Yes the problem these days is a lot of commercial providers want this to become "common knowledge" and for it to be "best practice" to use their systems. But what happens if Okta has a data breach and you don't even know if your users were affected? (This happened)
I strongly believe in rolling your own auth:
1. It keeps it simple
2. You control the data that's a critical part of your system
3. Okta and Auth0 are giant targets because they have so many peoples' creds - you aren't
4. Even if you do use something like Auth0, you still need to implement authorization somehow. Of course, there are people who want to sell you solutions for that too...
Use libraries for the underlying primitives like bcrypt and JWT's. Do the rest yourself. Keep it simple.
Oh, and keep it simple.
The one good reason I've seen recently to use third party auth services is because they often support MFA. But how many companies actually need that? I've worked for a bunch of companies over my career and the amount of times I've had to implement/add MFA is 0.