> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Grant Per-Application Access to an Organization

> Enable per-application access for an Organization to control which applications members can log in to using the Auth0 Dashboard or Management API.

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Grant Per-Application Access" stage="ea" plans="B2C Professional, B2B Professional, and Enterprise" terms="true" />

Auth0 allows you to grant applications access to an Organization to control which applications members of that Organization can log in to. By default, Organizations use an implicit access model in which members can access any application that has:

* enabled Auth0 Organizations
* a configured active connection

When you enable per-application access for an Organization, only applications you explicitly allow are accessible to its members.

You configure per-application access per Organization. When you enable it for one Organization, other Organizations in your tenant are not affected.

<Card title="Before you start">
  To configure per-application access:

  * Your Management API token must have the following scopes: `update:organizations` and `create:organization_clients`.
  * Your application must have [Organizations enabled](/docs/manage-users/organizations/configure-organizations/define-organization-behavior).
  * Configure your application to use `authorization_code` or `implicit` grant types. Applications without these grant types can be associated with an Organization but the Member Access setting has no effect on login.
  * For Early Access, each Organization supports up to 100 user-facing application associations.
</Card>

## Enable per-application access

When you enable per-application access for an Organization, you switch the Organization from implicit to explicit access enforcement. Members can only log in to applications you have explicitly granted access to.

You can pre-configure application grants before enabling enforcement. Auth0 stores grants you add while per-application access is off, and they take effect when you turn it on.

When per-application access is enabled, Auth0 blocks first-party applications without an explicit grant. Third-party applications without an explicit grant continue to follow the Organization's [third-party application access](/docs/manage-users/organizations/configure-organizations/enable-third-party-application-access) policy. To override the policy for a specific third-party application, add it to the list and set its **Member Access** directly.

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to [Auth0 Dashboard > Organizations](https://manage.auth0.com/#/organizations) and select the Organization.
    2. Select the **Applications** tab.
    3. Enable the **Per-Application Access** toggle.
    4. Select **Save**.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` request to the [Update an Organization](/docs/api/management/v2/organizations/patch-organizations-by-id) endpoint with `is_app_entitlement_active` set to `true`.

    ```bash cURL wrap lines theme={null}
    curl --request PATCH \
      --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID' \
      --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
      --header 'Content-Type: application/json' \
      --data '{
        "is_app_entitlement_active": true
      }'
    ```

    | **Parameter**               | **Description**                                                                                                              |
    | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
    | `is_app_entitlement_active` | Controls if explicit per-application access is enforced for this Organization. Set to `true` to enable. Defaults to `false`. |
  </Tab>
</Tabs>

## Grant access to an application

When you add an application to an Organization, you control if members can log in through that application with the Member Access setting.

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to [Auth0 Dashboard > Organizations](https://manage.auth0.com/#/organizations) and select the Organization.
    2. Select the **Applications** tab.
    3. Select **+ Add Application**.
    4. Search for and select the application.
    5. Enable **Member Access** to allow Organization members to log in through this application.
    6. Select **Save**.

    To update member access for an existing application association, toggle **Member Access** on or off in the applications table and select **Save**.

    Check the **Authentication** column to determine whether the application supports user-based login. If an application's grant types do not include `authorization_code` or `implicit`, Authentication shows **Not applicable** and the Member Access toggle is disabled. To enable member access for that application, update its [grant types](/docs/get-started/applications/application-grant-types) in the application's settings.

    Third-party applications (strict) can also be added and appear in the table with a **Third-party** label. Adding a third-party application and setting **Member Access** overrides the Organization's **Third-Party Application Access** policy for that specific application.
  </Tab>

  <Tab title="Management API">
    Make a `POST` request to the Create Organization Client Associations endpoint. You can add up to 10 applications per request, up to a maximum of 100 per organization.

    ```bash cURL wrap lines theme={null}
    curl --request POST \
      --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID/clients' \
      --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
      --header 'Content-Type: application/json' \
      --data '{
        "clients": [
          {
            "client_id": "YOUR_CLIENT_ID",
            "use_for_member_access": true
          }
        ]
      }'
    ```

    | **Parameter**           | **Description**                                                                                                                                                                                                            |
    | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | `client_id`             | The Client ID of the application to associate with the Organization.                                                                                                                                                       |
    | `use_for_member_access` | When `true`, Organization members can log in through this application when per-application access is enabled. Only takes effect for applications with `authorization_code` or `implicit` grant types. Defaults to `false`. |

    <Callout icon="file-lines" color="#0EA5E9" iconType="regular">
      You can associate machine-to-machine applications with an Organization and set `use_for_member_access`, but it has no effect on member login. You can pre-configure this value before converting the application to a user-facing type.
    </Callout>
  </Tab>
</Tabs>

## Revoke access to an application

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to [Auth0 Dashboard > Organizations](https://manage.auth0.com/#/organizations) and select the Organization.
    2. Select the **Applications** tab.
    3. Select the overflow menu (**...**) next to the application and select **Remove**.
  </Tab>

  <Tab title="Management API">
    Make a `DELETE` request to the Delete Organization Client Associations endpoint. You can remove up to 10 applications per request. The operation is idempotent — removing an association that does not exist does not return an error.

    ```bash cURL wrap lines theme={null}
    curl --request DELETE \
      --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID/clients' \
      --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN' \
      --header 'Content-Type: application/json' \
      --data '{
        "clients": [
          { "client_id": "YOUR_CLIENT_ID" }
        ]
      }'
    ```
  </Tab>
</Tabs>

## List an Organization's applications

Use the Management API to retrieve all applications associated with an Organization, including the member access status for each.

```bash cURL wrap lines theme={null} theme={null}
curl --request GET \
  --url 'https://YOUR_DOMAIN/api/v2/organizations/ORG_ID/clients' \
  --header 'Authorization: Bearer YOUR_MANAGEMENT_API_TOKEN'
```

The response includes each associated application and its `use_for_member_access` value. The response uses checkpoint pagination.

## Limitations

* Each Organization supports up to 100 user-facing application associations at Early Access. This limit applies to applications with `use_for_member_access` eligible types (SPA, Regular Web Application, Native). Machine-to-machine association limits are subject to change during Early Access.
* Connection-level and client-level settings cannot bypass per-application access enforcement. Third-party applications not explicitly listed in an Organization's Applications tab are not subject to per-application access enforcement — they continue to follow the organization's Third-Party Application Access policy.

## Learn more

* [Organizations overview](/docs/manage-users/organizations/organizations-overview)
* [Enable third-party application access for an organization](/docs/manage-users/organizations/configure-organizations/enable-third-party-application-access)
* [Create organizations](/docs/manage-users/organizations/configure-organizations/create-organizations)