What Changed

The Auth0 Logs (via Codeless Connector Framework) connector has been updated to v3.2.0 with multi-host support. Previously a single-tenant connector, it now supports configuring multiple Auth0 domain connections from a single connector instance, with each ingested record tagged by source domain.

Key changes:

  • DCR schema updated: Auth0Domain (string) column added to the Custom-Auth0Logs_CL stream declaration in DCR.json. Records collected before reconnection will have an empty Auth0Domain; records collected after reconnect will carry the configured domain value.
  • DCR API version bumped: from 2021-09-01-preview to 2023-04-01-preview. The dataCollectionEndpointId reference moved from a hardcoded ARM expression to the top-level dataCollectionEndpointId property using a template parameter.
  • transformKql updated: the new transform uses null-safe TimeGenerated assignment and now explicitly projects Auth0Domain through rather than using project-away. The old transform used project-away; the new one uses an explicit project with all mapped fields.
  • DataConnectorDefinition.json updated: API version bumped to 2025-07-01-preview; connector description updated; new sample query added (Auth0Logs_CL | summarize count() by Auth0Domain); UI now surfaces an Add Auth0 host flow allowing per-host Domain/Client ID/Client Secret configuration.
  • PollingConfig.json updated: restructured to support per-connection poller instances, each polling a distinct Auth0 domain endpoint.
  • table.json updated: Auth0Domain column added to the Auth0Logs_CL custom table schema.

Security Impact (Visibility and Fidelity)

Multi-tenant coverage gap closed. Organizations running more than one Auth0 environment (e.g., production and staging, or multiple business unit tenants) previously had to deploy separate connector instances or accept commingled, indistinguishable logs in Auth0Logs_CL. The new Auth0Domain field enables accurate source attribution per event.

Upgrade requires reconnection - not automatic. Upgrading the solution to 3.2.0 does not automatically reprovision the DCR or add the Auth0Domain column to existing ingestion. Affected deployments must reconnect each host via Data connectors > Auth0 Logs (via Codeless Connector Framework) > Add Auth0 host to activate the new schema and multi-host polling. Until reconnection:

  • Existing single-host ingestion continues uninterrupted.
  • Auth0Domain will be absent/empty in Auth0Logs_CL for all records.
  • Any KQL referencing Auth0Domain against pre-upgrade records will return null.

Queries referencing Auth0Domain against pre-upgrade records will return null - this is a data fidelity gap for multi-tenant environments, not a cosmetic fix. After reconnection, new records are tagged; historical records are not backfilled.

The transformKql null-safety fix for TimeGenerated is a minor fidelity improvement - records with a missing date field previously would have produced an incorrect TimeGenerated.

Affected Files

Solutions/Auth0/Data Connectors/Auth0_CCP/DCR.json
Solutions/Auth0/Data Connectors/Auth0_CCP/DataConnectorDefinition.json
Solutions/Auth0/Data Connectors/Auth0_CCP/PollingConfig.json
Solutions/Auth0/Data Connectors/Auth0_CCP/table.json
Solutions/Auth0/readme.md
(packaging artefacts: 3.2.0.zip, ReleaseNotes.md, Solution_Auth0.json, mainTemplate.json)