Self-Service SSO Ticket URLs Revert to Canonical Auth0 Domain

A platform update introducing the Multiple Custom Domains (MCD) feature causes Self-Service Single Sign-On (SSO) ticket URLs to revert to the canonical Auth0 domain. Administrators can resolve this by setting the preferred custom domain as the default in the Auth0 dashboard. The observable issue is that newly generated Self-Service SSO tickets use the canonical Auth0 domain (for example, <tenant.us.auth0.com>) instead of the previously configured custom domain.

• Auth0
• Self-Service Single Sign-On (SSO)
• Multiple Custom Domains (MCD)

A platform update rolled out the Multiple Custom Domains (MCD) feature, introducing a new default custom domain setting. During the migration of existing tenants to support this architecture, Auth0 seamlessly falls back to the canonical Auth0 domain (e.g., <tenant.us.auth0.com>) as the baseline default to ensure continuity for all backend Management API and Auth API processes. Because Auth0 generates Self-Service SSO tickets via the Management API, the tickets adopt this new baseline canonical default.

How is the default custom domain configured?

Navigate to the Auth0 dashboard and set the preferred custom domain as the default to ensure new tickets use it.

1. Navigate to Branding, and then select Custom Domains.
2. Set the preferred custom domain as the default.
3. Review the Default Domain documentation for additional configuration details.

What is the impact of changing the default domain on existing connections and tickets?

Changing the default custom domain updates the URL structure for any new Self-Service SSO tickets. Auth0 automatically uses the default custom domain for generated links and API responses when administrators do not explicitly provide a specific domain.

Changing the default domain does not impact custom connections already built by clients. Existing integrations and connections continue to function normally. Any existing or pending Self-Service SSO tickets remain valid and accessible, provided the original domain used in the ticket remains active in the Auth0 tenant.