Oversized Auth0 profiles can break logins after 4 March 2027. Here's how to find yours

Auth0 now limits how much data one user profiledefinitionIt's the record Auth0 keeps on each person. Their identity provider fills in the login details, and your team can bolt its own data on top. can hold, and tenants with large profiles get until 4 March 2027 before that limit starts applying to them. Check one toggle in your Dashboard this week. If it's on, find your oversized users and move the data out before somebody's login depends on it.

Most teams will think of a failed API call first. The login is what'll hurt. Auth0 updates operational fields on a profile during a standard login, so once a profile is past the allowance, a plain sign-in is one of the operations Auth0 says may fail. The person logging in did nothing wrong. They've got a heavy record, and the first anyone hears of it is a support ticket.

Plenty of other everyday operations are on Auth0's list too: creating and updating users through the Management API, bulk imports, changes to MFA factors, metadata writes from an Action, and SCIMdefinitionA way for a company's directory to push users and groups into another system. Auth0 can then keep those groups as their own objects instead of on the profile. updates. Your provisioning job can start failing for one person at a time, which is hard to spot on a dashboard.

Your own Dashboard will tell you whether you're flagged in under a minute. The harder part is what comes next, because Auth0's warnings only fire when a profile gets updated. Someone who logs in once a year stays invisible until that one login.

Don't expect your own arithmetic to match Auth0's. The check runs on an internal representation that carries operational fields the API never shows you. Sizing the JSON from Get a User gives a fair estimate and lets you compare one profile with another, but leave yourself some headroom. Auth0 also doesn't say whether 50KB means 50,000 bytes or 51,200, so we'd work to the lower number.

The older numbers cause their own confusion. A developer on Auth0's forum wrote in 2022 that logins failed after a metadata change, having expected a 16MB allowance, and got pointed to a per-session limit in Actions. Today Auth0's Actions limits page lists 32kB each for user and app metadata persistence per session. So keep two limits apart: what one Action session can save, and what the whole profile can hold.

Start in the Dashboard. Go to Tenant Settings, then Advanced, and scroll to Migrations. If there's an Uncapped User Profile Data toggle and it's on, your tenant was flagged and has work to do. If the toggle is off or missing, Auth0 says no further action is needed. Do this for every tenant, including dev and staging, because each one is flagged on its own data.

Then find the people. You'll want more than one of the sources below, because each misses someone the others catch.

Paste this query into Monitoring, then Logs. It's the one from Auth0's migration guide: type:depnote AND description:Uncapped\ User\ Profile\ Data*. In each result, read user_id and projected_size_bytes from the details object. Auth0's sample shows both under details.feature.

example: rank users by rough size. Point this at a JSON bulk export that includes the metadata fields
sizes are estimates. Auth0 counts fields the export does not include
jq -c '{id: .user_id, bytes: (tojson | utf8bytelength)}' tenant.json \
  | jq -s 'sort_by(-.bytes) | .[:20]'

Log retention decides how much history you get. Auth0 keeps tenant logsdefinitionAuth0's running record of logins, errors and other events in your account. How far back you can look depends on your plan, and it can be as little as a day. for 1 day on Starter, 5 on the Essentials plans, 10 on Professional and 30 on Enterprise. On a smaller plan, a warning from last week may already be gone. Set up a log stream to your own tooling now and leave it running through the winter, so seasonal and monthly users get caught when they turn up.

Don't size profiles from the List or Search Users endpoints. For very large older profiles, Auth0 only indexes and returns up to 1MB per user there, and one of its support articles says a record whose combined metadata goes past 1MB may not come back from search at all. Use Get a User, or an export, to see the whole thing.

Auth0's advice comes down to two moves. Remove anything that login and authorization don't need, and put the rest somewhere else. Which fix you use depends on where the bulk came from, so open your ten largest profiles and read them before you pick.

Test the Deny ListdefinitionA per-connection list of root attributes Auth0 shouldn't store. They can still reach your login code, but they don't get saved on the profile. before you rely on it. Auth0's migration guide says denied attributes stay readable in post-login extensibility. Its Deny List page adds that they drop out of tokens in some setups, and multi-factor authentication is one of them. If an app reads one of those claims from the token, you'll want to find out in dev.

Business accounts deserve a look first. One developer asked on Auth0's forum in October for metadata on the link between a user and an organization, and Auth0 staff said it's a backlog item with no delivery date. Until that exists, we'd expect some teams to keep per-organization data in app_metadatadefinitionCustom data stored on an Auth0 user that influences access, such as a plan or a role. user_metadata is its sibling, for things like preferences. Both count as profile data. anyway. People who belong to many organizations are the ones to check early.

There's a good security reason to do this work anyway. Auth0's own documentation says metadata isn't a secure data store and should only hold what identity and access management needs. Every copy of business data you pull out of a profile is one less thing to explain to an auditor. And big metadata has hurt before: a 2017 forum thread describes a base64 profile image that saved without complaint, then broke logins when a rule ran.

We plan and run Auth0 migrations and clean-up work. For this change that means reading your largest profiles, tracing what writes to them, and moving groups or business data out before you opt out. If you're also dealing with the January change, read our post on Auth0's custom database import, and our guide to the Rules and Hooks deadlines. See our Auth0 page for how we work, bring in Auth0 engineers if you need hands on it, or book an assessment and we'll look at your tenant with you.