Configure Deny All Rule for Tenant ACL - Auth0 Docs

For scenarios requiring strict traffic rejection, you can implement a Deny All rule. The Deny All configuration acts wildcard denial by rejecting, allowing, or redirecting all incoming traffic to your tenant regardless of the specific identifier used.

Configuration details

The key to the Deny All implementation is the match_all attribute. When set to true, this attribute ensures the rule bypasses specific signal matching (such as IP or geolocation) and instead applies the action to all requests targeting the specified scope.

Example configuration

The following configuration demonstrates the match_all attribute:

{
 "active": true,
 "description": "Block all traffic",
 "priority": 99,
 "rule": {
  "action": {
    "block": "true"
  },
  "scope": "tenant",
  "match_all": true
 }
}

Parameter	Description
`match_all`	Required. Must be set to `true`. Setting this to `false` is not supported for Deny All rules.
`priority`	Assign a high priority number (for example, `99`) to ensure the Deny All rule serves as the final evaluation step, allowing more specific rules with lower priority numbers to be evaluated first.
`scope`	Apply to the `tenant` scope to enforce comprehensive protection across all incoming traffic.

Tenant ACL logs

Standard logging applies to this rule just like any other Tenant ACL rule. To learn more about event logging, read the Tenant Log Event Reference.