purchasing behavior, fueling Subaru’s considerable investment in its online offering. The company required an entirely new infrastructure and approach to managing customer information, focusing on integrated CRM software and an identity platform. Auth0 is a vital means for Subaru to build stronger relationships with customers, offer greater post-purchase service, and remain a leader in this highly competitive space.

“We’ve seen enormous momentum around digital transformation in the region. Combined with updated regulations around customer data management, it is more important than ever that identity management becomes a critical piece of any digital foundation,” said Eugenio Pace, co-founder, and CEO of Auth0. “We are honored to work with Subaru on its industry-leading online offering, and look forward to merging identity security with their online presence into one seamless experience.” 

With more than 550,000 users on its owner-oriented “My Subaru” application, Subaru’s goal is to improve consumer engagement and users’ before and after sales experience through universal identification and the identity work in place now with Auth0 will help the company achieve its ambitious goals into the future.

<include src="asides/AboutAuth0" />

### Media Contacts
Jessica Sealby 
Auth0 PR Manager, APAC 
[jessica.sealby@auth0.com](mailto:jessica.sealby@auth0.com)

Auth0 Supports Subaru Corporation with Digital Transformation Shift

ghazi-masood

I'm a seasoned business leader with nearly a 25 year track record in Sales running and managing teams of all sizes working in leadership positions for world class organizations.  Nowadays, you can find me at Auth0 leading all aspects of Revenue growth  for the Americas business.

Auth0 Vice President and General Manager, Americas.

Ghazi Masood

A customizable Identity and Access Management (IAM) solution is key to improving CX in mixed environments.

## Every Environment Is a Mixed Environment

Software implementations are often discussed in terms of “[build vs. buy](https://auth0.com/resources/whitepapers/build-vs-buy-evaluating-identity-management),” meaning that for each functionality desired in the tech stack, an organization needs to decide whether to develop the functionality in-house (build) or go with a third-party solution (buy). The latter essentially means entrusting the functionality, whether that’s team communications or identity and access management (IAM), to a dedicated expert.

But what if your environment comprises both built and bought solutions? For many companies, particularly at the enterprise level, the build vs. buy thinking doesn’t necessarily capture their experience. Instead, they’re working with legacy architecture that’s a highly customized combination of purchased and built-to-spec apps. Sometimes the reality is that, in the words of one CISO, “every environment is a mixed environment.”

## IAM Alleviates Pain

In a mixed environment, ensuring a frictionless customer experience can be a challenge. Having more applications in your architecture creates more opportunities for friction to disrupt the user experience. And now that identity is disseminated across so many different platforms and devices, with users needing the flexibility to log in anywhere, from any device, it’s more important than ever to support [federated identity](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/). But how can you ensure that you’re prepared to solve the constantly-shifting identity challenges presented by distributed and mixed environments?

IAM lightens the burden on companies struggling to manage identity in mixed environments. Implementing IAM empowers companies to increase security, work more efficiently, and deliver a painless customer experience regardless of tomorrow’s fresh challenges and unforeseen pain points. 

An identity-as-a-service provider like Auth0 manages authentication across all of your applications, so the login experience is both seamless and secure. A flexible IAM solution gives your team the access and insight they need to accelerate innovation, deliver more value to users, and strengthen your security posture — not just in response to the identity challenges you’re encountering now but those you’ll encounter in a year or five years. 

## Customization Is the Key

To address today’s rapidly evolving use cases, you need to add modern, greenfield functionality to your tech stack. Companies often add that functionality through third-party microservice providers: cloud-based software-as-a-service (SaaS) companies like Salesforce, ZenDesk, or Trello. At the same time, your legacy environment is powering your business, so while you might see the benefits of moving completely to the cloud, you may not be ready for the disruption of a full-scale cloud migration.

Fortunately, customization is the middle ground that can alleviate much of the pain you feel without creating additional headaches by forcing you into a migration strategy that’s not right for your situation. 

Auth0 powers customizations that integrate easily with your legacy system, driving revenue and allowing you time to adjust your strategy and reach consensus before moving forward with full-scale digital transformation. The right IAM solution helps you minimize disruption for users and customers during replatforming and other transitions, so you can minimize turnover and limit missed opportunities.

## Use Identity to Bring Business Logic Into Focus 

The process of implementing an identity strategy clarifies what your company needs to do. Put a different way, to make your identity strategy work; you need to understand the structure and needs of your business at a deep level. Implementing IAM creates opportunities for discussion that brings business logic into sharper focus and allows you to build innovation into your company’s DNA.

Building a product that is as flexible, extensible, customizable, and responsive to change as you need it to be also create the opportunity to take this same approach to higher-level conversations. When leadership sets lofty business goals, you can execute on these goals quickly, equipped with an identity solution that speeds time-to-market (TTM).

## Real-World Example: Bluetooth Special Interest Group (SIG)

Let’s look at an example of an enterprise environment where a flexible IAM solution helped mitigate the pain of a mixed environment that encompassed multiple different apps — and presented multiple challenges.

Formed in 1998, [the Bluetooth SIG](https://auth0.com/case-studies/bluetooth-sig/) is the not-for-profit trade association that oversees Bluetooth® technology. In support of more than 34,000 member companies, the Bluetooth SIG facilitates the collaboration of its members to create new and enhanced specifications that expand the technology, drives global interoperability via a world-class product qualification program, and grows the brand by increasing the awareness, understanding, and adoption of Bluetooth technology.

Bluetooth SIG needed a modern identity solution with single sign-on (SSO) to support all of the company’s homegrown and third-party SaaS apps. They had to be able to implement the solution while keeping the existing platform operating and mapping a path for full migration in the future. It was also essential to establish user roles and access to ensure proper protection for confidential information.

Auth0 fulfilled all of Bluetooth SIG’s requirements. Our solution was easy to implement and allowed the Bluetooth SIG team to add SSO and modern authentication. Without disrupting the legacy system, a migration plan was developed and carried out. Implementation of Auth0 took days, compared with the months it would have taken to implement an in-house platform. 

Top-tier documentation with detailed code samples helped Bluetooth SIG engineers get up to speed quickly on their modern identity solution. Bluetooth SIG and Auth0’s developer success engineers worked together to develop a proof of concept showcasing the platform’s capabilities. Ultimately, Auth0’s full suite of technology, documentation, and expert support gave Bluetooth SIG the solution they were looking for.

## Support Business Processes With Software, Not the Other Way Around

Software should support your core business functions — not the other way around. With an [identity-as-a-service (IDaaS)](https://auth0.com/blog/what-is-idaas/) provider like Auth0, you’ll have the functionality and extensibility to accomplish what you need to without wasting time and resources on a solved problem. IAM is a rapidly evolving specialty in which the only constant is the change. That’s why an out-of-the-box identity solution or an in-house authentication platform can only take you so far. 

Auth0 believes in the business value of entrusting identity to an IDaaS provider, but we also understand the power of code. That’s why we feel an IDaaS+code approach gives you the best of both worlds: identity services managed by an easy-to-use service, plus the same customizability and control you’d have if you’d coded the entire solution from scratch. 

To learn more about how the right identity solution can provide enhanced data protection and a seamless customer experience in your mixed environment, [reach out to the team at Auth0](https://auth0.com/contact-us?place=blog%20post&type=link&text=contact%20us).

<include src="asides/AboutAuth0" />

How to Improve Customer Experience in Your Mixed Environment

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Making every customer touchpoint work in harmony takes work, but a satisfied customer is worth it.

Today's consumers are constantly moving across channels and devices, which means companies have to move with them by adopting an omnichannel strategy. If you're a retailer, you want a customer to be able to find a product on Instagram, buy it on their phone, pick it up at a brick-and-mortar store, and call a support line if something goes wrong. Just as importantly, you want to have a single view of this customer that tracks all interactions across digital and physical channels.

Being able to provide a robust omnichannel experience increases your brand's visibility, improves customer service, and gives you rich information about your customers. As consumers grow more accustomed to seamless interactions with brands, and as the pandemic forces every retailer to reach the market in new ways, an omnichannel approach isn't just an advantage, it's an essential survival strategy.

## Defining Omnichannel Retail

Omnichannel retail means providing multiple avenues through which your customer can interact with your brand through marketing, purchasing, and ongoing customer service. In an omnichannel approach, your social media campaigns, emails, mobile apps, website, physical stores, and telephone helplines all provide seamless customer experience, supporting one another with as little friction as possible.

![Omnichannel Diagram](https://images.ctfassets.net/23aumh6u8s0i/4R9jiLsQ22iKfF5nFYW5qm/5e22f180c5c980130af02a358c9d7d04/omnichannel_diagram)

### Omnichannel vs. multichannel

Marketers often contrast omnichannel retail with a multichannel approach, and the distinction is useful in designing an effective strategy. In a multichannel strategy, you can make use of the same number of platforms (mobile, web, physical), but they're disconnected or even working at cross-purposes with one another. The difference between omnichannel and multichannel retail is seamlessness &mdash; ensuring that a customer may switch devices but remain on a single journey.

Your web team may be incentivized to dominate the purchasing process in a multichannel approach, circumventing your physical stores. But an omnichannel strategy uses physical stores as assets, directing customers to pick up or return their orders in person. This enables tighter inventory control, makes better use of your existing infrastructure, and, of course, increases the likelihood that the customer will make additional purchases while they're in your store.

The key to achieving this synergy is to maintain a single view of the customer across channels and make that data easily accessible, not siloed by different teams.

![Omnichannel 1](https://images.ctfassets.net/23aumh6u8s0i/3MmYLhlDw5G0qLrJg3ccH1/f365d2f3a57e37efe59bfc97d94267a1/omnichannel-sep-1)

## Business Impacts of an Omnichannel Strategy

Omnichannel is already a fact of life for most customers, if not businesses. [McKinsey's research](https://www.mckinsey.com/business-functions/operations/our-insights/redefine-the-omnichannel-approach-focus-on-what-truly-matters) found that over half of customers used between three and five channels to purchase or resolve an issue. According to [_Harvard Business Review,_](https://hbr.org/2017/01/a-study-of-46000-shoppers-shows-that-omnichannel-retailing-works) omnichannel customers spend 10% more online and 4% more in person than shoppers who use only a single channel.

The push toward omnichannel had been gaining momentum for years, but in 2020, the pandemic kicked this trend into overdrive. Ecommerce platform [Kibo reported](https://kibocommerce.com/blog/bopis-orders-covid-19/) that in the early months of the pandemic, their clients reported a 563% increase in Buy Online, Pickup In-Store (BOPID) orders. That dramatic spike has subsided somewhat in the summer, but it's likely many customers who have adopted these habits during the pandemic will incorporate them into their shopping once the crisis is over.

### Increased in-store sales

Adding digital touchpoints to physical stores has a measurable impact on sales. With [endless aisle technology](https://www.iqmetrix.com/blog/what-is-endless-aisle-two-important-but-very-different-definitions), customers browsing a store can use a touchscreen or their phones to order products that are out of stock or that are preferred in a different style/size/color. Giving customers this ability can reduce "[showrooming,](https://auth0.com/blog/how-to-leverage-showrooming-behavior-to-increase-revenue/)" in which customers see an item in person and then go online to buy it from the cheapest seller. Putting this technology in the hands of your sales associates can also boost revenue. McKinsey found that one retailer increased its customers' average basket size by 5% when they gave their in-store salespeople a tablet equipped with a sales-assist tool.

An omnichannel strategy can also facilitate "reverse showrooming"— advertising your products online to encourage in-store visits. [Ulta Beauty, Target, and Home Depot](https://www.fool.com/investing/2019/03/19/call-it-reverse-showrooming-these-companies-are-ca.aspx) all posted revenue increases, which the retailers credited to their strategy of driving e-commerce buyers to physical stores.

### Improved customer experience
Today, providing a personalized and frictionless customer experience is a key competitive advantage for retailers. [PwC research](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) found that a third of customers would abandon a brand they love after a single bad experience. On the flip side, 63% said they would be willing to share more information with companies that provided great experiences.

In practice, providing great experiences means providing human interaction when customers want it, and frictionless self-service the rest of the time. Customers don't want to have to call a customer service rep just because they've forgotten their password; they want to click a button and handle it themselves. But if an online order is never delivered, customers should be able to speak to a human being. A sound omnichannel strategy understands the customer well enough to put each of these common issues in a separate funnel. The lost password customer doesn't need or want a human interaction; in fact, it will frustrate them. But the customer with a lost package needs to receive more personal attention, not be passed onto a chatbot.

Email is a cornerstone of many companies' omnichannel strategies and can be a critical way to provide unobtrusive customer service. Asking for feedback via [automated (but personalized) follow-up emails](https://vitally.io/blog/posts/how-to-send-automated-customer-success-emails-that-dont-suck/) helps personalize your brand and ensure that unsatisfied customers aren't falling through the cracks.

![Omnichannel 2](https://images.ctfassets.net/23aumh6u8s0i/6ypJycdvvn3qVpQMXfdH2d/edf7a141ffd7c366469594c3b908fe4b/omnichannel-sep-2)

## Key Elements of a Successful Omnichannel Strategy
More retailers are ramping up omnichannel investments, but unless these are guided by a coherent strategy, the result is chaos. Omnichannel efforts don't pay off if businesses try to do everything at once and give equal weight and attention to every channel. Instead, retailers must make data-driven choices about reaching customers.

Three principles form the bedrock of every successful omnichannel strategy:

1. **Find customers where they are.** This boils down to knowing your customer and tailoring your message and channel to their needs and tastes.
2. **Direct customers toward the most appropriate funnel for their needs, in as few steps as possible.** This means you might advertise a product on Instagram but provide a link that takes them directly to a cart instead of your website's home page. By the same token, it means dividing service requests by those that do require human interaction and those that do not.
3. **Maintain visibility of the entire process, and use it to inform your future decisions.** Every interaction at every touchpoint should be logged and fed into a single, central user profile. This can be accomplished with loyalty programs or incentives to share personal information with sales associates for in-store visits.

An [identity and access management (IAM) system](https://auth0.com/learn/cloud-identity-access-management/) can help deliver on these three principles by connecting all your channels. A sophisticated IAM system lets you lower friction, starting at the log-in box. With single sign-on (SSO) and social log-ins, customers can log in quickly without filling out forms or having to create a new password. That's good for everyone because customers are happier and less likely to walk away from a transaction.

The current generation of cloud-based "identity as a service" (IDaaS) providers are designed to integrate across channels. So when a customer uses a loyalty card for an in-store purchase, calls a customer service agent for support, or orders a product on a desktop, your IAM platform will log all these interactions and feed them back into a central user profile. This lets you provide more personalized service across all channels because each one benefits from the knowledge of the others.

## Don't Let Your Customers Leave You Behind

Your customers are already leading omnichannel lives. A millennial shopper expects to see patio furniture on a Facebook ad, purchase it with just a few clicks, instantly receive an email letting them check the order status, and have it delivered the next day from the local store. Each part of that transaction feels intuitive, but it's the result of a complex system working in harmony. Getting your omnichannel strategy right takes careful planning, but the rewards are higher sales, improved customer loyalty, and greater alignment across your company.

<include src="asides/AboutAuth0" />

Why an Omnichannel Strategy Is Critical in 2020

Long-lived sessions can improve user experience and reduce password reset costs.

**How long should a customer stay logged in to an application?** The [Open Web Application Security Project (OWASP)](https://auth0.com/blog/a-run-through-the-owasp-top-10/) and the [National Institute of Standards and Technology (NIST)](https://auth0.com/blog/what-the-new-nist-guidelines-mean-for-authentication/) state that it's safer for customers to sign in to your app for mere minutes. Limiting your customers to hold short sessions may leave them frustrated and unwilling to come back to use your application. A pillar of customer retention is to provide both a user-friendly and secure user experience. However, balancing those two user experience components is a real challenge for most businesses.

OWASP recommends application builders to implement **short idle time outs (2-5 minutes) for applications that handle [high-risk](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Session_Management_Cheat_Sheet.md) data**, like financial information. It considers that longer idle time outs (15-30 minutes) are acceptable for low-risk applications.

On the other hand, [NIST](https://pages.nist.gov/800-63-3/sp800-63b.html) recommends that application builders make their users **re-authenticate every 12 hours** and **terminate sessions after 30 minutes of inactivity**. For intermittent re-authentication, that session termination time shrinks to 2 minutes.

These guidelines by OWASP and NIST provide an ideal foundation to implement session security in applications. However, before you choose to extend your application's session length, it's also ideal for your team and your internal stakeholders to discuss how such a decision can impact your application's user experience.

Ultimately, [balancing security and user experience](https://abacuscambridge.com/blog/why-iam-perfect-blend-security-and-customer-experience) is key to achieve customer retention. A tedious authentication process can exhaust your customers and discourage them from using your application. A seamless, perhaps even invisible, authentication process can instead encourage your users to spend more time with your application _securely_.

Auth0 offers you a feature called long-lived sessions to offset the cost of implementing a secure user experience around authentication.

<include src="TweetQuote" quoteText="UX can help you keep or lose a customer. Balance #UX and #security with Auth0 long-lived sessions."/>

## Why Customers (And Businesses) Want Long-Lived Sessions

One of the conveniences of email services like Gmail is that you can check your email sporadically without having to face repetitive login prompts. Imagine how tedious it would be if you had to log in every time that you go idle for more than two minutes.

For media companies, like [Alma Media](https://auth0.com/learn/alma-media-sees-30-total-savings-seamless-brand-access/), customers may visit their site infrequently. Registered users often visit media sites every two weeks to consume content. Returning users who face the hassle of signing back in may opt to stop visiting the site. **For a media company, losing its audience means losing ad revenue, since clicks generate payments on ads.** If the revenue strategy also involves targeted advertising, media companies require a security strategy that favors maximum engagement with minimal friction.

If a company offers an essential service, its users may not have the option to leave the site. However, they may still become vocal about their dissatisfaction with the user experience on social media or review channels.

For example, a utility company may have monthly or quarterly billing cycles where end-users access its application to pay their bills. Other companies like [Autotrader](https://auth0.com/learn/coxs-autotrader-launches-premium-experience-auth0/) have customers with usage patterns that vary widely based on purchase and maintenance cycles. For any application with long periods between end-user engagement, users understandably forget their passwords.

Some Auth0 customers have reported that as much as **22% of their customers forget their passwords each quarter**. Frustrated customers have to contact call center staff to request password resets. Forgotten passwords may lead to decreased customer satisfaction, paired with increased business operation costs.

For low-risk engagements, you can provide better user experience by implementing a longer session limit, which could become the difference between keeping or losing a customer. While Auth0 focuses on making your applications more secure, we also understand the substantial value of your end-user experience.

Everything considered, long-lived sessions work exceptionally well for organizations with periodic or even intermittent engagement cycles.

Poor user experience can lead to customer dissatisfaction. Insufficient security can amount to legal penalties, fines, and losing customer trust. **The combination of poor user experience and insufficient security can compound into a catastrophic punch to damage a brand**.

## 100 Days Inactivity/365 Days Total Timeout

Auth0 lets you customize session lengths to fit the security risk tolerance of your desired user experience. You can configure session limits with up to 100 days of inactivity (idle timeout) and up to one year in total duration (absolute timeout). 

> The motivation behind the 100-day idle timeout cap is to cover one quarter plus a few days, which provides wiggle room for people who log in to do end-of-quarter reports.

Long-lived sessions allow companies with quarterly, monthly, or other types of customer engagement cycles to reduce friction for end-users and provide secure access to low-risk content and functionality.

Whenever your customers need to perform high-risk actions, such as changing account details or updating payment methods, you can rely on Auth0 functionality to programmatically require password validation to run those actions as an added layer of security.

![Auth0 Long-Lived Sessions - New Session Limits 100 Days/365 Days total timeout chart](https://images.ctfassets.net/23aumh6u8s0i/7tmP5QwFpRVgPVuZsYhcp0/f383df39269f7cd6b732315bc4542a28/auth0-long-lived-sessions-new-session-limits)

With Auth0's long-lived sessions, session management, and Single-Sign On (SSO), you can build a better user experience for returning customers, enable personalized targeting, and reduce the costs of operations by mitigating password resets. **If you'd like to learn more about how you can customize Auth0's out-of-the-box features to fit your needs, please reach out to <sales@auth0.com>**.

Balance User Experience and Security to Retain Customers

Australian software giant provides simple login experience for customers; focuses on security and identity.

**BELLEVUE, WA – May 18, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, is powering identity management for [Atlassian](https://www.atlassian.com/), a leading provider of team collaboration and productivity software. Atlassian has been using Auth0 to secure and simplify its identity and authentication process for customers and millions of users around the world.

Atlassian builds collaboration and productivity software to help businesses organize, discuss, and complete shared work, including Walmart Labs, Merrill Lynch, Bank of America, and Verizon. With the multitude of products it provides (Jira, Confluence, Trello, Opsgenie, and more), Atlassian relies on Auth0 for flexible, configurable authentication that has allowed it to balance better collaboration for users and the security controls needed by administrators. Outsourcing authentication also enables Atlassian to focus its valuable development team on product innovation. 

As Atlassian continues its rapid growth, it is placing a renewed focus on a Single Sign On (SSO) solution to all its products and support systems for millions of users worldwide, placing a high importance on identity. Auth0’s identity platform is providing a simple login experience removing a barrier to entry for many Atlassian cloud customers as they expand their use of Atlassian products. 

Working with Auth0 has helped Atlassian build out key identity features like multi-factor authentication (MFA), Security Assertion Markup Language (SAML) support, and OAuth, which has helped evolve its third-party ecosystem and address security and privacy needs among its customer base.

“The security of our customers is very important to us, and we want to ensure our administrators’ information is held securely. Auth0 has been integral in offering our administrators and users that level of confidence,” said William Bath, Head of Engineering for Identity at Atlassian. 

Atlassian is constantly innovating and bringing new product capabilities to the market. Working with Auth0 gives Atlassian simple, powerful, and developer-friendly identity building blocks so they can free up resources to focus on its core business value. It has also allowed the company to quickly and simply keep pace with new integrations such as Sign in with Apple and login through Microsoft Accounts. 

“The best login experience is one that you barely notice, yet keeps your account secure,” added Bath. “Auth0 allows us to offer a simple, fast, reliable, and secure login experience. With that, we’re helping more and more teams collaborate and have a greater impact.” 

“Atlassian has been an incredibly valued customer for some time, and we are thrilled to continue to serve as an identity partner to them as they expand their global footprint with the highest quality collaboration and productivity software and services,” said Richard Marr, General Manager for the Asia Pacific at Auth0. “Auth0 provides a simple, extensible, and scalable platform to secure identities so Atlassian can concentrate on the innovation that drives its success.”

<include src="asides/AboutAuth0" />

### Media Contacts
Jessica Sealby 
Auth0 APAC Communications 
[press@auth0.com](mailto:press@auth0.com)

Atlassian Authenticates Millions Of Users with Auth0

T025590N6-UA74EV4TB-edf9e73df2fc-512 avatar

T025590N6-UA74EV4TB-edf9e73df2fc-512

I’m a product designer based in Portland, OR. I specialize in breaking down big messy problems and coming up with elegant solutions.

Product Designer

Stacy Taylor

Not only do our customers rely on us to provide secure authentication, they also rely on us to create a positive experience for their users



At Auth0 we provide the tools for application builders to implement authentication and access management so that they can focus on what makes their product unique, rather than on authentication. Our product design team is responsible for both shaping the experience that developers use to implement Auth0 into their product and for informing the design of the authentication experience for our customer’s customers.

That’s a big responsibility. Not only do our customers rely on us to provide secure authentication, they also rely on us to create a positive experience for their users. A well designed and frictionless signup experience can make a huge impact on our customers’ conversion rates and on their users’ level of satisfaction with their product.

As designers, we’re trained to create flows that are intuitive and easy to use, with as little friction as possible. But when it comes to the authentication experience, some degree of friction is required to ensure security. Passwords, multi-factor authentication, CAPTCHA, and session timeouts all introduce friction to the authentication process, but that friction is what stops bad actors from gaining illicit access to accounts.

So how do we balance the need for security with the desire for a frictionless user experience?

## Good Actors vs Bad Actors
One way of balancing security and user experience is by getting better at predicting which transactions are coming from legitimate users and which are not. If we can predict with reasonable accuracy that a user is legitimate we can remove much of the friction from their path. By the same token, if we predict that a user is not acting with good intentions we can introduce more friction to try to stop their attempts at logging in.

At Auth0 we’ve developed several ways of predicting legitimate logins to improve the user experience without sacrificing security.

### Contextual Multi-Factor Authentication
Most security-savvy users are aware that enabling multi-factor authentication (MFA) or two-factor authentication is one of the best ways to protect your accounts online. In May 2019 Google reported that enabling multi-factor authentication can block up to 100% of automated attacks, 99% of bulk phishing attacks, and 66% of targeted attacks.

![Contextual Multi-Factor Authentication](https://images.ctfassets.net/23aumh6u8s0i/1ppxm1wcvVNL65EstifOrV/289400624bb7a80dbba1e485206f72dc/ux-body-01)

But that protection comes at a cost to the user experience. Adding a second factor to the authentication process interrupts the user’s flow. Even a simple factor, like a one time password, requires the user to wait for the SMS or email to arrive, change apps, copy a code, and go back to the original app and paste in the code before returning to the original flow. While mobile operating systems are making it easier to enter a one time password with less context switching, it still disrupts the user flow. Authentication apps, such as Authy and Google Authenticator, provide greater levels of security but are even more disruptive to the user flow.

Wouldn’t it be nice if you had the protection of multi-factor authentication without the inconvenience? That’s the idea behind Auth0’s Contextual MFA feature. Contextual MFA uses certain signals, such as the device you’re using, your geographic location, or your IP to determine how likely it is that a login attempt is legitimate. As the feature learns your login habits it will learn to predict which login attempts are legitimate and only prompt for multi-factor authentication if the confidence score is low.

## CAPTCHA
CAPTCHA, or Completely Automated Public Turing test to tell Computers and Humans Apart, requires users to prove that they’re human, usually by entering a word or words in an image or by identifying objects in a series of images, which helps to reduce automated attacks by bots.

![CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7d5ZwC8CYh02nCwsPfr6UC/2f4d12aa2da72dc5f2226728030144b6/ux-body-02)

CAPTCHA can be an effective tool to stop many automated attacks, but again, this protection comes at a cost to the user experience. Like MFA, CAPTCHA interrupts the user flow and requires users to decipher difficult to read text or identify objects in grainy photos. If you get it wrong you frequently have to begin the entire process all over again. CAPTCHA also suffers from many accessibility issues. Users with visual impairments may not be able to solve the CAPTCHA at all. Sometimes an audio CAPTCHA is presented as an alternative, but this may not be a feasible solution for users with hearing difficulties, who are in a noisy environment, or don’t have a sound enabled on their system.

These extra barriers can be significant enough to prevent users from signing up or logging in to an application. According to one study, adding CAPTCHA to a form can reduce conversions by up to 33%!

At Auth0 we work hard to ensure that our customers’ users don’t have to deal with CAPTCHA. Our automated attack protection analyzes traffic patterns in order to determine whether a login is being initiated by a human or a bot and only require CAPTCHA if we’re reasonably certain traffic is coming from a bot. Like with Contextual MFA, a legitimate user’s login experience should never be interrupted.

## Not All Products Are Secured Equally
Helping to secure your application is what Auth0 is all about, but we also understand that certain applications need to be more secure than others. For instance, an online banking app should have more friction in the authentication experience than a product that doesn’t store sensitive personal information.

### Long Lived Sessions
At Auth0, we recognize that while it’s important for applications with access to sensitive data to log users out after they’ve been idle for just a few minutes, many of our customers with lower risk products may not want that for their users.

Media companies, for example, often find that users visit their site once every few weeks. If users are required to authenticate and can’t remember their password they’re likely to just abandon the site. For companies that rely on ad revenue that can be a huge blow to their bottom line.

Other companies, such as insurance or utility companies, might have customers who interact with their site once a month or once a quarter. It’s quite common for users to forget their password after such a long time, which can lead to increased customer service calls and decreased customer satisfaction.

Auth0’s [long lived sessions](https://auth0.com/blog/when-ux-equals-keeping-or-losing-the-customer/) feature addresses these and other similar use cases. Our customers can now customize session limits with up to 100 days of inactivity and up to one year in total depending on the balance of risk and user experience that’s right for them. Customers with a lower risk profile can remove friction for their users by enabling longer session lengths, while customers with higher risk profiles can automatically log users out after a much shorter period of time.

## Obfuscation as a Necessary Evil
Part of designing a good user experience is making sure a user can easily understand what’s happening and what their next course of action should be. Unfortunately, there are times when making things easy for our users also puts them at risk.

### User Enumeration
Have you ever tried to log in to an application only to receive a generic “there was a problem with your username or password” error message? If so, there’s a good chance you cursed the designer who created that error message.

![User Enumeration](https://images.ctfassets.net/23aumh6u8s0i/1WowXTwcIGf90FTqtSJ1oU/49c814a488f089cfe6e71741c845f7c8/ux-body-03)

What kind of subpar UX designer would design such a bad experience? Aren’t they familiar with number nine on Jakob Nielsen’s list of Ten Usability Heuristics, which clearly states “Help users recognize, diagnose, and recover from errors?” A more specific error message like “this username does not exist” or “incorrect password” would be better…right? Maybe not.

While it’s true that a vague error message can be annoying and frustrating, it can also help to protect you. For example, if an application’s error message was “this username does not exist” when the username is invalid, but “incorrect password” when the username is valid it would allow attackers to compile a list of valid usernames for an application. That information could then be used in brute force attacks, such as dictionary attacks or credential stuffing attacks. A dictionary attack is when a hacker uses a known username combined with common passwords like 123456 or passw0rd to try to hack into an account. A credential stuffing attack is when an attacker uses credentials obtained from a data breach on one service to hack into the user’s account on another service.

Using complex and unique passwords help to prevent brute force attacks once a malicious actor has your username, but obfuscated error messages can prevent them from validating your username in the first place.

## Conclusion
Securing the world’s identities while providing a positive authentication experience for end users might seem like a daunting task, but it’s not impossible.

Our engineers work hard behind the scenes to determine whether an attempted login or sign up is legitimate so that we can implement CAPTCHA or multi-factor authentication for suspicious logins while keeping the authentication process frictionless and secure for our customers’ users. We give our customers the power to customize their user experience depending on their risk tolerance and the needs of their users. And while sometimes it is necessary to sacrifice the ideal user experience in order to guarantee the security of our customers and their users, it’s a trade-off that we make consciously and with a great deal of consideration and collaboration.

Designing for both UX and security is a difficult balancing act that the product design team at Auth0 faces every day. If this seems like the kind of challenge you’re interested in tackling be sure to check out our jobs page [here](https://auth0.com/careers/positions?areas=Design).



Balancing UX and Security at Auth0

Electric utility centralises identity management for several million customers

**LONDON — 15 October 2019 —** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced its partnership with German energy company [EnBW Energie Baden-Württemberg AG (EnBW)](https://www.enbw.com/company/). EnBW is one of the largest energy companies in Germany and Europe and supplies around several million customers with electricity, gas, and water, as well as energy-related solutions and services. 

Using Auth0, private and business customers of EnBW as well as its subsidiary, Yello, will be able to access several digital services quickly and securely with a single login, including the customer portal, "My EnBW" and the EnBW mobility+ app. The cloud-based identity solution helps EnBW consolidate its previously decentralised login interfaces and simplify the authentication process for customers. This not only increases EnBW's efficiency in managing identity for several million customers but also improves the customer experience. [Auth0 complies with all GDPR regulations](https://auth0.com/explore/data-privacy/) and stores data regionally in the Amazon Web Services (AWS) data centre in Frankfurt.

"Digital transformation is more than just an isolated project or the development of an app. Rather, it is a matter of laying a long-term technical foundation for improving proximity to the customer. By using the Auth0 solution, we are able to do just that. This enables us to offer a consistent customer experience across all digital services," says Florian Riedl, head of digitisation at EnBW. "Authentication is an important building block when it comes to customer experience. This applies not only to new customers but above all to existing ones."

"Organisations like EnBW use our solution to learn more about their customers' needs. This is an important differentiator in a highly-competitive market," said Steven Rees-Pullman, GM of EMEA at Auth0. "We're pleased to work with EnBW as they digitise their business and provide new services to their customers."

<include src="asides/AboutAuth0" />

### Media Contacts:

Silvia Hänig 
shaenig@wireside.com 
haenig@i-kom.org 
0173-3838572 
089-44848127 

Mark Fowler 
Racepoint Global for Auth0, EMEA 
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com) 
+44 (0) 77 1124 4113

EnBW Uses Auth0 to Improve its Customer Experience

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

To stay competitive, media companies have to deliver seamless experiences built around customer identity. The race starts at login.

Today’s media consumers enjoy an incredible array of content and have an unprecedented number of choices for how, when, and where to consume it. In this saturated environment, media heads of product are engaged in a war for consumer attention. The winners are the companies that curate the most relevant content for each user, with simple, intuitive platforms that keep them coming back for more.

The media companies that are most successful at keeping consumer attention are those with the most intensive surgical focus on creating a personalized user experience. Netflix, for instance, doesn’t merely use its insights to recommend shows; they even tailor the [thumbnail images](https://www.vox.com/2018/11/21/18106394/why-your-netflix-thumbnail-coverart-changes) of those shows to different demographics and what they find most irresistible. Achieving this level of personalization requires media outlets to possess a deep and holistic understanding of each customer, not one that is fragmented across channels or devices.

In this piece, we’ll explore how uniting customer identity in a single view will enable UX that caters directly to your customers’ preferences. Building UX around identity is crucial for heads of production who want to make their platforms stand out rather than be one more dish in the endless media smorgasbord.

## Simplify Authentication Across Devices

The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content. But the promise of seamless, nearly effortless device usage is often stymied at the login screen.

As anyone who has tried to type their email address with a TV remote can attest, there are few UX experiences more painful than attempting to log in with a device that was never intended for entering credentials. This frustration and its cost to UX are avoidable if you implement [single sign-on (SSO)](https://auth0.com/blog/implementing-single-sign-on-in-b2c-applications/). With SSO, when users log in to an application with one set of credentials, they are automatically signed into other applications. The primary UX benefit of this is that it simplifies authentication across devices and accelerates the time to first login.

<include src="TweetQuote" quoteText="The era of the internet of things (IoT) presents exciting possibilities for both media producers and consumers as more smart devices become capable of delivering content."/>

With a sophisticated customer identity and access management (CIAM) solution like Auth0, you can use SSO to shift the login process to other devices, which are more user-friendly and are already associated with user profiles.

![Login Process](https://images.ctfassets.net/23aumh6u8s0i/01aER9PsXDQQNimIMoPUdF/4b03aa9398019f303bd1a13e1955ec2f/login-process)

Using [OAuth Device Flow](https://auth0.com/blog/oauth-device-flow-no-hassle-authentication-as-seen-on-tv/), a user trying to log in to your app via their smart TV won’t have to fiddle with their remote. Instead, they’ll be directed to visit a URL on their computer or smartphone, enter a short code, and complete the authentication process with far less friction. Aside from ease of use, shifting authentication to a browser also improves security, since users don’t have to directly expose their credentials to their smart devices.

## Reduce the Number of Required Logins

The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience. At worst, it means they browse without logging in, robbing you of the chance to present them with personalized content. The solutions to this issue hinge on using your view of the customer to minimize the number of times they have to re-enter their credentials.

For multi-brand media companies, a seamless customer experience starts with SSO. For example, we’re all familiar with SSO when we log in to Google and are automatically logged in to YouTube. That feature is critical in enabling YouTube to recognize users and recommend videos tailored to their interests.

<include src="TweetQuote" quoteText="The login box is your first impression with a customer. At best, a time-consuming login means that customers begin their session with an unpleasant experience."/>

Another effective tactic to reduce tedious logins is implementing [long-lived sessions](https://auth0.com/blog/when-ux-equals-keeping-or-losing-the-customer/) for users. Long-lived sessions let developers extend the login period before idle time-outs, in which users are automatically logged out after a certain period of inactivity. Whereas maintaining a brief window for idle time-outs makes sense for apps that handle highly sensitive information, it often hurts media companies. If you have a user who typically logs on once a month to read new content, forcing them to log in each time harms UX without providing any real benefit.

![Long-Lived Sessions Diagram](https://images.ctfassets.net/23aumh6u8s0i/7mEOMklyIKITdeeLKYnAYw/c6c49224407e2e7fb40afe1595e156c9/long-lived-sessions)

If you choose to explore long-lived sessions, it’s crucial to have a CIAM provider like Auth0 that lets you tailor the system to your business. Auth0 lets you customize session limits of up to 100 days, which you can adjust based on the level of risk your business is comfortable with. You can also apply rules that require users to authenticate when engaging in activities such as changing payment details. It’s crucial to maintain this level of customization with long-lived sessions; otherwise, your short-term UX gains can be erased by compromised security.

## Create a Consistent Experience with an Identity Directory

In a media ecosystem that is often overwhelming to users, the ideal UX is a place where one’s needs are understood and catered to the moment one logs in. To achieve this uniform, curated experience across platforms, consider storing user profiles on a centralized directory.

It’s vital to have rich, holistic profiles that function as the authoritative source of truth about your customer. That way, even if a user logs in via social media at one point, and email the next, both logins still feed into a single profile. With this approach, profiles and content recommendations stay relevant even as login behaviors evolve.

Having a single profile — as opposed to duplicates across login methods or devices — ensures that your company’s advertising and marketing efforts are appropriate rather than intrusive. Lacking this alignment can have a negative effect on UX; [a recent study](https://www.marketingcharts.com/customer-centric/privacy-and-security-107946) found that 66% of consumers disliked being targeted too many times, and 44% were annoyed if targeted for too long.

Auth0 offers customers the ability to host their directories on their own servers or on the secure Auth0 server. If your needs change, you can [move your directory to Auth0](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) without requiring that customers undergo a disruptive password reset. This model lets you scale, which results in consistent delivery of good UX even as you grow.

## Use Identity to Become a Content Concierge

In this crowded media landscape, compelling content is no longer enough to attract and retain customers. Consumers increasingly demand that companies not only select the most relevant and valuable content for them but also deliver it across all their devices with minimal effort.

Understanding your users’ identity is at the core of great UX. That’s why attaining a single vision of the customer is such an effective digital initiative for media heads of product. To do this project justice, be sure to partner with a CIAM that can provide an experience as simple, yet as customizable, as the one you offer your customers. If you’d like to learn more about how Auth0 can help you quickly create a CIAM solution that suits your needs, please reach out to an [Auth0 resource](mailto: sales@auth0.com).

<include src="asides/AboutAuth0" />

---

How To Improve CX/UX Through A Single Vision Of The Customer

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Help your customers fall in love with your application by providing a secure and easy authentication experience they don't have to remember.

Ah, Valentine's Day! Love is in the cloud. Billions of people are either signing up for or logging in to web services to wish their loved ones a happy day. They are ordering flowers, buying chocolates, or sharing the most intimate of thoughts through messages. Building scalable authentication the right way to sustain spikes in demand can leave developers with a heavy heart. 

However, Auth0 can help you prepare for the best and the worst today and every day. Let me show you why using Auth0 can make you fall in love with authentication through these solid Auth0 features that make modern authentication a walk in the park.

## <a class="toc-target" id="single-sign-on-will-keep-us-together"></a>Single Sign-On Will Keep Us Together

According to the [2018 World Password Survey run by MacAfee](https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/security-world-password-day/), consumers who responded to the survey have an average of **23 online accounts** that require a password but **on average only use 13 unique passwords** for those accounts. With so many passwords to track, forgetting a password is common.

Going through the motions of resetting a password can bring some heartache... Imagine if one of the "Challenge Questions" is asking you about the favorite vegetable of your ex. However, not being able to recover the account or getting it compromised can truly unleash the worst of heartbreaks. 

This all could be alleviated if we only needed to remember one username and one password, right? Find _the_ one and be forever happy with easy access to all of our accounts. This sounds like a fairy tale but it's not. Fortunately for us, Password Charming exists in the form of **Single Sign-On**. 

Single sign-on (SSO) allows users to simply log in once and use all applications they have been granted access to. You could use your Google account to authenticate yourself with a dating site or any other application that decided to delegate the responsibility to create, maintain, and protect your username and password to Google.

![Single sign-on example login authentication in action](https://images.ctfassets.net/23aumh6u8s0i/7cMIHIB6DD65M59E8b60JU/3e95a93f4bd9fd5d532a890de2b5b49f/auth0-single-sign-on-flow)

Building and maintaining an identity platform with Single Sign-On can become expensive, time-consuming, and difficult to get right &mdash; just like love. In a [recent survey](https://auth0.com/forrester-total-economic-impact/), 94% of organizations said they were able to implement Auth0 in less than a month. That is possible because with Auth0’s SSO solution you get:

* [Over 40 supported Identity Providers](https://auth0.com/docs/identityproviders) including mainstream social providers such as MySpace. Kidding!

![Auth0 has built-in identity providers such as Facebook, Twitter, Google, GitHub, LinkedIn, Dropbox, and many more.](https://images.ctfassets.net/23aumh6u8s0i/6oH8TXss4ErZM3RzJ9n7Rp/d31d514b9368daa63782d5a4da15fafb/new-grid-02b)

* The ability to authenticate the social butterfly by consolidating duplicate accounts across various providers with account linking &mdash; while [increasing conversion rates](https://auth0.com/retail/).

* Ease of use by having the freedom to write your code once and integrate any configured connection. One login screen to rule them all.

* Like meeting the expectations of even the strictest of parents, [compliance with leading organizations including SOC2, GDPR, HIPAA, and others](https://auth0.com/docs/compliance). 

[Let Auth0 help you get SSO right today](https://auth0.com/single-sign-on) to help your customers fall in love with an amazing authentication user experience. Don't let any customer be the one that got away because he or she forgot to remember you.

## <a class="toc-target" id="rules-to-love"></a>Rules to Love

Relationship needs are not static. They change as the relationship grows... or dwindles. Authentication is one of the most critical relationships you'll ever form with your customers. This process helps you understand who they are and how you can help them based on an established and ongoing relationship around identity. Therefore, authentication needs to be extensible, flexible, and customizable.

With Auth0 Rules, you can customize your authentication workflow. Auth0 Rules are JavaScript functions that execute when a user authenticates to your application. They run once the authentication process is complete. You can use them to customize and extend Auth0's capabilities.

### Use Auth0 Rules to:

* Enrich user profiles: query for information on the user from a database/API, and add it to the user profile object.

* Create authorization rules based on complex logic (anything that can be written in JavaScript).

* Reuse information from existing databases or APIs for migration scenarios.

* Keep a white-list of users and deny access based on email.

* Notify other systems through an API when a login happens in real-time.

* Modify tokens: Change the returned scopes of the Access Token and/or add claims to it, and to the ID Token.

[Let Auth0 help you rule the authentication game today](https://auth0.com/docs/rules). 

## <a class="toc-target" id="universal-login-one-form-one-heart"></a>Universal Login: One Form, One Heart

One of the easiest ways to improve your customers’ experience while boosting security is through consistency. Imagine that each login form in your application is a physical door. If the look and feel of this door are not consistent throughout the application, your customers' user experience when logging in may look like this:

![Doors metaphorically representing the UX and UI of an app's login form flow.](https://images.ctfassets.net/23aumh6u8s0i/4qZC52zb2rkifVRgofbtvh/1f1e5140952a12c0126b8b456ef6c6f6/valid-doors-valid-login-forms)

Each door that represents a login form looks different. They are all valid entryways for the customer's credentials, but your customer can't anticipate what the login form should look like. This inconsistency can let a malicious actor to phish your customers. Here’s how:

![Invalid door metaphorically representing introduction of a phishing login form.](https://images.ctfassets.net/23aumh6u8s0i/7govsBdLttTOlrwwqEEKTN/668dacccd29c76629deb2b79727aa68c/invalid-door-invalid-login-form)

The attacker creates a site and requests your customers' login. If your login forms are inconsistently designed, for your customers, the brown door may just signal a new form design. They could easily enter their credentials there expecting access to your application &mdash; and just like that, they become phishing victims.

To help protect your customers, a consistent authentication UX and UI helps them better identify when a phishing attempt may be happening. Say that you opt for all of your login forms to look like the yellow door. Now it's much harder to trick one of your customers:

![Consistent app UX and UI of login flow/forms helps to recognize a phishing form.](https://images.ctfassets.net/23aumh6u8s0i/5nckAsKhcjZUvSGITOUnGX/1c7ebfca7a4618e415084e5492071596/consistent-valid-door-design-consistent-valid-login-form-design)

The universal design and implementation of the login makes your customers expect one, and only one, form for their credentials. Anything different must be rejected.

Auth0 offers you an easy way to build this unique door for your customers through **Universal Login**. Anytime your customers need to log in, they are redirected to a central authorization server that presents them with a login form that embraces your brand. Since authentication takes place on the same domain as the login, credentials are not sent across origins, increasing security and protecting against phishing and bucket brigade attacks, also known as man-in-the-middle (MITM) attacks.

Universal Login and SSO also happen to be a match made in heaven. You can orchestrate single sign-on (SSO) between multiple apps. If the user has already signed on to one app, the login page will not be shown again and the user will be logged in via SSO.

Play this video to see it in practice!

<AmpContent>
<amp-video controls
 layout="responsive"
 width="480" height="270">
 <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"
 type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
 <source src="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4">
 Your browser doesn't support HTML5 video. Here is a <a href="https://videos.ctfassets.net/2ntc334xpx65/67t8nyR02cUssAmCmsaiE6/4abf027ac21be3f56b0c16854b5bcd5e/sso_new_diagram_video.mp4"> link to Universal login and SSO</a> instead.
</video>

</NonAmpContent>

Love and security are based on trust. Don't let phishing steal your customers' trust in your design or implementation. You can [get started with Universal Login from Auth0 today](https://auth0.com/universal-login).

## <a class="toc-target" id="multi-factor-authentication-are-you-the-one-for-me"></a>Multi-Factor Authentication: Are You the One for Me??

![Are these images of actress Jaime Pressly or Margot Robbie?](https://images.ctfassets.net/23aumh6u8s0i/2PqNgYrJVTbFlgEJprLfkb/810a1cf582f03290460a72b1145405ef/margot-jaime)

[Left image source: Gage Skidmore](https://en.wikipedia.org/wiki/Margot_Robbie#/media/File:Margot_Robbie_by_Gage_Skidmore.jpg)

Pictured above are _two_ different and unique women. One of them is [Jaime Pressly](https://www.imdb.com/name/nm0005326/) and the other one is [Margot Robbie](https://www.imdb.com/name/nm3053338/). If someone gives you the picture of one of them and tells you to hand her a super secret script for an upcoming Spider-Woman movie, would you be able to tell them apart?

It would be very difficult. Even if you were to ask one of them for their name... What if Margot, jokingly, says her name is Jaime. You need to ask more questions to establish their identity and not make the mistake of giving the prized script to the unintended person. 

Authenticating users is just like that. If you want to have greater confidence that you are granting data access to the right person, multi-factor authentication is for you.

Multi-factor authentication (MFA) is a method of verifying a user's identity by requiring them to present more than one piece of identifying information. This effectively provides an additional layer of security, decreasing the likelihood of unauthorized access. The type of information required from the user is typically two or more of the following:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a mobile device)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The complexity of getting MFA right keeps developers from implementing it in their applications. However, with Auth0, enabling MFA for your application is a fairly straightforward process:
 
* Choose what factors to enable on your application, such as push notification.

* Perform any further setup required to configure that factor.
 
* Choose whether or not you wish to enforce MFA for all users.

![Auth0 Multi-Factor Authentication dashboard with different factors to enable](https://images.ctfassets.net/23aumh6u8s0i/76dOMSouGVa1RG4sZHWMIl/fb3c361a75713719bef1665bc9ba185d/mfa-dashboard-1)

With Auth0 Rules, as you learned earlier, your application's MFA experience can be customized. You can only require MFA in specific circumstances or force a particular factor to be used. When in doubt, always ask: is he or she the one to log in?

Catfishing? Ain't nobody got time for that! Don't let doubt erode your confidence and increase your risk of leaking data. Love, trust but verify. [Give Auth0 Multi-factor Authentication a try today](https://auth0.com/docs/multifactor-authentication).

## <a class="toc-target" id="anomaly-detection-trouble-in-paradise"></a>Anomaly Detection: Trouble in Paradise

> You know that I trust you, baby
>
> But your data's so good lookin'
>
> I'm afraid somebody's gonna steal it away from me.

We know that most of the time it's your customers who are authenticating into your application, but we also know that their data is beautiful and attractive to many malicious users out there. They will try to pretend to be your customer by deception or by force.

Legitimate users may try to log in three or five times if they have forgotten their password but are trying to remember it:

> Was it `correcthorsebatterystaple` or `confectcoarsewaterymaple`?

Ten failed consecutive attempts to log in are definitely a red flag. If the legitimate user is so pressed to log in, they will resort to resetting their password as soon as possible.

With Auth0, you can detect anomalies and stop malicious attempts to access your application. Auth0 offers two types of shields:

* Brute-force protection
* Breached password detection

![Auth0's Anomaly Detection dashboard](https://images.ctfassets.net/23aumh6u8s0i/17r5rvTrkVXqzAgA1v6WM1/724776f473b2c765614f0efaf0ac4ea6/anomaly-detection-overview)

A shield specifies the action you wish to take given a specific trigger. A trigger is a suspicious event that is detected when someone is trying to log in to your system, or they are using a breached password that has been reported by another third-party service.

**Brute-force protection is enabled by default for all connections**. There are two different triggers for the brute-force protection shield, for two slightly different attack scenarios:

* 10 consecutive failed login attempts for the same user and from the same IP address
* 100 failed login attempts from the same IP address in 24 hours or 50 sign up attempts per minute from the same IP address

Auth0 tracks large security breaches that are happening on major third-party sites to help keep your users and systems secure. By enabling breached password detection, when a trigger occurs, your users can be notified and/or blocked from logging in if we suspect their credentials were part of a published security breach. **Auth0 never blocks the user itself, just the attempts from the suspicious origin**.

Is love knocking at your door or is it a brute force attack? [Integrate Auth0's anomaly detection in your application today](https://auth0.com/docs/anomaly-detection) to mitigate bad actors from forcing themselves into the heart of your data.

## <a class="toc-target" id="happy-valentines-day"></a>Happy Valentine's Day

Let Auth0 be the final piece that helps you build a secure and seamless user authentication experience that your customers will love to use. <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Get started with SSO, MFA, Universal Login, Anomaly Detection, and Rules for free today</a>!

![Auth0 Features to Fall in Love With - SSO, Rules, and More](https://images.ctfassets.net/23aumh6u8s0i/7fRVnuSnZAQva1b4YwQP0P/6f3f16fb671fecefb1cfd08e28dd40af/auth0-the-final-piece-in-authentication-to-fall-in-love-with)

<include src="asides/AboutAuth0" />

Auth0 Features to Fall in Love With

Insurers know that digital transformation is coming. To stand out from your peers, adopt identity and access management for a secure experience that customers can trust.

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---


Insurers know that implementing digital changes have the potential to benefit them long term. A recent [McKinsey study](https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/making-digital-strategy-a-reality-in-insurance) found that insurers that digitized their processes eliminated 30 to 50 percent of the human service costs. The top quartile of those surveyed achieved 2X the growth of their peers.

<include src="TweetQuote" quoteText="Insurers know that digital transformation is coming. To stand out from your peers, create a secure experience that customers enjoy and trust."/>

But specific obstacles in the industry have stalled progress. First, the majority of insurers don't have the in-house technical expertise and equipment to make sweeping changes without support. In addition, many are concerned, particularly in an era of [increased scrutiny around customer data](https://auth0.com/blog/cambridge-analytica-and-facebook/), that a system overhaul could threaten measures they've already taken to protect sensitive information.

Despite these real challenges, customers increasingly expect cutting-edge solutions. Other industries, like [healthcare](https://auth0.com/healthcare/) and [financial services](https://auth0.com/financial-services), are quickly incorporating digital methods, raising the bar for everyone. Eventually, insurers will be forced to change. Early adopters will gain an edge, and those who are slow to transform will lose.

While it's possible to begin a digital transformation in many ways — from creating a new claims platform to simply delivering online quotes — starting with an identity and access management (IAM) strategy is a clear, easy-to-implement step that allows managers to attack several core functions at once.

## Legacy Systems in a Changing Environment

In industries such as [retail](https://auth0.com/retail), many teams are able to rely on consumer data pulled from public sources like [social media profiles](https://auth0.com/learn/social-login/) to underpin their strategies. This might include compiling current and potential customer interests, events they've attended, and pages they've liked. In insurance, it's more complicated. Agents work with higher-touch information sets, like health records and credit scores.

![Legacy, old insurance systems example](https://images.ctfassets.net/23aumh6u8s0i/1T3qVEXkTfn8vpmFRHZyqX/35117cf6090d3668e1aacab3d062734a/legacy-systems-struggle-to-keep-up-with-digital-transformation)

[Source: Electronic Medical Records & Electronic Health Records Software](http://www.emr-ehrs.com/mental-health-electronic-health-records.php)

This data is the foundation for building customer risk profiles, determining premiums, and completing claims. Most teams have developed processes over decades that continue to work well. Although a lot of this data exists on legacy insurance softwares and systems and may not be intuitive for new hires to find and work with, more-seasoned agents understand the process and don't feel an urgent need to change.

With such fixed methods, it can be challenging to know why and how to begin to make updates. Tweaking any aspect of an established insurance company's model, even something as simple as market research or reaching out to new prospects, could skew the whole.

Yet if teams don't start somewhere, they risk becoming irrelevant in markets that are quickly evolving. Home insurers, for example, are facing variables such as interconnected home security and heating systems, like the Google Nest; auto insurers are having to factor in autonomous vehicles and the changes that ride-sharing programs like Uber and Lyft bring; even health insurers are seeing stiff competition from newcomers, like Oscar, that have a strong focus on UX and more-affordable plans.

Just because many insurance teams have succeeded with business-as-usual for decades, it doesn't mean they don't need to revamp for the future.

## Organize Your Users for Greater Security and Efficiency

For insurance teams facing a daunting set of changes, developing a clear [identity and access management - IAM](https://auth0.com/app-modernization) modernization strategy of legacy softwares is a concrete first step. IAM is a simple, initial fix that can form the basis for more updates down the line. It is a single solution for organizing and tracking customers, employees, and even business partners who are working with critical data in your system.

IAM often begins with a portal that collects, organizes, and protects customer data at the login stage. This starts with a simple welcome screen on the front end:

![Customer acquisition starts with a secured, basic identity management](https://images.ctfassets.net/23aumh6u8s0i/6skPK5VXzplAOaOIG2mXAW/d4cc7731371771ffcd5576d3fcf99044/transforming-customer-acquisition-starts-with-a-basic-identity-management-strategy)

Behind this screen, the technology tracks customer logins and platform behavior and enriches their profiles with personal details and historical records. This can be information that the insurer manually uploads or automatically pulls from public sources. Some features also include additional options, such as [progressive profiling](https://auth0.com/blog/how-profile-enrichment-and-progressive-profiling-can-boost-your-marketing/), to help build customer data over time (e.g., location, age, and gender).

For administrators, certain features allow for a bird's-eye view of all users in a given system, noting growth in users over time, ratio of new to returning users, who is accessing what levels of information at any time– even what device(s) they're using:

![Customer data visualization in Auth0 reports allows for better reporting and analytics](https://images.ctfassets.net/23aumh6u8s0i/5iw0moRjxmuV8bvOeZ9t16/e39d7192b9ca429b294a43df722dd491/organizing-customer-data-in-a-single-location-allows-for-better-reporting-and-analytics)

Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights on customer histories and current behavior. This approach will make your company more efficient at building risk profiles, communicating with customers in a more personalized way (particularly if and when they are in distress and need to make a claim), and understanding your target audience at a granular level.

<include src="TweetQuote" quoteText="Organizing customer data in a single location allows for better tracking, heightened security, and the possibility of gaining sharper insights."/>

## Outsourcing IAM to the Experts

While you can try to update your IAM system on your own, most insurers don't have the in-house capacity to do so — at least not at the level needed to meet future needs. This would require building a portal that is a one-stop solution for all users — yet is still flexible enough evolve alongside your business. The advantage of outsourcing IAM is having a dedicated team of experts whose entire job, 24/7, is to build and deliver these solutions — as opposed to adding it to a pile of tasks your IT team is currently balancing.

A provider like Auth0 makes sure all of its [features adhere to the highest industry standards](https://auth0.com/security), including LDAP, SAML, OAuth, OpenID, OpenID Connect, and JSON Web Tokens (JWTs). In addition, it is GDPR, EU-US Privacy Shield, and HIPAA compliant.

![Auth0 compliance and certifications](https://images.ctfassets.net/23aumh6u8s0i/35nsnoblygw4XlOUwuocQ6/c02f2b95ba00c2410da392fe049e68c4/auth0-adheres-to-the-highest-industry-standards)

[Source](https://auth0.com/security">Auth0 Security)

This eliminates the need for your team to do additional research to ensure any changes are up to code in your geographic area or industry.

Top-notch identity and access management providers like Auth0 will offer even more tools, like 2FA options, to help ease the customer experience. These features can provide a clear measure of safety that customers will immediately appreciate. Each step along the way allows your team to move further away from lagging competitors by gaining user trust, invigorating your brand, and creating more-efficient internal processes.

## Be an Early Adopter

If you're an insurer, now is the time to make bold changes to your current strategy. The early digital adopters in the industry will gain sharper insights and win and retain more customers.

No teams will be able to hide from change. With new products constantly coming to market, the industries in which insurance teams operate are themselves being revolutionized. Taking the first step to develop and implement a tight IAM system will open the door for full digital change.

<include src="asides/AboutAuth0" />

How the Right IAM Tools Will Help Insurance Teams Make the Shift to Digital

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Passwordless and Multifactor Authentication motivate companies to shift their approach to customer logins.

**BELLEVUE, Wash. -- July 9, 2018 --** [Auth0](https://auth0.com), a global leader in Identity-as-a-Service (IDaaS), today announced key findings on how companies are approaching the Customer Login Experience as new technologies like Passwordless, Multifactor Authentication, and social login options become more prevalent. According to anonymized data collected in May from a large sampling of Auth0 customers across all verticals, including financial services, media, retail, transportation, SaaS, and more, Auth0 found that companies are eager to embrace and adopt methods for streamlining the login process, suggesting that we should see an increase in passwordless usage in the near future. 

The emergence of [FIDO 2.0](https://fidoalliance.org/specs/fido-v2.0-rd-20170927/fido-overview-v2.0-rd-20170927.html) and [WebAuthn](https://auth0.com/blog/introduction-to-web-authentication) have encouraged more companies to take the leap into a passwordless future. Auth0’s customers are leading the charge, with 19.4 percent already using its [Passwordless](https://auth0.com/passwordless) feature, allowing developers to easily enable sign-in to apps without the need for passwords – a feature that Auth0 has offered since 2015. 

> Learn more and [try a WebAuthn demo crafted by Auth0, here](https://webauthn.me/).

The shift toward passwordless is a strategic one, considering that password changes are quite common for Auth0’s customers that use traditional username/password as a login method. Customers in the staffing & recruiting industry see 48.2 percent of their customers requesting a password change, followed by transportation (39.8 percent), federal (23.0 percent), and financial services (18.6 percent), the most common reason being forgotten passwords. “Gartner predicts that, through the end of 2020, enterprises that invest in new authentication methods and compensating controls will experience 50 percent fewer identity-related security breaches than peers that do not (Gartner).”[1](#myfootnote1)

As the industry evolves to a possibly passwordless future, the current state of the industry still finds a predominant use of passwords as the primary means of logging in. Before making the leap into passwordless, many companies have implemented [social login](https://auth0.com/learn/social-login) as an easier way to consolidate secure logins. 
 
Auth0 provides support for 30+ social providers, which 72 percent of its customers take advantage of, easing the login process for their users. The top five most widely used social login sites for Auth0 customers are: Google (60.3 percent), Facebook (24.1 percent), LinkedIn (8.8 percent), GitHub (7.1 percent), and Windows Live (6.8 percent). These percentages may shift in coming months based on recent news about how Cambridge Analytica handled Facebook data, which is a [cautionary tale](https://auth0.com/blog/cambridge-analytica-and-facebook/) for organizations about the implications of data breaches. 

With the prevalence of passwords still being used, the best way to protect identity credentials is to employ a feature like [Multifactor Authentication](https://auth0.com/multifactor-authentication) (MFA), which only 11.4 percent of Auth0 customers currently provide to their users. Of these customers, the top three industries consist of healthcare, manufacturing, followed by government. Adoption rates of MFA are on the low end due to the perception of added friction it supposedly creates for users, but it’s a critical feature for stopping phishing attacks, as well as decreasing the probability of getting hacked. In addition to this essential security layer, customers are relying on additional risk-based MFA that accommodates factors such as geographic location, IP filtering, type of device, which is a huge benefit with today’s global workforce. 

“The login experience is continually changing based on user demand and the need to protect against today’s sophisticated cybercriminal landscape. Passwordless is a signal of the kind of industry change we are all heading toward,” said Martin Gontovnikas, VP of Marketing and Growth at Auth0. “The insights we continually gather from our fantastic in-house data team fuel the continued innovation of our platform so customers stay several steps ahead in this constantly changing industry.” 

<a name="myfootnote1">1</a>: [Gartner Smarter with Gartner, Aim for a Workable Password Policy, Not a Perfect One October 9, 2017](https://www.gartner.com/smarterwithgartner/aim-for-a-workable-password-policy-not-a-perfect-one/)

<include src="asides/AboutAuth0" />

### **Media Contact:**

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

Momentum Building for a More Streamlined Customer Login Experience, According to Auth0

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Join AGL Enterprise Security Architect Heng Mok at the AWS Summit to learn of digital transformation challenges and wins (with the help of Auth0).



AGL Enterprise Security Architect [Heng Mok](https://www.linkedin.com/in/hengmok/)’s made a career out of being at the start of transformation programs. After building his deep knowledge of cybersecurity strategy and architecture in the banking industry, he shifted to energy, joining one of Australia’s leading providers of integrated energy at just the right time.

_“The energy market is going from centralized to distributed,”_ Mok says. “There are number of things that need to change. In a distributed world, you have to have more of a focus on what the customer wants and the platform to orchestrate that new energy concept.”

At the [AWS Summit](https://aws.amazon.com/summits/sydney/) in Sydney this week, Mok will share lessons learned during the first stage of [AGL Energy](https://www.agl.com.au/about-agl)’s digital transformation journey — re-architecting customer identity and authentication for AGL’s applications with the help of Auth0.

![AWS Summit Sydney](https://images.ctfassets.net/23aumh6u8s0i/jjb9cXebzQGKtzxVi8lrS/98b9f67d07037d93c8bfda5b29cc72e9/identity)

Before the change, AGL customers faced poor sign-up and login experiences as well as the need to navigate to disconnected sites. Mok and his team were looking to partner with a third-party provider who could rapidly deliver secure speed-to-value as well as key features. This is why AGL chose Auth0, Mok says. Also critical was the ability to maintain local data sovereignty — easily handled thanks to Auth0’s data center presence through AWS.

AGL’s fast timeline due to the demanding schedule needed to rebuild applications also meant that Mok was looking for a partnership instead of a traditional customer/vendor relationship. “Culturally, Auth0 has been very delightful to worth with,” Mok says. citing strong support teams and architects’ building capability as well as Auth0’s willingness to speed up features on its own roadmap to accommodate AGL’s needs, like an earlier release of [custom domains](https://auth0.com/docs/custom-domains).

Since the first minimum viable product (MVP) went live in March of 2017, Mok and his team have built eight other apps and integrations, providing with seamless and secure authentication as well as innovations like integrating through Auth0 to give AGL customers the ability to manage energy using [Alexa’s voice control](https://www.agl.com.au/about-agl/media-centre/asx-and-media-releases/2018/january/agl-announces-amazon-alexa-skill).

Using a custom-built migration, AGL has been able to successfully consolidate identity to a central location. Mok has seen a dramatic increase in overall speed-to-value, from faster onboarding and an increased ability to rapidly offer customer choices to building new business capabilities. Having created these patterns, he says they are now able to quickly incorporate excellence into the platform with automatic testing that takes only five to 30 minutes during rollout.

“Auth0’s probably our fastest performing component in our digital set. Onboarding customers live onto the platform and handling quick authentication switches has improved the overall customer experience,” Mok says.

During his AWS talk, The Secret to AGL’s Digital Transformation, on April 11th from 4:15 - 4:45 p.m., Mok will share:

- Practical tips for integrating identity, easily and securely
- First-hand anecdotes and lessons learned
- Strategies to integrate an identity platform into an existing in-house infrastructure

_“I’m definitely excited to share AGL’s journey and how partnering with Auth0 has been a fundamental business enabler for our organization. I’ll discuss what challenges we’ve been through and some of the wins we’ve had as a result,”_ says Mok.

To learn more about Interaction-based Authentication Skills for Alexa, check out Auth0 Sales Engineer Steve Adams’ talk from 4:15 - 4:30 p.m on April 12th. Auth0’s expert staff will also be available to discuss your identity needs throughout the conference. You’ll find them at Auth0’s booth at Marketplace M7. Not able to make to Sydney this year but still need help with identity? Reach out to [sales@auth0.com](mailto:sales@auth0.com).


AWS Summit: How AGL Increased Time-to-Value, Improved Customer Experience with Auth0

Social login capabilities make Youi Rewards app easier to use

**BELLEVUE, Wash. -- March 28, 2018** -- [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), announced that it is providing the identity platform for [Youi Insurance](https://www.youi.com.au/) (“YouInsured™”), a leading insurance provider in Australia that offers a range of motor and home insurance policies. Youi is relying on Auth0’s social login functionality for its Youi Rewards app, a mobile customer platform for earning rewards with policy purchases or file claims.

Youi’s people-first mission is the foundation for all customer interaction, and they were looking for a way to improve the user experience of their Rewards app as demand increased. The existing custom-built app did not incorporate social login, which posed a barrier to adoption. Execution speed and the assurance of the security of user data also played a large role in making the decision to standardize on Auth0.

“We had several technical requirements in mind when evaluating identity providers,” said Doug Inman, Group Chief Information Officer at Youi. “Ultimately, Auth0’s ability to get us up and running right away and simultaneously improve our customers’ experience made it an easy decision.”

“Youi has a reputation for being customer-centric, and we are proud to play a role in keeping their customers happy,” said Eugenio Pace, CEO of Auth0. “Consumers are demanding more from their engagement with brands, and Youi is a great example of a company using technology to anticipate and meet customer needs.”

For more information on how Youi Insurance is using Auth0, please visit: [https://auth0.com/learn/youi-insurance-case-study/](https://auth0.com/learn/youi-insurance-case-study/).

<include src="asides/AboutAuth0" />

---

Youi Insurance Relies on Auth0 for Better Customer Experience

Social login makes customer experience hassle-free

**BELLEVUE, Wash. -- March 5, 2018** – [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), today announced that it is the identity management platform of choice for fuboTV, the leading sports-first live streaming TV service in the U.S. The company’s rapidly growing subscriber base will use Auth0 for authentication and social login across a variety of platforms including desktop, mobile phones, and tablets.

fuboTV subscribers use the OTT service to watch their favorite teams and stay on top of the most popular sports, news, and entertainment networks in the U.S. For example, its fubo Premier base package includes more than 65 channels, viewable on desktop at [www.fubo.tv](http://www.fubo.tv) as well as Android and iOS mobile phones and tablets, and leading TV connected devices including Apple TV, Roku, and Amazon Fire TV.

_“We wanted to make the login process easier and more secure for our customers, who rely on us 24/7 for the latest and greatest in sports and entertainment,”_ said Sung Ho Choi, co-founder, fuboTV. _“Auth0’s authentication capabilities, including the option for our customers to login via their social media profiles, gives our customers a better experience overall.”_

Today’s cord-cutting culture and the need for always-on entertainment is creating a huge surge in demand for streaming sports. fuboTV, as it meets this demand, will rely on Auth0 to scale authentication for its continually growing subscriber base.

_“We are excited to be a trusted partner to fuboTV as they continue their expansion,”_ said Eugenio Pace, CEO and co-founder of Auth0. _“Its varied offering and optimal customer experience will continue to set fuboTV apart from other streaming services in this competitive marketplace.”_

For more information on how Auth0 supports media companies like fuboTV, please visit: [https://auth0.com/media-publishing](https://auth0.com/media-publishing).

<include src="asides/AboutAuth0" />

### Media Contact

Jeana Tahnk 
Corporate Communications 
Auth0 
[jeana.tahnk@auth0.com](mailto:jeana.tahnk@auth0.com)

Kasia Hall 
Matter for Auth0 
[khall@matternow.com](mailto:khall@matternow.com) 
971-246-7898

fuboTV Enables Easier Login for Streaming Sports Fans with Auth0

story-tweedie-yates

Story is a Sr. Director of Product Marketing at Auth0, where she is passionate about the value of identity in the applications you build. With an eclectic background in psychology, professional athletics and cybersecurity, her expertise lies in working deeply with analysts, sales and customers to uncover the significance of security and identity to customers’ biggest business problems. Story is a Stanford graduate with a BS in Psychology. She also has an MBA from Thunderbird School of Global Management, speaks fluent Spanish and has done business in over 40 countries. In her time off, you will find her scooting her twins around the town or exploring underwater treasures with a scuba mask alongside her husband.

Sr. Director Product Marketing

Story Tweedie-Yates

GDPR compliance is an opportunity to improve how you do Identity—whether it's improving customer experience, time to market or increasing revenue.

<div class="alert alert-info alert-icon">
 
 GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.
</div>

---

Like the business trip that hits at an inopportune moment, [GDPR](https://auth0.com/gdpr) compliance can feel like a large inconvenience, even though it is business-critical. We believe that every security or compliance requirement has a silver lining. With GDPR, you have an opportunity to improve how you do Identity—whether it's in the context of improving customer experience, time to market, or increasing revenue.

<include src="TweetQuote" quoteText="We believe that every security or compliance requirement has a silver lining."/>

![GDPR - General Data Protection Regulation](https://images.ctfassets.net/23aumh6u8s0i/1TWFcNwmXWjBsj2kZUcYiB/9b7cf20f83478bafa60b8a7f4cfbf73f/gdpr-flag)

Many of our customers make the most of their investment in compliance by using Auth0 to upgrade their customers' experiences and achieve their business goals at the same time. Here are a few examples of how they've done it—and how you can too.

## Increase customer conversions and upgrade user experience

Your largest customer is often both the most demanding and rewarding. If you can redirect them to a customized page after logging into your application, you will be able to treat this customer differently from the rest—as you should.

Thank them. Make it easy for them to add to their subscription. Engage them with questions. Auth0 makes it easy to take an innovative approach to this page to increase customer conversions.

An unfriendly implementation of GDPR compliance could tarnish that interaction. Instead, demonstrate your respect for their time by automatically recording the date when explicit consent or agreement to new privacy terms was granted without any disruption to service. Using Auth0 to automatically record the data without adding anything to the login form means your biggest fan won't notice the difference.

Auth0 Rules and the Management API let you accomplish [the url redirection based on identity](https://auth0.com/docs/rules/current/redirect) while [recording when explicit consent was provided](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance), as well as new privacy terms and conditions agreed to at login.

## Turn leads into revenue faster

Every time a new user creates an account within your application, you can create an opportunity for your sales and marketing team. Ideally, they'll be able to convert that user from a contact into a lead and, eventually, into a customer. But success here is a numbers game. The percent of new accounts that turn into qualified leads is typically small, so automating this process can be key.

Automatically creating leads from new accounts in your CRM or marketing tools like Marketo or Eloqua frees your team to begin the customer nurturing process faster, shortening the time to potential reward.

Making lead creation contingent upon the user's explicit permission to create the account and receive marketing information at login allows you to easily automate one aspect of GDPR compliance.

Again, rules are the Auth0 innovation tool that allows our customers to [automatically create a Salesforce lead](https://github.com/auth0/rules/blob/master/rules/creates-lead-salesforce.md) or Marketo contact when a new person signs up with an account. Auth0 allows you to [provide an explicit consent option](https://auth0.com/docs/compliance/gdpr/features-aiding-compliance) within the login screen, while custom logic within Rules could be created to make sure that lead doesn't get generated in an external system without gaining (and tracking) explicit consent.

## Optimize your users' experience

Everybody wants a great user experience for their apps' login to save on costs and increase customer conversions. But this especially applies to those organizations with a very complex group of application users faced with the challenge of providing an ideal user login experience across a large number of applications. In this case, 'out of the box' identity isn't enough. Customization is critical.

One of our logistics and transport industry customers had users who might be a driver for one company, a dispatcher for another company and a manager at yet another company. Same user signing into different applications, with completely different roles. We were able to seamlessly tie the customer's complex permissions scheme to the login process to convert users based on context and give them access to the appropriate applications right from the login screen, giving our logistics and transport industry customer the precise control they needed.

GDPR specifies confidentiality of customers' personal data—so if any of these applications contain personal data, it is also critical from a compliance perspective to be able to granularly control who is accessing what application and with which permissions.

With Auth0 Rules, our customer was able to easily verify user logins and specify further permissions within the app based on information from the customer—innovating their users' experience while achieving gains in GDPR compliance.

## Compliance can help grow your bottom line through innovation

When you invest in meeting your GDPR requirements you can also innovate identity for your applications. With Auth0, compliance and innovation are not mutually exclusive.

<include src="TweetQuote" quoteText="With Auth0, compliance and innovation are not mutually exclusive."/>

See how much innovating your identity with Auth0 can grow your bottom line with the[ Forrester Total Economic Impact assessment](https://resources.auth0.com/forrester-tei-research-case-study/).

Jumpstart Identity Innovation with GDPR

fedemolina

Marketing Lead @ Decentraland

Federico Molina

Intuitive design, interface, and simple layouts are key to keeping people on your site. Is your login experience driving users away?

<div class="alert alert-info alert-icon">
 
 Forrester Consulting analysis determines that using Auth0 can yield a 548% ROI and $3.7M in identity-related savings. Read the full report: <a href="https://resources.auth0.com/forrester-tei-research-case-study/">Total Economic Impact of Auth0</a>.
</div>

---
About [60% of users have admitted to reusing passwords](https://www.passwordboss.com/password-habits-survey-part-1/) to avoid having to remember multiple sign ins. Logging in to a site is so annoying for most people they're willing to compromise their security to make it easier. 

Your company's login is the first impression of its services. For customers, the login experience is a proxy for how your product and customer service will fare later. If your login is inconvenient, unclear, takes too long, sticky or clunky, you could be losing customers who will never come back. 

Below are some examples of counterintuitive logins as well as solutions to ease the login process for your customers.

## The Login Form Should Be Easy to Navigate

Users have to pick one login pathway from a list of 34 options just to enter the website for the health care solution provider McKesson. This company offers 34 different login pages on 34 separate sites, when it could just be one easy login that funnels you to the right place.

A login like this is daunting for customers.

![Bad Login UX Example](https://images.ctfassets.net/23aumh6u8s0i/2AwMN3xXgxAOYpebUAnK9Y/03307fdec4e419cfd30332b6cd2b4078/bad-login-example)

Having too many steps to your login process will turn customers off and they might move on to a competing site.

Loyalty programs, in particular, are notorious for having too many steps required for logging in. On the first page for many of these sites, customers have to input their username and passwords. From there they may have to answer security questions or log in again through their bank, credit card, or other partners to be authenticated.

Logging in should be as easy as entering a password or, ideally, clicking a button. There shouldn't be too many steps and there also shouldn't be winding pathways to get to the login page itself. 

Auth0 offers [Passwordless login](https://auth0.com/passwordless) which is both secure and fast. It uses email or SMS to authenticate customers and moves them quickly into the site. By clicking on a magic link, users can fly past the login panel to enter the site. It's more intuitive and secure than a wall of login options all leading to different sites. 


## Customers Will Leave if Logging On Requires Too Many Steps

When you try to log into [Starwood Preferred Guests' Guest Loyalty Program](http://www.starwoodhotels.com/preferredguest/index.html?language=en_US) via multiple devices you have to answer annoying security questions.

![SPG Loyalty Program Login](https://images.ctfassets.net/23aumh6u8s0i/2nuPyD6Lq1jxBwL1gkugPt/6888a61b9f24f867f731bbb2000b3816/spg-login)

![SPG Loyalty Program login with many security questions](https://images.ctfassets.net/23aumh6u8s0i/Bu9k8zg8JZgT9AB5dbZ3f/ccb5f7d36bf308c009c695a60beada47/spg-security-questions)

Pages that take longer than three seconds to load can result in a [7% reduction in conversions](https://blog.kissmetrics.com/loading-time/). That's just loading. When customers have to spend longer than a few seconds logging in, there's a good chance they'll leave too. Security questions like Starwood's can frustrate customers so much they bounce from the page.

Banks and credit cards often have lengthy login processes in order to authenticate users. They'll also ask security questions or require extra passwords. And while security is important for these services, there are more customer-centric ways of providing a secure login and digestible user interface. 

[Single Sign On](https://auth0.com/blog/what-is-and-how-does-single-sign-on-work/) (SSO), for example, automatically links logins through federated identity so users can log in from multiple devices and across different domains. Federated identity provides a single access pathway across multiple systems through a variety of enterprise sources. SSO authenticates and authorizes users so they can enter the site quickly without having to deal with a series of security questions while still keeping the process safe from hacking.

## Unclear Signage Confuses and Frustrates Users

It's not clear where the login is for SSLPrivateProxy, shown below. Is it “Getting Started,” “Login,” or “Register”? Any of these, which are all located in the upper left-hand corner, could be entry points for the site. 

![SSL Private Proxy shows an unclear login experience](https://images.ctfassets.net/23aumh6u8s0i/34niRJ0OtvYQ9RVvMZtL3t/d12960fcbee23c39bdf2d978a4f0c250/sslprivateproxy-unclear-login)

![SSL Private Proxy showing login for clients](https://images.ctfassets.net/23aumh6u8s0i/77Ar74cytGPKbyzociMzM/5ffb8005512318ee9b602e8abb32f8aa/sslprivateproxy-login-for-clients)

Counterintuitive design for login panels can frustrate customers and waste their time. The login panel should be front and center on the landing page. Or, if not center, at least easily accessible as soon as the customer enters the website. 

Customers have to spend an extra second deciding which one to click on. And even from there, instead of a small [login widget](https://auth0.com/how-it-works), which hovers upon a click over the landing page, customers are taken to a completely new page to log in. This login wastes time and might even prompt some customers to leave or avoid using the site.

## Easy Login Keeps Customers Happy and Boosts Company Growth

Login is only the gateway for your website, it isn't even your product. And, yet, when the login design, interface, and experience is complicated or annoying, customers have to spend time carefully considering how they will sign in. This doesn't count the actual logging in which may include trying multiple passwords, password resets, or new registration. 

Clean and easy login can not only boost the user's experience, but it can lead to drive MRR. Customers love [social login](https://auth0.com/learn/social-login/) so much it's even [driving growth and conversion rates](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) for many companies who have employed it. One company reported that [social logins lead to a 40-60% increase](https://www.quora.com/What-impact-does-social-login-have-on-conversion-rates) in conversion rates for them. Some said they saw a whopping 130% increase in conversions due to social login.

Social login has the dual effect of making your site easier to enter and use while also making the whole design look cleaner. Clean design actively invites customers in, making them more likely to spend time on your site and trust your company's products.

## Aside: Auth0 Login Widget

Our Lock widget is a beautifully designed, all-in-one, embeddable login box for your apps. It provides sign up, sign in, password reset, and other features that are ready to go. The widget’s styles can be easily customized to line up with your brand, and you can use one of our pre-made themes to help. Unlock the power of a good login experience with Auth0 Lock. Try our live demo in the [Auth0 Lock](https://auth0.com/lock) page.

![Auth0 Login Widget"](https://images.ctfassets.net/23aumh6u8s0i/6JbvTf3oNiN8D2OyFpUoka/ddbf2f9d2741964186381c240aca0c44/what-is-social-login-1)

## Focusing on Your User's Experience Will Keep Them Coming Back

Login is the gateway to your whole website and your product beyond that. If customers feel like there are any roadblocks to them entering your website, they'll move on to another. 

There shouldn't be any obstacles for customers to enter your site beyond basic authentication. They shouldn't even have to do more than press a button to be allowed in.

By making login easier for customers with passwordless login, social login, or SSO, companies can actually boost business overall. It's a win all around.

"customer experience"