Skip to main content
In some cases, you may find it useful to exclude resources from being managed. This could be because your tenant has a large number of a particular resource and itโ€™s operationally burdensome to manage them, or your development workflow only pertains to a specific subset of resources and youโ€™d like to omit all other resources for performance. Regardless, there are several options available for excluding resources when using the Deploy CLI.

โ€‹
Exclude entire resources by type

For more complex tenants, you may find yourself wanting to omit entire resource types. For example:
  • Enterprise tenant with thousands of organizations, where managing all would be operationally burdensome.
  • CI/CD process only focuses on managing roles, and you want to exclude all others.
  • Feature development pertains to hook, and you want to temporarily exclude all others to optimize performance.
This type of exclusion is expressed by passing an array of resource names into either theย AUTH0_EXCLUDEDย orย AUTH0_INCLUDED_ONLYย configuration properties. Theย AUTH0_EXCLUDEDย configuration property excludes only the resource types provided to it. Inversely, theย AUTH0_INCLUDED_ONLYย property excludes all properties except the ones defined. Exclusion worksย bi-directionally, that is, both when export from Auth0 and importing to Auth0, regardless if resource configuration files exist or not. All supported resource values for exclusion: actions, attackProtection, branding, clientGrants, clients, connections, customDomains, databases, emailProvider, emailTemplates, guardianFactorProviders, guardianFactorTemplates, guardianFactors, guardianPhoneFactorMessageTypes, guardianPhoneFactorSelectedProvider, guardianPolicies, logStreams, migrations, organizations, pages, prompts, resourceServers, roles, tenant, triggers.

โ€‹
Exclusion example

The following example shows how to exclude clients, connections, databases, and organizations from being managed by the Deploy CLI.

โ€‹
Inclusion example

The following example shows how to specify to onlyย manageย actions,ย clientsย andย connectionsย by the Deploy CLI.

โ€‹
Exclude single resources by ID

Some resource types support exclusions of the individual resource by ID. This is useful if you work in a multi-environment context and wish to omit a production-specific resource from your lower-level environments. This method is supported for rules, clients, databases, connections and with the AUTH0_EXCLUDED_RULES, AUTH0_EXCLUDED_CLIENTS, AUTH0_EXCLUDED_DATABASES, AUTH0_EXCLUDED_CONNECTIONS, AUTH0_EXCLUDED_RESOURCE_SERVERS configuration values respectively.

โ€‹
Example

Excluding resources by ID is being considered for deprecation in future major versions. See the resource exclusion proposal for more details.

โ€‹
Omission and empty states

In addition to excluding resources, which forcefully ignore configurations bi-directionally, the Auth0 Deployย  CLI supports two similar concepts: omission and empty states.

โ€‹
Omission

Resource configuration that is absent, either intentionally or unintentionally, will be skipped during import. For example, if your resource configuration were deleted, it would be skipped during import and would not alter the state of the remote tenant. There is no concept of omission for exporting. Unless specifically excluded, all your tenant configurations will be written to resource configuration files.

โ€‹
Example

โ€‹
Empty

Resource configuration that is explicitly defined as empty. For set-based configurations like hooks, organizations, and actions, setting these configurations to an empty set expresses an intentional emptying of those resources. This would signal a deletion, so long as the AUTH0_ALLOW_DELETE deletion configuration property is enabled. To learn more about this property, read Configure the Deploy CLI. For non-set-based resource configuration like tenant and branding, the concept of emptiness does not apply, and will not trigger any deletions or removals.

โ€‹
Example of emptiness