Administrators receive constant emails for a deleted user account with the following subject:

We have detected suspicious logins.

This occurs because Auth0 does not support the auth0-forwarded-for header for triggering Tenant Access Control List (ACL) rules, preventing IP-based blocks from engaging. To resolve this, administrators can disable tenant-wide notifications, use log streams for custom filtering, clear persistent user blocks via the Management Application Programming Interface (API), or submit product feedback.

• Auth0
• Suspicious Login Emails
• Anomaly Detection
• Tenant Access Control List (ACL)

Auth0 does not currently support an allowlist or suppression mechanism to mute suspicious login email notifications for specific users, IP addresses, or deleted accounts. Additionally, Auth0 does not support the auth0-forwarded-for header for triggering Tenant ACL rules generally, which prevents IP-based blocks from engaging.

How do administrators disable tenant-wide notifications?

Disable admin emails for the specific Attack Protection feature tenant-wide without affecting throttling or blocking by navigating to the security dashboard and toggling the notifications setting.

1. Navigate to Dashboard.
2. Select Security, and then choose Attack Protection.
3. Select the specific feature generating the emails.
4. Navigate to Notifications and toggle the setting off.

Configure Log Streams for Custom Filtering

Forward events like limit_mu externally and filter or suppress alerts per IP or user by configuring log streams and referencing the custom notifications documentation.

1. Configure a log stream to forward events to an external logging system.
2. Filter or suppress alerts per IP or user within the external system.
3. Review the Custom Notifications for Suspicious Logins documentation for detailed configuration instructions.

How do administrators clear persistent user blocks?

Clear the block or throttle state that persists after user deletion by checking and clearing the status via the Management API user-blocks endpoints.

1. Access the Auth0 Management API.
2. Call the user-blocks endpoints to check for existing blocks on the deleted user.
3. Clear the persistent block or throttle state using the API.

Submit Product Feedback for Specific User Muting

Request the ability to mute suspicious login emails for specific users or IP addresses by submitting a feature request on the Auth0 feedback page.

1. Navigate to the Auth0 Feedback page.
2. Enter the details regarding the need to mute suspicious login emails for specific users or IP addresses.
3. Submit the feedback for review by the product team.

Related References

• Custom Notifications for Suspicious Logins