End-of-Life Rollout for Unwarranted Session Removal After Management API User Updates

The end-of-life date for the unwarranted authentication session invalidation after Management API user updates was August 19, 2025. After this date, the deprecated behavior progressively became unavailable. The process to remove access to the deprecated behavior had the following phases:

• August 20, 2025 - Remove access for tenants tagged as development or staging tenants.
• October 6, 2025 - Remove access for outstanding tenants, including production tenants. 

The end-of-life rollout ended on November 20, 2025, and as of that date, all tenants had transitioned to the non-deprecated behavior. The corresponding migration toggle is no longer available in the Auth0 Dashboard (Tenant Settings > Advanced) as the updated behavior is now effective and permanent for all Auth0 tenants.

With the updated behavior, user update (PATCH - /api/v2/users/{id}) requests that set the email or email_verified attributes to an unchanged value, or set the email_verified attribute to true, do NOT trigger the invalidation of authenticated sessions for database connection users.

It is relevant to note that, for database connection users, update requests that change an existing email attribute to a different value or transition the email_verified attribute from true to false will continue to trigger session invalidation.

• Management API
• Users
• End of Life (EOL)

The changes mentioned above enabled consistent behavior between setting an email as verified through the Management API and the built-in email verification flows provided by the service. Additionally, it enhances the overall end-user experience by preventing session invalidation in situations that do not demand it, such as setting either the email or email_verified attributes to unchanged values.

On February 11, 2025, Auth0 announced the deprecation of the previous service behavior. The information provided in the original announcement is available in the respective Dashboard and Support Center notification.

The behavior change improves on the previous behavior, and the semantics of the user update requests will not change. Therefore, the change should be seamless and generally not require any implementation change.

However, integrations that specifically perform user update requests with unchanged values solely to trigger user session invalidation must use other methods to achieve the requirement—for example, using the user-specific session management endpoints or forcing a password change.