Use Auth0 to Restrict Access to Apps Outside of Venn’s Blue Border

You can restrict access to any applications that authenticate through Auth0 by adding custom Post Login Action logic so that they can only be used securely in Blue Border.  

For example, if your users log in to Zoom with their Auth0 credentials, you can restrict access to Zoom using with a Post Login Action.

Post Login Actions run at sign-in and again each time the application exchanges a refresh token for a new access token.

Requirements

This approach uses Auth0 Actions, which are written in JavaScript and run in the Auth0 Dashboard under Actions Flows Login. This requires custom development work — if you don’t have a developer familiar with JavaScript and the Auth0 Actions programming model, loop one in before you begin.

Auth0 Resources

Auth0 doesn’t have a dedicated “report-only” or “monitor” mode like Entra ID or Google Workspace. Because this is custom logic your developer controls, you can build a monitor-first version of the Action that logs matches instead of denying access, confirm it’s catching the right sign-ins in the tenant logs, and then update it to enforce the restriction — as described in the Approach below.

Approach

  1. Gather your PCG IP addresses.
  2. In the Auth0 Dashboard, create an Action triggered on Login / Post Login (instructions here).
  3. Have your developer write the Action’s logic so that, for the specific application(s) you want to restrict, it checks the incoming request’s IP address against your PCG IP addresses and denies the login if there’s no match.
    • Scope the check to only the application(s) you want to restrict, so the Action doesn’t affect logins to other apps in your tenant.
    • To start in a non-blocking, “monitor” state, have the Action log a message identifying the user and application any time it finds a login outside your PCG IP addresses, rather than denying access.
  4. Deploy the Action, then go to Actions Flows Login and drag it into the flow between Start and Complete, and select Apply. Because this version only logs, it won’t block any real logins.
  5. Review the log messages in Monitoring Logs in the Auth0 Dashboard over a few days to confirm the Action is correctly identifying logins from outside your PCG IP addresses for the application(s) you plan to restrict (instructions here).
  6. Once you’ve confirmed the logic is correct, have your developer update the Action to deny access instead of logging, and deploy it again to start blocking access from outside your PCG IP addresses.

Warnings

  • If Auth0 is your Venn identity provider, do not scope the Action to the application Venn uses to authenticate users, in order to avoid blocking users from being able to log in to Venn’s Workplace app.
  • This Action runs for every application that uses your Auth0 tenant’s Login flow, but only the application(s) your developer scopes it to will be restricted. Double-check the exact application name(s) or client ID(s) (found under Applications in the Auth0 Dashboard) before deploying, so you don’t accidentally restrict the wrong app.
  • If you are not using Venn’s MDM solution, have your developer exclude iOS and Android devices so that this restriction only applies to devices that users will be using Venn on (Windows and/or Mac).
  • Keep in mind that there may be use cases and exceptions that you are not aware of or there may be individuals at your organization who were not fully onboarded to Venn.
    • If possible, create a policy that only logs the access and review monitoring logs over a few days before changing the policy to deny access as outlined above to test the restriction before blocking access.
    • Always notify users before enabling restrictions in order to avoid disruption of business. Leverage the Access Lockdown email template in the Venn Rollout Toolkit to inform your users.

Tips

  • If Auth0 is set up as your Venn identity provider, consider scoping the restriction to the same set of applications and users you use to control access to Venn’s Workplace app.
  • Post Login Actions can restrict access to any application that authenticates through your Auth0 tenant. Consider setting up Auth0 SSO for key business applications so that you can improve ease of access for your users and restrict access outside of Venn’s Blue Border (instructions here).

Was this article helpful?