andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Implement effective B2B SaaS user onboarding strategies with Auth0. Learn about self-service, admin provisioning, and JIT flows, plus a Blazor invitation example.

For developers building B2B SaaS applications, a seamless user onboarding experience is crucial for customer satisfaction and adoption. A clunky or complicated onboarding process can lead to frustration and churn, while a smooth and intuitive one can set the stage for a long and successful customer relationship.

This article explores various user onboarding strategies for B2B SaaS applications, with a focus on the solutions offered by Auth0. We will delve into different onboarding flows and provide a practical guide on how to implement member invitations in a Blazor application.

## User Onboarding Strategies

When it comes to onboarding users to your B2B SaaS application, there is no one-size-fits-all solution. The best approach will depend on your specific application, your customers' needs, and their technical capabilities. [Auth0's Organizations](https://auth0.com/docs/manage-users/organizations) feature provides the flexibility to support various onboarding models.

### Self-Service vs. Admin Provisioning

A fundamental choice in user onboarding is between self-service and administrator-led provisioning.

* **Self-service:** In a self-service model, users can sign up for the application on their own. This is a common approach for applications that want to offer a frictionless trial experience. To maintain control, you can implement an approval workflow where administrators from the customer's organization need to approve new sign-ups.
* **Admin provisioning:** In an admin-provisioning model, an administrator from the customer's organization invites users to the application. This gives the customer more control over who has access to the application and is a common requirement in enterprise settings.

### Onboarding Flows with Auth0 Organizations

Auth0 Organizations allows you to model your B2B customers as distinct entities within your Auth0 tenant. This enables you to manage users, connections, and policies on a per-organization basis. Here are two common user onboarding flows you can implement with Auth0 Organizations:

1. **Invitation flow:** An administrator from the customer's organization can invite users to join their Organization within your application. The user receives an email with an invitation link. When they click the link, they are guided through the signup or login process and are automatically added to the correct Organization.
2. **Just-in-Time (JIT) provisioning:** For enterprise customers using their own identity providers (like Azure AD or Okta), [JIT provisioning](https://auth0.com/docs/manage-users/organizations/configure-organizations/grant-just-in-time-membership) is often the preferred method. With JIT, a user account is automatically created in your application the first time the user logs in through their corporate Single Sign-On (SSO). This eliminates the need for manual user creation and streamlines the onboarding process.

## Inviting Users to an Organization

Let's take a closer look at the invitation flow, a common and effective onboarding strategy. With Auth0, you can invite members to an Organization using either [the Auth0 dashboard](https://auth0.com/docs/manage-users/organizations/configure-organizations/send-membership-invitations#auth0-dashboard) or the Management API.

In the rest of the article, you will learn how to invite a new user to join an Organization programmatically. Basically, the invitation process works as shown in the following diagram:

<picture>
<img src="https://images.ctfassets.net/23aumh6u8s0i/iiI1xhwIzjjr00xV9wKIM/6cdc6fe5e83e58535c630a76bf7f1472/user-invitation-flow-diagram_v2.jpg" alt="Diagram illustrating the multi-step user invitation process for B2B SaaS applications using Auth0 Organizations." style="width: 75%; margin: auto">
</picture>

Following the numbered lines in the diagram:

1. An administrator initiates an invitation from your application.  
2. Your application uses the Auth0 Management API to create an organization invitation.  
3. Auth0 sends an email to the user with a unique invitation link.  
4. The user clicks the link, which directs them to your application's login page.  
5. After the user signs up or logs in, they are automatically added to the organization.

> To implement this flow, you need to configure an "Application Login URI" in your Auth0 application settings. This is the URL in your application that will handle the invitation acceptance.
>
>For more details, refer to the [Auth0 documentation on inviting organization members](https://auth0.com/docs/manage-users/organizations/configure-organizations/invite-members).

## Implementing User Invitations

Now, let's see how to add support for inviting organization members to the sample B2B Blazor application, as featured in previous Auth0 blog posts:

* [Add Auth0 Organizations to Your B2B Blazor Web App](https://auth0.com/blog/auth0-organizations-for-b2b-saas-blazor-web-apps/)  
* [Enable Self-Subscribing Model in Your Blazor B2B SaaS Application](https://auth0.com/blog/enable-self-subscription-in-blazor-b2b-saas-application/)  
* [Enforce Customer Email Verification in Your B2B Blazor Web App](https://auth0.com/blog/enforce-customer-email-verification-b2b-saas-blazor-app/)  
* [Implementing Role-Based Access Control in Your Blazor B2B SaaS Application](https://auth0.com/blog/role-management-auth0-organizations-b2b-saas/)

The Blazor application allows a new customer to subscribe and create a new Organization, but currently, they can add new users only via the Auth0 dashboard. With the changes we are about to implement, you will enable the Organization administrator to invite users directly from the application.

### Prerequisites

If you don’t want to implement the sample application from scratch following the previous articles, you can download it by running the following command:

```shell
git clone --branch roles-organizations --single-branch https://github.com/andychiare/MyBlazorSaaS
```

Follow the instructions in the attached README file to register and configure the application with Auth0. If you don't have an Auth0 account, [you can sign up for free](https://a0.to/blog_signup).

To enable the application to send invitations for joining an Organization, you need to add a new permission for your application.

Assuming you have configured your application according to the mentioned README file, navigate to your [Auth0 dashboard](https://manage.auth0.com/) and locate the *ManagementClient* application under the [Applications \> Applications](https://manage.auth0.com/#/applications) section.

On the application's configuration page, select the *APIs* tab and expand the area below the Auth0 Management API item. Then, select the `create:organization_invitations` permission and click the *Update* button to save your changes.

<include src="ebook-ads/dotnetIdentity" />

### Implementing the invitation feature

Now we are ready to implement the invitation feature. As the first step, create a new page named `Invite.razor` under the `MyBlazorSaaS/Components/Pages/Dashboard` folder and start adding the following code:

```html
@page "/dashboard/users/invite"
@attribute [Authorize(Roles = "admin")]
@rendermode InteractiveServer

@using Auth0.ManagementApi
@using System.ComponentModel.DataAnnotations
@using Auth0.ManagementApi.Models
@using Microsoft.Extensions.Configuration

@inject IAuth0Management auth0Management
@inject IConfiguration Configuration

<h3>Invite a New User</h3>

<div>
 <div class="form-group row my-2">
   <label for="email" class="col-sm-4 col-form-label">EmailAddress</label>
   <div class="col-sm-6">
     <InputText
       type="email"
       @bind-Value="EmailAddress"
       id="email"
       class="form-control"/>
   </div>
 </div>

 <div class="form-group row my-2">
   <label for="role" class="col-sm-4 col-form-label">Role</label>
   <div class="col-sm-6">
     <InputSelect id="role" class="form-select" @bind-Value="RoleId">
           <option value="">Select a role...</option>
           @foreach (var role in availableRoles)
           {
               <option value="@role.Id">@role.Name</option>
           }
     </InputSelect>
   </div>
 </div>

 <button class="btn btn-primary" @onclick="HandleInvite">Send Invite</button>
</div>

@if (!string.IsNullOrWhiteSpace(successMessage)) {
 <div class="alert alert-success" role="alert">
   @successMessage
 </div>
}

@if (!string.IsNullOrWhiteSpace(errorMessage)) {
 <div class="alert alert-danger" role="alert">
   @errorMessage
 </div>
}
```

This is the UI part of the user invitation page. Its relative path is `/dashboard/users/invite`, and it is accessible only to administrators. It defines a textbox for the new user’s email address and a select box with the roles that can be assigned to users. The last two if statements control the visibility of the success and error messages.

For the sake of simplicity, no data validation is performed on the data submitted through the form, but this must be done in production code, of course.

The rendering of this page looks like the following picture:

![User onboarding invitation form in a B2B SaaS Blazor application with fields for email and role.](https://images.ctfassets.net/23aumh6u8s0i/7y7XcINPkTwxNNah4CKwGl/004a4e06d965fa7abd4a538928af99b6/invite-new-user.png)

Now, let’s implement the behavior behind this UI by adding the following code to the `Invite.razor` page right after the existing code:

```c#
// ...existing code...

@code {
 [CascadingParameter]
 private Task<AuthenticationState>? authenticationState { get; set; }
 private ManagementApiClient? managementClient;
 private string EmailAddress = "";
 private string RoleId = "";
 private string OrganizationId = "";
 private string OrganizationName = "";
 private string successMessage = "";
 private string errorMessage = "";
 private IEnumerable<Role>? availableRoles = [];


 protected override async Task OnInitializedAsync()
 {
   if (authenticationState is not null)
   {
     var state = await authenticationState;

     if (state.User?.Identity?.IsAuthenticated??false)
     {
       OrganizationId = state.User?.FindFirst(c => c.Type == "org_id")?.Value??String.Empty;
       if (!string.IsNullOrEmpty(OrganizationId))
       {
         managementClient = await auth0Management.getClient();
         var organization = await managementClient.Organizations.GetAsync(OrganizationId);
         OrganizationName = organization.DisplayName;

         availableRoles = await managementClient.Roles.GetAllAsync(new GetRolesRequest());
       }
     }
   }
 }

   private async Task HandleInvite()
   {
       try
       {
           var inviterName = $"{OrganizationName} Admin";

           var invitation = new OrganizationCreateInvitationRequest
           {
               Inviter = new OrganizationInvitationInviter { Name = inviterName },
               Invitee = new OrganizationInvitationInvitee { Email = EmailAddress },
               ClientId = Configuration["Auth0:ClientId"],
               Roles = new List<string> { RoleId }
           };

           await managementClient.Organizations.CreateInvitationAsync(OrganizationId, invitation);

           successMessage = $"Invitation sent successfully to {EmailAddress}.";

           EmailAddress = "";
           RoleId = "";
       }
       catch (Exception ex)
       {
           errorMessage = $"Error sending invitation: {ex.Message}";
       }
   }
}
```

The `OnInitializedAsync()` method sets the stage for the invitation creation. It retrieves the ID and name of the current Organization, gets an instance of the Auth0 Management client, and loads the user roles to be displayed in the select box.  
The `HandleInvite()` method, triggered by the “Send Invite” button, actually creates and sends the invitation to the user. It prepares an invitation request through an instance of the `OrganizationCreateInvitationRequest` class and sends it to the user via the `CreateInvitationAsync()` method.

### Handling the invitation

Note that the invitation instance created in the `HandleInvite()` method needs the value of the [application’s client ID](https://auth0.github.io/auth0.net/api/Auth0.ManagementApi.Models.OrganizationCreateInvitationRequest.html#Auth0_ManagementApi_Models_OrganizationCreateInvitationRequest_ClientId) among the other parameters. This is necessary to resolve the application’s login endpoint mentioned earlier.

When the user receives the email with the invitation link, they need to navigate to that endpoint to accept the invitation and sign up to the Organization. So, your application must handle the invitation to complete the user onboarding. Fortunately, the Blazor sample app you are using has already implemented it.  

For more information on this, please refer to the "[Manage User Invitations](https://auth0.com/blog/auth0-organizations-for-b2b-saas-blazor-web-apps/#Manage-User-Invitations)" section of the [Add Auth0 Organizations to Your B2B Blazor Web App](https://auth0.com/blog/auth0-organizations-for-b2b-saas-blazor-web-apps/) blog post.

### The final touch

To make the `Invite.razor` page accessible to the Organization's admin, you need to modify the current simple dashboard page of the Blazor application. You will simply add a button that lets the admin navigate to the `Invite.razor` page.  
Open the `Home.razor` page in the `MyBlazorSaaS/Components/Pages/Dashboard` folder and apply the changes highlighted below:

```html
@page "/dashboard"
@attribute [Authorize(Roles = "admin")]
@* 👇 new code *@
@rendermode InteractiveServer

@inject IAuth0Management auth0Management
@* 👇 new code *@
@inject NavigationManager navManager

<PageTitle>Dashboard</PageTitle>

<h1>Admin dashboard</h1>

 <div>
   @* ...existing code... *@
 </div>
@* 👇 new code *@
 <div class="form-group row my-2">
   <div class="col-sm-4"></div>
   <div class="col-sm-6">
     <button class="btn btn-primary" 
             @onclick="@(() => navManager.NavigateTo("/dashboard/users/invite"))">
            Invite a new user
      </button>
   </div>
 </div>
</div>
@* 👆 new code *@

@* ...existing code... *@

```

This first change concerns the page’s render mode. Since we are going to allow the admin to click a button to navigate to the invitation page, you need to enable interactivity.  
Then, you injected the `NavigationManager` service to enable page navigation.  
Finally, you added a section showing the button to navigate to the invitation page.

This will show as follows:

![Admin dashboard for B2B SaaS application showing a button to invite new users for simplified user onboarding](https://images.ctfassets.net/23aumh6u8s0i/2w1QXbqYR4CyzhhklE07Ri/9d7497b911fe501dc308f9f39f738c7e/admin-dasboard-with-user-invitation.png)  
Now you have everything ready to test your user onboarding through invitation\!

## Conclusion

Choosing the right user onboarding strategy is a critical decision for any B2B SaaS application. By leveraging Auth0's powerful and flexible Organizations feature, you can implement a variety of onboarding flows that cater to the diverse needs of your customers. Whether you opt for a manual invitation process, a self-service model, or a fully automated JIT provisioning workflow, Auth0 provides the tools you need to create a seamless and secure onboarding experience for your users.

While this article showed how to implement user onboarding through invitation in .NET, and specifically with the Blazor framework, you are invited to explore other user onboarding approaches and implementations. For example, the SaaStart app includes an implementation of the invitation onboarding in Next.js.

By the way, you can download the final code of the Blazor project created in this article on [this GitHub repository](https://github.com/andychiare/MyBlazorSaaS/tree/member-invite).

User Onboarding Strategies in a B2B SaaS Application

Daizen Ikehara

.NETエンジニアとしてキャリアをスタートさせた後、UIコンポーネントベンダーやクラウドコミュニケーションプラットフォームベンダーにおいて様々なロールを歴任。2023年3月よりOktaに参画し、日本市場における開発者リレーションを担当。趣味はゲームと長距離散歩。

Daizen Ikehara joined the Developer Relations team in March 2023 as a Principal Developer Advocate. In the early stages of his professional career, Daizen started using C#. Then, he touched on various JavaScript technologies/frameworks—Angular, React, and Vue. Recently, he’s been using Node.js/JavaScript more often. He is passionate about talking with developers. Outside of work, Daizen likes to take long walks, play video games, and watch Formula 1 racing.

Daizen Ikahara

In this blog post, we will add the capability to edit existing Self-Service SSO configurations in your SaaS application.

In the previous post, we added [a Self-Service capability to create SSO connections](https://auth0.com/blog/how-to-add-self-service-sso-to-your-nodejs-saas-app/). This is a powerful feature that you can use to offload administrative tasks to your customers' admins. However, your SaaS also needs to support editing the existing SSO configurations.


## Creating SSO Connections Is a Must-Have


Let's discuss why editing is essential. After creating an SSO connection, a customer admin might need to update the Client Secret or swap the SAML certificate for the connection. In this scenario, the customer admin still needs to contact SaaS’s support or representatives.


To provide true “Self-Service” administration, you can continue to leverage the power of Auth0's [Self-Service SSO](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO) feature. Let's dive into the details.


## The Sample App


This blog post will use the sample application built previously as a starting point.


You can download a sample Node.js/Expression application:


```bash
git clone --branch feature/self-service-sso-create --single-branch https://github.com/neri78/self-service-sso-express.git
```


> Note: The sample code omits error handling to make the code simple. In a real-world development, you will need to implement error handling correctly.


Follow the attached README file instructions to register and configure the Regular Web Application and a Machine-to-Machine (M2M) Application.


In the sample app, once you have signed up as a user and logged in, click Dashboard on the header navigation to open the dashboard page. You will see the following page on the navigation to the Dashboard page. Currently, the Dashboard provides a button to create a new SSO Connection.

![Admin dashboard for the self-service SSO application, showing only the 'Add SSO Connection' button before changes.](https://images.ctfassets.net/23aumh6u8s0i/1aT1P96Mvj5ZyZedvOalfQ/596ff65b8017d157e2732abd07f2bbb3/sso-dashboard-start.png)

## Self-Service Editing for SSO Connections
To add editing capability to the sample application, we will perform the following steps:


1. Update the UI on the Dashboard page.
2. Add a permission for the Management API to retrieve existing connections.
3. Update router handler to create a Self-Service SSO editing.

### Update the UI on the dashboard page


First, let's add an Edit button on the `views/dashboard.ejs` file:


```html

   <form action="/dashboard" method="post" class="w-full max-w-xl">
     <div class="md:flex md:items-center">
       <div >
       
         <button class="shadow bg-indigo-600 hover:bg-indigo-500 focus:shadow-outline focus:outline-none text-white font-bold py-2 px-4 rounded"
                 name="action"
                 value="create"
                 type="submit">
           Add SSO Connection
         </button>
         <p>or</p>
         <button class="shadow bg-indigo-600 hover:bg-indigo-500 focus:shadow-outline focus:outline-none text-white font-bold py-2 px-4 rounded"
                 name="action"
                 value="edit"       
                 type="submit">
           Edit SSO Connection
         </button>
       
       </div>
     </div>
   </form>

```

Now, the dashboard has two buttons. Each button has a `value` attribute, which is used to branch logic in the router handler.

![Updated admin dashboard for self-service SSO, now with both 'Add SSO Connection' and 'Edit SSO Connection' buttons.](https://images.ctfassets.net/23aumh6u8s0i/5HvXR2dwCAvggLI5qZlPRE/342a95bcd2fa4e0e3968b9a1062ced5f/Self_Service_SSO_-_dashboard_-_edit.png)

### Add a Permission for the Management API to retrieve existing connections

We must retrieve existing connections using the [Auth0 Management API](https://auth0.com/docs/api/management/v2) to edit an existing connection. For those purposes, grant the following permission in your Machine-to-Machine (M2M) application:

- `read:connections`

![Auth0 Management API permissions screen, with the 'read:connections' permission selected to retrieve existing connections.](https://images.ctfassets.net/23aumh6u8s0i/2yDvfX80n1XdrX6RElU5am/8f43c9c42546add6b8c6a3458ff6f82c/Management_API_-_read_-_connections_permission.png)

## Update Router Handler to Create a Self-Service SSO Editing

The application has a POST handler for `/dashboard` in the `router/index.js` file. This handler is creating a Self-Service SSO ticket to create a connection. We are going to use this handler for editing, too. 

### Branch the logic

Let's update the handler to branch based on the button's value attribute.

```javascript
// routes/index.js

// ...existing code...
router.post('/dashboard', requiresAuth(), async function (req, res, next) {
   // get an instance of the ManagementClient.
   const management = getManagementClient();

   // get a list of Self-Service Profiles.
   const { data: ssoProfiles } = await management.selfServiceProfiles.getAll();

   // use the 1st profile in this sample.
   const ssoProfile = ssoProfiles[0];

   const requestParameters = {
       id: ssoProfile.id
   };

   // 👇 change code
   let bodyParameters = {};

   const action = req.body.action;

   if (action === 'create') {
       // build bodyParameter for 'create a connection'.
       bodyParameters = {
           ...bodyParameters,
           connection_config: { name: `self-service-sso-${Date.now()}` },
           enabled_clients: [process.env.CLIENT_ID]
       }
   } else if (action === 'edit') {
       // build bodyParameter for 'edit a connection'.
   }
   // 👆 change code

   // generate a Self-Service SSO ticket.
   const { data: ssoTicket } =
       await management.selfServiceProfiles.createSsoTicket(
           requestParameters,
           bodyParameters
       );

   res.render('dashboard', {
       title: 'Admin Dashboard',
       ticketURL: ssoTicket.ticket
   });
});
// ...existing code...
```

With this change, we can keep the existing logic for creating new connections.

### Build a bodyParameter to edit an existing connection

To edit an existing connection with the Self-Service SSO, specify `connection_id` in the `bodyParameters`. Here's the updated code:

```javascript
// routes/index.js

//...existing code...
router.post('/dashboard', requiresAuth(), async function (req, res, next) {
   // get an instance of the ManagementClient.
   const management = getManagementClient();

   // get a list of Self-Service Profiles.
   const { data: ssoProfiles } = await management.selfServiceProfiles.getAll();

   // use the 1st profile in this sample.
   const ssoProfile = ssoProfiles[0];

   const requestParameters = {
       id: ssoProfile.id
   };

   let bodyParameters = {};
   const action = req.body.action;

   if (action === 'create') {
       // build bodyParameter for 'create a connection'.
       bodyParameters = {
           ...bodyParameters,
           connection_config: { name: `self-service-sso-${Date.now()}` },
           enabled_clients: [process.env.CLIENT_ID]
       }
   } else if (action === 'edit') {

       // build bodyParameter for 'edit a connection'.
       // 👇 add code
       // get connections for the current client
       const { data: enabledConnections } = await management.clients.getEnabledConnections({
           client_id: process.env.CLIENT_ID
       });

       // filter a connection with the name and use the first item for this sample.
       const ssoConnection = enabledConnections.connections.filter(connection => {
       return connection.name.includes('self-service-sso-')
       })[0];

       // add connection_id to the bodyParameter.
       bodyParameters = {
           ...bodyParameters,
           connection_id: ssoConnection.id
       };
       // 👆 add code
   }

   // generate a Self-Service SSO ticket.
   const { data: ssoTicket } =
       await management.selfServiceProfiles.createSsoTicket(
           requestParameters,
           bodyParameters
       );

   res.render('dashboard', {
       title: 'Admin Dashboard',
       ticketURL: ssoTicket.ticket
   });
});
// ...existing code...
```

Let's see the details of the code.

### Retrieve an existing connection

We need to get the `id` of the connection we want to edit. You can use the [Get enabled connections for a client](https://auth0.com/docs/api/management/v2/clients/get-client-connections) endpoint to get a list of connections for the current Auth0 Application and filter the list with condition(s).

```javascript  
// get connections for the current client
const { data: enabledConnections } = await management.clients.getEnabledConnections({
   client_id: process.env.CLIENT_ID
});

// filter a connection with the name and use the first item for this sample.
const ssoConnection = enabledConnections.connections.filter(connection => {
   return connection.name.includes('self-service-sso-')
})[0];
```

`management.clients.getEnabledConnections()` method retrieves a list of connections for a specified Auth0 client (application). Because we created a Self-Service SSO connection with a naming convention in the previous post, we can apply a `filter`  to the list with the following condition:

- The name of the connection includes `self-service-sso-`.

This blog post assumes the first connection that matches the condition is appropriate.

> If you are using [Auth0 Organizations](https://auth0.com/docs/manage-users/organizations), you can use the [Get connections enabled for an organization](https://auth0.com/docs/api/management/v2/organizations/get-enabled-connections) endpoint instead. The `auth0-node` [supports](https://auth0.github.io/node-auth0/classes/management.OrganizationsManager.html#getEnabledConnections) this endpoint, too. Make sure the machine-to-machine application has `read:organization_connections` permission for the Auth0 Management API access. In another post, I will cover the combination of Self-Service SSO and Auth0 Organizations.

### Set connection_id in the bodyParameter

The final step is to set the `connection_id` value in the bodyParameter

```javascript
 // add connection_id to the bodyParameter.
 bodyParameters = {
   ...bodyParameters,
   connection_id: ssoConnection.id
 };
```

That's all. Now, everything is set to create a Self-Service SSO Ticket to edit an existing connection. We can keep using existing code to generate a ticket:

```javascript
 // generate a Self-Service SSO ticket
 const ssoTicket = await management.selfServiceProfiles.createSsoTicket(
   requestParameters,
   bodyParameters
 );
```

## Let’s See It in Action!

When you click the `Edit SSO Connection` button on the dashboard page, you will see the following page with another button that opens the URL of the generated ticket.

![Application dashboard showing a 'Click here to Configure SSO' button, which appears after the self-service SSO ticket has been generated.](https://images.ctfassets.net/23aumh6u8s0i/7EiN9VIyZ49VfY5O9EqUIV/5062b95e568a4971e9ba13389858f4d6/Self_Service_SSO_-_continue.png)

When you click the button, the browser opens a new tab with the SSO setup assistant page and the current connection settings. Customer admins can change settings here.

![The Auth0 self-service SSO setup assistant, pre-filled with existing Google Workspace connection data for editing.](https://images.ctfassets.net/23aumh6u8s0i/6gc8xwfpP0rpVYFy1lVh61/c4b4c3b107973812ef761299672490a3/Edit_SSO_connection_-_Google.png)

## Conclusion

In this post, you learned how to:

- Update the application to generate a Self-Service SSO ticket for an existing connection.

With the creation and editing capabilities of Self-Service SSO, you can provide a delegate administration feature in your SaaS. In the following posts, I will cover the details of the Self-Service profile and using this feature with Auth0 Organizations for a B2B SaaS scenario.

## Try with SaaStart: Next.js B2B SaaS Reference Application

Auth0 provides features for building a B2B SaaS application. In this post, I used Node.js/Express to showcase one of its features. If you are considering building a B2B SaaS in Next.js, try [SaaStart](https://a0.to/saastart). The app provides reference implementations of necessary features for B2B SaaS, such as multi-tenancy, login options for enterprise users, security policies, and more.

[Explore the SaaStart App](https://a0.to/saastart)   
Deploy locally using the [SaaStart GitHub repo](https://a0.to/saas-code)

Unlock Enterprise Readiness: How to Edit Existing Connections with Self-Service SSO in your SaaS App

In this blog, we will add a capability to add Self-service SSO capability to your SaaS application.

Unlock Enterprise Readiness: How to Add Self-Service SSO to Your SaaS App

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Self-Service Single Sign-On (SSO) reaches General Availability (GA) status

As Independent Software Vendors (ISVs) quickly learn, in addition to building the core functionality of your software-as-a-service (SaaS) apps, you must also provide features that support your business customers’ administration, integration, and security needs.

One of the most challenging features to implement is Single Sign-On (SSO) due to the many competing standards and protocols available. Plus, merely supporting SSO is only one piece of the puzzle — it also has to get deployed:

* **From the perspective of each of your business customers**, setting up SSO for each and every app they’ve adopted can be a tedious process, often involving lots of back and forth with your customer service reps — and perhaps even your developers
* **For you as an ISV**, helping each and every business customer set up SSO for your app is just as tedious and time-consuming

Both parties benefit from a quick and simple deployment approach, which is why we’re excited to announce that our Self-Service SSO feature has reached General Availability (GA) status.

## SSO Is an Enterprise Imperative

Due to its associated benefits, Single Sign-On (SSO) — an Identity solution that allows multiple applications to use the same authenticated session — is an essential element of modern Identity and Access Management (IAM). SSO is so important, in fact, that it’s a foundational element of [the emerging Interoperability Profile for Secure Identity in the Enterprise (IPSIE) security standard](https://www.okta.com/blog/2024/10/oktane-2024-the-future-of-identity-security/).

On top of providing a convenient user experience, SSO dramatically reduces the number of credentials in use and helps to ensure that security policies are consistently applied across all of an organization’s applications, since the policies can be enforced at an organization’s Identity Provider (IdP).

Now that Identity has emerged as the primary enterprise security entry point, and with [organizations deploying more apps than ever before](https://www.okta.com/businesses-at-work/), SSO is needed more than ever.

### Simplifying SSO configuration saves time, reduces errors, and manages information risk

Self-service SSO refers to a flow that allows your business customers to set up and edit SSO connections themselves.

This capability delivers several valuable benefits, including:

* **Saving time for everyone:** Building Identity solutions isn’t your core business, and any time spent doing so pulls your team from product extension and innovation. With Self-Service SSO, your developers can focus more on your product instead of SSO integrations.
* **Reducing the potential for errors:** Manually configuring SSO introduces the risk of errors that impede productivity and undermine security. Self-Service SSO keeps manual tasks to a bare minimum.
* **Eliminating the need to share sensitive information:** Configuring SSO often requires the ISV and the business customer to share sensitive information (e.g., client IDs, SAML certificates, etc.), but Self-Service SSO eliminates these exchanges.

## How Self-Service SSO Works

Self-Service SSO requires minimal configuration in your Auth0 tenant and provides your customers with a setup assistant that guides them through the enablement process. After a customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

Diving a little more deeply, Self-Service SSO uses three components to delegate setup to your customers:

* **Self-Service profile:** Defines key elements of customer SSO implementations, such as the IdPs they can use for SSO and which user attributes they must capture (e.g., email address)
* **Self-Service access ticket:** Grants customer admins access to the SSO setup assistant and sets specific details for their resulting SSO integration
* **SSO setup assistant:** A Self-Service Wizard that guides customer admins through the SSO setup process — enabling your business customers’ administrators to create, edit, and test SSO connections

You also benefit from additional **observability** features, including new tenant logs to monitor ticket consumption and the creation and enablement of connections; you can monitor logs to promptly initiate any tasks once the connection has been created.

At a high level, the Self-Service SSO workflow includes the following tasks:

1. You (the Auth0 by Okta customer) create a self-service profile in your tenant using the Auth0 Dashboard or the Management API.
2. Next, you use the Management API to create a self-service access ticket that allows customer admins to configure SSO.
3. You retrieve the ticket URL from the asset created in Step 2 and send this link to your customer admin.
4. Your customer admin launches the SSO setup assistant and follows the steps provided to create an application with their identity provider.
5. After the customer completes their setup, the SSO integration is automatically added to your tenant as an [Enterprise connection](https://auth0.com/docs/authenticate/enterprise-connections).

<include src="Vidyard" id="UPTUao1LfxdMLrnD38Gsxc" />

## Getting Started

As enterprises continue to adopt best-of-breed tools, IT and security leaders will increase their focus on access management strategies, like SSO, that can simultaneously support productivity and contribute to a strong security posture.

Whether you include SSO within your base product or offer it as a premium add-on, Self-Service SSO enhances your overall value proposition.

By empowering your customers to configure their own SSO integrations with your app, you can streamline your onboarding process and grant them more autonomy over their sign-on experience — while reducing the time and costs associated with managing SSO across your customer base.

**If you’d like to learn more about this new feature**, we invite you to peruse [the Self-Service Single Sign-On documentation](https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO).

**Want to launch a B2B SaaS application quickly?** Check out our reference application, [SaaStart,](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/), a complete, working example of how to implement SaaS Identity with Auth0, built with the most popular frameworks developers use today. You can gain hands-on experience on Self-Service SSO and other essential CIAM features and quickly deploy a sample Auth0 template directly within the SaaStart [repo](https://github.com/auth0-developer-hub/auth0-b2b-saas-starter) or from [our new integration](https://vercel.com/integrations/auth0) in the Vercel marketplace.


Empower Your Enterprise Customers to Set up Their Own SSO Implementations

auth0_by_okta_hero copy

Auth0 Team

Offering expanded access and optionality for self-service plans and features

**TLDR**: 
Self-service customers have access to Auth0 capabilities that previously required a call with sales. Effective immediately: (1) customers can now upgrade to our B2B Professional Plan directly through the dashboard, (2) the Enterprise Connection limit in the B2B Pro plan has been increased from 3 to 5, and (3) Pro plans customers can now add a single Enterprise MFA factor (called 'Enterprise MFA Lite') via self-service.

In November 2023, we introduced [updated self-service plans and pricing](https://auth0.com/blog/upcoming-pricing-changes-for-the-customer-identity-cloud/) to scale with our customers. As a continuation of this work and based on your feedback, we now offer self-service customers easier access to plans and capabilities that previously required a discussion with sales.

### Here’s what’s new, effective May 2024:

* You can now choose our [B2B Professional Plan](https://auth0.com/pricing) using your dashboard! The B2B Pro Plan includes: 
    * 5,000 M2M Authentications (more available as add-ons)
    * M2M Add-on
    * External Database
    * Cross App SSO
    * 5 Enterprise Connections (increased from 3)
    * 100 organizations
    * And other features included in the B2B Essentials plan.

    _To upgrade: [Dashboard > Settings (Subscription Tab)](https://manage.auth0.com/#/tenant/billing/subscription) > Select Plan & Quota > Click Upgrade or you can continue to purchase this plan through our Sales team._

* **5 Enterprise Connections** for the B2B Professional Plan's Enterprise Connection limits have increased from 3 connections to 5 connections via self-service. This will allow more of our SaaS customers to scale more effectively. As a reminder, there is no limit on [Okta Enterprise Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/okta) for customers on all of our B2B plans.
* **Enterprise MFA Lite** is now available through self-service for both B2C and B2B Professional. This capability was only available via a contract with Sales, but it can now be added via the dashboard.
    * Enterprise MFA Lite allows you to add either SMS, push, or voice notifications to Professional plans for an additional fee. Fees vary by the amount of MAUs; find more information on [Dashboard > Settings (Subscription Tab.)](https://manage.auth0.com/#/tenant/billing/subscription)
    * This includes the support of push, [SMS, and voice notifications](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa), (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. 

### MFA Offerings Explained

MFA ([Multi-Factor Authentication](https://auth0.com/blog/multifactor-authentication-mfa/)) provides a method to verify a user's identity by requiring them to provide more than one piece of identifying information. For example, **something you know**: a password, PIN, or security question, **something you have**: a smartphone, security token, or smart card, or **something you are**: your fingerprint, face scan, or voice pattern.

Some of our MFA offerings include: 

* **Pro MFA** &mdash; included in B2C Professional, B2B Essentials, B2B Professional, and Enterprise plans 
* **Enterprise MFA Lite Add-on** &mdash; an add-on for B2B and B2C Professional plans and Enterprise plans
* **Enterprise MFA** &mdash; included in our Enterprise Plans 

![Pro Plan Improvements for Self-Service Customers - May 2024](https://images.ctfassets.net/23aumh6u8s0i/sTrHbEBf42kTVlbfp6mRt/2459de4604259c2031a9808dd2111efa/MFA_Table.png)

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <b> Please note that upgrading to B2B Professional and adding Enterprise MFA Lite to B2B and B2C Professional plans will incur additional fees. Visit our <a href="https://auth0.com/pricing">pricing page</a> for more information.</b><br> 
</div>

### Which MFA factor(s) are best for my product?

Choosing the right [MFA factor](https://auth0.com/docs/secure/multi-factor-authentication#mfa-factors) is all about striking a balance between security and user experience. Consider the sensitivity of the accounts you're protecting, the technical comfort level of your users, and the accessibility of the MFA factor across different devices. 

![Not All MFA is Created Equal](https://images.ctfassets.net/23aumh6u8s0i/5TgjqFrUJwTDkldGCqov7o/6d80ca9d9c0d29faebea01578a02e0b6/Not_All_MFA_is_Created_Equal.png "Not All MFA is Created Equal")
<p align="center"><i>From blog post: <a href="https://auth0.com/blog/not-all-mfa-is-created-equal/">Not All MFA is Created Equal</a></i></p>

<p align="left"</p>
To help evaluate our MFA offerings, visit this [blog post](https://auth0.com/blog/not-all-mfa-is-created-equal/) to learn about your options and for more details on factor types and authentication assurance levels, check out [this datasheet](https://www.okta.com/resources/datasheet-factor-assurance/).

### Have more questions about your plan or our MFA offerings?

We’re here to help! If you’re on a paid plan, our [Support team](https://support.auth0.com/) can help, and if you’re on a free plan, you can post in our [Community forum](https://community.auth0.com/). Thanks for being a valued customer. We hope this allows for more flexibility and optionality during your auth journey. Happy authenticating!

Pro Plan Improvements for Self-Service Customers - May 2024

Abbie Carlson

As a Product Marketing Manager, I'm responsible for communicating the value of Identity for consumer apps as well as focusing on the developer experience. I'm forever curious about how Identity plays a role in our everyday lives as consumers and how a great Customer Identity solution can make or break a business through patron loyalty and retention. 

Outside of work can catch me watching Seattle sports, going to as many concerts as I can or listening to true crime podcasts.

Senior Product Marketing Manager

Introducing updated self-service plans and pricing that scale with your company

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
  <strong>UPDATE:</strong><br> 
  This information was modified on December 11th, 2023. The new plans and feature offerings are now universally available for everyone.<br> 
</div>

We're excited to share with you our updated and revamped plan offerings for Auth0, which powers Okta Customer Identity Cloud.

Effective November 1st, 2023 we launched changes to our plan offerings and pricing structure. Changes listed below:

* **Our free plan now supports up to 7,500 MAUs vs the previous 7,000.**
    * More than 65,000 active tenants enjoy this plan today.
    * Our always-free plan continues to offer social login, DB connection for securely storing identity information, branded login, extensibility and security capabilities (brute force and suspicious IP throttling), and support for 5 regions (US, UK, EU, JP, AUS). 
    * We also recently added [passkeys support](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/) to the free plan.
* Our pricing structure has been updated to more predictably scale as you grow:
    * B2C Essentials pricing now starts at $35/Mo for 500 Monthly Active Users (MAUs)
    * B2B Essentials pricing now starts at $150/Mo for 500 MAUs
    * You can now purchase 20,000 MAUs on B2C Essentials with your credit card.
* [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard), a new feature that aggregates usage across all tenants for seamless oversight that includes updated tenant limits with the ability to consolidate tenants.
* The below capabilities that can be added to your plan through our “[Let’s Chat](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales)” form. You will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024:
    * New multi-factor authentication (MFA) add-ons, expanding access to MFA capabilities that were previously only available to enterprise customers.
    * Increased enterprise connection limits on the B2B Professional Plan.
    * We have increased our maximum MAU tier limit on our self-service plans.

> It’s important to note that we are not making changes to any existing plans as a result of this update. However, if you make changes to your subscription, the new plan and pricing structure will be applied.

## Pricing & Payment Updates

We last updated our Essentials and Professional plan pricing in May of 2021. With the above changes the following pricing updates became effective on November 1st, 2023. **Keep in mind, this only applies to new sign ups and any subscription changes.**

* B2C Essentials pricing will now start at $35/Mo for 500 MAU, up from $23/mo for 1,000 MAU. 
* B2B Essentials prices will now start at $150/Mo up from $130/Mo for 500 MAU
* B2C Professional prices will stay the same, starting at $240/Mo for 1,000 MAU
* B2B Professional will now only be available by invoice, via our sales team, rather than credit card. 

The price adjustment on B2C Essentials creates increased transparency and price predictability as your MAUs scale on our platform, reducing the risk of customers who grow from B2C Essentials into higher plans being shocked by a price change. While the scaling rate of B2C Essentials is increasing, we’re committed to enabling customers to stay on their chosen plan for longer by making it possible to remain on a self-service plan when surpassing the previous MAU limit of 10,000.

In addition to the above plans, check out the [Auth0 for Startups program](https://auth0.com/startups), our [Auth0 for Non-Profits](https://auth0.com/nonprofits) offers, as well as our always-free plan.

### Payment options

With the above changes, we are committed and will continue to support customers that want to pay us monthly through their credit cards on plan tiers that previously supported this functionality. We will now also allow customers with a yearly spend over $10,000 to contact our sales team to purchase an annual contract paid via invoice. 

Keep in mind, any new tenants created will be subject to the new pricing structure outlined above.

![Payment options](https://images.ctfassets.net/23aumh6u8s0i/7trs7tiGY0Ea5rQ2GmU0D3/952fb21eac9f2306c58d1a3e1bb4a14a/pricing-02.jpg)

`*` Can only be purchased by contacting our Sales team directly or via the ["Contact Sales"](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) form. Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.<br> 
`**` Previously, each tenant was a separate subscription, so only one tenant of any type was allowed per plan.

## Introducing Auth0 Teams:

We understand at times it’s difficult to manage resource access, keep track of and juggle multiple tenants. Auth0 Teams aggregates usage across all tenants for seamless oversight. The addition of this feature will enable the management of administrators and multiple tenants from a single, centralized location.

### Increased tenant limits

Tenant limits are being increased as part of this update.

These new limits will be displayed on both our [pricing page](https://auth0.com/pricing) and in your tenant’s [subscription settings](https://manage.auth0.com/#/tenant/billing/subscription). 

![Increased tenant limits](https://images.ctfassets.net/23aumh6u8s0i/6c62XnCJPnWmP72v55PIlY/f33f1ad5bf8c52375a25c92f74bd73db/pricing-01.jpg)

**With the launch of Auth0 Teams, you can now link existing tenants together under one account. It’s important to note that:**

* The owner of a team and/or the admin on the tenant are the only individuals that can group tenants.
* Tenants cannot be unlinked without the assistance of Auth0 Customer Support. If you linked a tenant and need to unlink it, please contact Support by submitting a ticket in the [Auth0 Support Center.](https://support.auth0.com/)

> Keep in mind, if you choose to stay on your current plan, you will be allowed a single tenant.

### How is this different than current Auth0 offerings?

As a part of this pricing change, customers will have the opportunity to link multiple tenants to the same subscription. Usage will be aggregated across tenants and will be billed at the subscription level. This allows customers with development and staging tenants to have access to the same features within said tenants, without having to purchase additional subscriptions. Along with these changes, we’re also introducing official tenant limits that align with the positioning of our various offerings. 

### Steps on how to migrate to Auth0 Teams

Information about this process can be [found here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams). If you want to migrate to Auth0 Teams, you must upgrade your plan in your tenant’s[ subscription settings](https://manage.auth0.com/#/tenant/billing/subscription) to have Teams automatically enabled for you.

## Additional Feature Offerings:

### Enterprise MFA Add-ons:

Multi-factor authentication ([MFA](https://auth0.com/docs/secure/multi-factor-authentication)) can block 99.9% of account hacking attacks. So, without being too obvious, implementing MFA within your Identity solution is pretty important. It’s imperative to prevent credential based attacks, and we want to make this easier for our customers to have access to this security feature. And so we’re introducing** Enterprise MFA Lite.**

Auth0 now allows you to use additional MFA capabilities that were previously only available to enterprise customers. Enterprise MFA Lite allows you to add any MFA factor to [Professional Plans](https://auth0.com/pricing) for an additional fee. This includes the support of [SMS](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors/configure-sms-voice-notifications-mfa) and push & voice notifications (SMS charges for MFA are charged separately by carriers supported by Auth0). Under Enterprise MFA Lite, subscriptions will be limited to one MFA factor on the subscription. However, this enhancement will give broader access to additional MFA protocols to support a wider range of use cases. 

### Enterprise Connection Limits:

**[Enterprise Connection](https://auth0.com/docs/authenticate/enterprise-connections)** limits are increasing from three connections to five connections on the B2B Professional Plan. This will allow for more of our SaaS customers to scale better. As a reminder, there is no limit on Okta Enterprise Connections for customers on all of our B2B plans. 

### Monthly Active Users (MAU) Tiers:

We are introducing [Essential](https://auth0.com/pricing) and [Professional](https://auth0.com/pricing) MAU tiers above the previous 7,000 and 10,000 MAU limits on B2B and B2C Plans, respectively. This change will allow you to better evaluate cost as you anticipate scaling on the Auth0 platform. 

Again, if you would like to take advantage of these options, please contact our team by completing this [form](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales). Please note you will need to move to a new plan with a yearly spend of $10,000 or more to take advantage of these options but we plan to include these add-ons via our self service plans (with a lower minimum) in the first half of 2024.

If you have further questions, please reach out to the [Auth0 Community](https://community.auth0.com/) (free plans) or submit a ticket in the[ Auth0 Support Center](https://support.auth0.com/) (paid plans).

## FAQs

* **Will the free plan still be available after November 1st, 2023?**
    * Yes, the free plan will continue to be available.
* **What’s the benefit of grouping tenants?**
    * All of your tenants can be managed in one place.
    * Entitlements, usage, etc. will be viewed together.
    * Increased security.
* **What is an Auth0 Team?**
    * Provides a single point of visibility and control over your Auth0 resources by providing centralized governance, compliance, and secure collaboration at scale. More information about Auth0 Teams can be found [here](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard). 
* **What if my tenants are already grouped?**
    * Nothing changes unless you make changes to your subscription.
    * If you make changes to your current plan, you will need to regroup your tenants since the plan structure differs.
* **What if I have multiple plans?**
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).
* **What if my company is a development agency (dev shop)?**
    * Contact [Support](https://support.auth0.com/) to request an exemption. 
* **Can I stay on my current plan?**
    * Yes, assuming you are using one tenant and are within your usage limits you can stay on your current plan.
    * We will provide you with at least 90-days notice if we decide to move existing customers that are within their usage limits to the new plan structure.
* **Where can I find the new Terms of Service?**
    * Our updated Terms of Service can be found [here.](https://www.okta.com/auth0-pss-self-service/)
* **I’m on an enterprise plan and I have a self service tenant(s) as well. Do I have to move those to my enterprise plan?**
    * Yes, and it will be more beneficial for you to manage all tenants under a single account that has enterprise capabilities.
* **Can I pay by invoice now rather than credit card?**
    * Yes, for plans above $10,000/year you can sign a contract and pay by invoice rather than by credit card. To take advantage of this, please [contact us](https://auth0.com/contact-us).
* **What happens if I have more than 7 admins?**
    * New plans released on November 1st will only get up to 7 admins.
* **Can I get more than 10K MAUs on a self service plan?**
    * Yes, we now include MAU tiers beyond 10K MAU
* **Which MFA factors can be used with the Enterprise MFA add-on on professional plans?**

* **✅ Included**
    * SMS Notifications
    * Push Notifications
    * Voice Notifications
* **❌ Not Included**
    * WebAuthn with security keys
    * WebAuthn with device biometrics
    * Email Notifications

Pricing Changes for Auth0

Peter-Wheeler-author

Peter leads marketing, community, and customer engagements at Auth0.org. 
With a visceral passion for effective and sustainable Corporate Social Responsibility, Peter develops non-performative programs and engagements for social impact organizations globally. He believes all organizations deserve the opportunity to use technology as a force for good and provide solutions and support to help heroes save the world. Peter prides himself on being a polymath, entrepreneur, innovator, founder, proud failpreneur, strategic marketer, process improver, and sales enabler driving positive impact. Say hi on <a href="https://www.linkedin.com/in/jpeterwheeler/">LinkedIn</a>.



Senior Marketing Manager, Social Impact

Peter Wheeler

Reflections on Product Impact and improving our Self Service process

This entry is a celebration of the launch of our new workflow for Social Impact Organization customers who want our Self Service products.

But the topic I want to cover is a little more universal and a little more important for the team here – providing the best care we can for those who care for others.

**TL;DR:** This being a long post about shortening a process is not a joke lost on me. If you want to experience the new validation process without reading this, visit https://auth0.org/get-started.

## Our Destination Is Product Impact

This past November, I was delighted to make the announcement that we were extending our cost-savings offer for nonprofits and social impact organizations to also include 50% off on Self Service plans.

This was not a small undertaking. We had multiple platforms to access: to verify the organization’s eligibility, adjust their pricing, document, and ensure the account launched properly. 

We, of course, iterated and improved regularly – something that Auth0 is known for. What we also did is take our instantaneous Self Service onboarding process and create a time to live of up to one month, averaging 22 days - something we don’t want to be known for.

## What Was a Beautiful Customer Journey?

We launched with a process that takes up to a month, and with so many steps, we needed to publish a guide explaining how to get the offer. But we launched.

Making sure social impact organizations could get the product discounted is important to us – but we sacrificed speed and simplicity to get our launch. 

It’s easy to excuse. In an enterprise environment, diligence is life. There are features and pricing tiers and stakeholders to involve. Talking to someone - sales, an engineer, support - that’s part of the process. Our customers receive white-glove treatment, and it’s perfectly fine to introduce that to a select group of our Self Service customers.

As a marketer, an entrepreneur, and a customer, it wasn’t OK. A lot of what I love about Auth0 self-service is that it is product led. We have free plans for everyone. It’s totally DIY, and we provide documentation and plugins, and support to keep it that way. I should be able to add authentication to my project while I tinker at 2 am – or whenever I have time, not wait on a multitude of processes.

## Getting Back on the Right Path

Because I wanted to, and because we had so many steps, I have spent my time here personally onboarding every self-service social impact customer that came to Auth0. I have met some amazing people who work for inspiring organizations. We’ve shared and continue to share these stories through case studies and posts about these organizations, like [NCBI](https://auth0.com/blog/social-impact-innovations-national-council-for-the-blind-ireland/) and [Every.org](https://auth0.com/resources/whitepapers/case-study-everydotorg). 

Even though I love it, this method is not sustainable as we grow. So many customers, so few working hours.

Beyond what they’re working on, our very patient and very open social impact customers clued me into their frustrations with our onboarding and other elements of the process that made their experience different and less than the process for-profit customers enjoy.

## A New Companion for the Journey

To make sure we’re giving the cost savings to organizations that fall within our eligibility criteria, that don’t take part in hate speech, that is who they say there are - we rely on third-party agencies. These agencies are known as “validators.” When I entered this space, I learned validation platforms operate reactively - meaning a nonprofit or charity can already be a member or indexed by the system - making approval easy, and if they weren’t already in the system, applying would initiate a process to get them verified and validated. This takes time, and even in the case of “easy, already in the system,” validation was still a manual process for us, the customer, and the verification organization. 

I started exploring the corporate social impact ecosystem, and another companion on our journey, Mitch Stein ([CEO of pond](https://www.joinpond.com/), a great marketplace, and a different upcoming post), let me know of a set of entrepreneurs pivoting their social impact app into a validations-and-beyond company, [Percent](https://poweredbypercent.com/).

I met with team Percent, and their platform used a proactively filled database - pre-validating organizations at a rapid pace to eradicate future wait time. They were also able to check a box that I thought couldn’t be - they were able to add automation to the process to get customers to the “next steps” while keeping it all Auth0 - eliminating the need for a separate guide.

Less than one month of integration, building, and testing later (thank you, Flor and the ever-so-patient Auth0 Marketing Engineering Team) - we’re live!

## Welcome to Our Emerald City

So here we are. We are launching again. An updated version and an updated process. A better customer experience for the nonprofit organizations we cherish.

If you’re a nonprofit that is listed with [TechSoup](https://app.ngok.techsoup.org/Default.aspx?vendorAppId=07ae4c97-f7a0-4c2e-bd1a-9480e0d971bd) - feel free to continue to validate [here](https://app.ngok.techsoup.org/Default.aspx?vendorAppId=07ae4c97-f7a0-4c2e-bd1a-9480e0d971bd). 

If you’re one of the nonprofit organizations that may not be with TechSoup, visit [https://auth0.org/get-started](https://auth0.org/get-started) and enjoy our new validation system powered by [Percent](https://wearepercent.com/).

If you read this far, that’s where we’re at on our product impact journey as we continue to explore and improve our customer journey. Thank you for following along, and never hesitate to reach out.

Peter

"self-service"