Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog


As the snow falls outside here in Switzerland creating a winter wonderland, I am filled with pride looking at the past year’s milestones.  Zitadel has grown in such exciting ways — the features that have been deployed, the product roadmap, the collaboration with our vibrant developer community, partnering with customers from every walk of life, and last but not the least, getting incredible support from our investors.  Each person, team, GitHub comment to the pull requests, Discord discussion have shaped the path to where we stand today!  A heartfelt thank-you to everyone involved.   To say I am thrilled about our next growth phase in 2025 is an understatement! 
 
As we near the last few weeks of 2024, I want to take a minute to reflect and review some of the milestones that made this year one of our best yet!

Before I get to it, I wanted to share our upcoming Discord event on the Back-Channel Logout feature.  If you want to see how it can help you manage your user sessions throughout your identity infrastructure, [register and join us in Discord on December 11th](https://discord.gg/bnuAe2RX?event=1308899625041924127) where [Livio Spring](https://www.linkedin.com/in/liviospring/), Engineer and Co-founder, Zitadel, will give a live demo.

## Zitadel in 2024: Highlights 

- We are [proud to announce](/blog/zitadel-the-future-of-identity-infrastructure) our $9 Million Series A  round of funding in collaboration with Nexus Ventures and Floodgate to advance Cloud-Native Identity Infrastructure.

- We achieved our [ISO 27001 certification](/blog/zitadel-iso-27001-certified) further reinforcing our commitment to security through this internationally recognized standard that confirms our dedication to maintaining the highest levels of security for our customers' data. 

- Zitadel has grown to serve over 150 customers this year such as Klaviyo, Open Systems, Vector Solutions,  and Kaspar&!

- [Zitadel’s Discord Community](https://discord.gg/szfmzC2M) has grown by 93% in 2024 from 1,527 to 2,953 members

- [Zitadel’s Github Repository](https://github.com/zitadel/zitadel) continues to make traction with a 57% increase to 9,100+ Github Stars and another 57% increase of individual contributors to 220+ collaborators across all the Zitadel repositories. 

- Continuing to be a remote-first team, we came together twice this year — in [Italy](/blog/team-retreat-bologna) and [Switzerland](/blog/team-retreat-zurich) — for team get-togethers and planning forward as we level up Zitadel’s future!

## Zitadel in 2024: Product

Looking over the past year we released key features that helped customers across the board in the way they manage their identity infrastructure. 

- **Performance Improvements:** We prioritized stability and scalability enhancements in 2024 to set a solid foundation for our Self-Hosted and Cloud customers.  With some of our customers deploying as many as 2.3 million tenants to manage their identity infrastructure, performance is key.  These enhancements include latency, [benchmark testing](/docs/apis/benchmarks), and reliability on services such as token endpoint and new generation APIs like the [improvedPerformance](/docs/apis/resources/feature_service_v2/feature-service-set-instance-features) field.

- **Easier Integrations:** This allows admins to set up an application in their [framework and programming language of choice](/docs/sdk-examples/introduction) quickly.  Zitadel simplifies the process for the admin’s deployment process of client applications by enabling the use of default settings!

- **Using external SAML IdPs:** This enables admins to level up using external identity providers by defining the preferred nameID format and configuring user mapping in Zitadel based on attributes received from the external IdP.  [Learn more](/docs/guides/integrate/identity-providers/mocksaml) about building using external SAML IdPs.

- **Setting up Email Providers:** This was accelerated greatly thanks to our open source community.  This feature makes it easier to configure email delivery even faster within Zitadel through SMTP provider templates.  [These templates](/docs/guides/manage/console/default-settings#smtp) offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

- **Managing OpenID Connect Signing Web Keys:** This became much easier with Zitadel taking the lead to create keys without expiry for each instance.  Now users can create, rotate, and disable signing Keys via API at your discretion as [documented here](/docs/guides/integrate/login/oidc/webkeys).

- **Organizational Metadata:** This allows developers to use the org’s metadata in the [complement token flow](/docs/apis/actions/complement-token) in Actions as well as include a user’s organization metadata into tokens that can be read by receiving applications. 

- **New Password Expiry:** Policies came out in mid-2024 to aid organizations to require users to change their passwords on a routine basis. [This feature](/docs/guides/manage/console/default-settings#password-expiry) can be used quickly through the Console UI at both instance and organization levels. 

- **New Sample Apps:** We prioritized building out sample apps in [VueJS](https://github.com/zitadel/zitadel-vue), [PHP](https://github.com/zitadel/example-symfony-oidc), and [Java](https://github.com/zitadel/zitadel-java) in the beginning of 2024 to make getting started with authentication and authorization easier with these specific examples and guides.

- **Back-Channel Logout:** This is a feature that resides on the server-side and does not require the user agent to be involved. Through [back-channel logout’s](/docs/guides/integrate/login/oidc/logout#back-channel-logout) ability it has the user logged out from all clients in the event that the authenticated session gets terminated. 

- **Four New Translations added to the Zitadel platform** with **Hungarian**, **Indonesian**, **Swedish**, and the latest being **Korean** thanks to the recent addition from our community contributor [Kim JeongHyeon](https://github.com/KimTibber)!

- **New Translations added to Upcoming Typescript Login** to include **German**, **Spanish**, **Italian**, and **English**.  If you’re not seeing the language of your choice, please request or collaborate with us directly on our [GitHub](https://github.com/zitadel/typescript/tree/main/apps/login/locales).

## Zitadel in 2025: Vision

For 2025, we are focusing on three key areas to enhance the Dev and SecOps experience:

- **A Seamless Onboarding Journey:**  Our goal is to make your first integration with Zitadel as smooth as possible.  We are working on intuitive APIs, comprehensive examples and SDKs, flexible user management tailored to your use case, and streamlined deployment and maintenance processes.

- **Enterprise-Grade Performance and Scalability:** We are committed to making Zitadel a highly scalable and performant identity infrastructure.  This includes linear scalability to meet your growing needs, easy upgrades for business continuity, and efficient user management with group administration and standardized provisioning/deprovisioning capabilities.

- **Proactive System Insights:** We empower you with the tools to proactively monitor and manage your Zitadel environment.  This includes seamless integration with your SOC/SIEM systems, real time system health insights, and user analytics to identify potential issues before they impact your customers.

## Zitadel in 2025: Product 

As we look to the future, we’ve got a wide range of exciting new features on the horizon! 

- **Performance Improvements:** This remains a top priority for the team as we continue to strengthen Zitadel’s core authentication capabilities, the platform’s existing & new API endpoints, and resource management across the board. 

- **New Typescript Login including OIDC:** This allows admins to enhance their Zitadel instance with a ready-to-deploy login that is highly customizable.  [Read the GitHub Product Roadmap Epic here](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50833557&issue=zitadel%7Ctypescript%7C46).

- **User Schemas:** This feature offers flexibility when managing user details from user- and admin- perspective by allowing to define the fields that are allowed to be managed by a user and the ones that are to be managed by admin.  Stay informed through our [GitHub Product Roadmap Epic](https://github.com/zitadel/zitadel/issues/6433).

- **Configurable Cache Options:** This was the last beta feature of 2024 that enables speedy lookup of objects that are often needed by storing them in cache, like Redis.  [Take it for a spin](/docs/self-hosting/manage/cache) before it becomes generally available in 2025 and [share your feedback](https://discord.com/channels/927474939156643850/1309157792292012063/1309158011469692958).

- **SCIM (System for Cross-domain Identity Management):** This is the standard for inbound user-provisioning so other systems can automatically provision and manage users within Zitadel.  This allows creation, update, and deletion of users based on user data changes in the external system and streamlines user management across systems ensuring consistent user states. To dig deeper into this feature, read the [GitHub Product Roadmap Epic here](https://github.com/zitadel/zitadel/issues/8140).

- **Actions v2:**   This feature will allow you to extend Zitadel with custom executions and triggers through API endpoints as you look to make the most out of your Zitadel instance.  Check out the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) to find out more.

- **User Group Authorizations:** Through this feature Zitadel expands past the managing users individually and now offers groups to enable authorizations as a wider scale for user management. To follow along on this feature delivery in 2025, review the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822).

## Community & Feedback Opportunities

As always, we appreciate and welcome your feedback.  It helps us shape our product roadmap and build a robust platform that caters to your needs: 

- If you are interested in a sneak peek at our User Schemas update, and would like to share your feedback, please email [Jim@Zitadel.com](mailto:Jim@Zitadel.com)

- Please share your feedback and experiences with our Community team by [scheduling some time here](https://calendar.app.google/UgTzLndLKKMk7BYp8)

- If you are using Zitadel today, please add yourself to the [Adopters](https://github.com/zitadel/zitadel/blob/main/ADOPTERS.md) list with a short description of your use case by opening a pull request and adding a section describing your usage of Zitadel.

- If you are interested in contributing to Zitadel, please review our [Contributing Guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md) to collaborate with us.

Have a look at our great product enhancements of 2024 and what is ahead for 2025.

End Of Year Product Wrap Up 2024


As an open source organization with strong community roots, we want to ensure that the care, intention, and nurturing that we pour into our product is also reflected within our team. Back in May of 2023, we held our first retreat, taking initial steps towards becoming a fully remote, global company. Fast forward to November 2024, we’ve grown from a small unit to a team of almost 20 fully distributed professionals across the globe. Along the way, we’ve made meaningful strides towards curating a strong sense of belonging while cultivating our remote work culture. Our efforts really come to life at our biannual off-sites where we’re all able to reconnect in person. Off-sites are one of many ongoing cultural rituals that allow us to work on the four Cs:  Collaboration, communication, connection, and . . . carbs **(yes, seriously —  stay with me, more on this in a second)**. 
 
## Pre-Arrival

Three days before everyone was set to fly out, we found ourselves needing to make a 1000+ kilometer change to our plans (we originally planned to go to Valencia, Spain). With time against us, we had to quickly rebook flights, shift the location of our activities and accommodations — all of this in less than 1 week. With some team members up to 8000 km away, this last-minute change really tested our ability to be communicative and adaptable. (In hindsight, this felt like an almost impossible task but we did it!)

Despite this being a logistical nightmare & having tight timelines, we were really able to come together as a team and push this through to success on such short notice. Adding on to a whirlwind of a week, illnesses, personal emergencies, and hurdles popped up that threatened to fully derail our upcoming trip. What could have been the end of our plans gave us an opportunity to show how far we’ve come as a remote-first team. We were operating like a well-oiled machine—leadership quickly went to work preparing a compact action plan, while team members supported each other with rebooking flights and figuring out how to navigate locally. From the warm, sunny coastlines we planned to visit to the cool, cozy vibes of Zurich -  the chaos gave us the opportunity to not only show resilience through challenging circumstances but also our ability to adapt and thrive together. 
 
## Arrivals

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-01.jpg" width="100%" alt="Nine Zitadel staff members smiling and posing at a bar near the Zurich opera house, with drinks on the table." />
</figure>

With our travel toils behind us, we began our journey to Zurich. For those already stationed in Switzerland, getting to Zurich wasn’t too much of a hassle. For others, it meant 20+ hours of travel - an experience best summarized as "amazing, spectacular, 10/10, would do again". Can you hear the sarcasm? The excitement to meet our co-workers in person surpassed the jet lag & weariness with all of us finally uniting in the evening. With early arrivals already at the hotel and others still on the way, a smaller group of us met near the opera house, where the view of the water at sunset provided a stunning backdrop for some great photos. We all quickly caught up (and met some new teammates!) before continuing on a short walk to the jazzy, goat-themed Widder Bar where the rest of team Zitadel joined us.  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-02.jpg" width="100%" alt="Table at Raclette Stube with wine glasses, a fondue pot, and plates of vegetables, meat, raclette, and potatoes." />
</figure>

Light banter, warm introductions, and plenty of jokes set the tone for our evening as we made our way to Raclette Stube. We all ate to our heart's content - with some of us experiencing raclette for the first time and others opting for the very classic fondue. After the night's festivities, most of us felt like we turned into a ball of cheese.

That first evening together melted away the strain of those last minute changes, leaving us recharged & ready to dive head first into the rest of a very promising retreat.
 
## Activities & Exploration

After we settled in, our retreat really started on day 2 with a series of workshops led by some of our incredible internal subject matter experts.
Our new product marketing manager, Jim, opened up our sessions with an engaging discussion around our documentation and how it is crucial to your (yes, you, dear reader) Zitadel experience. Following Jim, our head of sales, Jason, broke down the sales process for our engineering team - delving into our processes, how we map customer needs while giving us a quick overview of negotiation tactics, and relationship building.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-03.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jason, the head of sales, present his workshop." />
</figure>

Next, Silvan and Max came in with well crafted & informative workshops focused on engineering. Silvan, through a hilarious presentation, provided much needed insights into Zitadel’s performance and detailed next steps on how we plan to improve it. Max gave a detailed overview of the new Typescript login, its implementation, and how it fits into creating an exceptional user experience. Our workshop series ended with our CEO, Florian, breaking down venture capital and offering a clear picture of where we currently are as a company [(check out our latest funding announcement!)](https://zitadel.com/blog/zitadel-the-future-of-identity-infrastructure)

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-04.jpg" width="100%" alt="Group hiking with those at the front smiling at the camera, while others straggle behind, surrounded by lush greenery." />
</figure>

With our workshops wrapped up, we took a casual stroll through Zurich that included us raiding Migros and Coop (a Swiss rite of passage). We tested our limits with an “intense” hike (spoiler: some of us fumbled on the beginner trail and felt winded at the end of it). The stunning views, adorable cows, and fresh air made every step of that hike worth it.

In the days that followed, we explored Lucerne where some of us shopped for souvenirs, crossed Kapellbrücke (with Florian providing important historical context), and wrapped up that day with a breathtaking ride up Pilatus. Of course, more souvenirs were added to our suitcases by the end of that Lucerne day trip.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-05.jpg" width="100%" alt="Group exiting the Lindt chocolate factory with the factory sign partially visible in the background." />
</figure>

We can't forget to mention one of the most delicious parts of our trip: our visit to the Lindt chocolate factory. We experienced (and ate) a key piece of Swiss history, with some of it ending up in our jackets & bags at the end of the day. 
 
## Wrapping Up

This was a trip filled with fresh energy, joy, collaboration, and a reinforced sense of belonging. We all had the chance to strengthen our existing relationships (and build new ones!) - From celebrating promotions, to learning through in-depth internal workshops, and getting a thorough workout in Zurich - This trip was a memorable experience that left us all inspired and more than excited to continue growing. 

💜 **Here are some staff quotes from the trip:**  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-06.jpg" width="100%" alt="Jim and Stefan sitting in the hotel lobby playing Magic: The Gathering, with cards spread across the table and drinks nearby." />
</figure>

"Our team retreat in Zurich was fantastic! It was refreshing to connect with everyone on a personal level. My highlight was those late-night Magic the Gathering sessions with Jim and Stefan – it had been 10 years since I'd played, and the competitive spirit with plenty of laughs was the perfect way to unwind and bond! Beyond the fun, it was inspiring to see how strong our company culture has become. As a remote company, these connections are crucial, and it's clear that even with the team nearly doubling in size, newcomers feel welcomed and supported. That creates such a positive and productive environment, no matter where we're working from. I can't wait for our next retreat!"
-**Florian Forster, CEO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-07.jpg" width="100%" alt="Lindt chocolate factory sign prominently displayed on the factory's exterior." />
</figure>

“It was great to show everyone our beautiful country and where the whole story of Zitadel started. I always love to explore something unique for the place we visit, and the Home of Chocolate was just amazing. Even if it was waaaay too much chocolate. :) Getting to know everyone in person is always my favorite part of the team retreat, and I am sure this makes a big difference for our daily remote work.”
-**Fabienne Bühler, CPO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-08.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jim, the product marketing manager, present his workshop." />
</figure>

“It was a lovely offsite that hit all the points you hope for out of a team coming together, from long term strategy discussions to rapport building amongst the crew. It’s exciting to have a strong alignment closing out 2024 and going into 2025!”
-**Jim Morrison, Product Marketing Manager**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-09.jpg" width="100%" alt="Team walking through Lucerne, passing buildings with signs for 'Pilatus', 'Victorinox', and 'La Fenice Steakhouse'." />
</figure>

“The Zurich retreat was an extraordinary experience, one that will forever be etched in my memory. To gather with colleagues from across the globe, to see familiar faces, and meet new ones, was truly inspiring. The days were filled with insightful discussions, thought-provoking presentations, and collaborative problem-solving. Yet, the moments outside of the formal agenda also truly resonated with me. The casual conversations, the shared laughter, the late-night card games with Magic the Gathering– these were the moments that forged deeper bonds and strengthened our team. The opportunity to explore the beauty of Switzerland was an added bonus. Whether it was a leisurely stroll through the city or a breathtaking hike in the mountains, each excursion offered a chance to unwind, recharge, and appreciate the simple joys of life. I’m incredibly grateful for the experience and can’t wait to reconnect with my colleagues at the next retreat.”
-**Stefan Benz, Software Engineer**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-10.jpg" width="100%" alt="Small group of Zitadel engineers casually chatting near picnic-style seats at an outdoor restaurant." />
</figure>

"I cherished the in-person conversations and unforgettable moments with these amazing people. The presentations, even though they were in the morning, were a valuable source of knowledge about others' work, making this retreat a truly unique experience."
-**Silvan Reusser, Software Engineer**


Discover how our fourth team retreat in Zurich turned last-minute challenges into opportunities for collaboration, connection, and cultural exploration.

Hopp Schwiiz - Company retreat V4


### Advancing the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Modern organizations have a complex landscape of interconnected systems, spanning hybrid and multi-cloud environments and serverless architectures. To succeed, businesses must constantly adapt their security and identity management strategies to improve developer productivity and user experience across multiple systems. This, however, presents significant challenges. Data ownership and security, the complexities of SSO and MFA, developer-friendly APIs and SDKs, and customization to specific use cases are major concerns that can hinder innovation, slow down time-to-market, and impact customer satisfaction."

### Announcing our Series A Funding Update

Through our collective experiences, we learned that the current solutions for Identity and Access Management and Identity Infrastructure fall short in many different areas. Driven by a shared vision to build a modern identity infrastructure platform, Fabienne, Max, and I, along with a talented group of engineers, founded Zitadel four years ago.

![zitadel raises 9 million series a](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure.png)

We're thrilled to announce today that [we've raised $9 million in Series A funding](https://www.prnewswire.com/news-releases/zitadel-raises-9-million-series-a-to-advance-cloud-native-identity-infrastructure-302311461.html) to further our mission of building a modern identity infrastructure platform. This investment, led by Nexus Ventures with continued participation from Floodgate, will enable us to accelerate development and bring Zitadel to even more organizations. We're incredibly grateful for the ongoing support of our investors and partners, who share our passion for creating a secure and developer-friendly identity solution.

### What makes Zitadel a great Identity Platform

#### Architectural Innovation

Zitadel is built as a cloud-native infrastructure project that leverages modern technologies to ensure a platform that scales with customers' needs. What sets Zitadel apart is its **unique event-sourced architecture**, where every change in the system is captured as an immutable event. This not only provides a **complete audit log** but also allows customers to **subscribe to real-time changes** within their Zitadel. Built with the help of Go, NextJs, Angular, Postgres and Redis, Zitadel is designed to be highly scalable, resilient, and secure. Our multi-tenant architecture allows us to support customers of all sizes, from small businesses to large enterprises. And our API-first approach makes it easy to integrate Zitadel with your existing applications and workflows.

![Architectural Innovation](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-overview.png)

#### Flexible Authentication and Login options

Passwordless authentication along with enterprise or social logins are quickly becoming the de facto standards in identity security. Zitadel supports these and provides a customizable log-in experience for businesses that would like to either embed their login workflow, passkeys, or build a completely custom login experience for their project.

#### Built for Multi-tenancy

Multi-tenancy is a fundamental capability of the Zitadel platform, engineered to effortlessly support millions of tenants. This allows customers to manage a vast number of organizations and policies simultaneously, with the flexibility to handle diverse scenarios – from B2B and B2C to complex mixed setups with both. Customers can seamlessly extend the scope of their applications by adding new organizations and granting projects to them, all within a single, unified Zitadel instance. This scalability ensures that Zitadel can grow with your business, no matter how large or complex your needs become.

![Built for Multi-tenancy](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-multitenancy.png)

#### Engineered for Developers

Zitadel is built with developers in mind, adopting an API-first approach. This means that every feature and function is accessible through well-defined and documented APIs. We offer both gRPC and REST APIs, giving you the flexibility to choose the best fit for your needs. This allows for seamless integration with your existing tech stack, regardless of your preferred programming languages or frameworks. Our comprehensive SDKs further simplify development, reducing the learning curve and accelerating your time to market.

With Zitadel's API-first approach, you can:

- **Automate user management:** Programmatically create, update, and delete users.
- **Customize authentication flows:** Integrate with your own login UIs or implement passwordless authentication.
- **Manage roles and permissions:** Fine-tune access control for your applications.
- **Extend Zitadel's functionality:** Build custom integrations with other services.

#### Enabling frictionless Security Operations

The Zitadel Identity Platform aims to empower security operators with critical capabilities such as secure login policies, audit and access events, etc. We are excited to grow our platform to extend this so the SecOps teams will be able to derive actionable insights through data aggregation, enabling them to monitor compliance and security across user behaviors and application usage patterns. By streamlining complex processes, security operators can leverage advanced usage analytics and threat intelligence capabilities, allowing them to focus on strategic security initiatives.

#### Continued Commitment to Open Source

Open source is at the heart of Zitadel and we firmly believe in the benefits that open source has. Our commitment to open source fosters innovation, encourages collaboration, and ensures that our platform remains adaptable and extensible. We invite everybody to join our thriving community, contribute to the project, and help shape the future of identity infrastructure.

<img src="/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-numbers.png" alt="Zitadel By The Numbers" />

### What’s Next

We are eager to set forth on the next part of our journey at Zitadel with our community. Check out our [documentation](https://zitadel.com/docs) or join us on [Discord](https://zitadel.com/chat). You can also stay informed of our updates by following us on your preferred social channel \- [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social).

Check out our [documentation](https://zitadel.com/docs)

Join us on [Discord](https://zitadel.com/chat), Follow us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social)


Zitadel raises $9 million in Series A to advance the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Zitadel: The Future of Identity Infrastructure


Imagine this: Dave, an IT manager, is responsible for overseeing access for multiple tenants within his company’s cloud service. He has User A from RetailCo and User B from FinanceCorp, both needing access to the same service but with completely different security requirements. User A prefers logging in with their Google account and demands strict password policies. User B uses their company’s Azure AD and requires multi-factor authentication. Dave thought managing a single organization was tough, but this? This is a whole new level of complexity.

As if that wasn't enough, Dave’s company is rapidly growing, introducing more customers from various industries, each with unique compliance and security requirements. Now he has User C from TechInnovators who needs passkeys for enhanced security, and User D from EduWorld demanding seamless SAML integration with their existing single sign-on system. The more tenants Dave’s company takes on, the more convoluted and headache-inducing his job becomes.


## Understanding Multi-Tenant IAM

Implementing multi-tenant Identity and Access management (IAM) systems can be complex, daunting, and filled with hidden challenges. Whether you're addressing the needs of B2B, B2C, or M2M (Machine-to-Machine) environments, multi-tenancy involves a single service instance serving multiple tenants, such as organizations or customers. This requires meticulous data and component segmentation based on service needs and data types. The chaos gets further compounded with individual compliance requirements. 

Consider a simple login screen—two input fields and a button. It looks straightforward, right? But this seemingly simple UI is just the tip of the iceberg. Behind the scenes, there's a multitude of complexities: username and password management, multi-factor authentication options (SMS codes, email codes, authenticator apps), passwordless authentication (face recognition, fingerprint scans), and identity brokering (social logins like Google, Apple, or Facebook).

On top of that, managing security settings, performing regular penetration testing, adhering to standards (such as SCIM, OAuth 2.0, and OpenID Connect), and obtaining certifications (like ISO and SOC 2) add layers of complexity. This is especially true when these features must be replicated across multiple tenants.


<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-01.png" 
    width="100%"
    alt="Underneath the simple login form"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - Underneath the simple login form lies a multitude of complexities—it's merely the tip of the iceberg

  </figcaption>
</figure>


When you introduce multi-tenancy, everything becomes more complex. Each customer brings their unique requirements—username and password for one, passwordless or multi-factor authentication for another, or integration with existing identity systems like Azure AD or Google Business. These varying needs mean you must be able to configure and maintain diverse systems for each tenant, requiring significant time, expertise, and resources.

<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-02.png" 
    width="100%"
    alt="The layers of complexities"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 2 - The layers of complexities behind the the multi-dimensional aspects of multi-tenancy

  </figcaption>
</figure>

Let’s look at a real-world example. Imagine you run an online store serving end consumers, business partners, and your workforce. Each group has different needs: consumers need a user-friendly login and account management system, business partners (such as other sellers) might use their existing enterprise identity systems and may have their own branding requirements, and your workforce needs robust role and permission management to secure administrative tasks.

Yes, it’s possible to manage all these requirements with roles and permissions. However, when you consider the need for different security settings, it often makes more sense to adopt a multi-tenancy approach. As you scale to multiple customers, each one may require unique domains, branding, social logins, and security settings. Managing these variations with a roles and permissions model becomes increasingly complex and unwieldy. Multi-tenancy offers a more streamlined and efficient solution, allowing you to handle these diverse needs effectively and securely.

Questions to ask when dealing with multi-tenancy include: How many levels of tenancy do you need? Are there multiple organizations within a tenant? What scenarios are you dealing with (B2C, B2B, mixed)? Each user group might need different authentication methods, security policies, and compliance requirements (e.g., GDPR, SOC 2, ISO).

Consider the example of a healthcare application where different tenants have varying password hashing requirements (PBKDF2, Argon2, bcrypt) and audit trail needs. Protocol-specific differences also arise; for instance, integrating customers’ existing Azure AD for user federation can lead to numerous configurations and requirements.

So, do you explain outdated or incorrect policies to each customer, or make your software flexible enough to handle these diverse needs while focusing on your business case? Ideally, you want to provide a robust, flexible platform that can accommodate different configurations and compliance requirements.

From an architectural perspective, you have two main options: shared systems or dedicated systems. Shared systems are cost-effective and simpler to manage but come with lower isolation, potential security risks, compliance challenges, and performance issues. Dedicated systems offer enhanced security, compliance, and customization but require more management, infrastructure costs, and personnel.

In summary, identity infrastructure involves much more than just two input fields and a button. It's intricate plumbing work, particularly with multi-tenancy. Always remember that the customer is king: guide them on security best practices, but also ensure your infrastructure can meet their unique needs. A proven track record in security is essential for enterprise deals, so regular penetration tests and certifications are crucial. Make use of established frameworks like OAuth 2.0 and OpenID Connect, and rely on an existing IAM product, such as ZITADEL, for authentication and authorization instead of building your own from scratch.


## How ZITADEL Handles Multi-Tenancy


ZITADEL has a strong focus on supporting SaaS providers with a multi-tenancy use case. This is achieved by allowing multiple organizations within your ZITADEL instance, where all customers can self-manage their own users and roles. ZITADEL operates as a shared system, but it also allows for virtual instances and separate organizations within each instance. This setup is particularly beneficial for B2B app providers where

- you sell your application to other businesses, where each business wants to manage their own users, roles, and access settings
- your customers have different needs for the login flow, such as unique branding, federated logins, password policies, and MFA options
- your customers want to self-manage their users and roles without relying on your administrative team
- users/employees of your customers need to log in or register independently
- not all customers have the same feature set within your application


## How Does Multi-Tenanacy Work in ZITADEL


### Create Organizations

For each customer, create an [organization](https://zitadel.com/docs/concepts/structure/organizations), the equivalent of a tenant, in ZITADEL. Assign an [organization manager](https://zitadel.com/docs/guides/manage/console/managers) to let each customer manage their users independently. Furthermore, users can belong to multiple organizations and switch between them using the same identity, simplifying user management and improving the user experience.

### Custom Configuration

Customers can configure their login look and feel ([branding](https://zitadel.com/docs/guides/manage/customize/branding), [authorization methods](https://zitadel.com/docs/guides/manage/console/roles), [federation](https://zitadel.com/docs/guides/integrate/identity-providers/introduction) or you can do it for them. ZITADEL supports various authentication methods, including [username/password](https://zitadel.com/docs/guides/integrate/login), MFA, and [passwordless options](https://zitadel.com/docs/concepts/features/passkeys). Integrate existing identity providers like Microsoft Azure AD, Google etc., allowing users to log in with their existing corporate credentials.

### Domain Discovery

ZITADEL offers [domain discovery](https://zitadel.com/docs/guides/solution-scenarios/domain-discovery) capabilities, which routes users to the appropriate organization based on their login methods, whether it's a username, email, or phone number. For instance, if a user from "foo.com" logs in, they are routed to the Foo Organization, while a user from "bar.com" is directed to the Bar Organization. This ensures users are authenticated according to their organization’s policies and access settings.


### Project Grants

With [project grants](https://zitadel.com/docs/concepts/structure/granted_projects) (also known as granted projects) your customers can access your project with a subset of roles so they can manage authorizations for their users. Enable granular role management, allowing organizations to assign specific roles and permissions to users based on their needs.



## Standards and Compliance


From a certification and standards compliance perspective, ZITADEL is [GDPR compliant](https://zitadel.com/gdpr) and [ZITADEL’s OIDC library has been certified by the OpenID Foundation](https://zitadel.com/blog/openid-connect-certification). Furthermore, [ZITADEL recently achieved ISO 27001 certification](https://zitadel.com/blog/zitadel-iso-27001-certified) for its information security management system, to maintain the highest standards of information security. ZITADEL assures customers that their data is protected by robust security measures, reflecting global best practices in information security management. 

By providing these capabilities, ZITADEL simplifies the management of multi-tenant IAM systems, ensuring security, flexibility, and ease of use for both administrators and end-users. Moreover, ZITADEL provides support for unlimited users, projects, and applications, making ZITADEL a trusted, secure, and scalable solution for your multi-tenant IAM needs that can grow with your business. 


*This blog post is based on and expands upon the talk "The Perils and Pitfalls of Multi-Tenant Identity Management" from Cloud Native Security Con 2024, North America. For the full discussion, you can watch the video [here](https://www.youtube.com/watch?v=gZHxjnx81WE&list=PLj6h78yzYM2MSAFvjG22ZynvaUs1nnaQJ&index=46).*




This post explores the complexities and solutions of multi-tenant identity management in modern SaaS environments.

The Complexities and Pitfalls of Multi-Tenant Identity and Access Management


In this newsletter, I want to share updates about our platform, and provide some tips on how you can simplify your identity infrastructure.

## Feature highlights

In June,  we shipped over 60 bug fixes, improvements, and new features. Most of those changes were released with ZITADEL [v2.55.0](https://github.com/zitadel/zitadel/releases/tag/v2.55.0), so make sure you are running the latest version.

### New password expiry feature

ZITADEL has introduced a new password age policy feature, enabling organizations to require users to change their passwords regularly. This feature can be easily managed through the Console UI at both instance and organization levels. Users will be prompted to change their password in the Login UI if their current password exceeds the defined age limit. This enhancement strengthens ZITADEL's password management capabilities and provides organizations with greater control over their password lifecycle.

![ZITADEL Console UI password expiry settings](2024-07-04-zitadel-product-newsletter-june-2024-01.png)

### Limit requested roles with new scope

A new scope was introduced to address the issue of excessive roles being returned in tokens (and as such increasing their size) for users belonging to multiple organizations. This new scope allows administrators and applications to specify which organizations' roles should be included in the token, thus streamlining access control for specific use cases. By using the new scope, either once or multiple times, only the roles of the specified organizations will be included in the token.  It's important to note that this feature is not compatible with legacy mode for Introspection or Userinfo endpoints.

[Reserved Scopes](https://zitadel.com/docs/apis/openidoauth/scopes#reserved-scopes)

### More performance improvements

ZITADEL's performance continues to improve as the team works to identify and eliminate bottlenecks. Notably, import operations for large quantities of project grants will witness a substantial enhancement. Furthermore, a significant improvement has been made to OpenID Connect / OAuth 2.0 session checks, effectively addressing recent observations identified during load testing.

### Sending test emails

The newly introduced feature has enhanced ZITADEL’s SMTP functionality by introducing a new testing step within the SMTP provider wizard. This allows administrators to verify their SMTP configuration before saving or updating it, preventing potential issues with email delivery. Additionally, the existing table of SMTP providers now includes a test option for existing configurations. This streamlined testing process ensures that email settings are correct from the outset, saving time and effort. This feature was contributed by the community - thank you for your efforts!

![ZITADEL Console UI sending test email during configuration of SMTP](2024-07-04-zitadel-product-newsletter-june-2024-02.png)

[Changelog](https://zitadel.com/changelog)

## ZITADEL achieves ISO 27001 certification, reinforcing commitment to security

<img src="/blog/2024-07-04-zitadel-product-newsletter-june-2024-03.png" width="25%" align="left" alt="" class="wrap"/>

In a significant milestone for ZITADEL's commitment to security and data protection, we have achieved ISO 27001 certification for our information security management system (ISMS). This internationally recognized standard validates our dedication to maintaining the highest levels of security for our customers' data.

To provide further transparency and information about our security practices, we have also updated our [Trust Center](https://trust.zitadel.com). This resource offers comprehensive details on our security posture, policies, and certifications.

[ZITADEL Achieves ISO 27001 Certification](https://zitadel.com/blog/zitadel-iso-27001-certified)

## 21 more reasons to celebrate: Community contributions in June

* Many Console UI improvements were contributed by [doncicuto](https://github.com/doncicuto) improving the user experience for administrators and users. Moreover [doncicuto](https://github.com/doncicuto) made it possible to send test mails for SMTP configurations and further improvements to mail providers.
* [JesperWe](https://github.com/JesperWe) made it possible for Swedish speakers to use their beautiful native language
* [Schettn](https://github.com/schettn) created a guide to integrate with the [Pylon](https://github.com/getcronit/pylon) framework

Many thanks to the contributors this month for their efforts, helping to improve documentation, tests, and fixing bugs in our code: [dkaminer](https://github.com/dkaminer), [panapol-p](https://github.com/panapol-p), [jvanderneutstulen](https://github.com/jvanderneutstulen), [danielmoisa](https://github.com/danielmoisa), [Loddan](https://github.com/Loddan), [Yxnt](https://github.com/Yxnt), [Cubox](https://github.com/Cubox), [danielloader](https://github.com/danielloader), [jfschubert](https://github.com/jfschubert)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion. 

[Contributing guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)

## Additional resources

* [ZITADEL Bi-Weekly Office Hours](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)
* [Forza Italia: Retreat the third edition in Bologna](https://zitadel.com/blog/team-retreat-bologna)
* First time contribution (Japanese only): [OSS コントリビュートの実績を解除した](https://zenn.dev/otakakot/articles/dc58ff849e43e4)
* Integrate .NET (Polish only):  [Integracja Aplikacji .NET z Zitadel | bd90](https://bd90.pl/integracja-aplikacji-net-z-zitadel/)

ZITADEL introduced new features and enhancements, including a password expiry feature, a new scope to limit requested roles in tokens, SMTP configuration testing, and performance improvements. ZITADEL achieved ISO 27001 certification, demonstrating its commitment to security.

Product Newsletter June 2024


ZITADEL, a leading provider of cloud-native identity and access management (IAM) solutions, has achieved ISO 27001 certification for its information security management system (ISMS). This certification demonstrates ZITADEL's deeply rooted commitment to protect the confidentiality, availability, and integrity of customer, company, and employee data.

"Obtaining the ISO 27001 certification is a testament to ZITADEL's commitment to information security," said Florian Forster, CEO of ZITADEL. "This certification demonstrates that we have the systems and processes in place to protect our customers' data."

<img src="/blog/2024-06-20-zitadel-iso-27001-certified-01.png" width="35%" align="left" alt="" class="wrap"/>

The ISO 27001 standard is a globally recognized framework for information security management. It provides a comprehensive set of requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving the security of ZITADEL.

We designed our information security management system (ISMS) to protect against a wide range of threats, including unauthorized access, data breaches, and cyberattacks. The ISMS further includes processes for managing and responding to security incidents.

"Secure development and operations practices are essential for protecting our customers' data," said Fabienne Bühler, CPO of ZITADEL. "ISO 27001 certification provides our customers with assurance that their data is safe and secure."

ZITADEL's ISO 27001 certification is a valuable asset for the company's customers. It provides customers with assurance that their data is protected by world-class processes and tools .

"Our commitment to information security and data privacy is steadfast," said Maximilian Panne, COO of ZITADEL. "ISO 27001 certification is a recognition of our efforts to protect our customers' data at ZITADEL."



You can verify the validity of our ISO certificate by visiting the [website of the British Assessment Bureau](https://cvs.babcert.com/babcert.asp?c=258048&v=3fs61l6zn6).

Visit the [Trust Center](https://trust.zitadel.com) to learn more about our commitment to information security and data protection.


ZITADEL achieved ISO 27001 certification, demonstrating its dedication to data protection and cybersecurity. This certification provides a framework for information security management, safeguarding data against unauthorized access and cyber attacks.

ZITADEL Achieves ISO 27001 Certification


As a fully remote company, the time we spend together in person is precious.
This is why twice a year, our team gathers for an in person retreat, an opportunity to connect beyond the virtual world.
Last week, we met outside the beautiful city of Bologna for our first retreat of the year.
Since we really enjoyed it, we wanted to share a glimpse of  our week-long adventure.

## Travel Monday and Arrival in Bologna

After a full day of travel by plane or train excitement filled the air as we arrived in Bologna.
The last steps to our accommodation were harder than expected, the location with its view of its flowing hills and grape wines were worth it.
As everybody arrived later in the afternoon we rounded off the evening with pasta, as one would expect in Italy.
We even committed ourselves to cooking two fresh sauces, ragu and a verdure.  The whole team enjoyed the get-together and chatted until late that night over a drink.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-01.jpg" width="100%" alt="Up the hill." />
</figure>

## Workshop Tuesday (with Pizza)

Tuesday marked the beginning of our planned activities. In the morning, we gathered for a collaborative workshop focused on team dynamics and fostering a productive environment. This session, prepared with the guidance of our coach, Diane, was insightful and set a strong foundation for our company culture.

The afternoon was free for everyone to explore the surroundings or engage in spontaneous discussions. Some team members chose to go for a walk, while others stayed back to exchange ideas and plans that have been in their heads for a long time and some others decided to play a game called Kubb.

The highlight of the day was undoubtedly pizza night. Max brought his portable pizza oven, and Florian had spent the afternoon making pizza dough from scratch. As evening fell, we gathered to create our own pizzas. The making was as enjoyable as the delicious outcome. We laughed, shared stories, and ate homemade pizzas—a perfect blend of teamwork and fun.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-02.jpg" width="100%" alt="Pizza Night" />
</figure>

## Wednesday, Continued Workshops and Exploration

Wednesday morning continued with another productive workshop session. Building on the previous day's discussions and results, we delved deeper into our operating principles, aligning our visions and strengthening our collaborative spirit.

The afternoon was again free for personal activities. These unstructured times were as valuable as the workshops, allowing for organic connections and idea exchanges.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-03.jpg" width="100%" alt="Workshop" />
</figure>

### A Culinary Adventure on Thursday

Thursday was dedicated entirely to food. We went on a walking food tour in Bologna, immersing ourselves in the local culinary delights. From fresh pasta to delicious pastries, we tasted a variety of specialties that the city is renowned for, such as cold-cuts, Tiggele, Tortellini al Brodo, Tagliatelle al Ragù. This gastronomic journey was not just about food but also about experiencing the culture and history of Bologna together.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-04.jpg" width="100%" alt="Pasta" />
</figure>

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-05.jpg" width="100%" alt="Church" />
</figure>

### The Importance of In-Person Retreats

We figured that these in-person retreats are crucial for our company culture. They provide us with a unique opportunity to build stronger relationships and learn about each other's interests and expertise. Spending time together allows us to connect on a personal and social level, enhancing our collaboration and understanding of each other, far beyond what is possible through modern communication channels like video and audio.

Our week in Bologna was a resounding success. From the insightful workshops to unforgettable culinary experiences, we cherished every moment. These retreats remind us of the importance of human connection in a digital world. It made us aware that remote work is hard work, and we are already looking forward to seeing each other again in person in the next retreat.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-06.jpg" width="100%" alt="Team" />
</figure>


As a fully remote company, the time we spend together in person is precious. Get some insights about our third team retreat taking place in Bologna.

Forza Italia: Retreat the third edition in Bologna


This is Max from ZITADEL. As in the previous months, in this update I want to highlight our product updates, and tips and tricks in making your identity infrastructure easier.

## Feature highlights

Again in May, we kept the pace high with more than 76 improvements shipped to our self-hosting and cloud users. Let’s go through the key improvements to ZITADEL this month.

[All changes](https://zitadel.com/changelog)

### Improvements using external SAML IdPs

We understand that many organizations, particularly enterprises, leverage SAML for user federation. In response to your needs, we've made significant steps in enhancing ZITADEL's interoperability with various SAML providers this May.

Previously, ZITADEL relied on a persistent nameID format, requiring external identity providers (IdPs) to consistently return this format for linking users. However, some IdPs utilize transient nameIDs, leading to mismatched user identities.

This update allows you to define the preferred nameID format and configure how ZITADEL maps users based on attributes received from the external IdP. For instance, you can leverage email addresses from the IdP to link users with matching emails in ZITADEL.

While ZITADEL offers pre-configured templates for external IdPs that utilize OpenID Connect, we're considering extending this functionality to SAML providers. We value your feedback – let us know your thoughts on this potential addition!

[Should we support SAML provider templates?](https://github.com/zitadel/zitadel/issues/7995)

### Making it easier to manage resources programmatically

While you get all the functionality through a UI, we are api-first and you are able to manage everything through our APIs. Managing ZITADEL resources and configuration programmatically just got simpler with some recent updates.

When you start with a new ZITADEL system, you need a first admin user to login and configure your system. In the past it was only possible to either create a human user or a service user, but not both at the same time. With a recent update creating both a human and service user is now possible, giving you hopefully a much simpler and easier access to configure ZITADEL from the start.

Moreover our [terraform provider](https://zitadel.com/docs/guides/manage/terraform/basics) got significantly updated and improved over the last weeks. Examples are managing organization and user metadata as well as managing SAML and OIDC generic external identity provider templates.

### Scaling to multi-million identities

We're excited to announce performance optimizations in ZITADEL to meet the growing needs of our enterprise customers! This update addresses the demands of multi-million identity deployments and aligns with our ongoing commitment to performance improvement. We've focused on enhancing the token endpoint, specifically for new token creation, alongside optimizations for many frequently used ZITADEL APIs. For detailed upgrade guidance, please refer to the technical advisories.

[Technical Advisories](https://zitadel.com/docs/support/technical_advisory)

## Office hours

Gear up for deeper dives and live engagement! We are excited to announce bi-weekly office hours on our Discord server for our community. These hour-long sessions will offer in-depth explorations of upcoming features, followed by a live Q&A where the ZITADEL team tackles your burning questions.

The first session, held on May 29th, delved into the exciting new version of the Actions feature.

Don't miss out on this chance to connect with the ZITADEL team and stay ahead of the curve! Checkout our [meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md) for upcoming sessions.

[Office hours meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)

## You will become a Pro

ZITADEL Cloud subscription model is changing to a simpler daily active user (DAU) model on July 1st for easier cost allocation and full feature access across instances. This serves as a friendly reminder that accounts not already on our Pro plan will automatically update.

All new subscription plans will include in the base fee 25’000 Daily Active Users in a month, one custom domain, and 3 external identity providers.

[Pricing Plans](https://zitadel.com/pricing)

## Contributors for the win

19 contributions came from our community in May. 
Thank you for your the continued support and the time you put in to make the project better for everyone.

* [yordis](https://github.com/yordis) helped us bring the typescript repo for our next gen login UI significantly forwards
* Never forget to activate your email service provider with this change from [doncicuto](https://github.com/doncicuto)
* Also by [doncicuto](https://github.com/doncicuto) comes a solution to a  community request, adding customization options to console navigation buttons
* [sujoysb](https://github.com/sujoysb) improved the error messages and user feedback for password complexity validations
* [calRobert](https://github.com/CalRobert), [jayPe69](https://github.com/jayPe69), [aurel004](https://github.com/aurel004), [burahimu](https://github.com/burahimu) all helped with our translations, and typos (is our French that bad? Apologies.)
* [cr1cr1](https://github.com/cr1cr1), [exeteres](https://github.com/exeteres), [kleberbaum](https://github.com/kleberbaum) contributed various improvement to our Charts
* Sign tokens FAPI-compliant with ES256 and PS256 thanks to [nannany](https://github.com/nannany)
* [ymarcus93](https://github.com/ymarcus93) increased compatibility with certain identity providers and fixed some issues around the library

## Additional resources

* [Passkeys: A Shattered Dream](https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/)
* [The SaaS Trends Report | Q1 2024 | Vendr](https://www.vendr.com/insights/saas-trends-report-q1-2024#top-categories-renewed) - Cybersecurity at the top
* [Navigating Session Logouts, Timeouts, and Token Expiry](https://zitadel.com/blog/session-timeouts-logouts)
* [Google Online Security Blog: On Fire Drills and Phishing Tests](https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html)

New Success Story: [Achieving 70% Faster B2B Integration in Document Automation at BLP Digital](https://zitadel.com/blog/success-story-blp)

Thanks for reading, \
Max


Updates on ZITADEL, and tips and tricks to simplify your identity infrastructure for May 2024. In this episode we highlight improvements to SAML IdPs, managing resources programmatically, and scaling to millions of identities.

Product Newsletter May 2024

BLP Digital experienced significant operational improvements after implementing ZITADEL, highlighted by the following key achievements:

- **70% faster B2B client integration** 
- **Full migration in just 4 weeks** 
- **50% reduction in machine user management overhead**


<img
    src="/blog/2024-05-14-success-story-blp-01.jpg"
    width="100%"
    height="75%"
    alt="Banner Image"
    style={{ margin: '0 auto' }}
  />


## Company Background

[BLP Digital AG](https://www.blp-digital.com/en/), which sprang from a pioneering project at the Swiss Federal Institute of Technology (ETH Zurich) in 2018, focuses on leveraging the latest neural network advancements to automate document-based ERP processes. The founding team, comprising both entrepreneurs and machine learning pioneers, officially formed the company in 2019, earning the prestigious ETH Zurich spin-off label. Today, driven by a team of over 50 skilled software engineers and business experts, BLP Digital serves a diverse global clientele, adapting to 20 languages and multiple regulatory environments. Their SaaS solution targets medium to large-sized industrial companies, trading companies, retailers, and financial institutions, all of whom benefit from high-volume document processing with minimal manual intervention.

## The Challenge

As BLP Digital expanded its services globally, it became clear that their existing Identity and Access Management (IAM) systems were inadequate. The company faced critical technical and financial challenges, particularly in creating a scalable and secure Single Sign-On (SSO) solution that adhered to open standards. The need for a more efficient and secure system became urgent as they planned to migrate thousands of active B2B users from traditional password systems managed through Auth0 to a streamlined SSO setup. 

## The ZITADEL Solution

After evaluating several options, including Keycloak, Firebase, Supertokens, and Ory, BLP Digital selected ZITADEL for its comprehensive capabilities. Through Role-Based Access Control (RBAC), flexible authentication options (including MFA and SSO), and simplified identity federation with a variety of corporate identity providers (including Microsoft Entra ID), ZITADEL significantly improved security and user experience.
ZITADEL stood out because of its:
- **Advanced Multi-Tenancy Capabilities**: Offering the ability to manage distinct, secure environments for each B2B client.
- **Flexible Hosting Options**: Including both cloud services for production environments and self-hosted setups for development, facilitating seamless integration into BLP Digital’s architecture.
- **Machine User Management**: Non-interactive accounts are vital for authorizing automated processes and backend services. This capability ensures secure and seamless service execution, a feature not available with their previous provider, Auth0.
- **Commitment to Open Standards**: Ensuring flexibility and preventing vendor lock-in, crucial for future scalability.
- **Support Model**: The integration process evolved into a dynamic partnership, with BLP Digital working closely with ZITADEL to refine and adapt features to better meet their needs.

## Key Outcomes

- **70% Faster B2B Client Integration**: The time required to set up and manage B2B client environments was reduced from 5 hours to just 1.5 hours.
- **Full Migration in Just 4 Weeks**: Demonstrating ZITADEL’s exceptional adaptability and speed in deployment.
- **50% Reduction in Machine User Management Overhead**: ZITADEL’s service user feature halved the time and effort required to manage backend services and automate processes.

## Testimonials

<img
  src="/blog/2024-05-14-success-story-blp-02.jpg"
  width="250px"
  alt="Portrait of Tim Beck"
/>

“As a leading SaaS company serving tens of thousands of users, we prioritize a robust and reliable authentication solution. After extensive research for the best provider, we were impressed by ZITADEL’s exceptional flexibility and cutting-edge technology. Their seamless integration and unwavering support have significantly enhanced our platform's security, making them an invaluable partner in our growth.”

- [Tim Beck](https://www.linkedin.com/in/timbeque/), Founder and CEO, [BLP Digital AG](https://www.blp-digital.com/en/)


Discover how BLP Digital uses ZITADEL's IAM features to boost their document automation services across B2B platforms.

Achieving 70% Faster B2B Integration in Document Automation at BLP Digital


We're thrilled to announce a significant milestone for ZITADEL: exceeding 100 paying customers as we entered 2024! This achievement marks a pivotal moment in our journey to establish ZITADEL as the leading open-source identity infrastructure platform.

While reaching over 7,000 GitHub stars, having 160+ active contributors across our projects, and a thriving 2,000-member Discord community are fantastic signs of our growing popularity, winning the trust of over 100 paying customers by the start of 2024 demonstrates the demand for a modern identity platform like ZITADEL and sets the stage for continued, rapid growth.

Our customers represent a diverse range of organizations who have chosen ZITADEL for its:

* **Unmatched security and transparency:** The open-source nature of ZITADEL fosters trust and allows for independent security audits, ensuring robust protection for user data.
* **Flexibility and customization:** ZITADEL empowers businesses to tailor its functionalities to their specific needs, offering a high degree of control over their identity infrastructure.
* **Self-hosting:** Many smaller customers trust the scalability and the peace of mind offered by our managed cloud service. Businesses have the option of self-hosting ZITADEL, granting complete control over user data and deployment environment, with support available for added peace of mind.
* **Advanced multi-tenancy:** ZITADEL's robust multi-tenancy features are ideal for B2B scenarios. It allows organizations to manage multiple tenants (customers or partners) with data separation, customizable branding, and secure access control.
* **Enhanced SSO and MFA:** Our customers want to replace their SSO and MFA capabilities with a more robust solution that offers technical and operational scalability. ZITADEL provides teams the functionality to manage their own security policies and SSO configuration coupled with modern phishing-resistant, multifactor authentication methods.

This milestone is a testament to the incredible work done by our amazing community and the unwavering commitment of our team. We are deeply grateful for the trust our customers have placed in ZITADEL, and we remain focused on providing the best possible open-source identity solution.

Join us on this exciting journey! Simplify your identity infrastructure and [get started with ZITADEL Cloud](https://zitadel.com) today.

Together, let's build an open and secure identity infrastructure!


ZITADEL is on Track towards Building the Best Open source Identity Infrastructure

Celebrating 100+ Paying Customers


This is Max from ZITADEL. As always, I would like to highlight some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.

Summarizing the April product updates for ZITADEL is a difficult task. While we continue to work on the big roadmap items, the team worked diligently to address improvements ranging from new security features to performance enhancements to secure millions of identities. We shipped over 76 features, improvements, and bug fixes to our products. For those keeping score, that is nearly 400 year to date.

### Feature highlights

Let me share some of the more noteworthy features that were shipped during the month of April.

#### Setup your email provider - easier than ever

A generous contribution from our open source community, simplifies the configuration of email delivery within ZITADEL by introducing SMTP provider templates. These templates offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

By the way, we strongly recommend replacing the pre-configured SMTP service in ZITADEL Cloud. The default provider is for demonstration purposes only and will not provide a reliable way to send emails to your users.

![SMTP provider settings in ZITADEL Console](/blog/2024-05-07-zitadel-product-newsletter-april-2024-01.png)

#### Link accounts with external identity providers

There are situations where your users might have created an account in your application and only later on want to connect their social login or external identity provider.

As of now an error might have been shown to the user, since the IdP link was not known before, but the automatic federation / creation failed, because the information (e.g. username) already existed in ZITADEL.

With a newly introduced functionality, users can connect their account with an account provided by an external identity provider. Administrators can configure how accounts should be matched against usernames or email addresses. 

#### Experimental features

Over the past weeks we introduced feature flags into the core of ZITADEL. Feature flags allow administrators to opt-in or opt-out of experimental features that are not intended to be generally available. In April we finished the work by shipping the new feature settings into the Console. 

Our intention with feature settings is to provide means to access and test early features for users to test and provide feedback. Among the currently available functionalities are several performance improvements, OpenID Connect Token Exchange, a preview of User Schemas, and a preview of a more powerful Actions feature. Some settings allow you to roll-back some improvements that would result in issues to few users.

![Feature settings in ZITADEL Console](/blog/2024-05-07-zitadel-product-newsletter-april-2024-02.png)

#### Limit one-time password attempts

Similar to the existing lockout functionality for password attempts, Managers are able to configure automatic lockouts after a specified number of consecutive failed Time-based One-Time Password (TOTP) checks. The new feature strengthens security posture by mitigating brute-force attacks targeting (T)OTP verification.

Lockouts are applied independently for each TOTP method. This ensures users retain the ability to attempt alternative verification methods (e.g., email OTP) even after exceeding the threshold for a specific TOTP method (e.g., mobile app).

[View all changes on our new changelog](https://zitadel.com/changelog)

### ZITADEL Cloud for scale and simplicity: focus on what matters most

We have no plans of moving to a cloud only service. Let me state that right at the start. There are many reasons and use cases to go for an enterprise grade identity management solution that runs on your private infrastructure, ranging from compliance requirements and risk reduction to special cases such as embedded systems.

In a self-hosted setup you will not only be responsible for managing the infrastructure layer, but also the operational security aspects of the deployment. When using cloud you don’t have to worry about DDoS attacks, WAF configuration, or bot detection during login and register. These are all covered by our systems, have a look at our shared [responsibility matrix](https://zitadel.com/docs/legal/service-description/cloud-service-description#responsibilities) to learn more.

The Pro plan now includes 25’000 daily active users per month. The cost for additional daily active users was also reduced to offer you better scale. We will streamline our subscriptions and update all existing plans that use authenticated requests to an up-to-date plan. No action is required on your end, the changes will be applied automatically on July 1st.

### What we’re working on

#### Feedback wanted on Token Exchange

We are very happy to announce that OAuth 2.0 Token Exchange according to RFC 8693 landed in ZITADEL. This grant will lay the foundation for more advanced integration scenarios, including impersonation of users, token validation and exchange with third-party identity providers, and exchange of session tokens and OAuth tokens.

To get started, follow our integration guide on [Impersonation and delegation using Token Exchange](https://zitadel.com/docs/guides/integrate/token-exchange) and make sure to [enable the feature](https://zitadel.com/docs/guides/manage/console/default-settings#features) in the newly introduced feature settings.

We would very much like to get your feedback on the implementation and learn more about your use cases. Join the discussion on our Github repository.

[Github Discussions](https://github.com/zitadel/zitadel/discussions)

#### A new login UI in typescript for you to make your own

Already today you can use our [hosted login UI](https://zitadel.com/docs/guides/integrate/login/login-users) for the highest security standards. For a couple of months you are also able to use the Session API to [build your own login interface](https://zitadel.com/docs/guides/integrate/login-ui) and user flows.

We are currently working on a next generation of our login page, written in Typescript, that will replace our existing hosted login UI. The goal is to implement a login UI, using the session API of ZITADEL, which also implements the OIDC Standard and is ready to use for everyone.

In the first phase we want to have a MVP login ready with the OIDC Standard and a basic feature set. In a second step the features will be extended. 

As always, we value your early feedback, ideas, and contributions to the next generation of our - and hopefully your - login experience.

[To the Typescript Repo](https://github.com/zitadel/typescript)

### Better together

Our community members contributed 23 improvements and features to ZITADEL repositories. I want to thank you for your continued support and the time you put in to make the project better for everyone.

* The feature SMTP templates for the most popular email service providers was contributed by [doncicuto](https://github.com/doncicuto). Not only a great feature, but also a lot of testing involved - a special thanks for that contribution
* [aDogCalledSpot](https://github.com/aDogCalledSpot) added the option to use locally generated RSA keys for service users, avoiding keys being sent over the network instead
* [Doncicuto](https://github.com/doncicuto) contributed also to multiple parts of the console to fix reported issues, improving the overall usability of the UI and APIs
* [Compatibility](https://github.com/zitadel/oidc/issues/565) of oidc client device authorization grant with Google by [celian-garcia](https://github.com/celian-garcia)  and ability to verify ID tokens based on available sign algorithms from the discovery endpoint by [otakakot](https://github.com/otakakot)
* [vigneshsankariyer1234567890](https://github.com/vigneshsankariyer1234567890) improved UX where users switching between register and login got lost
* [celian-garcia](https://github.com/celian-garcia) , [jkroepke](https://github.com/jkroepke), and [otakakot](https://github.com/otakakot) improved error handling in our oidc library
* [yordis](https://github.com/yordis), [zoltantemesvari](https://github.com/zoltantemesvari), [ahmednfwela](https://github.com/ahmednfwela), and  [HaimKortovich](https://github.com/HaimKortovich) helped us to improve and keep our SDKs up-to-date
* Charts repository dependencies by [rud](https://github.com/rud) and improved configuration of ports [ameijboom](https://github.com/ameijboom) 
* Typos and corrections to docs [EthanHeilman](https://github.com/EthanHeilman),  [alexrimlin](https://github.com/alexrimlin), and [thamow](https://github.com/thamow)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion and get started with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [‘Worth exploring’ - Thoughtworks technology radar](https://www.thoughtworks.com/radar/platforms/zitadel)
* Video: [Complete Guide to Identity Federation and Brokering Using ZITADEL](https://www.youtube.com/watch?v=wg-ee-EnHdE)
* [Built with ZITADEL: 23 Technologies' Kubernetes-as-a-Service](https://zitadel.com/blog/success-story-23-technologies) 
* [Test Token Introspection in ZITADEL with Postman](https://zitadel.com/blog/testing-token-introspection-with-postman)

Thanks for reading,

Max


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for April 2024. In this episode we write about SMTP provider templates, limit attacks on OTP, and account linking. We also share what we are currently working on.

Product Newsletter April 2024


This is Max from ZITADEL. In this newsletter, I would like to highlight some of our product updates, and tips and tricks in making your identity infrastructure easier and more effective.
This is the March 2024 edition of our newsletter.

### Feature highlights

In March, the team shipped over 110 improvements and features to ZITADEL, including many bug fixes and stability improvements. We also delivered critical security patches for issues that were reported by the community and customers. Most of the new feature development in March contributes to our roadmap items and improves the user experience.

#### Easier integration with your frameworks

Simply set up a client application in your framework and programming language. You can choose your framework in the Console, and we take care of the default settings for you so you can get started even faster.

Of course, you can still integrate with any other framework or language.

![ZITADEL Console showing app creation screen with various programming languages and frameworks](/blog/2024-04-05-zitadel-product-newsletter-march-2024-01.png)

#### Better descriptions and tooltips

While you can use the APIs to configure ZITADEL, many users rely on the Console as a user interface to configure their system. Descriptions, tooltips, and labels of both the default settings and the organization settings pages were adapted for clarity and to provide more information to users.

The latest stable version is 2.43.11. You can find the [version of our stable release](https://zitadel.com/docs/support/software-release-cycles-support#stable) information in our documentation. Some features are only available in the latest versions.

### New docs resources

This month, we worked on several documentation resources to help developers use and integrate ZITADEL more effectively. 

* [How to handle session validation when building your own login UI](https://zitadel.com/docs/guides/integrate/login-ui/session-validation)
* [Using OKTA SAML IdP for single-sign-on](https://zitadel.com/docs/guides/integrate/identity-providers/okta-saml)
* [Using Entra ID SAML IdP for single-sign-on](https://zitadel.com/docs/guides/integrate/identity-providers/azure-ad-saml)
* [Code example for ZITADEL actions](https://zitadel.com/docs/apis/actions/code-examples)
* [Guide on how to login users with SSO in ZITADEL](https://zitadel.com/docs/guides/integrate/identity-providers/introduction)
* Reworked [service user authentication](https://zitadel.com/docs/guides/integrate/service-users/authenticate-service-users) and guides on [how to access ZITADEL APIs](https://zitadel.com/docs/guides/integrate/zitadel-apis/access-zitadel-apis)
* [Streaming audit logs to external systems such as SIEM/SOC](https://docs-git-external-idp-intro-zitadel.vercel.app/docs/guides/integrate/external-audit-log)

[Check out all our guides](https://zitadel.com/docs/guides/overview)

### Technical & security advisories

Technical advisories (“TA”) are notices about major issues with ZITADEL Self-Hosted or the ZITADEL Cloud platform that could potentially impact security or stability in production environments.   For example, we issue technical advisories if breaking behavior was introduced in a release or if you must expect downtime during an upgrade.

[Review and subscribe to our technical advisories](https://zitadel.com/docs/support/technical_advisory)

Security advisories are notices about security vulnerabilities that affect ZITADEL. While we patch ZITADEL Cloud automatically, these advisories are critical for self-hosted deployments. Make sure to subscribe to “Security alerts” on our GitHub repository, by clicking on “Unwatch”, then “Custom” and selecting “Security alerts”.

[Review past security advisories](https://github.com/zitadel/zitadel/security)

Both technical and security advisories contain the details about the issue, affected versions, and how to resolve the issue.

### What we’re working on

Behind the scenes, the team is continuously  developing and refining the next major feature and improvement.

We needed to make delivery of alpha (experimental) and beta features safer and easier for users. With the recent releases in March, we introduced feature flags via a [feature API](https://zitadel.com/docs/apis/resources/feature_service), allowing users to enable features that are not yet intended for general availability for testing purposes.

In March, we made significant progress on these features. Make sure to subscribe to the underlying GitHub issue to receive regular updates.

* [Impersonation](https://github.com/zitadel/zitadel/issues/7208) enables a functionality to impersonate users to act on behalf of other users. Our efforts in March focused on security settings, Manager roles, and token exchange. We expect to release a preview of the feature in the coming weeks.
* [User Schema](https://github.com/zitadel/zitadel/issues/6433): Implementation for user schemas has started with the first APIs becoming available. This feature is still experimental and behind a feature flag.

[Roadmap](https://zitadel.com/roadmap)

### Community building: Contributions and feedback

Token exchange (RFC8693) is a permissive standard that we will implement to facilitate use cases, such as the impersonation of users. We hope to gather some feedback on our implementation from our community.

Give your [feedback on Token Exchange and impersonation](https://github.com/zitadel/zitadel/discussions/7624).

In March, our community contributed to ZITADEL and our libraries again. Thank you for your continuous support!

* [ay4toh5](https://github.com/ay4toh5i) implemented the OpenID Connect  form_post response mode, increasing interoperability with client applications of our zitadel/oidc library and in the further development of ZITADEL itself.
* [doncicuto](https://github.com/doncicuto) added expiration date information for service users’ keys. Keys expire at midnight (UTC), and that information was previously not displayed to users.
* [vigneshsankariyer1234567890](https://github.com/vigneshsankariyer1234567890) realized we were misaligned with our login button in the email verification and fixed it, while [github-tijlxyz](https://github.com/github-tijlxyz) corrected a mistake in our keycloak migration guide
* [bjw-s](https://github.com/bjw-s) and [pisarz](https://github.com/pisarz) improved our charts allowing additional pod labels and introducing parametrization to probe schemes
* [PaulHiryliuk](https://github.com/PaulHiryliuk) and [petrmifek](https://github.com/petrmifek) helped by reviewing and improving  Czech and Russian translations

We are really grateful to receive all the big and small contributions and the countless feedback and improvement ideas. In case you want to contribute, start with our [contribution guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md).

### Additional resources

* [On our blog: Test your web app login flow with Postman](https://zitadel.com/blog/testing-login-with-postman)
* [ROSS Index: ZITADEL as one of the top trending open-source startups in 2023](https://runacap.com/ross-index/annual-2023/)
* [Transforming Identity and Access Management with Event Sourcing](https://thenewstack.io/transforming-identity-and-access-management-with-event-sourcing/)
* [ZITADEL as Identity Provider for NetBird](https://docs.netbird.io/selfhosted/identity-providers)
* [Load testing ZITADEL using K6](https://medium.com/@harsha_reddy/load-testing-zitadel-using-k6-a68328c89b33)


Updates on ZITADEL, and tips and tricks in making your identity infrastructure easier and more effective for March 2024. This edition includes improvements to the console, new docs resources, and things we are working on right now.

Blog.