03 / Enterprise SaaS
Auth0.
Acquired by Okta, $6.5B
The problem
Auth0 had been built for startups, where one developer owned one account and that was enough. As the company grew into the enterprise market, larger customers arrived with security teams, platform teams and several environments to look after. The dashboard still assumed a single person at the keyboard, making every change alone.
That mismatch showed up fast. Enterprise buyers wanted to invite colleagues, decide who could change what, and require the same sign-in rules for everyone. None of it existed in the product. Without it, security reviewers had a reason to say no, and sales had no answer. The work was also tied to revenue from the start, so the cost of getting it wrong was high.
The approach
I worked as both designer and researcher on a small enterprise team, so what we heard from customers went straight into the screens.
- 01
Listening to enterprise buyers
I started by sitting in on conversations with enterprise customers and the people who sold to them. The same three questions kept coming up: who can see this, who can change it, and can we force our own sign-in. I wrote those down as the brief and used them to cut every idea that did not answer one of them.
- 02
Defining the roles
I conceptualized the company's first RBAC system. The hard part was granularity. Too few roles and a security lead could not grant read-only access to logs. Too many and nobody would set them up. I settled on a short list with plain descriptions, and let one dialog apply roles to several tenants at once.
Assigning roles across tenants. - 03
Team Activity
Once a team had many members, owners needed to see who had joined and what they could reach. I designed Team Activity as a time-ordered feed with a member panel beside it listing that person's role in each tenant. Answering the access question took one click, not a trip through settings.
Team Activity. - 04
Team-level SSO settings
SSO had to feel like a team decision, not a per-user toggle. I put one switch at the top of a Security tab to enforce SSO for all members, and listed the supported providers as cards underneath. Each card shows its own state, so an admin can see at a glance what is on.
Team-level SSO settings. - 05
Configuring a provider
Setting up an identity provider means copying values between two systems, and that is where admins get lost. I split the form into what Auth0 gives you, with copy buttons, and what you bring back from your provider. Both halves sit on one screen, with a clear status at the top.
Configuring an SSO provider. - 06
Mapping the MFA flows
Team-level MFA raised the question of what happens when an admin loses a phone. I drew the flows before any screens: enrolling several factors, prompting for backup methods, issuing a recovery code, and a route to a person when everything else fails. Engineering and security reviewed these first, so the edge cases were agreed early.
Admin flow: set up MFA.
The solution
The result was a set of enterprise features that sat on top of the existing dashboard. Teams had accounts with invited members. Owners assigned roles per tenant from one dialog and watched membership change in Team Activity. Security settings applied to the whole team, including enforced SSO with a choice of providers and MFA with recovery paths.
The idea that held it together was treating access as something an owner could read at a glance. Roles had short descriptions in plain language, each member's reach was visible in one panel, and each security setting showed its state on the card it belonged to. That kept a large permission model from feeling like a form to fill in.
What I delivered
- Team accounts and Team Activity feed
- First role-based access control system for the company
- Multi-tenant role assignment dialog
- Team-level SSO settings and provider configuration
- Admin MFA enrollment, authentication and recovery flows
- Connected prototype board for the enterprise flows
Value added
For people using it
Account owners could invite colleagues, give each person only the access they needed and see who had joined. Admins set up SSO from one screen and had recovery routes if they lost an MFA device.
For the business
Enterprise buyers had been asking for team accounts, roles and enforced SSO. Shipping them gave sales a direct answer to security reviews and removed a common reason for deals to stall.
For the team
The role model and the flow diagrams gave engineering and product one shared reference. Decisions about edge cases such as lost devices were settled on paper before build, which cut back-and-forth later.
The result
Sales grew 300% in the first quarter after launch, and four to five enterprise customers converted each week. Okta has since acquired Auth0 for $6.5B.
Results
- 300%sales growth in the first quarter after launch
- 4–5enterprise customers converting each week
- $6.5Bwhat Okta paid to acquire Auth0
What I took from it
Writing the flows for the worst day, an admin locked out of their own account, shaped the screens more than the happy path did. On the next permissions project I would draw the recovery routes before the settings pages.