---
title: "Auth0 single sign-on"
url: "https://support.3rdrisk.com/en/article/auth0-single-sign-on"
language: "en"
last_updated: "2026-08-24T09:16:42.475Z"
---

# Auth0 single sign-on

Sign in to 3rdRisk with Auth0.

Auth0 can be used to sign your colleagues in to 3rdRisk, so they reach the platform from your corporate identity instead of keeping a separate password. You configure it yourself in the platform, and nothing changes for your users until you switch it on.

This article covers the Auth0 side of the setup and the one field that only Auth0 uses. Everything that applies to every provider — how the connection test works, what happens to accounts that do not exist yet, and how to switch single sign-on on — is described in the main article.

Start here for the shared steps: [Single sign-on](https://support.3rdrisk.com/en/article/single-sign-on)

## **Overview**

You create a regular web application in Auth0, copy two values out of it into 3rdRisk, paste one value back into Auth0, and add your Auth0 domain. Auth0 is the only provider that also uses the **Token URL Path** field.

**Permissions needed:** **Configuration settings** (read and update). To grant it, navigate to: Left menu: **Configuration**, then **Roles**.

**Available for:** an administrator of both systems. You need an Auth0 tenant administrator account and access to Configuration in 3rdRisk.

*Note: single sign-on does not create accounts by itself. Either the person already exists in 3rdRisk, or you fill in* ***Default roles*** *so that they are created on their first sign-in.*

## **1\. Open the SSO settings in 3rdRisk**

-   Navigate to: Left menu: **Configuration**, then **General**, then the **SSO** tab.
-   Set **SSO Provider** to **Auth0**.

The page then shows a **Redirect URI**, generated from your platform address. You need it in the next step. Leave this page open.

## **2\. Create the application in Auth0**

-   Sign in to the Auth0 Dashboard as a tenant administrator.
-   Open **Applications**, then **Applications**, then **Create Application**.
-   Enter a name, for example `3rdRisk`, choose **Regular Web Applications**, then **Create**.
-   On the application's **Settings** tab, copy the **Domain**, the **Client ID** and the **Client Secret**.
-   Still on **Settings**, under **Application URIs**, paste the **Redirect URI** from the 3rdRisk SSO page into **Allowed Callback URLs**, then **Save Changes**.

## **3\. Enter the details in 3rdRisk**

Back on the **SSO** tab, fill in:

| Field | Value |
| --- | --- |
| SSO Provider | **Auth0** |
| Client ID | **Client ID** from the application's Settings tab |
| Client Secret | **Client Secret** from the same tab |
| Base URL | your Auth0 domain as a full address, for example [`https://your-tenant.eu.auth0.com`](https://your-tenant.eu.auth0.com/) |
| Token URL Path | `/oauth/token` unless your tenant uses a different path |
| Redirect URI | generated for you — this is the value you pasted into Auth0 |
| Support Email | the address your own users should contact about sign-in problems |

**Tenant ID** is not used by Auth0. Leave it empty.

**Click** on **Save**.

## **4\. Choose how users are identified**

Under **Identity provider**, **Username Type** decides which value is matched against the account in 3rdRisk:

-   **Email address** — the default, and the right choice for most organisations.
-   **User Principal Name (UPN)** — use this only when you match on UPN deliberately.

*Note: Auth0 identifies people by e-mail address, so leave this on* ***Email address*** *unless you have a specific reason not to.*

## **5\. Enable single sign-on**

Once your settings are saved, switch **Enable SSO** on. Unlike Microsoft Entra ID, Auth0 does not require a connection test first — but running one anyway is the cheapest way to find a wrong secret or a mistyped callback URL before it affects everyone.

The test, its three possible results and the order of saving and enabling are described here: [Single sign-on](https://support.3rdrisk.com/en/article/single-sign-on)

## **Known limitations**

-   **A connection test never stores the client secret.** Save your settings before testing.
-   **The Base URL is a full address including** **`https://`**, and it is the Auth0 domain rather than a login URL.
-   **The callback URL must match exactly.** Auth0 compares it character for character, so paste it rather than retyping it.
-   **MFA is your provider's responsibility.** The MFA enforcement setting on the SSO tab is specific to Microsoft Entra ID, and **Require two-factor authentication for 3rdRisk sign-in** applies only while the provider is **3rdRisk**. With Auth0, configure the requirement in your Auth0 tenant.