Tenant Access Control List - Auth0 Docs

Tenant Access Control List (ACL)

The Tenant Access Control List (ACL) manages traffic to your tenant’s resources based on rules you define. Using the Tenant ACL can help you conserve your rate limits against potential threats (like denial-of-service attacks) and ensure that only legitimate users access your applications.

How it works

Each Tenant ACL is composed of a set of rules. When your tenant or Management API receives a request, your Tenant ACL’s rules determine how it responds. The Tenant ACL’s granular configuration options let you apply rules to a variety of different signals and scopes. Some examples are:

• You can use the hostnames scope to disable or restrict access to your canonical domain while allowing traffic via custom domains.
• If you are adopting Model Context Protocols (MCP) in your tenant, you can use the Dynamic Client Registration (dynamic_client_registration) scope to avoid risks like unauthorized application registration or phishing attempts via misleading application names.

For monitoring and auditing, a tenant log event (acls_summary) is created every 10 minutes for each Tenant ACL rule with details of how that rule is affecting traffic. You can enable monitoring mode for rules to test and log how they would behave without actually applying the rule to traffic.

Limitations

• Customers on an Enterprise plan can create 1 Tenant ACL.
• Customers on an Enterprise plan with the Attack Protection add-on can create up to 10 Tenant ACLs.
• Each Tenant ACL can include up to 20 entries per source identifier (such as IPv4, CIDR, and more).
• The User Agent identifier is not supported when using self-managed custom domains.
• The auth0-fowarded-for header is not supported.