--- description: Learn how to secure self-hosted and SaaS applications with Cloudflare One. Configure a unified dashboard for seamless access and security. title: Cloudflare One image: https://developers.cloudflare.com/cloudflare-one/og.png?v=f7b33ed7a4a33247 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare One Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Secure your organization with Cloudflare One — a cloud security platform that replaces legacy perimeters with Cloudflare's global network. Available on all plans Cloudflare One is Cloudflare's [Secure Access Service Edge (SASE) ↗︎](https://www.cloudflare.com/learning/access-management/what-is-sase/) platform. SASE is an architectural model that unifies enterprise networking services with Zero Trust security. [Zero Trust ↗︎](https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/) is a security model designed around the principle of least privilege. In the past, once you logged into a corporate network, you were "trusted" to move around freely. Zero Trust changes that. It assumes that threats can exist both outside and inside the network. Therefore, every request is authenticated and authorized based on identity and context before granting access. The Cloudflare One platform allows organizations to move away from a patchwork of hardware appliances and point solutions. Instead, it consolidates security and networking through a unified control plane that includes products like [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/), [Secure Web Gateway (SWG)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/), [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/), [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/), [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/), [Cloud Access Security Broker (CASB)](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/), and [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/). Refer to our [SASE reference architecture](https://developers.cloudflare.com/reference-architecture/architectures/sase/) to learn how to plan, deploy, and manage SASE architecture with Cloudflare. [Get started](https://developers.cloudflare.com/cloudflare-one/setup/) [Cloudflare dashboard](https://dash.cloudflare.com/) [Implementation guides](https://developers.cloudflare.com/cloudflare-one/implementation-guides/) ## Products [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) Authenticate users accessing your applications, seamlessly onboard third-party users, and log every event and request. [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) Securely connect your resources to Cloudflare without exposing a public IP by using Cloudflare Tunnel, which establishes outbound-only connections from your infrastructure to Cloudflare's global network via the lightweight `cloudflared` daemon. [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) Connect devices and private networks to each other with post-quantum encrypted mesh networking, using Cloudflare Mesh nodes instead of a central concentrator. [Secure Web Gateway (SWG)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) Inspect and filter DNS, network, HTTP, and egress traffic to enforce your company's Acceptable Use Policy (UAP), block risky sites with custom blocklists and threat intelligence, and enhance visibility and protection across SaaS applications. [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) Protect corporate devices by privately sending traffic from those devices to Cloudflare's global network, build device posture rules, and enforce security policies anywhere. [Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) Mitigate the impact of attacks by executing all browser code in the cloud and securely browse high-risk or sensitive websites in a remote browser. [Cloud Access Security Broker (CASB)](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) Protect users and sensitive data at rest in SaaS applications and cloud environments, scan for misconfigurations, and detect insider threats as well as unsanctioned application usage to prevent data leaks and compliance violations. [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) Scan your web traffic and SaaS applications for the presence of sensitive data such as social security numbers, financial information, secret keys, and source code. [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) Configure policies to manage your inbox, automatically move emails based on disposition, and use screen criteria to investigate messages. [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) Monitor device, network, and application performance across your Zero Trust organization. [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) Replace legacy MPLS and SD-WAN circuits by connecting branch sites, data centers, and cloud networks to Cloudflare over IPsec, GRE, or direct interconnect. [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) Connect branch sites to Cloudflare One using a Cloudflare-managed hardware or virtual appliance. [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Filter traffic at the network layer with firewall-as-a-service, applying packet filtering rules before traffic reaches your infrastructure. [Multi-Cloud Networking](https://developers.cloudflare.com/multi-cloud-networking/) Discover resources across your public cloud accounts and manage connectivity between them from a single control plane. [Data Localization Suite](https://developers.cloudflare.com/data-localization/) Control the regions where Cloudflare inspects and stores your traffic data, to meet data residency requirements. --- ## More resources ### [SASE video series](https://developers.cloudflare.com/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) New to Zero Trust and SASE? Get started with our introductory SASE video series. ### [Reference architecture](https://developers.cloudflare.com/reference-architecture/architectures/sase/) Explore our reference architecture to learn how to evolve your network and security architecture to Cloudflare One, our SASE platform. ### [Plans](https://www.cloudflare.com/plans/zero-trust-services/) Cloudflare Zero Trust offers both Free and Paid plans. Access to certain features depends on a customer's plan type. ### [Limits](https://developers.cloudflare.com/cloudflare-one/account-limits/) Learn about account limits. These limits may be increased on Enterprise accounts. ### [Support](https://developers.cloudflare.com/cloudflare-one/troubleshooting/) Find troubleshooting guides for Cloudflare One products and learn how to collect information for Support. ### [Community](https://community.cloudflare.com/) Ask questions, get answers, and share tips. Note Enterprise customers can preview this product as a [non-contract service](https://developers.cloudflare.com/billing/understand/preview-services/), which provides full access, free of metered usage fees, limits, and certain other restrictions. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/#page","headline":"Cloudflare One","description":"Learn how to secure self-hosted and SaaS applications with Cloudflare One. Configure a unified dashboard for seamless access and security.","url":"https://developers.cloudflare.com/cloudflare-one/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/og.png?v=f7b33ed7a4a33247","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Set up Cloudflare Zero Trust for your organization. Choose a use case to get started with a guided quick-start. title: Get started image: https://developers.cloudflare.com/cloudflare-one/setup/og.png?v=a03497584ce80063 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Get started Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Set up Cloudflare Zero Trust to protect your users, devices, and networks. Complete the prerequisites below, then choose a use case to get started. ## Prerequisites Before you begin any use case, you need a Cloudflare account and a Zero Trust organization. ### 1. Create a Cloudflare account Sign up for a [Cloudflare account ↗︎](https://dash.cloudflare.com/sign-up) and enable two-factor authentication. ### 2. Create a Zero Trust organization 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), select **Zero Trust**. 2. On the onboarding screen, choose a team name. The team name is a unique, internal identifier for your Zero Trust organization. Users will enter this team name when they enroll their device manually, and it will be the subdomain for your App Launcher (as relevant). Your business name is the typical entry. You can find your team name in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) by going to **Zero Trust** > **Settings**. 3. Complete your onboarding by selecting a subscription plan and entering your payment details. If you chose the **Zero Trust Free plan**, this step is still needed but you will not be charged. When you create your organization, Cloudflare automatically adds the [Cloudflare identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method, so your users can sign in with their Cloudflare account credentials right away. You can add a [one-time PIN](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/) or connect a [third-party identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/) at any time. ## What would you like to do? These use cases match the guided onboarding in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com). To follow along in the dashboard, select **Get Started**. ### [Replace your VPN](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/) Give remote users, offices, and devices secure access to private networks and applications without a traditional VPN. ### [Secure access to private apps from any browser](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/) Provide browser-based access to internal web applications, SSH servers, and RDP sessions without installing software on user devices. ### [Filter DNS to block threats](https://developers.cloudflare.com/cloudflare-one/traffic-controls/get-started/dns/) Set up DNS filtering to block malware, phishing, and unwanted content across your network in minutes. ### [Secure web traffic from threats](https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/) Inspect and filter all Internet-bound traffic from your users to block threats, enforce acceptable use policies, and prevent data loss. Note For in-depth deployment guides that cover policy design and advanced configuration, refer to [Implementation guides](https://developers.cloudflare.com/cloudflare-one/implementation-guides/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/#page","headline":"Get started","description":"Set up Cloudflare Zero Trust for your organization. Choose a use case to get started with a guided quick-start.","url":"https://developers.cloudflare.com/cloudflare-one/setup/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/og.png?v=a03497584ce80063","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Replace your traditional VPN with Cloudflare Zero Trust. Choose a connection scenario to get started. title: Replace your VPN image: https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/og.png?v=a83b5519cbdcef1e --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Replace your VPN Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare One uses Cloudflare's global network and Zero Trust Network Access (ZTNA) to replace traditional VPNs. After you securely connect your devices and resources to Cloudflare, you can set policies to verify every request based on identity and context, reducing your attack surface and improving performance for remote users. For more background, refer to [Why should you replace your VPN?](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/why-vpn/) How you set this up depends on what needs to connect to what. Choose the scenario that matches your use case: ### [Device to network](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-network/) Connect remote users to internal applications and services through a secure connection. Best for remote access to private networks. ### [Device to device](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-device/) Create secure, direct connections between two or more devices through Cloudflare's network using Mesh IPs. Best for device-to-device communication. ### [Network to network](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/network-to-network/) Connect two or more private networks bidirectionally through Cloudflare. Best for linking offices, data centers, or cloud environments. Note For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/#page","headline":"Replace your VPN","description":"Replace your traditional VPN with Cloudflare Zero Trust. Choose a connection scenario to get started.","url":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/og.png?v=a83b5519cbdcef1e","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Connect a remote device to a private network using Cloudflare Tunnel and the Cloudflare One Client. title: Device to network image: https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-network/og.png?v=c1e63d3eb863ff71 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Device to network Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-network/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Connect a remote device to a private network so your users can securely access internal applications and services from anywhere, without the security risks and performance bottlenecks of a traditional VPN. To explore other connection scenarios, refer to [Replace your VPN](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/). This guide follows the same steps as the **Get Started** onboarding wizard in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com). ## How it works [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) is a network connector that creates an outbound-only connection between your private network and Cloudflare. No open inbound ports or firewall changes are required. The [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) is an app that you install on each user's device. It routes traffic through Cloudflare and into the tunnel, so users can reach internal resources from anywhere. ## Prerequisites - A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](https://developers.cloudflare.com/cloudflare-one/setup/). - A Linux, Windows, or macOS device on your private network to run the tunnel. - A Linux, Windows, or macOS device to install the Cloudflare One Client on. ## Step 1: Assign a Tunnel Cloudflare Tunnel establishes an outbound connection between your resources and Cloudflare. This is how new devices can reach your private network. You can install Tunnel on any Windows, Mac, or Linux device currently in your private network. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Replace my client-based or site-to-site VPN**, select **Get started**. 3. For **Device to network**, select **Continue**. 4. On the **Connect a remote device to a private network** screen, select **Continue**. 5. On the **Assign a Tunnel** screen, use the dropdown to choose an existing tunnel or create a new one. 6. Select **Continue**. ## Step 2: Set your Tunnel's IP range Add the IP range of your private network to the tunnel. This defines which internal resources your remote users can reach. Your tunnel accepts traffic to this range from devices enrolled in your Zero Trust organization. 1. Enter your IP range (for example, `10.0.1.0/24`). 2. Select **Continue**. Note If you are not sure of your IP range, check your router or network settings. ## Step 3: Deploy your Tunnel Install the `cloudflared` connector on a device in your private network and run the tunnel. This service creates the secure connection between your network and Cloudflare. 1. Select your device's operating system and architecture. 2. Copy the install command and run it on your device. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. For macOS, the command looks similar to: ```sh brew install cloudflared && sudo cloudflared service install ``` For Windows and Linux, the dashboard provides a download link and install command for your selected architecture. For more download options, refer to [Downloads](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/). 3. After `cloudflared` connects, the dashboard confirms the tunnel is active. 4. Select **Continue**. ## Step 4: Enroll your devices Device enrollment controls which users can connect their devices to your private network through Cloudflare. In this step, you register your first device by providing an email address and installing the Cloudflare One Client. 1. Enter the email you want to use to enroll your first device. 2. Select your device's operating system. 3. Select **Download to continue** to download the Cloudflare One Client, or copy the download link to send to a different device. 4. Select **Continue**. Note You can manage device enrollment permissions later in **Team & Resources** > **Devices**. ## Step 5: Complete Cloudflare One Client setup On your device, complete the Cloudflare One Client installation wizard. Then connect the Cloudflare One Client to your Zero Trust organization. For comprehensive OS-specific instructions, refer to [Manual deployment](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/). 1. Open the Cloudflare One Client. On macOS, select the Cloudflare icon in your status bar. On Windows, select the Cloudflare icon in your system tray. 2. Go to **Preferences** > **Account** > **Login to Cloudflare Zero Trust**. 3. Enter your team name when prompted. Your team name is the unique identifier for your Zero Trust organization and was set when the organization was created. The dashboard displays your team name on this screen for easy reference. Note To find or change your team name, go to **Settings** > **Team name** and select **Edit**. 4. Complete the authentication steps. 5. The Cloudflare One Client should show as **Connected**. 6. Select **Continue** in the dashboard. ## Step 6: Verify your connection The dashboard confirms that you are securely connected. You now have remote access between your device and your private network resources. To verify connectivity, try reaching a resource on your private network (for example, `http://10.0.1.100` or `ssh 10.0.1.50`). ## Recommended next steps After verifying your connection, consider securing your private network with policies and access controls: - **Set up Gateway policies**: By default, all enrolled devices can reach your entire private network. Gateway policies let you scan, filter, and log traffic between your devices and your private network. For more information, refer to [DNS policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/), and [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). - **Create an Access application**: Restrict access to specific applications or hostnames on your private network with identity-based rules. For more information, refer to [Secure a private IP or hostname](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). - **Explore more with Zero Trust**: Review your tunnel, policies, and connected devices in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com). For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/). ## Troubleshoot If you have issues connecting, refer to these resources: - [Troubleshoot WARP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/): resolve Cloudflare One Client connection and enrollment issues. - [Troubleshoot tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-network/#page","headline":"Device to network","description":"Connect a remote device to a private network using Cloudflare Tunnel and the Cloudflare One Client.","url":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-network/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-network/og.png?v=c1e63d3eb863ff71","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Private networks"]} ``` --- --- description: Create a secure connection between two devices using Cloudflare Mesh and Cloudflare's network. title: Device to device image: https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-device/og.png?v=05e3b5fbcfb75d10 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Device to device Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-device/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Create a secure connection between two devices so they can communicate directly through Cloudflare's network, without needing to be on the same physical network. This is useful when you need to remotely access a specific device, for example connecting to a home computer from a laptop at a coffee shop. To explore other connection scenarios, refer to [Replace your VPN](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/). ## How it works The [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) is an app that you install on each device you want to connect. When you enroll a device in your Cloudflare account, it is assigned a [Mesh IP](https://developers.cloudflare.com/cloudflare-one/networks/routes/reserved-ips/#device-ips). Devices use their Mesh IPs to communicate with each other through Cloudflare's network. This works for most common types of network traffic, including web requests, remote desktop, file sharing, and ping. Only devices enrolled in your Cloudflare account can reach these addresses, so they are not accessible to anyone outside your organization. No tunnel infrastructure or network configuration is required, and the connection does not disrupt existing traffic on your network. For more details, refer to [Connect client devices](https://developers.cloudflare.com/mesh/guides/connect-client-devices/). ## Prerequisites - A [Cloudflare account ↗︎](https://dash.cloudflare.com/sign-up) - Two Linux, Windows, macOS, Android, or iOS devices you want to connect together. ## Step 1: Enroll your first device The Mesh dashboard provides the Cloudflare One Client installer and organization name. 1. In the Cloudflare dashboard, go to **Networking** > **Mesh**. [Go to **Mesh** ↗](https://dash.cloudflare.com/?to=/:account/mesh) 2. Select **Add participant** > **Add device**. 3. Select your platform and use the provided link or QR code to install the Cloudflare One Client. 4. Open the client and select **Cloudflare Zero Trust** when prompted for a connection type. 5. Enter the organization name displayed in the Mesh dashboard and sign in. ## Step 2: Enroll your second device Both devices must be enrolled in your Cloudflare account for the connection to work. 1. Download the Cloudflare One Client on your second device. 2. Open the client, enter the same team name, and sign in. 3. The client should show as **Connected** on both devices. ## Step 3: Verify your connection Both devices are now connected through Cloudflare's network using their assigned Mesh IPs. To view your device's assigned Mesh IP: 1. In the Cloudflare dashboard, go to **Networking** > **Mesh**. [Go to **Mesh** ↗](https://dash.cloudflare.com/?to=/:account/mesh) 2. Your connected devices appear with their Mesh IPs. To test connectivity, `ping` the Mesh IP of one device from the other. ## Recommended next steps After verifying your connection, consider securing your connected devices with policies and access controls: - **Set up Gateway policies**: By default, all enrolled devices can reach each other over the Mesh IP space. Gateway policies let you scan, filter, and log traffic between your devices. For more information, refer to [DNS policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/), and [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). - **Create an Access application**: Restrict access to specific destinations on enrolled devices with identity-based rules. For more information, refer to [Secure a private IP or hostname](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/). ## Troubleshoot If you have issues connecting, try these steps: - **Windows users**: Windows Firewall blocks device-to-device traffic by default. You may need to add a firewall rule that allows incoming traffic from `100.96.0.0/12`. For details, refer to [Connect client devices](https://developers.cloudflare.com/mesh/guides/connect-client-devices/). - [Troubleshoot the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/): resolve connection and enrollment issues. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-device/#page","headline":"Device to device","description":"Create a secure connection between two devices using Cloudflare Mesh and Cloudflare's network.","url":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-device/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/device-to-device/og.png?v=05e3b5fbcfb75d10","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Private networks"]} ``` --- --- description: Connect two private networks using Cloudflare Mesh nodes and Cloudflare's network. title: Network to network image: https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/network-to-network/og.png?v=43aefad2275200ab --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Network to network Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/network-to-network/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Connect two separate private networks so devices on each network can send and receive traffic in both directions through Cloudflare. This is useful when you need to link office locations, data centers, or cloud environments. For example, employees in one office could access a file server, printer, or internal application in another office. To explore other connection scenarios, refer to [Replace your VPN](https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/). ## How it works [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) (formerly WARP Connector) lets you deploy mesh nodes — lightweight network connectors that you install on a single Linux device in each network. That device handles traffic for the entire network: it sends outbound traffic to Cloudflare and receives inbound traffic back, then passes it to the right device on the network. Because of this, other devices on the network do not need to install any software. ## Prerequisites - A [Cloudflare account ↗︎](https://dash.cloudflare.com/sign-up). - A Linux device or virtual machine on your first private network. This is where you install your first mesh node. - A second Linux device or virtual machine on a separate private network. This is where you install your second mesh node. Note Mesh nodes are currently Linux-only. For more details on requirements, refer to [Cloudflare Mesh](https://developers.cloudflare.com/mesh/). ## Step 1: Create your first mesh node 1. In the Cloudflare dashboard, go to **Networking** > **Mesh**. [Go to **Mesh** ↗](https://dash.cloudflare.com/?to=/:account/mesh) 2. Select **Add participant** > **Add node**. 3. Enter a name for the node (for example, `office-a`). 4. Follow the wizard to configure enrollment and device profile settings. 5. Copy the install commands from the wizard and run them on your Linux device. 6. After the node connects, the dashboard confirms it is online. ## Step 2: Add a route for the first network 1. Go to the node detail page for your first node. 2. Select the **Routes** tab. 3. Select **Add a route**. 4. Enter the IP range of your first network (for example, `10.0.0.0/24`). 5. Select **Create**. ## Step 3: Create your second mesh node Repeat [Step 1](#step-1-create-your-first-mesh-node) on a Linux device in your second network. Give it a distinct name (for example, `office-b`). ## Step 4: Add a route for the second network Repeat [Step 2](#step-2-add-a-route-for-the-first-network) for your second node, entering the IP range of your second network (for example, `192.168.1.0/24`). The IP range must not overlap with your first network. ## Step 5: Forward device traffic If the mesh node is installed on your network's router (the device that serves as the default gateway), other devices on the network automatically send traffic through it. No additional configuration is needed, and you can skip this step. If the mesh node is installed on a different device, other devices on the network need a static route so they know to send cross-network traffic to the mesh node. Without this route, devices do not know where to send traffic destined for the other network. For details on routing options, refer to [Routes](https://developers.cloudflare.com/mesh/features/routes/). ## Step 6: Verify your connection Devices on both networks can now communicate through Cloudflare. To verify connectivity, try reaching a device on the opposite network (for example, `ping 192.168.1.100` from a device on your first network). ## Recommended next steps After verifying your connection, consider securing your connected networks with policies and access controls: - **Set up Gateway policies**: By default, all traffic between your network segments flows through Cloudflare without restriction. Gateway policies let you scan, filter, and log traffic between your networks. For more information, refer to [DNS policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/), and [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). - **Create an Access application**: Restrict access to specific services or hosts on your connected networks with identity-based rules. For more information, refer to [Secure a private IP or hostname](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). - **Enable high availability**: Deploy multiple replicas of each mesh node for automatic failover. For more information, refer to [High availability](https://developers.cloudflare.com/mesh/features/high-availability/). For in-depth guidance on policy design and device posture checks, refer to the [Replace your VPN learning path](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/). ## Troubleshoot If you have issues connecting, refer to these resources: - [Tips and best practices](https://developers.cloudflare.com/mesh/best-practices/): review common Cloudflare Mesh configuration tips and troubleshooting strategies. - [Troubleshoot tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/network-to-network/#page","headline":"Network to network","description":"Connect two private networks using Cloudflare Mesh nodes and Cloudflare's network.","url":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/network-to-network/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/replace-vpn/network-to-network/og.png?v=43aefad2275200ab","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Linux","Private networks"]} ``` --- --- description: Provide browser-based access to internal web applications, SSH servers, and remote desktops without installing software on user devices. title: Secure private apps image: https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/og.png?v=4ccf8f46562fb97c --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Secure private apps Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare Access lets users reach internal applications through a browser without a VPN or client software on their device. You connect your application to Cloudflare using a secure connection called a tunnel, then protect it with policies that control who can access it. For more background, refer to [What is clientless access?](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/what-is-clientless-access/). How you set this up depends on the type of application you are securing. Choose the scenario that matches your use case: ### [Private web application](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/private-web-app/) Connect an internal web application to Cloudflare and control who can access it. Best for applications like company intranets, internal wikis, or admin panels. ### [Clientless SSH](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/clientless-ssh/) Provide in-browser command line access to an internal server without SSH client software on the user's device. ### [In-browser remote desktop](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/in-browser-rdp/) Provide in-browser remote desktop access to Windows hosts without remote desktop client software on the user's device. Note For in-depth guidance on clientless access and advanced configuration, refer to the [Clientless access learning path](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/what-is-clientless-access/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/#page","headline":"Secure private apps","description":"Provide browser-based access to internal web applications, SSH servers, and remote desktops without installing software on user devices.","url":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/og.png?v=4ccf8f46562fb97c","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Connect a private web application to Cloudflare and protect it with Access. title: Private web application image: https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/private-web-app/og.png?v=b769a5de220d7555 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Private web application Last updated Mar 26, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/private-web-app/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Connect a self-hosted web application to Cloudflare so authorized users can access it from a browser without a VPN. This is useful when you need to give employees or contractors secure access to applications like company intranets, internal wikis, or admin panels. To explore other access scenarios, refer to [Secure private apps](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/). This guide follows the same steps as the **Get Started** experience in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com). ## How it works [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) connects your private network to Cloudflare without opening any ports on your network. You install `cloudflared`, a connector service that runs in the background, on a device that can reach your application. It creates a secure connection from your network out to Cloudflare, so no firewall changes are required. [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/) sits in front of the application and verifies who each user is before letting them through. Users sign in through a browser using an email one-time PIN or your identity provider. ## Prerequisites - A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](https://developers.cloudflare.com/cloudflare-one/setup/). - An [active domain on your Cloudflare account](https://developers.cloudflare.com/fundamentals/manage-domains/add-site/). A public subdomain is created on this domain for your application. - A Linux, Windows, or macOS device on your private network that can reach the application. This is where you install the tunnel. - A running web application on your private network (for example, `http://10.10.1.25` or `http://grafana.local`). ## Step 1: Define your application In this step, you describe the internal application you want to make available through Cloudflare. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Set up secure access to private apps from any browser**, select **Get started**. 3. For **Connect a private web application**, select **Continue**. 4. On the **Connect and access private web applications** screen, select **Continue**. 5. Enter a name for your application (for example, `grafana-gcp`). 6. Enter the hostname or IP address where the application is running. Use the IP address if you are not sure (for example, `10.10.1.25`). 7. Select the protocol your application uses (HTTP or HTTPS). 8. Enter the port your application listens on. This is usually part of the URL you use to access the application locally (for example, the `80` in `http://10.10.1.25:80`). 9. Select **Continue**. ## Step 2: Select a public domain Your application needs a public URL so users can reach it from a browser. Cloudflare creates a public URL on one of your existing domains for the application. 1. Select a domain from the dropdown. 2. Enter a subdomain (for example, `grafana`). A preview of the full URL appears (for example, `grafana.example.com`). 3. Select **Continue**. ## Step 3: Add your first policy An Access policy controls who can reach your application. In this step, you create a simple policy using email-based one-time PINs. Users you add here receive a one-time PIN by email when they try to access the application. 1. Enter the email addresses of users you want to grant access to. 2. Select **Continue**. Note You can add your identity provider (for example, Okta or Google Workspace) to the application later. For more information, refer to [Identity providers](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). ## Step 4: Assign a tunnel A tunnel connects your private network to Cloudflare so traffic can reach your application. You can select an existing tunnel or create a new one. 1. In the **Choose or create a Tunnel** dropdown, select an existing tunnel or enter a name to create a new one. 2. Select **Continue**. ## Step 5: Deploy your tunnel Install `cloudflared` on a device in your private network that can reach the application. The dashboard generates commands specific to your operating system. 1. Select your operating system from the dropdown. 2. Copy and run the commands shown in the dashboard. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. 3. After the tunnel connects, select **Continue**. ## Step 6: Review details The dashboard confirms that your application is available and protected behind Cloudflare Access. ## Recommended next steps - **Test your application**: 1. Select **Test login** on the success screen. 2. On the Access login screen, enter one of the email addresses you added to your Access policy. 3. Select **Send me a code**. 4. Enter the code from your email and select **Sign in**. - **Explore more**: Review your applications and policies under **Zero Trust** > **Access controls**, and your tunnels in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) under **Networking** > **Tunnels**. - **Configure an identity provider**: Replace email one-time PINs with your organization's identity provider for a seamless login experience. For more information, refer to [Identity providers](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). For in-depth guidance on clientless access, refer to the [Clientless access learning path](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/what-is-clientless-access/). ## Troubleshoot If you have issues connecting, refer to these resources: - [Troubleshoot tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. - [Troubleshooting](https://developers.cloudflare.com/cloudflare-one/troubleshooting/): resolve common Zero Trust errors and issues. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/private-web-app/#page","headline":"Private web application","description":"Connect a private web application to Cloudflare and protect it with Access.","url":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/private-web-app/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/private-web-app/og.png?v=b769a5de220d7555","dateModified":"2026-03-26","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Private networks"]} ``` --- --- description: Provide in-browser SSH access to an internal server through Cloudflare Access. title: Clientless SSH image: https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/clientless-ssh/og.png?v=95f00f4bcff7f126 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Clientless SSH Last updated Mar 26, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/clientless-ssh/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Provide secure, in-browser command line access to an internal server without SSH client software on the user's device. This is useful when you need to give developers or IT staff remote access to servers for administration or troubleshooting from any browser. To explore other access scenarios, refer to [Secure private apps](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/). This guide follows the same steps as the **Get Started** experience in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com). ## How it works [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) connects your private network to Cloudflare without opening any ports on your network. You install `cloudflared`, a connector service that runs in the background, on a device that can reach your server. It creates a secure connection from your network out to Cloudflare, so no firewall changes are required. [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/) sits in front of the server and verifies who each user is before letting them through. Users sign in through a browser using an email one-time PIN or your identity provider, then interact with the server through an in-browser terminal. For details on connection methods and advanced configuration, refer to [Connect to SSH in the browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-browser-rendering/). ## Prerequisites - A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](https://developers.cloudflare.com/cloudflare-one/setup/). - An [active domain on your Cloudflare account](https://developers.cloudflare.com/fundamentals/manage-domains/add-site/). A public subdomain is created on this domain for your application. - A Linux, Windows, or macOS device on your private network that can reach the server. This is where you install the tunnel. - A server on your private network with SSH enabled. ## Step 1: Define your application In this step, you describe the internal server you want to make available through Cloudflare. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Set up secure access to private apps from any browser**, select **Get started**. 3. For **Configure clientless SSH access to an internal service**, select **Continue**. 4. On the **Zero Trust SSH terminal directly from your browser** screen, select **Continue**. 5. Enter a name for your application. 6. Enter the hostname or IP address of the server. Use the IP address if you are not sure (for example, `10.10.1.25`). 7. Enter the SSH port (the default is `22`). 8. Select **Continue**. ## Step 2: Select a public domain Your application needs a public URL so users can reach it from a browser. Cloudflare creates a public URL on one of your existing domains for the application. 1. Select a domain from the dropdown. 2. Enter a subdomain (for example, `grafana`). A preview of the full URL appears (for example, `grafana.example.com`). 3. Select **Continue**. ## Step 3: Add your first policy An Access policy controls who can reach your application. In this step, you create a simple policy using email-based one-time PINs. Users you add here receive a one-time PIN by email when they try to access the application. 1. Enter the email addresses of users you want to grant access to. 2. Select **Continue**. Note You can add your identity provider (for example, Okta or Google Workspace) to the application later. For more information, refer to [Identity providers](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). ## Step 4: Assign a tunnel A tunnel connects your private network to Cloudflare so traffic can reach your application. You can select an existing tunnel or create a new one. 1. In the **Choose or create a Tunnel** dropdown, select an existing tunnel or enter a name to create a new one. 2. Select **Continue**. ## Step 5: Deploy your tunnel Install `cloudflared` on a device in your private network that can reach the application. The dashboard generates commands specific to your operating system. 1. Select your operating system from the dropdown. 2. Copy and run the commands shown in the dashboard. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. 3. After the tunnel connects, select **Continue**. ## Step 6: Review details The dashboard confirms that your application is available and protected behind Cloudflare Access. ## Recommended next steps - **Test your application**: 1. Select **Test login** on the success screen. 2. On the Access login screen, enter one of the email addresses you added to your Access policy. 3. Select **Send me a code**. 4. Enter the code from your email and select **Sign in**. - **Explore more**: Review your applications and policies under **Zero Trust** > **Access controls**, and your tunnels in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) under **Networking** > **Tunnels**. - **Configure an identity provider**: Replace email one-time PINs with your organization's identity provider for a seamless login experience. For more information, refer to [Identity providers](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). For in-depth guidance on clientless access, refer to the [Clientless access learning path](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/what-is-clientless-access/). ## Troubleshoot If you have issues connecting, refer to these resources: - [Troubleshoot tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. - [Troubleshooting](https://developers.cloudflare.com/cloudflare-one/troubleshooting/): resolve common Zero Trust errors and issues. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/clientless-ssh/#page","headline":"Clientless SSH","description":"Provide in-browser SSH access to an internal server through Cloudflare Access.","url":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/clientless-ssh/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/clientless-ssh/og.png?v=95f00f4bcff7f126","dateModified":"2026-03-26","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Private networks"]} ``` --- --- description: Provide in-browser remote desktop access to Windows hosts through Cloudflare Access. title: In-browser remote desktop image: https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/in-browser-rdp/og.png?v=211ac59c15f0c7f4 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # In-browser remote desktop Last updated Mar 26, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/in-browser-rdp/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Provide secure, in-browser remote desktop access to Windows hosts without Remote Desktop Protocol (RDP) client software on the user's device. This is useful when you need to give IT staff or support teams remote access to Windows machines for administration or troubleshooting from any browser. To explore other access scenarios, refer to [Secure private apps](https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/). This guide follows the same steps as the **Get Started** experience in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com). ## How it works [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) connects your private network to Cloudflare without opening any ports on your network. You install `cloudflared`, a connector service that runs in the background, on a device that can reach the Windows host. It creates a secure connection from your network out to Cloudflare, so no firewall changes are required. [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/) sits in front of the host and verifies who each user is before letting them through. Users sign in through a browser using an email one-time PIN or your identity provider, then interact with the Windows desktop through an in-browser remote desktop session. For details on supported operating systems, connection methods, and known limitations, refer to [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). ## Prerequisites - A Cloudflare account with a Zero Trust organization. If you have not set this up, refer to [Get started](https://developers.cloudflare.com/cloudflare-one/setup/). - An [active domain on your Cloudflare account](https://developers.cloudflare.com/fundamentals/manage-domains/add-site/). A public subdomain is created on this domain for your application. - A Linux, Windows, or macOS device on your private network that can reach the Windows host. This is where you install the tunnel. - A Windows host on your private network that accepts Remote Desktop connections. ## Step 1: Define your application In this step, you describe the Windows host you want to make available through Cloudflare. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), select the **Get Started** tab. 2. For **Set up secure access to private apps from any browser**, select **Get started**. 3. For **Enable in-browser remote desktop sessions to Windows hosts**, select **Continue**. 4. On the **Zero Trust RDP client directly from your browser** screen, select **Continue**. 5. Enter a name for your application. 6. Enter the local IP address of the Windows host (for example, `10.10.1.25`). 7. Enter the RDP port (the default is `3389`). 8. Select **Continue**. ## Step 2: Select a public domain Your application needs a public URL so users can reach it from a browser. Cloudflare creates a public URL on one of your existing domains for the application. 1. Select a domain from the dropdown. 2. Enter a subdomain (for example, `grafana`). A preview of the full URL appears (for example, `grafana.example.com`). 3. Select **Continue**. ## Step 3: Add your first policy An Access policy controls who can reach your application. In this step, you create a simple policy using email-based one-time PINs. Users you add here receive a one-time PIN by email when they try to access the application. 1. Enter the email addresses of users you want to grant access to. 2. Select **Continue**. Note You can add your identity provider (for example, Okta or Google Workspace) to the application later. For more information, refer to [Identity providers](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). ## Step 4: Assign a tunnel A tunnel connects your private network to Cloudflare so traffic can reach your application. You can select an existing tunnel or create a new one. 1. In the **Choose or create a Tunnel** dropdown, select an existing tunnel or enter a name to create a new one. 2. Select **Continue**. ## Step 5: Deploy your tunnel Install `cloudflared` on a device in your private network that can reach the application. The dashboard generates commands specific to your operating system. 1. Select your operating system from the dropdown. 2. Copy and run the commands shown in the dashboard. For Windows, open Command Prompt as an administrator. For all other operating systems, use a terminal window. 3. After the tunnel connects, select **Continue**. ## Step 6: Review details The dashboard confirms that your application is available and protected behind Cloudflare Access. ## Recommended next steps - **Test your application**: 1. Select **Test login** on the success screen. 2. On the Access login screen, enter one of the email addresses you added to your Access policy. 3. Select **Send me a code**. 4. Enter the code from your email and select **Sign in**. - **Explore more**: Review your applications and policies under **Zero Trust** > **Access controls**, and your tunnels in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) under **Networking** > **Tunnels**. - **Configure an identity provider**: Replace email one-time PINs with your organization's identity provider for a seamless login experience. For more information, refer to [Identity providers](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). For in-depth guidance on clientless access, refer to the [Clientless access learning path](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/what-is-clientless-access/). ## Troubleshoot If you have issues connecting, refer to these resources: - [Troubleshoot tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/): diagnose tunnel connectivity and routing problems. - [Troubleshooting](https://developers.cloudflare.com/cloudflare-one/troubleshooting/): resolve common Zero Trust errors and issues. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/in-browser-rdp/#page","headline":"In-browser remote desktop","description":"Provide in-browser remote desktop access to Windows hosts through Cloudflare Access.","url":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/in-browser-rdp/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/setup/secure-private-apps/in-browser-rdp/og.png?v=211ac59c15f0c7f4","dateModified":"2026-03-26","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Private networks","Windows"]} ``` --- --- description: View implementation guides for Cloudflare Zero Trust. title: Implementation guides image: https://developers.cloudflare.com/cloudflare-one/implementation-guides/og.png?v=b142a095fd168fcd --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Implementation guides Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/implementation-guides/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Implementation guides cover deployment steps and best practices for specific Cloudflare One use cases. ### [Secure web traffic from threats](https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/) Inspect and filter all Internet-bound traffic from your users to block threats, enforce acceptable use policies, and prevent data loss. ### [Replace your VPN](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/) Give users secure, auditable network and application access. ### [Secure private apps without a client](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/) Provide browser-based access to internal web applications, SSH servers, and RDP sessions without installing software on user devices. ### [Secure your email with Email security](https://developers.cloudflare.com/learning-paths/secure-your-email/concepts/) Use Cloudflare's Email security to protect your Microsoft 365 email inbox from phishing and malware attacks. ### [Holistic AI security with Cloudflare One](https://developers.cloudflare.com/learning-paths/holistic-ai-security/concepts/) Monitor and secure generative AI usage within your organization. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/implementation-guides/#page","headline":"Implementation guides","description":"View implementation guides for Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/implementation-guides/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/implementation-guides/og.png?v=b142a095fd168fcd","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Secure Internet traffic and SaaS apps. title: Concepts image: https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/og.png?v=7bc7bd59b1702974 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. # Concepts Last updated Apr 23, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Learn the core concepts of using Cloudflare Zero Trust functionality to provide granular security policy for devices and networks accessing the Internet. ## Objectives By the end of this module, you will be able to: - Understand what products and features Cloudflare offers. - Describe how Cloudflare implements Internet traffic and SaaS app security. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/#page","headline":"Concepts","description":"Secure Internet traffic and SaaS apps.","url":"https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/","inLanguage":"en","image":"https://developers.cloudflare.com/learning-paths/secure-internet-traffic/concepts/og.png?v=7bc7bd59b1702974","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Replace your VPN with Cloudflare Zero Trust. title: Concepts image: https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/og.png?v=7bc7bd59b1702974 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. # Concepts Last updated Apr 23, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Concepts explain the basic ideas behind how Cloudflare Zero Trust works. ## Objectives By the end of this module, you will be able to: - Explain how Cloudflare works. - Describe the purpose of a VPN. - Understand the benefits of switching to a Zero Trust architecture. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/#page","headline":"Concepts","description":"Replace your VPN with Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/","inLanguage":"en","image":"https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/og.png?v=7bc7bd59b1702974","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Secure browser-based access without device clients. title: Concepts image: https://developers.cloudflare.com/learning-paths/clientless-access/concepts/og.png?v=7bc7bd59b1702974 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. # Concepts Last updated Apr 23, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/learning-paths/clientless-access/concepts/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Review the concepts behind clientless access. ## Objectives By the end of this module, you will be able to: - Understand the purpose and benefits of clientless access. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/learning-paths/clientless-access/concepts/#page","headline":"Concepts","description":"Secure browser-based access without device clients.","url":"https://developers.cloudflare.com/learning-paths/clientless-access/concepts/","inLanguage":"en","image":"https://developers.cloudflare.com/learning-paths/clientless-access/concepts/og.png?v=7bc7bd59b1702974","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Protect your organization from email phishing attacks. title: Concepts image: https://developers.cloudflare.com/learning-paths/secure-your-email/concepts/og.png?v=7bc7bd59b1702974 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. # Concepts Last updated Apr 23, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/learning-paths/secure-your-email/concepts/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Review the concepts behind Cloudflare's Email security. ## Objectives By the end of this module, you will be able to: - Explain how Cloudflare works. - Describe what Email security is. - Understand how Cloudflare prevents email-based phishing attacks. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/learning-paths/secure-your-email/concepts/#page","headline":"Concepts","description":"Protect your organization from email phishing attacks.","url":"https://developers.cloudflare.com/learning-paths/secure-your-email/concepts/","inLanguage":"en","image":"https://developers.cloudflare.com/learning-paths/secure-your-email/concepts/og.png?v=7bc7bd59b1702974","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Monitor and secure generative AI usage. title: Concepts image: https://developers.cloudflare.com/learning-paths/holistic-ai-security/concepts/og.png?v=7bc7bd59b1702974 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt > Use this file to discover all available pages before exploring further. # Concepts Last updated Apr 23, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/learning-paths/holistic-ai-security/concepts/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) The goal of this learning path is to provide Cloudflare One users with the strategy and tools to securely adopt generative AI within their organizations. This guide will help address new security challenges and mitigate risks like shadow AI and data loss. ## Objectives - Determine risk tolerance: Identify areas of concern and risk tolerance for AI use to establish a baseline for your organization's AI security strategy. - Monitor AI usage: Utilize Cloudflare One's tools, such as the Shadow IT dashboard and API CASB integrations, to gain visibility into both sanctioned and unsanctioned AI application usage. - Build security policies: Create granular security policies using Cloudflare Gateway to control AI usage, prevent data loss with DLP, and manage user behavior through actions like blocking or redirecting. - Secure sanctioned models: Apply Zero Trust principles to sanctioned AI models and internal services like Model Context Protocol (MCP) servers to ensure secure access and protect sensitive data from being exposed. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/learning-paths/holistic-ai-security/concepts/#page","headline":"Concepts","description":"Monitor and secure generative AI usage.","url":"https://developers.cloudflare.com/learning-paths/holistic-ai-security/concepts/","inLanguage":"en","image":"https://developers.cloudflare.com/learning-paths/holistic-ai-security/concepts/og.png?v=7bc7bd59b1702974","dateModified":"2026-04-23","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Videos for Cloudflare One. title: Videos image: https://developers.cloudflare.com/cloudflare-one/video-tutorials/og.png?v=57637dd5998f4cbf --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Videos Last updated May 19, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/video-tutorials/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) ### [Build and secure your SASE corporate network](https://developers.cloudflare.com/learning-paths/sase-overview-course/series/evolution-corporate-networks-1/) Dive into Cloudflare's Secure Access Service Edge (SASE) platform and learn how it's been designed to revolutionize the idea of the corporate network. ### [Understand and troubleshoot Cloudflare WARP](https://developers.cloudflare.com/learning-paths/warp-overview-course/series/warp-basics-1/) In this series, we cover the basics of Cloudflare WARP, share useful troubleshooting tips, and explain the warp-diag logs in detail. ### [What's a Cloudflare Tunnel?](https://developers.cloudflare.com/videos/what-is-cf-tunnel/) Cloundflare Tunnel is like a private, secure pathway from your computer to the Internet, so you don't have to leave the front door (your network) wide open. ### [Add your domain to Cloudflare](https://developers.cloudflare.com/videos/the-online-address-book/) To begin using a Cloudflare Tunnel, you need a domain name. Learn how DNS works and how Cloudlare manages your domain through the metaphor of an online address book. ### [Set up Access policies for your tunnel](https://developers.cloudflare.com/videos/set-up-access-policies/) Set up access policies using Cloudflare Access to verify the identity of every user. ### [Set up Cloudflare Tunnel](https://developers.cloudflare.com/videos/set-up-cf-tunnel/) Set up Cloudflare Tunnel to create a secure link between your private environment and the Cloudflare edge. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/video-tutorials/#page","headline":"Videos","description":"Videos for Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/video-tutorials/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/video-tutorials/og.png?v=57637dd5998f4cbf","dateModified":"2026-05-19","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: View and manage applications in Cloudflare One, including custom applications. title: Application Library image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/og.png?v=c262ba0aaa3d16c7 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Application Library Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) The Application Library allows users to manage their SaaS applications in Cloudflare One by consolidating views across all relevant products: [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/), [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/), and [Cloud Access Security Broker (CASB)](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/). The App Library provides visibility and control for available applications, as well as the ability to view categorized hostnames and manage configuration for Access for SaaS and Gateway policies. For example, you can use the App Library to review how Gateway uses specific hostnames to match against application traffic. To access the App Library in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Application library**. Each application card will list the number of hostnames associated with the application, the supported Cloudflare One product usage, and the [app type](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/#app-types). The App Library groups [Do Not Inspect applications](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/#do-not-inspect-applications) within the corresponding application. For example, the App Library will group *Google Drive (Do Not Inspect)* under **Google Drive**. Traffic that does not match a known application will not be included in the App Library. You can also [create custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) to identify internal services or applications that are not in the Cloudflare-managed catalog. Use custom applications in [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/#application), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#application), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/#application) policies with the existing **Application** selector. ## View application details Select an application card to view details about the application. ### Overview The **Overview** tab shows details about an application, including: - Name - Shadow IT [review status](#review-applications) - Number of hostnames - [App type](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/#app-types) - Supported Cloudflare One applications - Application ID for use with the API and Terraform ### Findings The **Findings** tab shows any connected [CASB integrations](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/#manage-casb-integrations) for the selected application, as well as instances of any detected [posture findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#posture-findings) and [content findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#content-findings) for each integration. ### Policies The **Policies** tab shows any [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and [Access for SaaS](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/) policies related to the selected application. ### Usage The **Usage** tab shows any logs for [Gateway traffic requests](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/), [Access authentication events](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#authentication-logs), [Shadow IT Discovery user sessions](https://developers.cloudflare.com/cloudflare-one/insights/analytics/shadow-it-discovery/), and [generative AI prompt logs](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#view-prompt-logs) sent to the selected application. This section requires logs to be turned on for each feature. The Shadow IT Discovery dashboard will provide more details for discovered applications. To access Shadow IT Discovery in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Insights** > **Dashboards**, then select **Shadow IT: SaaS analytics** or **Shadow IT: Private Network analytics**. ## Review applications The App Library synchronizes application review statuses with approval statuses from the [Shadow IT Discovery SaaS analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/shadow-it-discovery/) dashboard. To organize applications into their approval status for your organization, you can mark them as **Unreviewed** (default), **In review**, **Approved**, and **Unapproved**. | Status | API value | Description | | --- | --- | --- | | Approved | `approved` | Applications that have been marked as sanctioned by your organization. | | Unapproved | `unapproved` | Applications that have been marked as unsanctioned by your organization. | | In review | `in review` | Applications in the process of being reviewed by your organization. | | Unreviewed | `unreviewed` | Unknown applications that are neither sanctioned nor being reviewed by your organization at this time. | To set the status of an application: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Applications**. 2. Locate the card for the application. 3. In the three-dot menu, select the option to mark your desired status. Once you mark the status of an application, its badge will change. You can filter applications by their status to review each application in the list for your organization. The review status for an application in the App Library and Shadow IT Discovery will update within one hour. Note Approval status does not impact a user's ability to access an application. Users are allowed or blocked according to your [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) and [Gateway policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). To filter traffic based on approval status, use the [*Application Status*](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#application-approval-status) selector. ## Application confidence scorecards Application confidence scorecards provide automated risk assessment for AI and SaaS applications to help organizations make informed decisions about application approval and security policies. These scores bring scale and automation to the labor- and time-intensive task of evaluating generative AI and SaaS applications. The scoring system evaluates applications across multiple security, compliance, and operational dimensions to generate two complementary scores: the Application Posture Score and the Generative AI Posture Score. These scores help security teams identify risks in Shadow AI and Shadow IT deployments without manual auditing of every application. To view an application's confidence scorecard: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Application library** 2. Find the application you would like to review or search it by name. 3. Review the Application Posture Score and the Generative AI Posture Score which are generated on the application card. ### Scoring methodology #### Application Posture Score (5 points) The Application Posture Score evaluates SaaS providers across five major categories. | Category | Points | Assessment Criteria | Scoring Logic | | --- | --- | --- | --- | | Security and Privacy Compliance | 1.2 | Presence of SOC 2 and ISO 27001 certifications, which signal operational maturity and adherence to security frameworks. | Full credit awarded for both certifications; partial credit for one certification; no credit if neither certification is present. | | Data Management Practices | 1.0 | Data retention windows and whether the provider shares data with third parties. | Shorter retention periods and no third-party data sharing earn the highest marks. Applications with indefinite data retention or extensive data sharing receive lower scores. | | Security Controls | 1.0 | Support for Multi-Factor Authentication (MFA), Single Sign-On (SSO), TLS 1.3, role-based access controls, and session monitoring capabilities. | These represent table stakes of modern SaaS security. Full credit requires comprehensive support across all controls; partial credit awarded for subset implementation. | | Security Reports and Incident History | 1.0 | Availability of trust or security pages, active bug bounty programs, incident response transparency, and recent breach history. | Recent material breaches result in full point deduction. Proactive security measures like bug bounty programs and transparent incident reporting increase scores. | | Financial Stability | 0.8 | Company financial status, funding levels, and operational stability. | Public companies and heavily capitalized providers score highest, while startups with limited funding or companies in financial distress receive lower scores. | | Total Points | 5.0 | | | #### Generative AI Posture Score (5 points) | Category | Points | Assessment Criteria | Scoring Logic | | --- | --- | --- | --- | | Compliance | 1.0 | Presence of ISO 42001 certification for AI management systems. | Full credit for ISO 42001 certification; no credit without this specialized AI governance certification. | | Deployment Security Model | 1.0 | Whether application access requires authentication and implements rate limiting, or if services are publicly exposed without controls. | Authenticated access with proper rate limiting receives full credit; publicly exposed services without controls receive minimal scoring. | | System Card | 1.0 | Publication of model or system cards documenting safety evaluations, bias testing, and risk assessments. | Comprehensive system cards with detailed safety and bias documentation receive full credit; incomplete or missing documentation results in score reduction. | | Training Data Governance | 2.0 | Whether user data is explicitly excluded from model training and availability of opt-in/opt-out controls for training data usage. | Explicit exclusion of user data from training receives maximum points; opt-in/opt-out controls receive partial credit; no controls or guaranteed user data training receives minimal scoring. | | **Total Points** | **5.0** | | | ### Automated scoring infrastructure #### Web crawling and data extraction The scoring system employs automated infrastructure to crawl and analyze public information sources. - Data sources: Trust centers, privacy policies, security pages, compliance documents, and vendor documentation. - Extraction process: Large language models parse documents to identify relevant information, with structured extraction methods to resist hallucinations and ensure accuracy. - Validation requirements: Source validation and structured data extraction prevent false positives and ensure reliable scoring. #### Human oversight and quality assurance Automated results are supplemented with manual review to maintain transparency and ensure data integrity. - Review process: Every automated score undergoes review and audit by Cloudflare analysts before publication in the Application Library. - Validation methodology: Combination of automated crawling and extraction with human validation ensures comprehensive and trustworthy scoring. - Update frequency: Scores update dynamically as vendors improve security and compliance postures, providing live assessment rather than static reports. #### Report score inaccuracies If you believe one of the Application confidence scores is incorrect or have additional evidence that should be considered in the scoring process, contact `app-confidence-scores@cloudflare.com`. Include relevant documentation or evidence that supports your assessment to help us review and update the score accordingly. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/#page","headline":"Application Library","description":"View and manage applications in Cloudflare One, including custom applications.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/og.png?v=c262ba0aaa3d16c7","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["AI"]} ``` --- --- description: Create, edit, and delete custom applications in the App Library and use them in Gateway policies. title: Custom applications image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/og.png?v=fbedbc2d26364f3a --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Custom applications Last updated Oct 15, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Create a custom application to identify an internal service or an application that is not in the Cloudflare-managed catalog. Custom applications belong to your account and appear alongside Cloudflare-managed applications in the App Library. You can use them in [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/#application), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#application), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/#application) policies with the existing **Application** selector. ## Create a custom application 1. In the Cloudflare dashboard, go to **Zero Trust** > **Team & Resources** > **Application library**. [Go to **Application library** ↗](https://one.dash.cloudflare.com/?to=/:account/team-resources/application-library) 2. Select **Add custom application**. 3. Enter an **Application name** and **Application ID**, and select a **Category**. The Application ID field contains a human-readable identifier generated from the name, which you can change before saving. Cloudflare also assigns a numeric application ID for use in Gateway rule expressions. 4. In **Network identifiers**, enter at least one **Hostname** or **IP subnet**. You can include both hostnames and IP subnets in the same application. 5. (Optional) Add **Support hostnames** for dependencies such as authentication or content delivery, and **Port protocols** to restrict matching to specific TCP or UDP ports. Refer to [custom application limits](#custom-application-limits) for formats and limits. 6. Select **Add custom application**. Creating an application does not create a Gateway policy. To control its traffic, [reference the application in a policy](#use-a-custom-application-in-gateway). ## Edit a custom application 1. In **Application library**, find the custom application and open its actions menu. 2. Select **Edit custom app**. 3. Update its **Hostnames**, **Support hostnames**, **IP subnets**, or **Port protocols**. The application must retain at least one primary hostname or IP subnet. 4. Select **Save**. The application name, human-readable Application ID, and category are fixed after creation. Editing the network identifiers preserves the numeric application ID, so Gateway policies that reference the application use its updated definition without changing their expressions. Allow time for the updated definition to propagate to Gateway. You can also [change the application's review status](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/#review-applications) from its actions menu. ## Use a custom application in Gateway 1. In **Traffic policies**, create or edit a DNS, HTTP, or network policy. 2. For the traffic condition, select **Application** and choose the custom application by name. You can select custom and Cloudflare-managed applications in the same condition. 3. Choose the policy action and save the policy. You can also start a policy from the application's actions menu by selecting **Create new Gateway policy** and choosing a policy type. Custom applications use the same selectors and numeric IDs as other [applications in Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/#custom-applications). Use the assigned numeric ID when configuring a Gateway rule through the API or Terraform. ## Delete a custom application You cannot delete a custom application while a Gateway rule or reusable profile references it. Remove the application from every referencing rule and profile before deleting it. Turning off a rule does not remove its reference. 1. In **Application library**, find the custom application and open its actions menu. 2. Select **Delete custom app**. 3. Confirm the deletion. If the application is still referenced, deletion fails and the API returns HTTP `409` with the referencing resource IDs, names, and types. If Gateway cannot verify the references, deletion also fails and the application remains available. ## Custom application limits For the number of custom applications you can create per account, refer to [Application Library account limits](https://developers.cloudflare.com/cloudflare-one/account-limits/#application-library). The following limits apply to each custom application when creating or editing it. | Field | Limit or supported format | | --- | --- | | Hostnames and support hostnames | 50 entries combined. For example, 40 primary hostnames leave room for 10 support hostnames. | | IP subnets | 50 entries per application, separate from the hostname limit. Use CIDR notation. IPv4 prefix lengths must be `/8` through `/32`. IPv6 prefix lengths must be `/32` through `/128`. For a single address, use `/32` for IPv4 or `/128` for IPv6. | | Port protocols | TCP and UDP, in `protocol/port` or inclusive `protocol/start-end` format, such as `tcp/443` or `udp/10000-20000`. The dashboard accepts ports `1` through `65535`. The API also accepts port `0`. The start of a range must be less than or equal to its end. There is no separate entry-count limit for this field. | At least one primary hostname or IP subnet is required. Support hostnames, ports, or a combination of support hostnames and ports cannot satisfy this requirement. You cannot create a custom application identified only by a port and protocol, such as `tcp/443`. Hostnames and IP subnets are alternative ways to match the application. Port protocols, when configured, restrict those matches in HTTP and network policies. DNS policies do not check destination ports. Refer to [custom application matching](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/#custom-application-matching) for examples. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/#page","headline":"Custom applications","description":"Create, edit, and delete custom applications in the App Library and use them in Gateway policies.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/og.png?v=fbedbc2d26364f3a","dateModified":"2026-10-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Set up User-side certificates for Zero Trust. title: User-side certificates image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/og.png?v=eeadf4e59803be1b --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # User-side certificates Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Advanced security features such as [HTTPS traffic inspection](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/), [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/), [anti-virus scanning](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/antivirus-scanning/), [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/), and [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) require users to install and trust a root certificate on their device. You can either install the certificate provided by Cloudflare (default option), or generate your own custom certificate and upload it to Cloudflare. Zero Trust [generates a unique root CA](#generate-a-cloudflare-root-certificate) for each account and deploys it across the Cloudflare global network. Alternatively, Enterprise users can upload and deploy their own [custom certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/). Default certificate expired on 2025-02-02 The default Cloudflare certificate expired on 2025-02-02 at 16:05 UTC. Review how this change impacts certificate propagation to your end-user devices and how to address browser issues in [Troubleshooting](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/common-issues/#browser-and-certificate-issues). ## Certificate status Zero Trust will indicate if a certificate is ready for use in inspection based on its deployment status: | Deployment status | Description | | --- | --- | | Inactive | The certificate has been generated by or uploaded to Cloudflare but is not deployed across the global network. | | Pending | The certificate is being activated or deactivated for use. | | Available | The certificate is deployed across the Cloudflare global network and ready to be turned on. The Cloudflare One Client will install the certificate on your users' devices. | | Available and In-Use | The certificate is turned on. Gateway will use the certificate for inspection. | ## Generate a Cloudflare root certificate To generate a new Cloudflare root certificate for your Zero Trust organization: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Traffic settings**. 2. Select **Certificates**. 3. Select **Generate certificate**. 4. Choose a duration of time before the certificate expires. Cloudflare recommends expiration after five years. Alternatively, choose *Custom* and enter a custom amount in days. 5. Select **Generate certificate**. Send a `POST` request to the [Create Zero Trust certificate](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/certificates/methods/create/) endpoint. *Create Zero Trust certificatebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/certificates" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` The API will respond with the ID and contents of the new certificate. The certificate will appear in your list of certificates as **Inactive**. To download a generated certificate, select it, then choose **Download .pem** and/or **Download .crt**. To deploy your certificate and turn it on for inspection, you need to [activate the certificate](#activate-a-root-certificate). Each Zero Trust account can generate a new root certificate a maximum of three times per day. ## Activate a root certificate Note Zero Trust accounts using the default Cloudflare certificate prior to 2024-10-17 will need to redeploy and activate the newly generated certificate. Zero Trust accounts created during or after 2024-10-17 will use an available certificate by default. Once a certificate is generated in or uploaded to Zero Trust, you need to activate it. Activating a certificate deploys it across the Cloudflare network and sets its status to **Available**. You can have up to 10 available certificates at once. To activate your root certificate: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Traffic settings**. 2. Select **Certificates**. 3. Select the certificate you want to activate. 4. Select **Activate**. Send a `POST` request to the [Activate a Zero Trust certificate](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/certificates/methods/activate/) endpoint. *Activate a Zero Trust certificatebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/certificates/$CERTIFICATE_ID/activate" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` The status of the certificate will change to **Pending** while it deploys. Once the status of your certificate is **Available**, you can install it on your user's devices either [with the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) or [manually](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). Once you deploy and install your certificate, you can turn it on for use in inspection: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Traffic settings**. 2. Select **Certificates**. 3. Select the certificate you want to turn on. 4. In **Basic information**, select **Confirm and turn on certificate**. Send a `PUT` request to the [Update Zero Trust account configuration](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/configurations/methods/update/) endpoint. For example: *Update Zero Trust account configurationbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/configuration" \ --request PUT \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "settings": { "certificate": { "id": "{certificate_id}", "in_use": true } } }' ``` You can set multiple certificates to **Available**, but you can only turn on one certificate for use in inspection at a time. Setting a certificate as **In-Use** will set any other in-use certificates as **Available** only and prevent them from being used for inspection until turned on again. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/#page","headline":"User-side certificates","description":"Set up User-side certificates for Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/og.png?v=eeadf4e59803be1b","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["TLS"]} ``` --- --- description: Automatically deploy a root certificate on desktop devices. title: Install certificate using the Cloudflare One Client image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/og.png?v=6474d4036ab907a7 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Install certificate using the Cloudflare One Client Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/)
Feature availability | Client modes | Zero Trust plans ↗︎ | | --- | --- | | All modes | All plans | | System | Availability | Minimum client version | | --- | --- | --- | | Windows | ✅ | 2024.12.554.0 | | macOS | ✅ | 2024.12.554.0 | | Linux \* | ✅ | 2024.12.554.0 | | iOS | ❌ | | | Android | ❌ | | | ChromeOS | ❌ | | * Only supported on Debian-based systems.
The [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) can automatically install a Cloudflare certificate or [custom root certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) on Windows, macOS, and Debian/Ubuntu Linux devices. On mobile devices and Red Hat-based systems, you will need to [install the certificate manually](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). The certificate is required if you want to [apply HTTP policies to encrypted websites](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/), display custom [block pages](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/), and more. ## Install a certificate using the Cloudflare One Client To configure the Cloudflare One Client to install a root certificate on your organization's devices: 1. (Optional) [Upload](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) a custom root certificate to Cloudflare. 2. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Devices** > **Management**. 3. Under **Global Cloudflare One Client settings**, turn on [**Install CA to system certificate store**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#install-ca-to-system-certificate-store). 4. [Install](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) the Cloudflare One Client on the device. 5. [Enroll the device](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/) in your Zero Trust organization. 6. (Optional) If the device is running macOS Big Sur or newer, [manually trust the certificate](#manually-trust-the-certificate). The Cloudflare One Client will now download any [certificates set to **Available**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). After download, the Cloudflare One Client will add the certificates to the device's system certificate store in `installed_certs/.pem` and append the contents to the `installed_cert.pem` file. If you have any scripts using `installed_cert.pem`, Cloudflare recommends you set them to use the individual files in the `installed_certs/` directory instead. `installed_certs.pem` will be deprecated by 2025-06-31. Note It may take up to 10 minutes for newly updated settings to propagate to devices. The Cloudflare One Client does not install certificates to individual applications. You will need to [manually add certificates](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#add-the-certificate-to-applications) to applications that rely on their own certificate store instead of the system certificate store. ## Access the installed certificate After installing the certificate using the Cloudflare One Client, you can verify successful installation by accessing the device's system certificate store. ### macOS To access the installed certificate in macOS: 1. Open Keychain Access. 2. In **System Keychains**, go to **System** > **Certificates**. 3. Open your certificate. The default Cloudflare certificate name is **Gateway CA - Cloudflare Managed G1**. 4. If the certificate is trusted by all users, Keychain Access will display **This certificate is marked as trusted for all users**. The Cloudflare One Client will also place the certificate in `/Library/Application Support/Cloudflare/installed_cert.pem` for reference by scripts or tools. #### Manually trust the certificate macOS Big Sur and newer do not allow the Cloudflare One Client to automatically trust the certificate. To manually trust the certificate: 1. In Keychain Access, [find and open the certificate](#macos). 2. Open **Trust**. 3. Set **When using this certificate** to *Always Trust*. 4. (Optional) Restart the device to reset connections to Zero Trust. Alternatively, you can configure your mobile device management (MDM) to automatically trust the certificate on all of your organization's devices. ### Windows To access the installed certificate in Windows: 1. Open the Start menu and select **Run**. 2. Enter `certlm.msc`. 3. Go to **Trusted Root Certification Authority** > **Certificates**. The default Cloudflare certificate name is **Gateway CA - Cloudflare Managed G1**. The Cloudflare One Client will also place the certificate in `%PROGRAMDATA%\Cloudflare\installed_cert.pem` for reference by scripts or tools. ### Debian-based Linux distributions On Debian-based Linux distributions, the certificate is stored in `/usr/local/share/ca-certificates`. The default installed Cloudflare certificate name is `managed-warp.pem`. The Cloudflare One Client will create a symbolic link named `managed-warp.crt` to use as its root certificate. If your system is not using `managed-warp.crt`, run the following commands to update the system store: 1. Update your list of custom CA certificates. ```sh sudo update-ca-certificates ``` 2. Go to the system certificate store. ```sh cd /usr/local/share/ca-certificates ``` 3. Verify your system has both the `managed-warp.pem` file and the `managed-warp.crt` symbolic link. For example: ```sh ls -l ``` ```sh lrwxrwxrwx 1 root root 49 Jan 3 21:46 managed-warp.crt -> /usr/local/share/ca-certificates/managed-warp.pem -rw-r--r-- 1 root root 1139 Jan 3 21:46 managed-warp.pem ``` The Cloudflare One Client will also place the certificate in `/var/lib/cloudflare-warp/installed_cert.pem` for reference by scripts or tools. ## Uninstall the certificate If the certificate was installed by the Cloudflare One Client, it is automatically removed when you turn on another certificate for inspection in Cloudflare One, turn off **Install CA to system certificate store**, or [uninstall the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/uninstall/). The Cloudflare One Client does not remove certificates that were installed manually (for example, certificates added to third-party applications). To manually remove the certificate, refer to the instructions supplied by your operating system or the third-party application. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/#page","headline":"Install certificate using the Cloudflare One Client","description":"Automatically deploy a root certificate on desktop devices.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/og.png?v=6474d4036ab907a7","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["TLS"]} ``` --- --- description: Manually add a Cloudflare certificate to mobile devices and individual applications. title: Install certificate manually image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/og.png?v=b6e53927267d3f8d --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Install certificate manually Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note This procedure is only required to enable specific Cloudflare Zero Trust features, and should only be done at the direction of your IT department. This procedure is not required to enable the Cloudflare One Client for consumers. If your device does not support [certificate installation via the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/), you can manually install a Cloudflare certificate. You must add the certificate to both the [system keychain](#add-the-certificate-to-operating-systems) and to [individual application stores](#add-the-certificate-to-applications). These steps must be performed on each new device that is to be subject to HTTP filtering. Zero Trust will only inspect traffic using installed certificates set to [**Available** and **In-Use**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). To install a certificate manually, you must: 1. Download a Cloudflare certificate and verify it. 2. Install the certificate in your operating system's certificate store. 3. If a target application does not accept certificates from the operating system, you must install the certificate in the application's certificate store. ## 1. Download a Cloudflare root certificate Download limitation You can only download Cloudflare-generated certificates from the Cloudflare One dashboard or with the Cloudflare One Client. First, [generate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/#generate-a-cloudflare-root-certificate) and download a Cloudflare certificate. The certificate is available in both `.pem` and `.crt` file format. Certain applications require the certificate to be in a specific file type, so ensure you download the most appropriate file for your use case. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Traffic settings**. 2. Select **Certificates**. 3. Select the certificate you want to download. 4. Select **More actions**. 5. Depending on which format you want, choose **Download .pem** and/or **Download .crt**. Alternatively, you can download and install a certificate [using the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/#install-a-certificate-using-the-cloudflare-one-client). The Cloudflare One Client will add the certificates to the device's system certificate store in `installed_certs/.pem`. ## 2. Verify the downloaded certificate To verify your download, use a terminal to check that the downloaded certificate's hash matches the thumbprint listed under **Certificate thumbprint**. For example: ### SHA1 *SHA1 .crt examplesh* ```sh openssl x509 -noout -fingerprint -sha1 -inform der -in ``` ```sh SHA1 Fingerprint=BB:2D:B6:3D:6B:DE:DA:06:4E:CA:CB:40:F6:F2:61:40:B7:10:F0:6C ``` *SHA1 .pem examplesh* ```sh openssl x509 -noout -fingerprint -sha1 -inform pem -in ``` ```sh SHA1 Fingerprint=BB:2D:B6:3D:6B:DE:DA:06:4E:CA:CB:40:F6:F2:61:40:B7:10:F0:6C ``` ### SHA256 *SHA256 .crt examplesh* ```sh openssl x509 -noout -fingerprint -sha256 -inform der -in ``` ```sh sha256 Fingerprint=F5:E1:56:C4:89:78:77:AD:79:3A:1E:83:FA:77:83:F1:9C:B0:C6:1B:58:2C:2F:50:11:B3:37:72:7C:62:3D:EF ``` *SHA256 .pem examplesh* ```sh openssl x509 -noout -fingerprint -sha256 -inform pem -in ``` ```sh sha256 Fingerprint=F5:E1:56:C4:89:78:77:AD:79:3A:1E:83:FA:77:83:F1:9C:B0:C6:1B:58:2C:2F:50:11:B3:37:72:7C:62:3D:EF ``` ## 3. (Optional) Convert the certificate Some applications require a certificate formatted in the `.cer` file type. You can convert your downloaded certificate using [OpenSSL ↗︎](https://www.openssl.org/): 1. [Install OpenSSL ↗︎](https://wiki.openssl.org/index.php/Compilation_and_Installation). 2. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 3. In a terminal, convert the certificate to DER format with the `.cer` file type: ```sh openssl x509 -inform PEM -in ~/Downloads/certificate.pem -outform DER -out ~/Downloads/certificate.cer ``` 1. [Install OpenSSL for Windows ↗︎](https://slproweb.com/products/Win32OpenSSL.html). 2. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 3. In a PowerShell terminal, convert the certificate to DER format with the `.cer` file type: ```powershell openssl x509 -inform PEM -in "$HOME\Downloads\certificate.pem" -outform DER -out "$HOME\Downloads\certificate.cer" ``` ## 4. Add the certificate to operating systems If you are deploying the Cloudflare certificate to desktop devices, use the [Install certificate using the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) method. Mobile devices require manual installations detailed in the instructions below. ### macOS In macOS, you can choose the keychain in which you want to install the certificate. Each keychain impacts which users will be affected by trusting the root certificate. | Keychain | Access scope | | --- | --- | | login | The logged in user | | Local Items | Users with access to cached iCloud passwords | | System | All users on the system | To install a Cloudflare certificate in macOS, you can use either the Keychain Access application or a terminal. Both methods require you to [download a certificate](#download-a-cloudflare-root-certificate) in `.crt` format. 1. Download a Cloudflare certificate. 2. Open the `.crt` file in Keychain Access. If prompted, enter your local password. 3. In **Keychain**, choose the access option that suits your needs and select **Add**. 4. In the list of certificates, locate the newly installed certificate. Keychain Access will mark this certificate as not trusted. Right-click the certificate and select **Get Info**. 5. Select **Trust**. Under **When using this certificate**, select *Always Trust*. The root certificate is now installed and ready to be used. 1. Download a Cloudflare certificate. 2. Open Terminal. 3. Add the certificate to your keychain: ```sh sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ``` This keychain will allow all users on the system access to the certificate. If you want to install the certificate to a different keychain, replace `System.keychain` with the name of that keychain. 4. Update the OpenSSL CA Store to include the Cloudflare certificate: ```sh echo | sudo tee -a /etc/ssl/cert.pem < certificate.pem ``` The root certificate is now installed and ready to be used. Change certificate access scope If you want to change user access to the Cloudflare certificate, you can open Keychain Access and move the certificate to a different keychain on the left sidebar. ### Windows Windows offers two locations to install the certificate, each impacting which users will be affected by trusting the root certificate. | Store location | Access scope | | --- | --- | | Current User Store | The logged in user | | Local Machine Store | All users on the system | 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate). 2. Right-click the certificate file. 3. Select **Open**. If a security warning appears, choose **Open** to proceed. 4. The **Certificate** window will appear. Select **Install Certificate**. 5. Now choose a Store Location. If a security warning appears, choose **Yes** to proceed. 6. On the next screen, select **Browse**. 7. In the list, choose the *Trusted Root Certification Authorities* store. 8. Select **OK**, then select **Finish**. The root certificate is now installed and ready to be used. Caution If your certificate is installed in the **Local Machine Store**, the [device posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/) looking for a certificate will fail. Install the certificate in the **Current User Store** to ensure a successful posture device check. ### Linux The location where the root certificate should be installed is different depending on your Linux distribution. Follow the specific instructions for your distribution. The following procedure applies to Debian-based systems, such as Debian, Ubuntu, and Kali Linux. 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Install the `ca-certificates` package. ```sh sudo apt-get install ca-certificates ``` 3. Copy the certificate to the system, changing the file extension to `.crt`. ```sh sudo cp certificate.pem /usr/share/ca-certificates/certificate.crt ``` 4. Import the certificate. ```sh sudo dpkg-reconfigure ca-certificates ``` The following procedure applies to Red Hat-based systems, such as CentOS and Red Hat Enterprise Linux (RHEL). 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in both `.crt` and `.pem` format. 2. Install the `ca-certificates` package. ```sh sudo dnf install ca-certificates ``` 3. Copy both certificates to the trust store. ```sh sudo cp certificate.crt certificate.pem /etc/pki/ca-trust/source/anchors ``` 4. Import the certificate. ```sh sudo update-ca-trust ``` NixOS does not use the system certificate store for self updating and instead relies on the certificates found in `~/.nix-profile/etc/ssl/certs` or provided by `NIX_SSL_CERT_FILE` at runtime. ### iOS 1. In Safari, [download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Open Files and go to **Recents**. 3. Find and open the downloaded certificate file. A message will appear confirming the profile was downloaded. Select **Close**. 4. Open Settings. Select the **Profile Downloaded** section beneath your Apple Account info. Alternatively, go to **General** > **VPN & Device Management** and select the **Gateway CA - Cloudflare Managed G1** profile. 5. Select **Install**. If the iOS device is passcode-protected, you will be prompted to enter the passcode. 6. A certificate warning will appear. Select **Install**. If a second prompt appears, select **Install** again. 7. The Profile Installed screen will appear. Select **Done**. The certificate is now installed. However, before it can be used, it must be trusted by the device. 8. In Settings, go to **General** > **About** > **Certificate Trust Settings**. The installed root certificates will be displayed under Enable full trust for root certificates. 9. Turn on the Cloudflare certificate. 10. A security warning message will appear. Choose **Continue**. The root certificate is now installed and ready to be used. ### Android 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate). 2. In Settings, go to **Security** > **Advanced** > **Encryption & credentials** > **Install a certificate**. 3. Select **CA certificate**. 4. Select **Install anyway**. 5. Verify your identity. 6. Choose the certificate file you want to install. The root certificate is now installed and ready to be used. ### ChromeOS ChromeOS devices use different methods to store and deploy root certificates. Certificates may fall under the **VPN and apps** or **CA certificate** settings. Follow the procedure that corresponds with your device. 1. [Download a Cloudflare certificate](#download-the-cloudflare-root-certificate) in `.crt` format. 2. Go to **Settings** > **Apps** > **Google Play Store**. 3. Select **Manage Android preferences**. 4. Go to **Security & location** > **Credentials** > **Install from SD card**. 5. In the file open dialog, choose the `certificate.crt` file you downloaded. Select **Open**. 6. Enter a name to identify the certificate. Ensure **Credential use** is set to *VPN and apps*. 7. Select **OK**. 1. [Download a Cloudflare certificate](#download-the-cloudflare-root-certificate) in `.crt` format. 2. Go to **Settings** > **Apps** > **Google Play Store**. 3. Select **Manage Android preferences**. 4. Go to **Security & location** > **Credentials** > **Install a certificate > CA certificate**. 5. When prompted with a privacy warning, select **Install anyway**. 6. In the file open dialog, choose the `certificate.crt` file you downloaded. Select **Open**. 7. To verify the certificate is installed and trusted, go to **Settings** > **Apps** > **Google Play Store** > **Manage Android Preferences** > **Security** > **Credentials** > **Trusted credentials** > **User**. After adding the Cloudflare certificate to ChromeOS, you may also have to [install the certificate in your browser](#browsers). ## 5. Add the certificate to applications Some applications do not use the system certificate store and therefore require the certificate to be added to the application directly. For certain applications like the ones below, you will need to follow the steps in this section and add the Cloudflare certificate to the application for TLS decryption to function properly. If you do not update the application to trust the Cloudflare certificate, the application will refuse to connect and you will receive an untrusted certificate error. All of the applications below first require downloading a Cloudflare certificate with [the instructions above](#download-the-cloudflare-root-certificate). On macOS, the default path to the system keychain database file is `/Library/Keychains/System.keychain`. On Windows, the default path is `\Cert:\CurrentUser\Root`. Note Some applications require the use of a publicly trusted certificate — they do not trust the system certificate, nor do they have a configurable private store. For these applications to function, you must add a [Do Not Inspect policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#do-not-inspect) for the domains or IPs that the application relies on. Caution Even if you deployed WARP through the [Install certificate using the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) method, you may still need to add the Cloudflare certificate to certain applications. The Install certificate using the Cloudflare One Client method only installs the Cloudflare certificate to the operating system certificate store. ### Browsers Browsers may use their own certificate stores or rely on the operating system certificate store. #### Chrome Versions of Chrome before Chrome 113 use the [operating system root store ↗︎](https://support.google.com/chrome/answer/95617?visit_id=638297158670039236-3119581239&p=root_store&rd=1#zippy=%2Cmanage-device-certificates-on-mac-windows) on macOS and Windows. Chrome 113 and newer on macOS and Windows -- and all versions on Linux and ChromeOS -- use the [Chrome internal trust store ↗︎](https://www.chromium.org/Home/chromium-security/root-ca-policy/#introduction). To install a Cloudflare certificate to Chrome manually: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. In Chrome, go to **Settings** > **Privacy and security** > **Security**. 3. Select **Manage certificates**. 4. Go to **Authorities**. Select **Import**. 5. In the file open dialog, choose the `certificate.pem` file you downloaded. 6. In the dialog box, turn on *Trust this certificate for identifying websites*, *Trust this certificate for identifying email users*, and *Trust this certificate for identifying software makers*. Select **OK**. 7. To verify the certificate was installed and trusted, locate it in **Authorities**. For information on installing a Cloudflare certificate for organizations, refer to [Google's Chrome Enterprise and Education documentation ↗︎](https://support.google.com/chrome/a/answer/3505249). #### Firefox To install a Cloudflare certificate to Firefox manually: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. In Firefox, go to **Settings** > **Privacy & Security**. 3. In **Security**, select **Certificates** > **View Certificates**. 4. In **Authorities**, select **Import**. 5. In the file open dialog, choose the `certificate.pem` file you downloaded. 6. In the dialog box, turn on *Trust this CA to identify websites* and *Trust this CA to identify email users*. Select **OK**. 7. To verify the certificate was installed and trusted, locate it in the table under **Cloudflare**. For information on installing a Cloudflare certificate for organizations, refer to this [Mozilla support article ↗︎](https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox). ### Mobile device management (MDM) software Zero Trust integrates with several [mobile device management (MDM) software partners](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/) to deploy the Cloudflare One Client across devices. #### Microsoft Intune To upload and deploy a Cloudflare certificate in Microsoft Intune: 1. [Download and convert a Cloudflare certificate](#convert-the-certificate) to DER format with the `.cer` file type. 2. In Microsoft Intune, [create a trusted certificate profile ↗︎](https://learn.microsoft.com/mem/intune/protect/certificates-trusted-root#to-create-a-trusted-certificate-profile) with your converted certificate. For more information, refer to the [Microsoft documentation ↗︎](https://learn.microsoft.com/mem/intune/protect/certificates-trusted-root). #### Jamf Pro To upload and deploy a Cloudflare certificate in Jamf Pro: 1. [Download and convert a Cloudflare certificate](#convert-the-certificate) to DER format with the `.cer` file type. 2. In Jamf Pro, go to **Computers** > **Configuration Profiles** to create a computer configuration profile, or go to **Devices** > **Configuration Profiles** to create a mobile device configuration profile. Select **New**. 3. Add a name and description for the profile. 4. Choose whether you would like Jamf to install the certificate automatically or with self-service, and whether you would like to install the certificate for a single user or all users on the device. 5. Select **Add** > **Certificate**. Choose the certificate file. 6. Uncheck **Allow export from keychain**. 7. Select **Scope**, then choose which devices or groups to deploy the certificate to. 8. Select **Save**. For more information, refer to the [Jamf Pro documentation ↗︎](https://learn.jamf.com/bundle/jamf-pro-documentation-current/page/PKI_Certificates.html). #### Kandji To upload and deploy a Cloudflare certificate in Kandji: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.crt` format. 2. In Kandji, [upload the certificate ↗︎](https://support.kandji.io/support/solutions/articles/72000558739-certificate-profile) as a PKCS #1-formatted certificate. #### Hexnode To upload and deploy a Cloudflare certificate in Hexnode: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. In Hexnode, follow the directions for adding the certificate to [macOS ↗︎](https://www.hexnode.com/mobile-device-management/help/how-to-add-certificates-for-mac-devices-with-hexnode-mdm/), [iOS ↗︎](https://www.hexnode.com/mobile-device-management/help/add-certificates-for-ios-devices-with-hexnode-mdm/), and/or [Android ↗︎](https://www.hexnode.com/mobile-device-management/help/how-to-add-certificates-for-android-devices-using-hexnode-mdm/) devices. #### JumpCloud To upload and deploy a Cloudflare certificate in JumpCloud: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. In JumpCloud, [upload the certificate ↗︎](https://jumpcloud.com/support/manage-device-trust-certificates#distributing-global-device-certificates-). 3. [Configure a conditional access policy ↗︎](https://jumpcloud.com/support/configure-a-conditional-access-policy) to deploy the certificate across devices. ### Programming languages and runtimes Programming language runtimes often maintain their own certificate stores or use language-specific certificate management tools. #### Python Depending on which version of Python you have installed and your configuration, you may need to use either the `python` or `python3` command. If you use [virtual environments ↗︎](https://docs.python.org/3/library/venv.html), you will need to repeat the following steps within each virtual environment. The command to install the certificate with Python on Windows automatically includes `pip` and `certifi` (the default certificate bundle for certificate validation). 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.crt` format. 2. In a PowerShell terminal, install the `certifi` package: ```powershell python -m pip install certifi ``` 3. Identify the Python CA store: ```powershell $CERT_PATH = python -c "import certifi; print(certifi.where())" ``` 4. Update the bundle to include the Cloudflare certificate: ```powershell gc "$env:USERPROFILE\Downloads\certificate.crt" | ac $CERT_PATH ``` 5. (Optional) Configure your system variables to point to the CA store by adding them to PowerShell's configuration file: ```powershell [System.Environment]::SetEnvironmentVariable('CERT_PATH', $CERT_PATH, 'Machine') [System.Environment]::SetEnvironmentVariable('SSL_CERT_FILE', $CERT_PATH, 'Machine') [System.Environment]::SetEnvironmentVariable('REQUESTS_CA_BUNDLE', $CERT_PATH, 'Machine') ``` 6. Restart your terminal. 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. In a terminal, install the `certifi` package: ```sh python -m pip install certifi ``` 3. Append the Cloudflare certificate to this CA store by running: ```sh echo | cat - certificate.pem >> $(python -m certifi) ``` 4. (Optional) Configure your system variables to point to the CA store by adding them to your shell's configuration file (such as `~/.zshrc` or `~/.bash_profile`). For example: ```sh echo 'export CERT_PATH=$(python -c "import certifi; print(certifi.where())") export SSL_CERT_FILE=${CERT_PATH} export REQUESTS_CA_BUNDLE=${CERT_PATH}' >> ~/.zshrc ``` 5. Restart your terminal. #### Java Java may have multiple certificate keystore locations depending on different installations or applications that include Java. Depending on your Java Virtual Machine (JVM) installation, you may need to install the certificate for each instance. You may also need to manually configure each Java application to use and trust the certificate. To install a Cloudflare root certificate in the system JVM, follow the procedure for your operating system. These steps require you to [download a `.pem` certificate](#download-a-cloudflare-root-certificate). 1. Install [OpenSSL ↗︎](https://www.openssl.org/). 2. In a terminal, format the Cloudflare certificate for Java. ```sh openssl x509 -in Cloudflare_CA.pem -inform pem -out Cloudflare_CA.der -outform der ``` 3. Import the converted certificate into the Java keystore. ```sh sudo $JAVA_HOME/bin/keytool -import -trustcacerts -alias 'Cloudflare Root CA' -file Cloudflare_CA.der -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -noprompt 2>&1 ``` 4. Restart any instances of Java. 1. Install [OpenSSL for Windows ↗︎](https://slproweb.com/products/Win32OpenSSL.html). 2. In an administrator PowerShell terminal, format the Cloudflare certificate for Java. ```powershell openssl x509 -in Cloudflare_CA.pem -inform pem -out Cloudflare_CA.der -outform der ``` 3. Import the converted certificate into the Java keystore. ```powershell "%JAVA_HOME%\bin\keytool" -import -trustcacerts -alias "Cloudflare Root CA" -file Cloudflare_CA.der -keystore "%JAVA_HOME%\jre\lib\security\cacerts" -storepass changeit -noprompt ``` 4. Restart any instances of Java. #### Ruby To trust a Cloudflare root certificate in RubyGems, follow the procedure for your operating system. These steps require you to [download a `.pem` certificate](#download-a-cloudflare-root-certificate). 1. Install [OpenSSL ↗︎](https://www.openssl.org/). 2. In a terminal, format the Cloudflare certificate for Ruby. ```sh openssl x509 -in ~/Downloads/certificate.pem -out ~/Downloads/ruby-root-ca.crt ``` 3. Create a RubyGems certificate directory in your home folder. ```sh mkdir -p ~/.gem/ssl ``` 4. Copy the Cloudflare certificate to your RubyGems certificate store. ```sh cp ~/Downloads/ruby-root-ca.crt ~/.gem/ssl/rubygems.org.pem ``` 5. Configure RubyGems to use the certificate. ```sh gem sources --add-trusted-cert ~/.gem/ssl/rubygems.org.pem ``` Alternatively, add the following line to your RubyGems configuration file located in `~/.gemrc` file to globally trust the certificate: ```yaml :ssl_cert: ~/.gem/ssl/rubygems.org.pem ``` 6. Restart any terminal sessions. 1. Install [OpenSSL for Windows ↗︎](https://slproweb.com/products/Win32OpenSSL.html). 2. In a PowerShell terminal, format the Cloudflare certificate for Ruby. ```powershell openssl x509 -in %UserProfile%\Downloads\certificate.pem -out %UserProfile%\Downloads\ruby-root-ca.crt ``` 3. Create a RubyGems certificate directory in your home folder. ```powershell mkdir -Force "$env:USERPROFILE\.gem\ssl" ``` 4. Copy the Cloudflare certificate to your RubyGems certificate store. ```powershell Copy-Item "$env:USERPROFILE\Downloads\ruby-root-ca.crt" "$env:USERPROFILE\.gem\ssl\rubygems.org.pem" ``` 5. Configure RubyGems to use the certificate. ```powershell gem sources --add-trusted-cert "$env:USERPROFILE\.gem\ssl\rubygems.org.pem" ``` Alternatively, add the following line to your RubyGems configuration file located in `$HOME\.gemrc` to globally trust the certificate: ```yaml :ssl_cert: C:/Users//.gem/ssl/rubygems.org.pem ``` 6. Restart any terminal sessions. #### Rust Rust's package manager Cargo uses the system certificate store by default on most platforms. However, you may need to configure it explicitly in some cases. 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Set the `CARGO_HTTP_CAINFO` environment variable to point to the certificate. In PowerShell: ```powershell [System.Environment]::SetEnvironmentVariable('CARGO_HTTP_CAINFO', "$HOME\Downloads\certificate.pem", 'User') ``` 3. Restart your terminal. Alternatively, you can configure this in your Cargo configuration file at `%USERPROFILE%\.cargo\config.toml`: ```toml [http] cainfo = "C:\\Users\\\\Downloads\\certificate.pem" ``` 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Set the `CARGO_HTTP_CAINFO` environment variable by adding it to your shell's configuration file (such as `~/.zshrc` or `~/.bash_profile`): ```sh export CARGO_HTTP_CAINFO="$HOME/Downloads/certificate.pem" ``` 3. Restart your terminal. Alternatively, you can configure this in your Cargo configuration file at `~/.cargo/config.toml`: ```toml [http] cainfo = "/path/to/certificate.pem" ``` ### Development tools and package managers Development tools and package managers often require certificate configuration for secure package downloads and repository access. #### Git 1. Open PowerShell. 2. Run the following command: ```powershell git config -l ``` This command will output: ```txt core.symlinks=false core.autocrlf=true core.fscache=true color.diff=auto color.status=auto color.branch=auto color.interactive=true help.format=html rebase.autosquash=true http.sslcainfo=C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt http.sslbackend=openssl diff.astextplain.textconv=astextplain filter.lfs.clean=git-lfs clean -- %f filter.lfs.smudge=git-lfs smudge -- %f filter.lfs.process=git-lfs filter-process filter.lfs.required=true credential.helper=manager ``` 3. The `http.sslcainfo` defines the CA Certificate store. To append the Cloudflare certificate to the CA bundle, update `http.sslcainfo`. ```powershell gc .\certificate.pem | ac $(git config --get http.sslcainfo) ``` To configure Git to trust a Cloudflare certificate, run the following command: ```sh git config --global http.sslcainfo [PATH_TO_CLOUDFLARE_CERT] ``` #### npm 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Set the `cafile` configuration to use the Cloudflare certificate: ```sh npm config set cafile [PATH_TO_CLOUDFLARE_CERT.pem] ``` On some systems you may need to set the following in your path/export list: ```sh export NODE_EXTRA_CA_CERTS='[PATH_TO_CLOUDFLARE_CERT.pem]' ``` #### PHP Composer The command below will set the [`cafile` ↗︎](https://getcomposer.org/doc/06-config.md#cafile) configuration inside of `composer.json` to use the Cloudflare root certificate. Make sure to [download a certificate](#download-a-cloudflare-root-certificate) in the `.pem` file type. ```sh composer config cafile [PATH_TO_CLOUDFLARE_CERT.pem] ``` Alternatively, you can add this manually to your `composer.json` file under the `config` key. #### Docker To install a certificate for use in a Docker container: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Create a directory for certificates in your Docker project: ```sh cd docker-project mkdir certs mv /path/to/downloaded/certificate.pem certs/ ``` 3. Verify the certificate was moved to the directory correctly. Your project should have the following structure: ```sh docker-project/ ├── Dockerfile └── certs/ └── certificate.pem ``` 4. Add the certificate to your Docker image: To add the certificate to your Dockerfile to install it during the build process: 1. Add the certificate install directions to your Dockerfile. For example: *Red Hat-based imagesdocker* ```docker FROM registry.access.redhat.com/ubi9/ubi:latest # Or FROM centos:7 or FROM fedora:38 # Install necessary certificates package RUN dnf install -y ca-certificates # Copy and add Cloudflare root certificate COPY certs/certificate.pem /etc/pki/ca-trust/source/anchors/certificate.crt RUN update-ca-trust extract ``` *Debian-based imagesdocker* ```docker FROM debian:12 # Or FROM ubuntu:22.04 # Install necessary certificates package RUN apt-get update && apt-get install -y ca-certificates # Copy and add Cloudflare root certificate COPY certs/certificate.pem /usr/local/share/ca-certificates/certificate.crt RUN update-ca-certificates ``` *Alpine-based imagesdocker* ```docker FROM alpine:3.18 # Install necessary certificates package RUN apk add --no-cache ca-certificates # Copy and add Cloudflare root certificate COPY certs/certificate.pem /usr/local/share/ca-certificates/certificate.crt RUN update-ca-certificates ``` 2. Build the Docker image: ```sh docker build -t . ``` 3. Verify the certificate was installed: *Red Hat-based imagessh* ```sh docker run --rm your-image-name sh -c "cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | grep Cloudflare" ``` *Debian and Alpine-based imagessh* ```sh docker run --rm your-image-name sh -c "cat /etc/ssl/certs/certificate.pem" ``` To add the certificate to your Docker Compose file to install it during runtime: 1. Add the certificate install directions to your `docker-compose.yml` file. For example: *Red Hat-based containersyaml* ```yaml version: '3' services: redhat-app: image: registry.access.redhat.com/ubi9/ubi:latest volumes: - certs/certificate.pem:/etc/pki/ca-trust/source/anchors/certificate.pem entrypoint: /bin/sh -c "dnf install -y ca-certificates && update-ca-trust extract && app start" ``` *Debian-based containersyaml* ```yaml version: '3' services: debian-app: image: debian:12 volumes: - certs/certificate.pem:/usr/local/share/ca-certificates/certificate.crt entrypoint: /bin/sh -c "apt-get update && apt-get install -y ca-certificates && update-ca-certificates && app start" ``` *Alpine-based containersyaml* ```yaml version: '3' services: alpine-app: image: alpine:3.18 volumes: - certs/certificate.pem:/usr/local/share/ca-certificates/certificate.pem entrypoint: /bin/sh -c "apk add --no-cache ca-certificates && update-ca-certificates && app start" ``` 2. Run the container: ```sh docker-compose up ``` 3. Verify the certificate was installed: *Red Hat-based containerssh* ```sh docker exec -it sh -c "cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem | grep Cloudflare" ``` *Debian and Alpine-based containerssh* ```sh docker exec -it sh -c "cat /etc/ssl/certs/ca-certificates.crt | grep Cloudflare" ``` ### Command-line tools Command-line tools typically use the system certificate store but may require specific configuration. #### cURL By default, cURL will use your operating system's native certificate store. To force cURL to use your default certificate, add the `--ca-native` flag to the command. For example: ```curl curl --ca-native https://example.com ``` To use a Cloudflare root certificate with cURL on macOS, [install the certificate to the operating system keychain](#macos). cURL will use the macOS root certificate by default. To use a Cloudflare certificate with the version of cURL preinstalled on Windows or another version that uses the Schannel (WinSSL) backend, [install the certificate to the Windows certificate store](#windows). If you use an older or custom version of cURL built with the OpenSSL backend, you will need to [manually configure cURL to use the certificate](#curl). To use a Cloudflare root certificate with cURL on Linux, [install the certificate to your distribution's certificate store](#linux). cURL will use the Linux root certificate by default. #### GNU Wget By default, GNU Wget will use your operating system's native certificate store. To force Wget to use your default certificate, add the `--ca-certificate` flag to the command. To use a Cloudflare root certificate with Wget on macOS, [install the certificate to the operating system keychain](#macos). Wget will use the macOS root certificate by default. To use a Cloudflare certificate with Wget on Windows, [install the certificate to the Windows certificate store](#windows). Wget will use the Windows root certificate by default. To use a Cloudflare root certificate with Wget on Linux, [install the certificate to your distribution's certificate store](#linux). Wget will use the Linux root certificate by default. Alternatively, you can specify a certificate file directly: ```sh wget --ca-certificate=[PATH_TO_CLOUDFLARE_CERT.pem] https://example.com ``` To make this permanent, add the following to your `~/.wgetrc` file: ```sh ca_certificate = [PATH_TO_CLOUDFLARE_CERT.pem] ``` ### IDEs and development environments Integrated development environments often use their own JVMs or certificate stores. #### Android Studio Android Studio uses its own JVM and certificate store. To install a Cloudflare root certificate: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate). 2. Find the `java.home` value for your Android Studio installation. 1. In Android Studio, go to **Help** > **About** (or **Android Studio** > **About Android Studio** on macOS). 2. Copy the JRE path shown in the dialog. For example: ```txt /Applications/Android Studio.app/Contents/jbr/Contents/Home ``` 3. Add the Cloudflare certificate to Android Studio's JVM: 1. In a terminal, add the JRE path you copied as an environment variable. ```sh export JAVA_HOME="/path/to/jre" ``` 2. Run `keytool` to install and trust the Cloudflare certificate. ```sh "$JAVA_HOME/bin/keytool" -import -file ~/Downloads/certificate.crt -alias CloudflareRootCA -keystore "$JAVA_HOME/lib/security/cacerts" -storepass changeit -trustcacerts -noprompt ``` 3. Restart Android Studio. 1. In an administrator PowerShell terminal, add the JRE path you copied as an environment variable. ```powershell $env:JAVA_HOME = "C:\Program Files\Android\Android Studio\jbr" ``` 2. Run `keytool` to install and trust the Cloudflare certificate. ```powershell & "$env:JAVA_HOME\bin\keytool.exe" -import -file "$env:USERPROFILE\Downloads\certificate.crt" -alias CloudflareRootCA -keystore "$env:JAVA_HOME\lib\security\cacerts" -storepass changeit -trustcacerts -noprompt ``` 3. Restart Android Studio. For Gradle builds within Android Studio, you may also need to configure the Gradle JVM to trust the certificate by following the same steps for the Gradle JVM location. #### JetBrains To install a Cloudflare root certificate on JetBrains products, refer to the links below: - [AppCode ↗︎](https://www.jetbrains.com/help/objc/settings-tools-server-certificates.html) - [CLion ↗︎](https://www.jetbrains.com/help/clion/settings-tools-server-certificates.html) - [DataGrip ↗︎](https://www.jetbrains.com/help/datagrip/settings-tools-server-certificates.html) - [DataSpell ↗︎](https://www.jetbrains.com/help/dataspell/settings-tools-server-certificates.html) - [GoLand ↗︎](https://www.jetbrains.com/help/go/settings-tools-server-certificates.html) - [IntelliJ IDEA ↗︎](https://www.jetbrains.com/help/idea/settings-tools-server-certificates.html) - [PhpStorm ↗︎](https://www.jetbrains.com/help/phpstorm/settings-tools-server-certificates.html) - [PyCharm ↗︎](https://www.jetbrains.com/help/pycharm/settings-tools-server-certificates.html) - [Rider ↗︎](https://www.jetbrains.com/help/rider/Settings_Tools_Server_Certificates.html) - [WebStorm ↗︎](https://www.jetbrains.com/help/webstorm/settings-tools-server-certificates.html) #### Eclipse To install a Cloudflare root certificate on Eclipse IDE for Java Developers, you must add the certificate to the Java virtual machine (JVM) used by Eclipse. 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate). 2. Find the `java.home` value for your Eclipse installation. 1. In Eclipse, go to **Eclipse** > **About Eclipse** (or **Help** > **About Eclipse IDE** on Windows and Linux) 2. Select **Installation Details**, then go to **Configuration**. 3. Search for `java.home`, then locate the value. For example: ```txt *** System properties: java.home=/Users//.p2/pool/plugins/org.eclipse.justj.openjdk.hotspot.jre.full.macosx.aarch64_17.0.8.v20230831-1047/jre ``` 4. Copy the full path after `java.home=`. 3. Add the Cloudflare certificate to Eclipse's JVM: 1. In a terminal, add the `java.home` value you copied as an environment variable. ```sh export JAVA_HOME=$(echo /path/to/java.home) ``` 2. Run `keytool` to install and trust the Cloudflare certificate. ```sh "$JAVA_HOME/bin/keytool" -import -file ~/Downloads/certificate.crt -alias CloudflareRootCA -keystore "$JAVA_HOME/lib/security/cacerts" -storepass changeit -trustcacerts -noprompt ``` 3. Restart Eclipse. 1. In a terminal, add the `java.home` value you copied as an environment variable. ```powershell set JAVA_HOME="\path\to\java.home" ``` 2. Run `keytool` to install and trust the Cloudflare certificate. ```powershell "%JAVA_HOME%\bin\keytool.exe" -import -file "%UserProfile%\Downloads\Cloudflare_CA.crt" -alias CloudflareRootCA -keystore "%JAVA_HOME%\lib\security\cacerts" -storepass changeit -trustcacerts -noprompt ``` 3. Restart Eclipse. For more information on adding certificates to Eclipse with `keytool`, refer to [IBM's documentation ↗︎](https://www.ibm.com/docs/en/ram/7.5.4?topic=client-adding-server-public-certificate-eclipse). ### Cloud and infrastructure tools Cloud service providers and infrastructure tools often require certificate configuration for API access and resource management. #### Google Cloud ##### Google Cloud SDK The commands below will set the Google Cloud SDK to use a Cloudflare certificate. For more information on configuring the Google Cloud SDK, refer to the [Google Cloud documentation ↗︎](https://cloud.google.com/sdk/docs/proxy-settings). 1. Get curl's `cacert` bundle. ```sh curl --remote-name https://curl.se/ca/cacert.pem ``` 2. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 3. Combine the certs into a single `.pem` file. ```sh cat cacert.pem certificate.pem > ~/ca.pem ``` 4. Configure Google Cloud to use the combined `.pem`. ```sh gcloud config set core/custom_ca_certs_file ~/ca.pem ``` Note The file at `~/ca.pem` needs to remain in place in order for the `gcloud` utility to leverage it. If the file is moved, then you must re-run step 3 to point `gcloud` to the file's new location. ##### Kaniko If you use Kaniko with Google Cloud SDK, you must install a Cloudflare certificate in the [Kaniko CA store ↗︎](https://docs.gitlab.com/ee/ci/docker/using_kaniko.html#using-a-registry-with-a-custom-certificate). For more information, refer to the [`gcloud` documentation ↗︎](https://cloud.google.com/sdk/gcloud/reference/builds/submit). ##### Google Apps Manager (GAM) Google Apps Manager (GAM) uses its own certificate store. To add a Cloudflare certificate to GAM, refer to the [GAM documentation ↗︎](https://github.com/GAM-team/GAM/wiki/#using-gam-with-ssl--tls-mitm-inspection). #### AWS CLI ##### Global config To persistently set the location of the certificate: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Locate and open your [AWS configuration file ↗︎](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html#cli-configure-files-where). 3. Configure the [`ca_bundle` setting ↗︎](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html#cli-configure-files-settings) with the location of your certificate. For example: *.aws/configdiff* ```diff [default] region = us-west-1 +ca_bundle = /path/to/certificate.pem ``` 4. Restart your terminal. ##### Environment variable To set the location of the certificate for use as an environment variable: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. In a terminal, set the [`AWS_CA_BUNDLE` environment variable ↗︎](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html) to the location of your certificate depending on your operating system. 3. Restart your terminal. #### Azure CLI ##### Global config To persistently set the location of the certificate: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Set the `REQUESTS_CA_BUNDLE` environment variable to point to your certificate depending on your operating system. Add the following to your shell's configuration file (such as `~/.zshrc` or `~/.bash_profile`): ```sh export REQUESTS_CA_BUNDLE="$HOME/Downloads/certificate.pem" ``` In PowerShell: ```powershell [System.Environment]::SetEnvironmentVariable('REQUESTS_CA_BUNDLE', "$HOME\Downloads\certificate.pem", 'User') ``` 3. Restart your terminal. ##### Per-command To set the location of the certificate for a single command: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Set the `REQUESTS_CA_BUNDLE` environment variable when running the command: ```sh REQUESTS_CA_BUNDLE=/path/to/certificate.pem az ``` For more information, refer to the [Azure CLI documentation ↗︎](https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy). #### Boto3 Boto3, the AWS SDK for Python, can be configured to use a Cloudflare certificate in several ways. ##### Environment variable To set the location of the certificate using an environment variable: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Set the `AWS_CA_BUNDLE` environment variable depending on your operating system. Add the following to your shell's configuration file (such as `~/.zshrc` or `~/.bash_profile`): ```sh export AWS_CA_BUNDLE="$HOME/Downloads/certificate.pem" ``` In PowerShell: ```powershell [System.Environment]::SetEnvironmentVariable('AWS_CA_BUNDLE', "$HOME\Downloads\certificate.pem", 'User') ``` 3. Restart your terminal. ##### AWS config file To persistently set the location of the certificate in your AWS configuration: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Locate and open your [AWS configuration file ↗︎](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html#cli-configure-files-where). 3. Configure the [`ca_bundle` setting ↗︎](https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-files.html#cli-configure-files-settings) with the location of your certificate. For example: *.aws/configdiff* ```diff [default] region = us-west-1 +ca_bundle = /path/to/certificate.pem ``` ##### In code To specify the certificate directly in your Python code: 1. [Download a Cloudflare certificate](#download-a-cloudflare-root-certificate) in `.pem` format. 2. Pass the certificate path when creating a Boto3 client or resource: ```python import boto3 client = boto3.client( 's3', verify='/path/to/certificate.pem' ) ``` For more information, refer to the [Boto3 documentation ↗︎](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html). ### Enterprise applications Enterprise desktop applications and specialized tools may require custom certificate configuration. #### Google Drive To trust a Cloudflare root certificate in the Google Drive desktop application, follow the procedure for your operating system. These steps require you to [download a `.pem` certificate](#download-a-cloudflare-root-certificate). 1. In a terminal, copy the contents of the Google Drive certificate file to a new certificate file in a permanent location, such as your Documents folder. For example: ```sh cat /Applications/"Google Drive.app"/Contents/Resources/roots.pem > ~/Documents/gdrivecerts.pem ``` 2. Append the contents of the downloaded certificate to the end of the new file. For example: ```sh cat ~/Downloads/certificate.pem >> ~/Documents/gdrivecerts.pem ``` 3. Apply the newly created root certificate to your Google Drive application. For example: ```sh sudo defaults write /Library/Preferences/com.google.drivefs.settings TrustedRootCertsFile "/Users/$(whoami)/Documents/gdrivecerts.pem" ``` You can verify the update with the following command. ```sh defaults read /Library/Preferences/com.google.drivefs.settings ``` 1. In an administrator PowerShell terminal, copy the contents of the Google Drive certificate file to a new certificate file in a permanent location, such as your Documents folder. For example: ```powershell Get-Content "C:\Program Files\Google\Drive File Stream\roots.pem" | Set-Content "$HOME\Documents\gdrivecerts.pem" ``` 2. Append the contents of the downloaded certificate to the end of the new file. For example: ```powershell Get-Content "$HOME\Downloads\certificate.pem" | Add-Content "$HOME\Documents\gdrivecerts.pem" ``` 3. Apply the newly created root certificate to your Google Drive application. For example: ```powershell Set-ItemProperty -Path "HKLM:\SOFTWARE\Google\DriveFS" -Name "TrustedRootCertsFile" -Value "$HOME\Documents\gdrivecerts.pem" ``` You can verify the update with the following command. ```powershell Get-ItemProperty -Path "HKLM:\SOFTWARE\Google\DriveFS" | Select-Object TrustedRootCertsFile ``` For more information, refer to the [Google documentation ↗︎](https://support.google.com/a/answer/7644837) for the `TrustedRootCertsFile` setting. #### Minikube To trust a Cloudflare root certificate in Minikube, refer to [x509: certificate signed by unknown authority ↗︎](https://minikube.sigs.k8s.io/docs/handbook/vpn_and_proxy/#x509-certificate-signed-by-unknown-authority). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/#page","headline":"Install certificate manually","description":"Manually add a Cloudflare certificate to mobile devices and individual applications.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/og.png?v=b6e53927267d3f8d","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["TLS"]} ``` --- --- description: Configure the Cloudflare One Client to use a custom root certificate instead of the Cloudflare certificate. title: Deploy custom certificate image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/og.png?v=13ffcb4b6efa47c3 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Deploy custom certificate Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Only available on Enterprise plans. Enterprise customers who do not wish to install a [Cloudflare certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) have the option to upload their own root certificate to Cloudflare. This feature is sometimes referred to as Bring Your Own Public Key Infrastructure (BYOPKI). Gateway will use your uploaded certificate to encrypt all sessions between the end user and Gateway, enabling all HTTPS inspection features that previously required a Cloudflare certificate. You can upload multiple certificates to your account, but only one can be active at any given time. You also need to upload a private key to intercept domains with JIT certificates and to enable the [block page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/). You can upload either a root certificate or a full certificate chain (root certificate plus intermediate certificates). Uploading a certificate chain allows end-user devices to only install the root certificate, which can simplify certificate management for larger enterprises. You can upload up to five custom root certificates. If your organization requires more than five certificates, contact your account team. Caution Custom certificates are limited to use between your users and the Gateway proxy. Gateway connects to origin servers using publicly trusted certificates, similar to how a browser validates secure websites. If your users need to connect to self-signed origin servers, create an HTTP Allow policy for the origin server with the [untrusted certificate action](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#untrusted-certificates) set to *Pass through*. ## Generate a custom root CA 1. Open a terminal. 2. (Optional) Create a directory for the root CA and change into it. ```sh mkdir -p /root/customca cd /root/customca ``` You can generate the certificate files in any directory. This step keeps things organized. If you skip it, files will be created in your current working directory. 3. Generate a private key for the root CA. ```sh openssl genrsa -out .pem 2048 ``` The `2048` value specifies the RSA key size in bits. You can use `4096` for stronger security at the cost of slightly slower TLS handshakes. Caution Keep the private key secure — if it is compromised, an attacker could issue trusted certificates on your behalf. 4. Generate a self-signed root certificate. ```sh openssl req -x509 -sha256 -new -nodes \ -key .pem \ -days 365 \ -out .pem \ -addext "basicConstraints=critical,CA:TRUE" \ -addext "keyUsage=critical,keyCertSign,cRLSign" ``` The `-addext` flags add the `basicConstraints` and `keyUsage` extensions required by [RFC 5280 ↗︎](https://datatracker.ietf.org/doc/html/rfc5280) for CA certificates. Without them, some TLS clients may reject certificates signed by your custom CA. In particular, Python 3.13 and later enforce strict RFC 5280 compliance by default ( `ssl.VERIFY_X509_STRICT`), causing HTTPS requests to fail for devices using the Cloudflare One Client when the uploaded CA does not include these extensions. The `-days 365` value controls certificate expiry. A shorter duration reduces risk if the key is compromised, but requires more frequent rotation. Rotating a deployed BYOPKI certificate is a disruptive operation, so choose an expiry that balances security with operational overhead.
Error: Unknown cipher or option -addext If your system runs OpenSSL versions older than 1.1.1, the -addext flag is not available. Use a config file instead: ```sh openssl req -x509 -sha256 -new -nodes \ -key .pem \ -days 365 \ -out .pem \ -config <(printf '[req]\ndistinguished_name=dn\n[dn]\n[v3_ca]\nbasicConstraints=critical,CA:TRUE\nkeyUsage=critical,keyCertSign,cRLSign') \ -extensions v3_ca ```
5. Verify the required RFC 5280 extensions are present: ```sh openssl x509 -in .pem -noout -ext keyUsage,basicConstraints ``` The output should include: ```txt X509v3 Basic Constraints: critical CA:TRUE X509v3 Key Usage: critical Certificate Sign, CRL Sign ``` If these fields are missing, regenerate the certificate using the command in step 4. 6. To review the private key, run the following command: ```sh openssl rsa -in .pem -text ``` To review the certificate, run the following command: ```sh openssl x509 -in .pem -text ``` When preparing your certificate and private key for upload, be sure to remove any unwanted characters, such as mismatching subdomains in the certificate's common name. ## Deploy a custom root certificate You can upload a single root certificate or a full certificate chain. When uploading a certificate chain via the dashboard, API, or Terraform, concatenate the root certificate and any intermediate certificates in PEM format, with the root certificate first. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Traffic settings** > **Certificates**. 2. Select **Upload certificate**. 3. Enter the private key and SSL certificate you generated or select **Paste certificate from file** to upload them from a file. If uploading a certificate chain, paste all certificates (root and intermediates) in PEM format with the root certificate first. 4. Select **Upload custom certificate**. You can now [use the generated custom root certificate](#use-a-custom-root-certificate) for inspection. 1. Use the [Upload mTLS certificate endpoint](https://developers.cloudflare.com/api/resources/mtls_certificates/methods/create/) to upload the certificate and private key to Cloudflare. The certificate must be a root CA or certificate chain, formatted as a single string with `\n` replacing the line breaks.
Required API token permissions At least one of the following token permissions is required: - Account: SSL and Certificates Write
*Upload mTLS certificatebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/mtls_certificates" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "example_ca_cert", "certificates": "-----BEGIN CERTIFICATE-----\nXXXXX\n-----END CERTIFICATE-----", "private_key": "-----BEGIN PRIVATE KEY-----\nXXXXX\n-----END PRIVATE KEY-----", "ca": true }' ``` The response will return a UUID for the certificate. For example: ```json { "success": true, "errors": [], "messages": [], "result": { "id": "2458ce5a-0c35-4c7f-82c7-8e9487d3ff60", "name": "example_ca_cert", "issuer": "O=Example Inc.,L=California,ST=San Francisco,C=US", "signature": "SHA256WithRSA", ... } } ``` When uploading a certificate chain, the `certificates` field should contain all certificates in PEM format. To format this field, order the root certificate first, then concatenate any intermediate certificates. 2. Set the certificate as available for use in inspection with the [Activate a Zero Trust certificate endpoint](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/certificates/methods/activate/). This will deploy the certificate across the Cloudflare global network. *Activate a Zero Trust certificatebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/certificates/$CERTIFICATE_ID/activate" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` The response will return the certificate and a `pending_deployment` binding status. For example: ```json { "errors": [], "messages": [], "success": true, "result": { "in_use": false, "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "certificate": "-----BEGIN CERTIFICATE-----\\n ... \\n-----END CERTIFICATE-----\\n", "issuer_org": "Example Inc.", "issuer_raw": "O=Example Inc.,L=California,ST=San Francisco,C=US", "fingerprint": "E9:19:49:AA:DD:D8:1E:C1:20:2A:D8:22:BF:A5:F8:FC:1A:F7:10:9F:C7:5B:69:AB:0:31:91:8B:61:B4:BF:1C", "binding_status": "pending_deployment", "type": "custom", "updated_at": "2014-01-01T05:20:00.12345Z", "uploaded_on": "2014-01-01T05:20:00.12345Z", "created_at": "2014-01-01T05:20:00.12345Z", "expires_on": "2014-01-01T05:20:00.12345Z" } } ``` 3. Use the [Get Zero Trust certificate details endpoint](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/certificates/methods/get/) to verify the certificate's binding status is set to `available`. *Get Zero Trust certificate detailsbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/certificates/$CERTIFICATE_ID" \ --request GET \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` ```json { "errors": [], "messages": [], "success": true, "result": { "in_use": false, "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "certificate": "-----BEGIN CERTIFICATE-----\\n ... \\n-----END CERTIFICATE-----\\n", "issuer_org": "Example Inc.", "issuer_raw": "O=Example Inc.,L=California,ST=San Francisco,C=US", "fingerprint": "E9:19:49:AA:DD:D8:1E:C1:20:2A:D8:22:BF:A5:F8:FC:1A:F7:10:9F:C7:5B:69:AB:0:31:91:8B:61:B4:BF:1C", "binding_status": "available", "type": "custom", "updated_at": "2014-01-01T05:20:00.12345Z", "uploaded_on": "2014-01-01T05:20:00.12345Z", "created_at": "2014-01-01T05:20:00.12345Z", "expires_on": "2014-01-01T05:20:00.12345Z" } } ``` 4. (Optional) Verify the certificate is installed on your user's devices either [with the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/automated-deployment/) or [manually](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). 5. Use the [Patch Zero Trust account configuration endpoint](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/configurations/methods/edit/) to turn on the certificate for use in inspection. For example: *Patch Zero Trust account configurationbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/configuration" \ --request PATCH \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "settings": { "certificate": { "id": "{certificate_id}", "in_use": true } } }' ``` Once `in-use` is set to `true`, Gateway will sign your traffic using the custom root certificate and private key. If you turn off or deactivate the custom certificate, Gateway will revert to the next available Cloudflare certificate generated for your Zero Trust account. Private key visibility When you upload a private key to Zero Trust, Cloudflare encrypts the key and stores it at rest. Only your delegated apps have the necessary decryption keys to decrypt the private key. You will not be able to retrieve the private key after upload. ## Use a custom root certificate To use a custom root certificate you generated and uploaded to Cloudflare, refer to [Activate a root certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate). ## Troubleshooting ### Error 526: Invalid SSL certificate If Gateway returns an **HTTP Response Code: 526** after deploying a custom certificate, refer to the [Error 526 documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/troubleshooting/#error-526-invalid-ssl-certificate). ### Python 3.13+ SSL errors with the Cloudflare One Client Python 3.13 and later enable `ssl.VERIFY_X509_STRICT` by default, which requires CA certificates to comply with [RFC 5280 ↗︎](https://datatracker.ietf.org/doc/html/rfc5280). If your BYOPKI certificate was generated without the `keyUsage` and `basicConstraints` extensions, Python HTTPS requests will fail when the Cloudflare One Client is active. To resolve the issue, [generate a new custom root CA](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/#generate-a-custom-root-ca) and upload it to Cloudflare. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/#page","headline":"Deploy custom certificate","description":"Configure the Cloudflare One Client to use a custom root certificate instead of the Cloudflare certificate.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/og.png?v=13ffcb4b6efa47c3","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["TLS","Python"]} ``` --- --- description: Reference information for Device registration in Zero Trust. title: Device registration image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/og.png?v=bb591f6347f874e9 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Device registration Last updated May 1, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) A device registration represents an individual session of the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) on a physical device, linking a user (or service token) and the device to your [Zero Trust organization](https://developers.cloudflare.com/cloudflare-one/setup/#2-create-a-zero-trust-organization). It is created the first time the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) authenticates on that device. Each device registration includes a unique public key, [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/), and [virtual IP addresses](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-ips/) (one IPv4 and one IPv6) that identify the device on your network. A single physical device can have [multiple device registrations](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/), for example, if multiple users share a single laptop and each enrolls the Cloudflare One Client with their own credentials. ## Key concepts | Concept | Definition | | --- | --- | | [User](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/#manage-users) | A person whose identity is verified through your identity provider (IdP) and who can enroll devices in your Zero Trust organization. | | [Seat](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/) | A billable unit consumed when a user authenticates to your Zero Trust organization. Each user occupies one seat regardless of how many devices they enroll. Service tokens do not consume seats. | | [Service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) | Credentials used by automated systems to authenticate against your Cloudflare One policies. | | Device registration | An individual session of the Cloudflare One Client on a physical device, with its own public key, [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/), and [virtual IP addresses](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-ips/) (one IPv4 and one IPv6). | | [Session](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/) | A time-limited JSON Web Token (JWT) that controls how long a user can access an Access application before re-authenticating. Unlike sessions, a device registration is persistent — it does not expire and exists until you delete it. | ## Review device registration status To review how many device registrations are associated with a device: 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and go to **Zero Trust** > **Teams & Resources** > **Devices**. 2. Select a device and select **View details**. 3. Scroll down to **Users** and review users who enrolled on this device. To review a device registration's status: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Teams & Resources** > **Devices**. 2. Select the device and select **View details**. 3. Scroll down to **Users** and find the user associated with the device. 4. Review the status (such as `Active` or `Revoked`) of the device registration under **Status**. To get a list of all device registrations, including active and revoked registrations: *List registrationsbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/registrations?status=all&per_page=50" \ --request GET \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` ```json { "created_at": "2026-01-26T19:27:49.770372Z", "device": { "client_version": "2025.10.186", "id": "11ffb86f-3f0c-4306-b4a2-e62f872b166a", "name": "My Device" }, "id": "11ffb86f-3f0c-4306-b4a2-e62f872b166a", "key": " **Teams & Resources** > **Devices**. 2. Select the device > **View details**. 3. Go to **Users** and mark the checkbox next to the device registration you want to delete. 4. Select **Action** > *Delete access*. To delete a single device registration using the [API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/devices/subresources/registrations/methods/delete/):
Required API token permissions At least one of the following token permissions is required: - Zero Trust Write
*Delete registrationbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/registrations/$REGISTRATION_ID" \ --request DELETE \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` To bulk delete multiple device registrations: ```curl curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/device/registrations/registrations?id=reg_id_1&id=reg_id_2&id=reg_id_3" \ --request DELETE\ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` The device registration is now permanently deleted, and its virtual IP address is released back into the available pool for reassignment. Automatic device re-registration If you delete a device registration, but the Cloudflare One Client remains installed and is successfully able to re-authenticate, a new device registration will be created for the user or service token. For long-term, permanent denial of access, you should [remove the user from your device enrollment policies or your IdP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-user-access) or [remove service token access](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-service-token-access). ### Revoke a device registration Revoking a device registration invalidates its associated public key, which disallows the specific device registration from connecting to Cloudflare's network. Revoking a device registration does not release the virtual IPs that are assigned to the registration. Because virtual IPs are a finite resource, Cloudflare strongly advises deleting a registration rather than revoking it. Automatic unrevocation If a user re-authenticates while the device registration is revoked, a new device registration will be created for the user. For long-term, permanent denial of access, you should [remove the user from your device enrollment policies or your IdP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-user-access) and [remove service token access](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-service-token-access). 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Teams & Resources** > **Devices**. 2. Select the device and select **View details**. 3. To revoke access, select **Revoke access**. This revokes access for all associated registrations on the device. 4. To unrevoke access, scroll down to the **Users** section and select one or more users using the checkbox. Select **Actions** > **Unrevoke access**. ### Delete a device Deleting a device removes the physical device from your Cloudflare Zero Trust account. This action automatically deletes all associated device registrations. Devices that have zero active registrations (because all registrations were deleted) are hidden by default in Cloudflare One > **Teams & Resources** > **Devices** table. You may need to adjust the filter to view devices with zero device registrations. Automatic device re-creation If you delete a device record, but the Cloudflare One Client remains installed and a user or service token is successfully able to re-authenticate, a device record will be automatically created in your dashboard with a new device registration. For permanent deletion, you should [remove service token access](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-service-token-access). To delete a device: 1. In Cloudflare One > **Teams & Resources** > **Devices**. 2. Select the device and select **View details**. 3. Select **Delete**. ## Device management Seat management (billing) and access management are separate processes. Deleting a device registration does not free up the user's seat or block them from accessing internal resources. To fully remove a user's access, you must take additional steps as described below. ### Remove user access Deleting or revoking a registration will not be permanent if the user can re-authenticate. To prevent a user from re-authenticating and creating new device registrations, you must remove them from your [device enrollment policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/) or from your Identity Provider (IdP). - If your device enrollment policies allow a broad domain (for example, `@company.com`), remove the user from your IdP. This prevents the user from authenticating through Access, effectively blocking them from enrolling devices. - If your device enrollment policies list specific user emails (for example, `sally@company.com`), you must remove that specific email from your device enrollment policies. Additionally, you can add an explicit Exclude rule for that user to the policy. After you have removed user access, to fully decommission a device, [remove service token access](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-service-token-access), if any exists. Devices with existing registrations will remain connected to Cloudflare until those specific device registrations are manually deleted. ### Remove service token access If you delete a service token's device registration, a new device registration for the service token will be automatically created without user interaction. For device registration deletion to be permanent, you must update your device enrollment policies to remove the service token. To block a service token from re-authenticating, you must either: 1. Delete the enrollment policy associated with the token, or modify the enrollment policy to no longer include the token (by removing its specific Include rule). 2. (Optional) [Delete the service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). You cannot use this service token to create new registrations. You cannot delete a service token while it is attached to a device enrollment policy. 3. Delete the service token [device registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#delete-a-device-registration). 4. (Optional) To fully decommission a device, [remove user access](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-user-access), if any exists. Devices with existing registrations will remain connected to Cloudflare until those specific device registrations are manually deleted. Impact on existing registrations If a single service token was used to enroll multiple devices, removing that token from your enrollment policies prevents all those devices from re-registering. Devices with existing registrations will remain connected to Cloudflare until those specific device registrations are manually deleted. ### Seat management (billing) Deleting a device or a device registration does not affect [seat usage](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/). Seats are tied to the user identity, not to individual devices. To stop a user from consuming a seat, you must remove the user from your Zero Trust Organization. Removing a user from your Zero Trust Organization will free up the seat the user consumed. The user will still appear in your list of users. To remove a user from your Zero Trust Organization: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Users**. 2. Select the checkbox next to a user with an **Active** status in the **Seat usage** column. 3. Select **Action** > **Remove users**. 4. Select **Remove**. The user will now show as **Inactive** and will no longer occupy a seat. If a user is removed but authenticates later, they will consume a seat again. To prevent a user from authenticating, you must remove them from your [device enrollment policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/) or from your Identity Provider (IdP). To automate the removal of users who have not logged in or triggered a device enrollment in a specific amount of time, turn on [seat expiration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/#enable-seat-expiration) or utilize [SCIM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) to remove users when they are deactivated in your identity provider. User record persistence You cannot delete or archive a user record. You can [remove a user](#remove-a-user) from a seat, but their user record will remain in your Zero Trust Organization. Inactive users do not count towards billing. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#page","headline":"Device registration","description":"Reference information for Device registration in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/og.png?v=bb591f6347f874e9","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["REST API"]} ``` --- --- description: Seat management in Zero Trust. title: Seat management image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/og.png?v=bfe200accaa8641e --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Seat management Last updated May 1, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare One subscriptions consist of seats that active users in your account consume. Active users are added to Cloudflare One through any [authentication event](#authentication-events). The amount of seats available in your Cloudflare One account depends on the amount of users you purchase. If you want to increase the number of seats available, you will have to purchase more users. Learn more about adding and removing seats from your account in the [Cloudflare One FAQ](https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/#how-do-i-change-my-subscription-plan). ## Authentication events A user consumes a seat when they perform an authentication event. For Access, this is any Cloudflare Access authentication event, such as a login to the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/) or an application. For Gateway, this is when any devices associated with the user connect to Cloudflare One within the [specified period](#enable-seat-expiration). If either one of these events occurs, that user's identity is added as an Active user to Cloudflare One and consumes one seat from your plan. The user will occupy and consume a single seat regardless of the number of applications accessed or login events from their user account. Once the total amount of seats in the subscription has been consumed, additional users who attempt to log in are blocked. A user who authenticates will hold their seat until you [remove the user](#remove-a-user) from your account. By default, inactive users will not be [automatically removed](#enable-seat-expiration) from your account. You can remove a single user or all users at any time, and those users will immediately stop counting against the seat count defined in your subscription. If you notice a number of accounts greater than the number of your users, you may need to configure an Access [bypass policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#bypass). Alternatively, you can use Access [service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) to allow access to applications without consuming seats. ## Seat management and device registrations [Removing a user](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/#remove-a-user) determines whether that user consumes a billable seat, but does not [prevent users from accessing resources](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/#remove-user-access) behind Cloudflare Access. Removing a user will delete all device registrations associated with the user. For more information about managing device registrations, refer to [Device registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/device-registration/). ## Manage users ### Check number of seats used To check the number of seats consumed by active users in your organization, log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and go to **Zero Trust**. **Cloudflare One overview** will display the amount of seats consumed and the remaining amount available. For more details on your users, go to **Team & Resources** > **Users**. ### Revoke a user When you revoke a user, this action will terminate active sessions, but will not remove the user's consumption of an active seat. To revoke a user from your Zero Trust Organization: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Users**. 2. Select the checkbox next to a user with an **Active** status in the **Seat usage** column. 3. Select **Action** > **Revoke**. 4. Select **Revoke sessions**. Revoked users can still log in if your policies allow them. To prevent a user from authenticating, you must remove them from your [device enrollment policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/) or from your Identity Provider (IdP). ### Remove a user Removing a user from your Zero Trust Organization will free up the seat the user consumed. The user will still appear in your list of users. To remove a user from your Zero Trust Organization: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Users**. 2. Select the checkbox next to a user with an **Active** status in the **Seat usage** column. 3. Select **Action** > **Remove users**. 4. Select **Remove**. The user will now show as **Inactive** and will no longer occupy a seat. If a user is removed but authenticates later, they will consume a seat again. To prevent a user from authenticating, you must remove them from your [device enrollment policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/) or from your Identity Provider (IdP). To automate the removal of users who have not logged in or triggered a device enrollment in a specific amount of time, turn on [seat expiration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/#enable-seat-expiration) or utilize [SCIM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) to remove users when they are deactivated in your identity provider. User record persistence You cannot delete or archive a user record. You can [remove a user](#remove-a-user) from a seat, but their user record will remain in your Zero Trust Organization. Inactive users do not count towards billing. ### Enable seat expiration Cloudflare One can automatically remove any user who does not log in to an Access application or whose device does not show any Gateway activity for the specified period (between one month and one year). To determine if a user will be removed, Cloudflare looks for any authentication events and checks the **Last seen** value for all of the user's devices. If both of those are outside the expiration window, the user will be removed and will no longer count against your number of seats. This process occurs once daily for an account. To enable user seat expiration: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Settings** > **Admin controls**. 2. In **Remove inactive users from seats**, select **Edit**. 3. Select an inactivity time from the dropdown menu. 4. Select **Save**. If a user is removed but authenticates later, they will consume a seat again. For more information about removing a user for Access and Gateway, refer to the [FAQ](https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/#removing-users). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/#page","headline":"Seat management","description":"Seat management in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/og.png?v=bfe200accaa8641e","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: How SCIM provisioning works in Zero Trust. title: SCIM provisioning image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/og.png?v=8827d86256e0c19d --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # SCIM provisioning Last updated Aug 26, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) System for Cross-domain Identity Management (SCIM) is an open standard protocol that allows identity providers to synchronize user identity information with cloud applications and services. After configuring SCIM, user identities that you create, edit, or delete in the identity provider are automatically updated across all supported applications. This makes it easier for IT admins to onboard new users, update their groups and permissions, and revoke access in the event of an employee termination or security breach. Note This section covers SCIM provisioning for Cloudflare Zero Trust only. To provision access to your Cloudflare account, you will need to set up a distinct [dashboard SSO SCIM integration](https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/) in your IdP. You can assign users and groups to this new SCIM application to define who can access the Cloudflare dashboard. Users provisioned via the [Zero Trust SCIM integration](#sync-users-and-groups-in-zero-trust-policies) will not have access to your Cloudflare dashboard unless you have manually added them to your [Cloudflare dashboard SSO application](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/). ## Supported identity providers Cloudflare One supports SCIM provisioning for all SAML and OIDC identity providers that use SCIM version `2.0`. ## Sync users and groups in Zero Trust policies Cloudflare Access can automatically deprovision users from Zero Trust after they are deactivated in the identity provider and display synchronized group names in the Access and Gateway policy builders. Cloudflare does not provision new users in Zero Trust when they are added to the identity provider -- users must first register a device with the Cloudflare One Client or authenticate to an Access application. SCIM affects Access and Gateway policy evaluation differently. Access evaluates a user's identity and group membership from the SAML assertion or OIDC token returned by the identity provider during authentication. SCIM provides readable group names in the Access policy builder, but Access does not use SCIM group membership to evaluate a login. If you turn on **Enable user deprovisioning**, removing a user from the SCIM application revokes their active Access sessions. You can also configure SCIM to revoke sessions after group membership changes. Access evaluates the updated identity provider data when the user authenticates again. Gateway evaluates identity-based policies against the [User Registry identity](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/users/). SCIM updates this identity when users or group memberships change, without waiting for the user to authenticate again. Cloudflare One Client device profiles use the same synchronized identity. To set up SCIM for Zero Trust, refer to our [SSO integration](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/) guides. ## Common provider-specific issues SCIM behavior depends on the identity provider configuration as well as Cloudflare. Common issues include: - **Okta**: User sync and group sync are separate. Make sure **Push Groups** is configured if you expect groups to appear in Zero Trust policies. - **Microsoft Entra ID**: Group sync only occurs for groups included in the provisioning scope. The `userName` attribute should match the user's email address in Cloudflare One. If users appear but groups do not, verify the IdP-side SCIM app first before troubleshooting Cloudflare policy behavior. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/#page","headline":"SCIM provisioning","description":"How SCIM provisioning works in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/og.png?v=8827d86256e0c19d","dateModified":"2026-08-26","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["SCIM"]} ``` --- --- description: How User logs works in Zero Trust. title: User logs image: https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/users/og.png?v=00dae7efe60b893a --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # User logs Last updated May 1, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/users/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) User logs show a list of all users who have authenticated to Cloudflare One. For each user who has logged in, you can view their enrolled devices, login history, seat usage, and identity used for policy enforcement. ## View user logs In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Users**. This page lists all users who have registered the Cloudflare One Client or authenticated to a Cloudflare Access application. You can select a user's name to view detailed logs, [revoke their session](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/#revoke-user-sessions), or [remove their seat](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/). ### Available logs - **User Registry identity**: Select the user's name to view their last seen identity. This identity is used to evaluate Gateway policies and Cloudflare One Client [device profiles](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). A refresh occurs when the user re-authenticates the device client, logs into an Access application, or has their IdP group membership updated via [SCIM provisioning](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/). To track how the user's identity has changed over time, go to the **Audit logs** tab. - **Session identities**: The user's active sessions, the identity used to authenticate each session, and when each session will [expire](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/). - **Devices**: Devices registered to the user via the Cloudflare One Client. - **Recent activities**: The user's five most recent Access login attempts. For more details, refer to your [authentication audit logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#authentication-logs). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/users/#page","headline":"User logs","description":"How User logs works in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/users/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/users/og.png?v=00dae7efe60b893a","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Cloud and SaaS findings in Cloudflare One. title: Cloud and SaaS findings image: https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/og.png?v=26616082715d6e62 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Cloud and SaaS findings Last updated Oct 5, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Availability Available for all Zero Trust users. Free users can configure up to two CASB integrations. You must upgrade to an Enterprise plan to view the details of a finding instance. Cloudflare's [Cloud Access Security Broker ↗︎](https://www.cloudflare.com/learning/access-management/what-is-a-casb/) (CASB) connects to SaaS application and cloud environment APIs to scan for security issues that can occur after a user has successfully logged in. These include misconfigurations (such as overly permissive sharing settings), unauthorized user activity, [shadow IT](https://www.cloudflare.com/learning/access-management/what-is-shadow-it/), and other data security issues. For a list of supported finding types, refer to [Cloud and SaaS integrations](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/). You can also send posture finding instances to external systems with [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/). ## Finding terminology CASB uses the following terms for posture findings: | Term | Definition | | --- | --- | | Finding type | A definition of a specific security issue that CASB detects. It includes detection logic and metadata for one vendor and asset class, such as files or users. One finding type can apply to multiple integrations. | | Posture finding | A summary of detections of one finding type within one integration. Each row in **Posture Findings** represents a finding and groups its instances. | | Finding instance | An individual occurrence of a posture finding affecting a specific asset within that integration. One asset can have instances of different finding types. | For example, CASB detects publicly viewable files in two Google Workspace integrations. **Posture Findings** shows two findings for the **Google Workspace: File publicly accessible with view access** finding type, one per integration. Each affected file, such as `budget.xlsx`, is a separate finding instance within its integration. Content findings use a different grouping. Each row in **Content Findings** represents one asset within an integration and groups its matching [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) profiles. To review detected findings and their affected assets, refer to [Manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/). ## Manage CASB integrations When you integrate a third-party SaaS application or cloud environment with Cloudflare CASB, you allow CASB to make API calls to its endpoint and read relevant data on your behalf. The CASB integration permissions are read-only and follow the least privileged model. In other words, only the minimum access required to perform a scan is granted. ### Prerequisites Before you can integrate a SaaS application or cloud environment with CASB, your account with that integration must meet certain requirements. Refer to the SaaS application or cloud environment's [integration guide](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) to learn more about the prerequisites and permissions. ### Add an integration 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** > **Integrations**. 2. Select **Connect an integration** or **Add integration**. 3. Browse the available integrations and select the application you would like to add. 4. Follow the step-by-step integration instructions in the UI. 5. To run your first scan, select **Save integration**. After the first scan, CASB will automatically scan your SaaS application or cloud environment on a frequent basis to keep up with any changes. Scan intervals will vary due to each application having their own set of requirements, but the frequency is typically between every 1 hour and every 24 hours. Once CASB detects at least one finding, you can [view and manage your findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/). ### Pause an integration 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** > **Integrations**. 2. Find the integration you would like to pause and select **Configure**. 3. To stop scanning the application, turn off **Scan for findings**. 4. Select **Save integration**. You can resume CASB scanning at any time by turning on **Scan for findings**. ### Delete an integration Caution When you delete an integration, all keys and OAuth data will be deleted. This means you cannot restore a deleted integration or its scanned data. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** > **Integrations**. 2. Find the integration you would like to delete and select **Configure**. 3. Select **Disenroll**. To resume scanning the integration for findings, you will need to [add the integration](#add-an-integration) again. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/#page","headline":"Cloud and SaaS findings","description":"Cloud and SaaS findings in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/og.png?v=26616082715d6e62","dateModified":"2026-10-05","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Compliance"]} ``` --- --- description: Manage findings in Cloudflare One. title: Manage findings image: https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/og.png?v=31d64742589b6a07 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Manage findings Last updated Oct 6, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare CASB detects security issues involving users, stored files, and application settings. In Cloudflare One, you can review posture and content findings and take action on affected assets. For definitions of finding types, posture findings, and finding instances, refer to [Finding terminology](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/#finding-terminology). ## Prerequisites - You have added a [Cloud and SaaS integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/). - Your scan has surfaced at least one security finding. ## Posture findings Posture findings include misconfigurations, unauthorized user activity, and other data security issues. Each finding summarizes one finding type within one integration. Its finding instances identify the affected assets. The same finding type can appear in separate rows for different integrations. To view details about the posture findings that CASB found: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Choose **SaaS** or **Cloud**. 3. To view details about a finding, select the finding name. Cloud & SaaS findings will display details about your posture finding, including the finding type, [severity level](#severity-levels), number of instances, associated integration, current status, and date detected. For more information on each instance of the finding, select **Manage**. To manage the finding's visibility, you can update the finding's [severity level](#severity-levels) or [hide the finding](#hide-findings) from view. You can also [send a posture finding instance to a webhook](#send-webhook). Some findings also provide a remediation guide to resolve the issue. To detect conditions that Cloudflare's standard finding types do not cover, refer to [Custom finding types](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/). ### Severity levels Cloudflare CASB labels each finding with one of the following severity levels: | Severity level | Urgency | | --- | --- | | Critical | Suggests the finding is something your team should act on today. | | High | Suggests the finding is something your team should act on this week. | | Medium | Suggests the finding should be reviewed sometime this month. | | Low | Suggests the finding is informational or part of a scheduled review process. | #### Change the severity level You can change the severity level for a finding at any time in case the default assignment does not suit your environment: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Locate the finding you want to modify and select **Manage**. 3. In the severity level drop-down menu, choose your desired setting (*Critical*, *High*, *Medium*, or *Low*). The new severity level will only apply to the posture finding within this specific integration. If you added multiple integrations of the same application, the other integrations will not be impacted by this change. ## Content findings Content findings identify potential data exposure detected by [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/). Each content finding represents one asset within an integration and groups all matching DLP profiles for that asset. To view details about the content findings that CASB found: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Content Findings**. 2. Choose **SaaS** or **Cloud**. 3. To view details about a finding, select the finding name. Cloud & SaaS findings will display details about your content finding, including the file name, a link to the file, matching DLP profiles, associated integration, and date detected. AWS users can configure a [compute account](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/aws-s3/#compute-account) to scan for data security resources within their S3 resources. ## View shared files Posture finding instances and content findings for some integrations (such as [Microsoft 365](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/microsoft-365/#file-sharing) and [Box](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/box/#file-sharing)) may link to an inaccessible file. To access the actual shared file: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Choose **SaaS** or **Cloud**. 3. Locate the individual finding, then select **Manage**. 4. In **Active Instances**, select the file name. 5. In **Shared Links**, select the linked file instance. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Content Findings**. 2. Choose **SaaS** or **Cloud**. 3. Select the file name of the detected asset. 4. In **Sharing details**, select the linked file instance. ## Hide findings After reviewing your findings, you may decide that certain posture findings are not applicable to your organization. Cloudflare CASB allows you to remove findings or individual instances of findings from your list of active issues. CASB will continue to scan for these issues, but any detections will appear in a separate tab. - **Ignore a finding** — Moves the posture finding for one integration from **Active** to **Ignored**. Current and future detections of that finding type within the integration appear under the ignored finding. Ignoring does not affect findings of the same type in other integrations. - **Hide an instance** — Moves one finding instance from **Active** to **Hidden**. Future detections of the same finding type for that asset within the integration go to the **Hidden** tab automatically. ### Ignore a finding 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Locate the active finding you want to hide. 3. In the three-dot menu, select **Move to ignore**. The finding's status will change from **Active** to **Ignored**. CASB will continue to scan for these findings and report detections. You can change ignored findings back to **Active** with the same process at any time. ### Hide an instance of a finding 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Choose the active finding you want to hide, then select **Manage**. 3. In **Active**, find the instance you want to hide. 4. In the three-dot menu, select **Move to hidden**. The instance will be moved from **Active** to **Hidden** within the finding. If CASB detects the same issue for that asset again, it appears in the **Hidden** tab. You can move hidden instances back to the **Active** tab at any time. ## Send webhook After you configure one or more [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/), you can send posture finding instances to external systems such as chat platforms, ticketing systems, SIEMs, SOAR tools, and custom automation services. CASB webhooks currently support posture finding instances only. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Choose **SaaS** or **Cloud**. 3. Choose the finding you want to review, then select **Manage**. 4. In **Active Instances**, select an instance. 5. In the instance details panel, select **Send webhook**. 6. Choose the webhook destination or destinations you want to use. 7. Select **Send webhooks**. Cloudflare queues webhook sends in the background. A success message means that Cloudflare accepted the request for delivery. To validate a destination before sending a live finding instance, use **Test delivery** from the [Webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/) page. ## Remediate findings In addition to detecting issues with SaaS and cloud applications, CASB can remediate supported posture finding instances directly in applications. ### Configure remediation permissions Before you can remediate finding instances, [add a new integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) and choose *Read-Write mode* during setup. Alternatively, you can update an existing integration: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** > **Integrations**. 2. Choose your integration, then select **Configure**. 3. In **Integration permissions**, choose *Read-Write mode*. 4. Select **Update integration**. CASB will redirect you to your Microsoft 365 configuration. 5. Sign in to your organization, then select **Accept**. CASB can now remediate instances of supported finding types directly. ### Remediate a finding To remediate a finding instance: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Cloud & SaaS findings** > **Posture Findings**. 2. Choose a finding whose type supports remediation, then select **Manage**. 3. In **Active Instances**, select an instance. 4. In **Remediation details**, choose a remediation action to take. CASB will begin remediating the instance. ### Remediate inherited file permissions CASB can remove supported permissions applied directly to a Microsoft 365 or Google Workspace resource. If a file inherits access from a parent folder or Shared Drive, change the permission on that parent resource. Changing the file itself does not remove the inherited access. CASB does not automatically change permissions on parent resources. Changing a parent permission can affect every downstream file and folder that inherits it. #### Microsoft 365 CASB may show a separate finding instance for the parent folder that gives the file its permission. The remediation details may include **Parent Folder Access** links. Open the linked instance to remediate the parent folder separately. When an inherited permission prevents remediation, CASB displays: > Resource has inherited permissions. Remediate permissions at the folder or organizational level. #### Google Workspace For Google Workspace, CASB does not identify the exact parent resource. Asset details may show the associated Shared Drive, but not the originating folder or permission. When an inherited permission prevents remediation, CASB displays: > Resource has inherited permissions from a parent resource. Direct remediation of the parent is not yet supported for Google Workspace. For example, a file inherits public access when its parent folder allows **Anyone with the link**. Change the **General access** setting on the parent folder to resolve the finding instance. A file can also inherit external access from a Shared Drive member. Change the relevant parent permission or Shared Drive membership to resolve the finding instance. To remediate an inherited Google Workspace permission: 1. In Google Drive, open the affected file and select **Share** or **Manage access**. 2. Find the public or external access associated with the finding instance. 3. If Google Drive identifies the parent, open that resource. Otherwise, inspect each parent folder until you find where the permission is configured directly. 4. For Shared Drive content, also inspect the membership and sharing settings. 5. Review the impact on downstream resources before changing the permission. 6. Change the permission at its source. CASB updates the finding instance after it receives updated asset data. The failed child-resource remediation remains in the remediation history. ### Manage remediated findings To review remediation progress, go to **Cloud & SaaS findings** > **Posture Findings** and open the affected finding instance. Each remediation status applies only to that instance: | Status | Description | | --- | --- | | Pending | CASB has set the finding instance to be remediated. | | Processing | CASB is remediating the finding instance. | | Validating | CASB completed the remediation and is waiting to confirm that the issue affecting the asset is resolved. | | Completed | CASB remediated the finding instance and confirmed that the issue is resolved. | | Failed | CASB could not remediate the finding instance. | | Rejected | CASB does not have the correct permissions to remediate the finding instance. | CASB may take up to 48 hours to validate a remediation. If the status is **Completed**, remediation succeeded. If the status is **Failed** or **Rejected**, remediation failed, and you can select the finding instance to take action again. A **Rejected** status indicates that CASB does not have the correct permissions to remediate the instance. CASB will log remediation actions in **Logs** > **Admin**. For more information, refer to [Cloudflare One Logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/). To automatically remediate matching finding instances without reviewing each one, refer to [Remediation Policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#page","headline":"Manage findings","description":"Manage findings in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/og.png?v=31d64742589b6a07","dateModified":"2026-10-06","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Compliance"]} ``` --- --- description: Automatically remediate finding instances or send webhooks with CASB policies in Cloudflare One. title: Remediation Policies image: https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/og.png?v=8c92cb64c5c7deaf --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Remediation Policies Last updated Oct 5, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Availability Requires a paid Cloudflare CASB plan. Remediation Policies are not available for free CASB integrations. Use CASB policies to automatically remediate a finding instance or send a webhook as soon as CASB detects it. A policy defines the vendor, integrations, finding type match, and action Cloudflare should take. For definitions of finding types and instances, refer to [Finding terminology](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/#finding-terminology). Policies build on [manual remediation](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#remediate-findings) and [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/). Instead of each finding instance needing to be actioned manually, a configured policy automatically triggers action on all newly discovered matching finding instances. ## Prerequisites - A configured [Cloud or SaaS integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/). - [Read-Write permissions](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#configure-remediation-permissions) on the integration, required for remediation actions. - A [configured webhook destination](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/#create-a-webhook), required for webhook actions. ## How policies work When CASB detects a finding instance, it checks whether the instance matches a customer-configured policy. If a policy matches, Cloudflare runs the action configured in the policy against that instance automatically. A policy can run a remediation action, send a webhook, or both. ## Find the IDs for a policy When you create a policy with the API or Terraform, you reference other objects by ID: - **Finding type ID**: Use the [List finding types](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/finding_types/methods/list/) endpoint. - **Remediation type ID**: Use the [List remediation types](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/finding_types/subresources/remediation_types/methods/list/) endpoint for the finding type. Only [some finding types](#run-remediations) support remediation. - **Webhook ID**: Use the ID of a [configured webhook](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/#create-a-webhook). In Terraform, reference the `id` of a `cloudflare_zero_trust_casb_webhook` resource or data source. - **Integration IDs**: Required only when the policy does not apply to all integrations. Use the [List integrations](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/integrations/methods/list/) endpoint. ## Create a policy 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Policies**. 2. Select **Create a policy**. 3. Under **Basic information**, enter a **Policy name**. Optionally, enter a **Description**. 4. Under **Choose how you want to trigger the policy**, select a **Vendor**. 5. Select one or more **Integrations**, or select **Apply to all integrations** to apply the policy to every integration for the vendor. 6. Select a **Finding type**. Only finding types available for the selected vendor and integrations appear here. 7. Under **Define what to do with findings that match your trigger**, choose one or both actions: - **Run Remediation** to have Cloudflare perform a first-party remediation action against the SaaS integration API. This option is only available for select finding types. - **Send webhooks** to send a notification to one or more webhook destinations. 8. Under **Status**, turn on **Enable policy**. 9. Select **Create policy**. Make a `POST` request to the [Create a policy](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/create/) endpoint. A policy must include at least one action, and can include at most one remediation:
Required API token permissions At least one of the following token permissions is required: - Zero Trust Write
*Create a new policy configurationbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/data-security/posture/policies" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "display_name": "Auto-remediate public files", "description": "Remove public access and notify the SIEM", "enabled": true, "applies_to_all_integrations": true, "finding_type_id": "", "actions": { "remediation_types": [ { "remediation_type_id": "" } ], "webhook_configs": [ { "webhook_config_id": "" } ] } }' ``` To limit the policy to specific integrations, set `applies_to_all_integrations` to `false` and provide an `integration_ids` array of [integration IDs](#find-the-ids-for-a-policy). 1. Add the following permission to your [`cloudflare_api_token` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token): - `Zero Trust Write` 2. Create a policy using the [`cloudflare_zero_trust_casb_policy` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_casb_policy) resource. The following example remediates matching findings and sends them to the `siem` webhook from [Create a webhook](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/#create-a-webhook). If you manage the webhook outside Terraform, use its ID or the `cloudflare_zero_trust_casb_webhook` data source instead: ```tf resource "cloudflare_zero_trust_casb_policy" "public_files" { account_id = var.cloudflare_account_id display_name = "Auto-remediate public files" description = "Remove public access and notify the SIEM" enabled = true applies_to_all_integrations = true finding_type_id = "" actions = { remediation_types = [{ remediation_type_id = "" }] webhook_configs = [{ webhook_config_id = cloudflare_zero_trust_casb_webhook.siem.id }] } } ``` To limit the policy to specific integrations, set `applies_to_all_integrations = false` and list the [integration IDs](#find-the-ids-for-a-policy): ```tf applies_to_all_integrations = false integration_ids = ["", ""] ``` Terraform reports an error at `terraform plan` if `applies_to_all_integrations` is `false` and `integration_ids` is empty. Policies will be in effect for all newly discovered finding instances going forward. New or updated policies are not applied retroactively to existing finding instances. CASB policies appear in a list showing each policy's name, integration, finding type, webhook, remediation action, status, and the time it last ran. ### Run remediations Remediation actions perform a first-party fix directly against the integration's API, such as revoking a public file share. CASB currently supports remediation actions for Microsoft 365 and Google Workspace file and folder finding types. If a finding type does not support remediation, **Run Remediation** displays **No automated remediation available for this finding type** and cannot be enabled.
Supported finding types for remediation **Google Workspace:** - File publicly accessible with edit access - File publicly accessible with view access - File shared outside company with edit access - File shared outside company with view access - File shared company-wide with edit access - File shared company-wide with view access - File publicly accessible with edit access with DLP Profile match - File publicly accessible with view access with DLP Profile match - File shared outside company with edit access with DLP Profile match - File shared outside company with view access with DLP Profile match - File shared company-wide with edit access with DLP Profile match - File shared company-wide with view access with DLP Profile match **Microsoft 365:** - File publicly accessible with edit access - File publicly accessible with view access - File shared company-wide with edit access - File shared company-wide with view access - File publicly accessible with edit access with DLP Profile match - File publicly accessible with view access with DLP Profile match - File shared company-wide with edit access with DLP Profile match - File shared company-wide with view access with DLP Profile match
Remediation requires [Read-Write permissions](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#configure-remediation-permissions) on the integration. If the integration only has Read permissions, upgrade the integration before the policy can remediate matching finding instances. For more information, refer to [Manage remediated findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#manage-remediated-findings). ### Send webhooks Webhook actions send the finding instance to a previously configured webhook destination. Use this to route finding instances to systems such as Slack, Microsoft Teams, Jira, ServiceNow, Tines, or a custom HTTPS endpoint. When a policy sends a webhook, the payload uses the same format as a webhook sent manually from a finding instance. For the payload structure and field descriptions, refer to [Payload format](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/#payload-format). ## Edit, turn off, or delete a policy 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Policies**. 2. Select the policy to update. 3. Modify the policy's basic information, trigger, or actions. 4. Select **Save changes**. To turn a policy on or off, use the **Enable policy** toggle under **Status**. Each policy displays its status as **Enabled** or **Disabled** in the policy list. A disabled policy stops matching new finding instances until you turn it on again. To delete a policy, open the policy and select **Delete**. To update a policy, make a `PUT` request to the [Update a policy](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/update/) endpoint. Include `display_name`, `enabled`, `applies_to_all_integrations`, and `actions`. The request replaces the existing policy, so include every action you want to keep. To turn the policy off, set `enabled` to `false`:
Required API token permissions At least one of the following token permissions is required: - Zero Trust Write
*Update a policy configurationbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/data-security/posture/policies/$POLICY_ID" \ --request PUT \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "display_name": "Auto-remediate public files", "enabled": false, "applies_to_all_integrations": true, "actions": { "webhook_configs": [ { "webhook_config_id": "" } ] } }' ``` You cannot change a policy's finding type. To use a different finding type, create a new policy. To delete a policy, make a `DELETE` request to the [Delete a policy](https://developers.cloudflare.com/api/resources/zero_trust/subresources/casb/subresources/posture/subresources/policies/methods/delete/) endpoint:
Required API token permissions At least one of the following token permissions is required: - Zero Trust Write
*Delete a policy configurationbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/data-security/posture/policies/$POLICY_ID" \ --request DELETE \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` To update a policy, change its attributes and run `terraform apply`. To turn the policy off, set `enabled = false`. Changing `finding_type_id` replaces the policy: Terraform deletes the existing policy and creates a new one. To delete a policy, remove the resource from your configuration and run `terraform apply`, or target the resource for destruction: ```sh terraform destroy -target=cloudflare_zero_trust_casb_policy.public_files ``` ## Manage existing policies with Terraform ### Import a policy To bring a policy created in the dashboard or API under Terraform management, import it using your account ID and the policy ID: ```sh terraform import cloudflare_zero_trust_casb_policy.public_files '/' ``` ### Look up policies Use the [`cloudflare_zero_trust_casb_policy` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/zero_trust_casb_policy) data source to read a single policy, or [`cloudflare_zero_trust_casb_policies` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/data-sources/zero_trust_casb_policies) to list all policies in an account: ```tf data "cloudflare_zero_trust_casb_policy" "public_files" { account_id = var.cloudflare_account_id policy_id = "" } data "cloudflare_zero_trust_casb_policies" "all" { account_id = var.cloudflare_account_id } ``` ## Logs Every policy produces two categories of logs, available under **Insights** in Cloudflare One: - **Admin Activity logs** record changes to a policy definition, including who created, edited, or disabled the policy, and when. - **Cloud & SaaS Security policies logs** record the runtime outcome of each policy invocation, including the finding instance that triggered the policy, the asset acted on, whether the action succeeded or failed, and the error returned by the vendor if it failed (for example, a `401 Unauthorized` response or a rate limit error). For compliance reporting, the Cloud & SaaS Security policies log ties a specific finding instance to a specific automated action and timestamp. For more information, refer to [Cloudflare One Logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/). ## Limitations - Remediation actions in a policy are only available for Microsoft 365 and Google Workspace file and folder finding types. - CASB cannot remove permissions inherited from a parent resource by remediating the affected child. For vendor-specific behavior and manual remediation steps, refer to [Remediate inherited file permissions](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#remediate-inherited-file-permissions). - A policy only applies to new instances of a finding type detected after the policy is created. ## Troubleshooting For help diagnosing issues, refer to [CASB troubleshooting](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/troubleshooting/casb/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/#page","headline":"Remediation Policies","description":"Automatically remediate finding instances or send webhooks with CASB policies in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/og.png?v=8c92cb64c5c7deaf","dateModified":"2026-10-05","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Compliance"]} ``` --- --- description: Define your own posture finding types with Rego in Cloudflare CASB. title: Custom finding types image: https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/og.png?v=25f252b39abecfe2 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Custom finding types Last updated Oct 8, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) In addition to providing predefined finding types to detect security issues within SaaS and cloud applications, Cloudflare CASB allows custom finding types to be defined from scratch, providing full control over the security conditions CASB detects. ## Prerequisites - A [Cloud or SaaS integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) has been added. - Familiarity with [Rego ↗︎](https://www.openpolicyagent.org/docs/policy-language). ## Standard and custom finding types Cloudflare CASB provides two ways that security risks are detected. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), they are differentiated in **Cloud & SaaS findings** > **Finding types library** as entries with **Origin** value "Standard" or "Custom". - **Standard finding type** - A predefined finding type created and managed by Cloudflare CASB. It can be inspected and duplicated, but not changed. - **Custom finding type** - A finding type that is created and managed in the account with Rego expressions. The following table shows the capabilities of a CASB customer's account for both standard and custom finding types: | Capability | Standard finding types | Custom finding types | | --- | --- | --- | | Inspect detection logic | ✅ | ✅ | | Create posture finding types | ❌ | ✅ | | Create content finding types | ❌ | ❌ | | Duplicate posture finding types | ✅ | ✅ | | Duplicate content finding types | ❌ | ❌ | | Edit posture finding types | ❌ | ✅ | | Edit content finding types | ❌ | ❌ | | Delete posture finding types | ❌ | ✅ | | Delete content finding types | ❌ | ❌ | | Disable posture finding types | ❌ | ❌ | | Disable content finding types | ❌ | ❌ | ## How custom finding types work ### Example scenario A security team at a company that uses Google Workspace wants to have visibility into when a group for executives, the board, or the legal team is open to people outside the company. The company names these groups with the prefixes `exec-`, `board-`, and `legal-`, and one of them, the outside counsel group, is allowed to have external members. Given that this depends on the company's own group naming convention and exception, CASB does not include a standard finding type for this exact scenario, so the team creates a custom finding type. 1. **Define the finding type.** In the Finding types library, the team creates a custom finding type. They name it "Sensitive group open to outsiders", set the severity to High, choose Google Workspace as the provider, and write a Rego expression that returns "fail" when a group whose address starts with `exec-`, `board-`, or `legal-` allows external members (unless it is the outside counsel group), lets anyone join, or lets anyone post. 2. **See the results.** As CASB receives updates for the company's Google Workspace groups, it evaluates each one. Groups that match appear as finding instances under **Posture Findings**, so the team can see which sensitive groups are open. Groups with other names are never flagged. 3. **Take action.** The team creates a [CASB policy](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) for this finding type that sends a webhook to their messaging admin automation. Each new finding instance now triggers the automation to restrict the group. The following sections describe each part of this flow in detail. ### Finding type fields A custom finding type consists of the following fields: | Field | Description | | --- | --- | | **Finding Type Name** | The display name of the finding type. | | **Description** | A definition for what the finding type detects against. | | **Severity** | The impact of the finding type: Low, Medium, High, or Critical. | | **Provider** | The [integration vendor](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) the finding type detects against. | | **Asset Class** | The set of asset fields available to the detection logic. These fields appear under **Available asset fields** in the finding type builder. | | **Category Type** | The classification of the findings it generates. | | **Integrations** | The integrations CASB evaluates this finding type against. Select **Apply to all integrations** to use all of them. | | **Rego Package** | The detection logic CASB uses to generate findings. | CASB evaluates a custom finding type against an asset when it is created or updated and exists within the set of configured integrations. They are not run retroactively against existing assets. Continuing the [example scenario](#example-scenario), one board group has an external member, and a new executive group is open to anyone: | Day | Event | Finding created? | | --- | --- | --- | | Sunday | The `board-directors@example.com` group allows external members and is updated. | No. The "Sensitive group open to outsiders" finding type does not exist yet. | | Monday | The security team creates the "Sensitive group open to outsiders" finding type. | No. CASB does not evaluate `board-directors`, because it has not changed since the finding type was created. | | Tuesday | The `exec-staff@example.com` group is created and anyone can join it. | Yes. CASB evaluates the new group and creates a finding instance. | | Wednesday | A member is added to `board-directors`. | Yes. CASB evaluates the group again and creates a finding instance, because it still allows external members. | | Thursday | The `legal-outside-counsel@example.com` group, which allows external members, is updated. | No. CASB evaluates the group and its result is "pass", because it is the approved exception, so no finding instance is created. | ## Rego detection logic Custom finding types are written in [Rego ↗︎](https://www.openpolicyagent.org/docs/policy-language), the open-source policy language used by Open Policy Agent (OPA). For an introduction to Rego, refer to the [OPA documentation ↗︎](https://www.openpolicyagent.org/docs/policy-language). CASB uses Rego v1 and supports a restricted subset of [Rego built-ins ↗︎](https://www.openpolicyagent.org/docs/policy-reference/builtins) and operations. The following expression is the one the security team writes in the [example scenario](#example-scenario). It detects sensitive groups that are open to people outside the company: ```txt sensitive_prefixes := ["exec-", "board-", "legal-"] external_exceptions := {"legal-outside-counsel@example.com"} default result := "pass" email := lower(input.asset.email) sensitive if strings.any_prefix_match(email, sensitive_prefixes) result := "fail" if { sensitive input.asset.allowExternalMembers == true not email in external_exceptions } result := "fail" if { sensitive input.asset.whoCanJoin == "ANYONE_CAN_JOIN" } result := "fail" if { sensitive input.asset.whoCanPostMessage == "ANYONE_CAN_POST" } ``` This expression works as follows: - `sensitive_prefixes` and `external_exceptions` hold the company's values. They are written into the expression, because CASB cannot fetch lists from another system during evaluation. - `default result := "pass"` sets the result to "pass" for every asset unless another rule in the expression changes it. Therefore, assets that do not match are never flagged. - `email := lower(input.asset.email)` lowercases the group's address, so that `Board-Directors@example.com` is treated the same as `board-directors@example.com`. - `sensitive` is true when the address starts with any of the three prefixes. `strings.any_prefix_match` checks the whole list in one call. Groups with other names never match. - `result := "fail" if { ... }` changes the result to "fail" when everything inside the braces is true. This will create a finding instance. - The first rule checks if sensitive groups allow external members without explicit approvals. - The second rule checks for sensitive groups that let anyone join. - The third rule checks for sensitive groups that let anyone post. ### Rego guidelines for custom finding type expressions - The expression must define a `result` that returns either "pass" or "fail". A "fail" result means the asset matches the finding type and creates a finding instance. - Add `default result := "pass"` so assets that do not match a fail condition return "pass". - No need to add a package declaration or any import statements, this includes `import rego.v1`. CASB adds these automatically, and the editor does not accept them. - Fields from the selected asset class can be read from `input.asset`. - Some asset classes include related assets, such as a file and its owner. When available, reference fields from related assets through `input.associated`. ### Rego validation Select **Validate** in the finding type builder to check a Rego expression before creating the finding. Validation compiles the expression and checks it against the asset schema. It reports any syntax errors or unsupported Rego built-ins it finds. Validation does not execute the expression against data. To confirm the expression detects the intended conditions, [verify the finding type's behavior](#verify-custom-finding-type-behavior) after it is created. ### Supported Rego built-ins Custom finding types support the following Rego built-ins and operators. Any built-in not listed here is unsupported.
Supported built-ins and operators | Category | Built-ins | | --- | --- | | Operators | =, ==, !=, >, >=, <, <=, in | | Aggregates | count, max, min, product, sort, sum | | Arrays | array.concat, array.flatten, array.reverse, array.slice | | Conversion | to_number | | Encoding and serialization | base64.decode, base64.encode, base64.is_valid, base64url.decode, base64url.encode, base64url.encode_no_pad, hex.decode, hex.encode, json.is_valid, json.marshal, json.marshal_with_options, json.unmarshal, urlquery.decode, urlquery.decode_object, urlquery.encode, urlquery.encode_object | | Glob and graph | glob.match, glob.quote_meta, graph.reachable, graph.reachable_paths, walk | | CIDR | net.cidr_contains, net.cidr_contains_matches, net.cidr_intersects, net.cidr_is_valid, net.cidr_merge | | Numbers | abs, ceil, div, floor, minus, mul, plus, rem, round | | JSON and objects | json.filter, json.remove, object.filter, object.get, object.keys, object.remove, object.subset, object.union, object.union_n | | Regular expressions | regex.globs_match, regex.is_valid, regex.match, regex.replace, regex.template_match | | Semantic versions | semver.compare, semver.is_valid | | Sets | and, intersection, or, union | | Strings | concat, contains, endswith, format_int, indexof, indexof_n, lower, replace, split, sprintf, startswith, strings.any_prefix_match, strings.any_suffix_match, strings.count, substring, trim, trim_left, trim_prefix, trim_right, trim_space, trim_suffix, upper | | Time | time.add_date, time.clock, time.date, time.diff, time.format, time.now_ns, time.parse_duration_ns, time.parse_ns, time.parse_rfc3339_ns, time.weekday | | Types | is_array, is_boolean, is_null, is_number, is_object, is_set, is_string, type_name | | Units | units.parse, units.parse_bytes | | URI | uri.is_valid, uri.parse | | UUID | uuid.parse, uuid.rfc4122 |
### Rego references Custom finding type expressions use Rego v1 syntax and the Cloudflare-supported Rego built-ins listed in this section. - [Rego policy language ↗︎](https://www.openpolicyagent.org/docs/policy-language) - Rego language documentation. - [OPA built-ins ↗︎](https://www.openpolicyagent.org/docs/policy-reference/builtins) - Full list of OPA built-ins. Custom finding types support a subset of this list. - [OPA style guide ↗︎](https://www.openpolicyagent.org/docs/style-guide) - General guidance for writing Rego expressions. - [OPA Playground ↗︎](https://play.openpolicyagent.org/) - Sandbox for writing and testing general Rego expressions. Note The OPA documentation and Playground include built-ins that custom finding types do not support. An expression that works in the Playground may fail validation in Cloudflare One. Use only the built-ins listed on this page. ## Create a custom finding type 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Finding types library**. 2. Select **Create finding type**. 3. Under **General Information**, enter a finding type name and description. Then, select a severity. 4. Under **Scope Definition**, select a provider and asset class. 5. Choose whether the finding type applies to all integrations for the provider or to selected integrations. 6. Under **Detection Logic**, enter the Rego expression. Use **Available asset fields** to identify supported fields. 7. Select **Validate**. Resolve each validation error before continuing. 8. Select **Create finding type**. CASB applies the custom finding type when it receives future asset updates within the selected scope. Matching assets appear as posture finding instances. ## Verify custom finding type behavior To confirm that a custom finding type is detecting matches, check its finding instances. 1. In **Cloud & SaaS findings**, go to **Posture Findings**. 2. Find the custom finding type. 3. Refer to the **Instances** column to confirm that matches have been found. The **Instances** column shows how many assets currently match. 4. Select **Manage** to view the matching assets. Note CASB evaluates assets only when it receives asset creations or updates. Assets that have not changed since the finding type was created are not evaluated, so they do not appear in **Instances**. If no instances appear after assets in the finding type's integrations have been created or updated, perform the following checks: - Check the specified provider - Check the specified asset class - Check the specified integration scope - Check the written field names in the written Rego expression - Check the field types used in the written Rego expression - Check the expected output of the written Rego expression ## Custom finding types restrictions and limits - An account can have up to 250 custom finding types. - Up to 25 custom finding types can apply to one integration. - Custom finding types support posture finding types. They do not support Data Loss Prevention (DLP) content finding types. - New and updated custom finding types do not apply retroactively. - The complete Rego policy, including Cloudflare-added declarations, can be up to 4 KiB. - Network access is not available during Rego expression evaluation. - Package declarations and import declarations are not accepted in the editor. ## Use custom finding types in policies Custom finding types can be used in [CASB policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) the same way standard finding types are used. When a [policy is created](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/#create-a-policy), the custom finding type is selected from the **Finding type** list. ### Example scenario Continuing the previous [example](#example-scenario), the security team wants a group restricted automatically each time CASB finds a sensitive group that is open to people outside the company. 1. **Create the policy.** The team creates a CASB policy and selects "Sensitive group open to outsiders" from the **Finding type** list. 2. **Set the scope.** The policy is set to **Apply to all integrations**, so it covers every Google Workspace integration the finding type is evaluated against. 3. **Choose the action.** The policy sends a webhook to the team's messaging admin automation. 4. **See it work.** When a group is created or updated and CASB evaluates it as "fail", CASB creates a finding instance. The policy then fires the webhook, and the automation restricts the group's membership and posting settings. ### Guidelines for using policies with custom finding types - Custom finding types can be used for policies that trigger webhooks. - A policy can only act on findings within the integrations it selects, or from all integrations if **Apply to all integrations** is set. It can only act on integrations within the custom finding type's integration scope. The two lists do not need to match. - If the [integration scope of the custom finding type](#edit-a-custom-finding-type) is edited to remove an integration, CASB no longer creates finding instances for that integration, so the policy has nothing to act on there. - If the custom finding type is [quarantined](#quarantined-custom-finding-types), CASB creates no new finding instances, so the policy does not trigger. - A custom finding type cannot be deleted while a policy uses it. [Delete the policy](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/#edit-turn-off-or-delete-a-policy) first, then [delete the custom finding type](#delete-a-custom-finding-type). ## Manage custom finding types Standard or custom posture finding types can be duplicated, supported fields on a custom finding type can be edited, and a custom finding type that is no longer needed can be deleted. ### Duplicate a finding type Open a standard posture finding type to inspect its detection logic. If the logic is a useful starting point, duplicate the finding type to create an editable copy. #### Example scenario Continuing the [previous example](#example-scenario), leadership asks that the executive and board groups be treated as Critical, with no exceptions, while the legal groups stay at High. Severity cannot be edited after creation, so the security team duplicates the finding type instead. 1. **Duplicate.** The team selects **Duplicate** on "Sensitive group open to outsiders". CASB copies the name, description, severity, provider, asset class, integration scope, and Rego expression into the builder. 2. **Adjust.** They rename the copy "Executive and board group open to outsiders" and set the severity to Critical. In the Rego expression, they change `sensitive_prefixes` to `["exec-", "board-"]`, and remove `external_exceptions` and the `not email in external_exceptions` line. 3. **Create.** They select **Validate**, then **Create finding type**. The copy is a new custom finding type. The original "Sensitive group open to outsiders" keeps running unchanged. For this company specifically, an `exec-` or `board-` group that breaks a rule now receives a finding from both finding types, one at High and one at Critical. #### Steps 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Finding types library**. 2. In the finding type menu, select **Duplicate**. 3. Review the copied name, description, severity, provider, asset class, integration scope, and Rego expression. 4. Change the copied fields as needed. 5. Select **Validate**. Resolve each validation error before continuing. 6. Select **Create finding type**. The duplicate finding type is a separate custom finding type. Changes to the duplicate do not affect the original finding type. ### Edit a custom finding type Only the following fields can be edited after a custom finding type is created: - Name - Description - Integration scope To change the provider, asset class, severity, or Rego expression, [duplicate the finding type](#duplicate-a-finding-type). 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Finding types library**. 2. In the custom finding type menu, select **Edit**. 3. Update the name, description, or integration scope. 4. Select **Save**. ### Delete a custom finding type 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Finding types library**. 2. In the custom finding type menu, select **Delete**. 3. Confirm the deletion. Deleting a custom finding type will stop all evaluations against future asset updates and deletes the associated finding instances. Deleting a finding instance cannot be undone. ### Disable a custom finding type Custom finding types cannot be disabled. To stop CASB from evaluating a custom finding type, [delete it](#delete-a-custom-finding-type). Deleting a custom finding type cannot be undone and deletes its existing finding instances. To stop a [CASB policy](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) that uses a custom finding type from triggering, turn off the policy instead. Refer to [Edit, turn off, or delete a policy](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/#edit-turn-off-or-delete-a-policy). ## Quarantined custom finding types Quarantine is a status CASB applies when a custom finding type's expression cannot be evaluated safely. A quarantined custom finding type displays a warning icon next to its entry in **Cloud & SaaS findings** > **Finding types library**. While a custom finding type is quarantined: - Existing finding instances remain visible. - CASB does not evaluate the expression when it receives asset updates, so no new finding instances are created. - Other custom and standard finding types on the same integrations continue to run normally. The **Policies** list does not show when a policy uses a quarantined custom finding type. ### Why a custom finding is quarantined A custom finding type will be quarantined if CASB is unable to evaluate the finding type against assets. Common causes include: - Nested iteration over large arrays, such as comparing every item in a list to every other item. - Timing out due to evaluation against large or deeply nested asset fields. - Running regular expressions against every element of a large collection when a simpler check, such as `startswith` or `endswith`, is sufficient. **Validate** compiles the expression and checks it against the asset schema, but does not run the expression against asset data. An expression can pass validation and still be quarantined later. ### Manually quarantine a custom finding type A custom finding type cannot be manually quarantined, and the status cannot be removed, from the dashboard or the API. Editing a quarantined custom finding type's name, description, or integration scope does not remove the status. ### Resolve a quarantined custom finding Custom finding type expressions cannot be edited. To resolve a quarantined custom finding type, duplicate it and correct the expression in the copy: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Finding types library**. 2. In the quarantined custom finding type menu, select **Duplicate**. 3. Rewrite the expression to reduce its runtime and memory use. Refer to [Why a custom finding is quarantined](#why-a-custom-finding-is-quarantined). 4. Select **Validate**. Resolve each validation error before continuing. 5. Select **Create finding type**. The duplicate is a new custom finding type and is not quarantined. 6. If a [CASB policy](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) uses the quarantined custom finding type, update the policy to use the new custom finding type. 7. [Delete the quarantined custom finding type](#delete-a-custom-finding-type). Note A quarantined custom finding type still counts toward the limits of 250 custom finding types per account and 25 per integration. If a limit has been reached, copy the expression and delete the quarantined custom finding type before the replacement is created. If the cause of the quarantine cannot be identified, contact [Cloudflare Support](https://developers.cloudflare.com/support/contacting-cloudflare-support/). Provide the custom finding type ID and as much detail as possible. ## Example expressions ### Iterate over an array For the Anthropic `AnthropicComplianceRole` asset class, the following expression detects a role with the Cowork permission: ```txt default result := "pass" result := "fail" if { some permission in input.asset.permissions permission.action == "cowork" } ``` ### Handle a nullable value For the Anthropic `AnthropicComplianceUser` asset class, the following expression detects a non-null email in the `example.com` domain: ```txt default result := "pass" result := "fail" if { input.asset.email != null regex.match(`(?i)@example\.com$`, input.asset.email) } ``` ### Use an associated asset For the Google Workspace `GoogleWorkspaceLicenseAssignment` asset class, the following expression detects a non-suspended, non-administrator user with an AI Ultra license: ```txt ai_ultra_sku_id := "1010470008" default result := "pass" result := "fail" if { input.asset.skuId == ai_ultra_sku_id input.associated.user.isAdmin == false input.associated.user.isSuspended == false } ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/#page","headline":"Custom finding types","description":"Define your own posture finding types with Rego in Cloudflare CASB.","url":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/og.png?v=25f252b39abecfe2","dateModified":"2026-10-08","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Compliance"]} ``` --- --- description: How Scan for sensitive data works in Cloudflare One. title: Scan for sensitive data image: https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/casb-dlp/og.png?v=c62f5989b0eea5fa --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Scan for sensitive data Last updated Oct 6, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/casb-dlp/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Requires Cloudflare CASB and Cloudflare DLP. You can use [Cloudflare Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) to discover if files stored in a SaaS application contain sensitive data. To perform DLP scans in a SaaS app, first configure a [DLP profile](#configure-a-dlp-profile) (a set of patterns that define what counts as sensitive data) with the data patterns you want to detect, then [add the profile](#enable-dlp-scans-in-casb) to a CASB integration. ## Supported integrations - [Amazon Web Services (AWS) S3](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/aws-s3/) - [Box](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/box/) - [Dropbox](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/dropbox/) - [Google Cloud Platform (GCP) Cloud Storage](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/gcp-cloud-storage) - [Google Drive](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/google-workspace/google-drive/) - [Microsoft OneDrive](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/microsoft-365/onedrive/) - [Microsoft SharePoint](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/microsoft-365/sharepoint/) - [Microsoft 365 Copilot](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/microsoft-365/m365-copilot/) - [OpenAI](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/openai/) - [Anthropic](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) ## Configure a DLP profile You may either use DLP profiles predefined by Cloudflare, or create your own custom profiles based on regex, predefined detection entries, datasets, and document fingerprints. ### Configure a predefined profile 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **Profiles**. 2. Choose a [predefined profile](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/) and select **Edit**. 3. Enable one or more **Detection entries** according to your preferences. 4. Select **Save profile**. Most predefined profiles match when any enabled detection entry matches. The **Personally Identifiable Information (PII) Record** profile is an exception and requires at least three unique detection entries in close proximity before the profile matches. Your DLP profile is now ready to use with CASB. ### Build a custom profile 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **Profiles**. 2. Select **Create profile**. 3. Enter a name and optional description for the profile. 4. Add detection entries to the profile.
Create a custom entry 1. Select **Create custom entry**. 2. Choose the type of detection entry you want to create and configure its values. For information on supported detection entry types, refer to Configure detection entries. 3. To save the detection entry, select **Done**.
Add existing entries Existing entries include predefined and user-defined detection entries that you manage from the Detection entries section. 1. Select **Add existing entries**. 2. Choose which entries you want to add, then select **Confirm**. 3. To finish, select **Done**.
5. (Optional) Add data classes to include reusable classification rules. - Select **Add data classes** - Choose the data classes you want to add, then select **Confirm** 6. (Optional) Use labels as match criteria for the profile. - Select a sensitivity schema and minimum sensitivity level. - Select a data tag group and one or more data tags. For more information on labels, templates, and data classes, refer to [Data Classification](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/data-classification/). 7. (Optional) Configure [**profile settings**](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/) for the profile. 8. Select **Save profile**. Your DLP profile is now ready to use with CASB. For more information, refer to [Configure a DLP profile](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/). ## Enable DLP scans in CASB ### Add a new integration 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Integrations** > **Cloud & SaaS**. 2. Select **Add integration** and choose a [supported integration](#supported-integrations). 3. During the setup process, you are prompted to select DLP profiles for the integration. 4. Select **Save integration**. CASB will scan every publicly accessible file in the integration for text that matches the DLP profile. The initial scan may take up to a few hours to complete. ### Modify an existing integration 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Integrations** > **Cloud & SaaS**. 2. Choose a [supported integration](#supported-integrations) and select **Configure**. 3. Under **DLP profiles**, select the profiles that you want the integration to scan for. 4. Select **Save integration**. If you enable a DLP profile from the **Manage integrations** page, CASB will only scan publicly accessible files that have had a modification event since enabling the DLP profile. Modification events include changes to the following attributes: - Contents of the file - Name of the file - Visibility of the file (only if changed to publicly accessible) - Owner of the file - Location of the file (for example, moved to a different folder) Caution If you add a DLP profile to an existing integration, CASB only scans files modified after you enabled the profile. To scan all files, you must enable the DLP profile during the [integration setup flow](#add-a-new-integration). ## Limitations DLP in CASB will only scan: - [Text-based files](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/#supported-file-types) such as documents, spreadsheets, and PDFs. Images are not supported. - Files less than or equal to 100 MB in size. - Java and R source code files that are at least 5 KB. Smaller files in these languages are skipped. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/casb-dlp/#page","headline":"Scan for sensitive data","description":"How Scan for sensitive data works in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/casb-dlp/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/casb-dlp/og.png?v=c62f5989b0eea5fa","dateModified":"2026-10-06","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Compliance"]} ``` --- --- description: Troubleshoot Troubleshoot CASB issues in Cloudflare One. title: Troubleshoot CASB image: https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/troubleshoot-casb/og.png?v=43ee8029b528fd46 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshoot CASB Last updated Oct 6, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/troubleshoot-casb/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Use this guide to troubleshoot common issues with Cloud Access Security Broker (CASB). This guide covers troubleshooting steps for CASB integrations and webhooks. For integration-specific issues, refer to the integration's documentation. ## Integration fails to connect or returns an error Integration connection problems are the most common issue during CASB setup. If you receive an error such as "There was an error creating the integration" or are redirected back to the dashboard without the integration appearing, follow these steps. ### Check permissions in the third-party application Ensure the account you are using to authorize the integration has the necessary administrative privileges in the third-party application (for example, **Global Administrator** for Microsoft 365, **Super Admin** for Google Workspace, or **Organization Owner** for GitHub). Insufficient permissions are the leading cause of setup failures. ### Clear previous installations If the SaaS application was previously integrated with a different Cloudflare account, you must manually revoke the old Cloudflare application from within the SaaS provider's admin console. - **For Microsoft 365**: Go to **Microsoft 365 admin center** > **Enterprise applications** and delete the existing Cloudflare One application. - **For Google Workspace**: Go to **Google Admin Console** > **Security** > **Access and data control** > **API controls** and remove the Cloudflare app from third-party app access. - **For GitHub**: Go to your organization's **Settings** > **Third-party access** and revoke the Cloudflare CASB application. After cleaning up the old app, wait a few minutes and then try the integration process again from the Cloudflare One dashboard. ### Verify OAuth permissions During setup, CASB will ask you to approve a set of permissions. The permissions requested are required for the CASB service to scan for misconfigurations and, if you choose, to take remediation actions. While some permissions may seem broad (for example, `write` access), they are necessary for actions like quarantining a file or modifying sharing settings. Refer to the specific integration guide for a detailed list of required permissions. ## Findings are stale or not updating after remediation A common point of confusion is when a resolved issue (for example, when a file is made private, or when a user is suspended) continues to appear as an active finding in the CASB dashboard. ### Understand scan frequency CASB integrations do not provide real-time updates. Scans are performed periodically to discover new findings and validate the status of existing ones. The initial scan can take several hours, and subsequent scans run approximately every 24-48 hours. ### Force a re-scan To trigger a new scan: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Integrations**. 2. Find your integration and select **Configure**. 3. Turn off **Scan for findings**. 4. After a few minutes, turn on **Scan for findings** again. This action will queue a fresh scan of your integration. Allow several hours for your findings to reflect the new results. ## Remediation action fails in the dashboard If you attempt to use a one-click remediation action (such as "Make private") on a finding, it may result in a **Failed** status, often with a timeout error. ### Verify permissions The remediation failure may be due to the permissions for the Cloudflare app being changed or revoked in the SaaS application after the initial setup. Re-validate the integration to ensure all required permissions are still granted. ### Remediate manually As a workaround, remediate the finding directly within the SaaS application (for example, change the file's sharing settings in Google Drive). CASB will clear the finding from the dashboard after the next successful scan. ## Webhook test or delivery fails If Cloudflare cannot deliver a test request or a posture finding instance to your destination, follow these steps. ### Check destination requirements Verify that the destination URL uses `https://` and is publicly reachable. Cloudflare rejects destinations that resolve to localhost, loopback, private, or other reserved addresses. ### Check authentication settings Ensure that the webhook's authentication method matches what your receiver expects. Re-enter any bearer token, Basic auth credentials, static headers, or signing secret if needed. ### Understand delivery timing Test delivery sends a test request immediately, but posture finding instance sends are queued in the background. A success message means that Cloudflare accepted the request for delivery. ## CASB is generating false positives CASB may incorrectly flag items, such as flagging internally-shared files as public or archived Google Workspace users as inactive. ### Review finding details Carefully examine the evidence provided in the finding. An object's status in the SaaS platform may not be accurate. ### Report the issue If you confirm the finding is a false positive, report the behavior to Cloudflare Support. Provide the finding ID (visible in the finding's detail view) and as much detail as possible. This helps the Support team refine the detection logic for all customers. ### Hide the finding While Cloudflare investigates the issue, you can [ignore the finding or hide individual instances](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/#hide-findings) to remove it from your active list and reduce noise. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/troubleshoot-casb/#page","headline":"Troubleshoot CASB","description":"Troubleshoot Troubleshoot CASB issues in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/troubleshoot-casb/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/troubleshoot-casb/og.png?v=43ee8029b528fd46","dateModified":"2026-10-06","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Debugging"]} ``` --- --- description: Lists in Zero Trust. title: Lists image: https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/og.png?v=e9d6147d05c883ef --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Lists Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) With Cloudflare One, you can create lists of URLs, hostnames, or other entries to reference when creating [Gateway policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) or [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). This allows you to quickly create rules that match and take actions against several items at once. Before creating a list, make note of the [limitations](#limitations). Note The lists described in this page are not the same as [custom lists](https://developers.cloudflare.com/waf/tools/lists/custom-lists/) defined at the account level. The two types of lists support different data types and have different validation rules. ## List types Lists can contain a single type of data each. Supported data types include: - URLs - Hostnames or domains - Serial numbers - User email addresses - IP addresses - Device ID numbers - AAGUIDs (used by [Access independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#restrict-authenticators-by-aaguid) to restrict the WebAuthn authenticators users can enroll) ## Create a list from a CSV file To test uploading CSV lists, you can download a [sample CSV file](https://developers.cloudflare.com/cloudflare-one/static/list-test.csv) of IP address ranges or copy the following into a file: *list-test.csvcsv* ```csv value,description 192.0.2.0/24,This is an IP address range in CIDR format 198.51.100.0/24,This is also an IP address range 203.0.113.0/24,This is the third IP address range ``` When you format a CSV file for upload: - Each line should be a single entry that includes a value and an optional description. - A header row must be present for Zero Trust to recognize descriptions. - Trailing whitespace characters are not allowed. - CRLF (Windows) and LF (Unix) line endings are valid. To upload the list to the Cloudflare dashboard: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Lists**. 2. Select **Upload CSV**. 3. Next, specify a **List name**, enter an optional description, and choose a **List type**. 4. Drag and drop a file into the **CSV file** window, or select a file. 5. Select **Create**. 1. Add the following permission to your [`cloudflare_api_token` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token): - `Zero Trust Write` 2. Decode the contents of the CSV file and store it as a local value: ```tf locals { ip_list = csvdecode(file("${path.module}/list-test.csv")) } ``` 3. Create a list using the [`cloudflare_zero_trust_list` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_list) resource: ```tf resource "cloudflare_zero_trust_list" "ips_from_csv" { account_id = var.cloudflare_account_id name = "IPs imported from CSV" description = "Managed by Terraform" type = "IP" items = local.ip_list } ``` You can now use this list in the policy builder by choosing the *in list* operator. ## Create a list manually 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Lists**. 2. Select **Create manual list**. 3. Next, specify a **List name**, enter an optional description, and choose a **List type**. 4. Enter your list element manually into the **Add entry** field and select **Add**. 5. Select **Save**. *Create Zero Trust listbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/lists" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "description": "Private application IPs", "items": [ { "value": "10.226.0.177/32" }, { "value": "10.226.1.177/32" } ], "name": "Corporate IP list", "type": "IP" }' ``` 1. Add the following permission to your [`cloudflare_api_token` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token): - `Zero Trust Write` 2. Create a list using the [`cloudflare_zero_trust_list` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_list) resource. Example list of IPs: ```tf resource "cloudflare_zero_trust_list" "wiki_IPs" { account_id = var.cloudflare_account_id name = "Company Wiki IP addresses" description = "Managed by Terraform" type = "IP" items = [ { description = "Example IP address range" value = "192.0.2.0/24", }, { value = "198.51.100.0/24" } ] } ``` Example list of domains: ```tf resource "cloudflare_zero_trust_list" "wiki_domains" { account_id = var.cloudflare_account_id name = "Company Wiki Domains" description = "Managed by Terraform" type = "DOMAIN" items = [ { value = "wiki.example.com" }, { value = "wiki2.example.com" }] } ``` You can now use this list in the policy builder by choosing the *in list* operator. ## Edit a list 1. In the **Lists** page, locate the list you want to edit. 2. Select **Edit**. This will allow you to: - Edit list name and description by selecting on the three-dots menu to the right of your list's name. - Delete the list by selecting the three-dots menu to the right of your list's name. - Delete individual entries. - Manually add entries to your list. 3. Once you have edited your list, select **Save**. ## Limitations ### List size Your lists can include up to 1,000 entries for Standard plans and 5,000 for Enterprise plans. An uploaded CSV file must be smaller than 2 MB. ### Wildcard entries Hostname lists do not support wildcard entries (`*.example.com`). You will need to add domains as exact matches. Adding a wildcard to lists comprised of hostnames will return an error when you save. ### Non-Latin characters Gateway supports non-Latin characters by converting all domains and hostnames to [Punycode ↗︎](https://www.rfc-editor.org/rfc/rfc3492.txt). Once you save a list with non-Latin characters, Gateway will display the entry as Punycode. ### Duplicate entries Lists cannot have duplicate entries. Because domains and hostnames are converted to [Punycode](#non-latin-characters), multiple list entries that convert to the same string will count as duplicates. For example, `éxàmple.com` converts to `xn—xmple-rqa5d.com`, so including both `éxàmple.com` and `xn—xmple-rqa5d.com` in a list will result in a duplicate error. ### URL slashes Gateway ignores trailing forward slashes (`/`) in URLs. For example, `https://example.com` and `https://example.com/` will count as the same URL and may return a duplicate error. ### Extended email addresses Extended email addresses (also known as plus addresses) are variants of an existing email address with `+` or `.` modifiers. Many email providers, such as Gmail and Outlook, deliver emails intended for an extended address to its original address. For example, providers will deliver emails sent to `contact+123@example.com` or `con.tact@example.com` to `contact@example.com`. By default, Gateway will either filter only exact matches or all extended variants depending on the type of policy and action used:
DNS policies | Action | Behavior | | --- | --- | | Allow | Match exact address only | | Block | Match exact address and all variants | | Override | Match exact address and all variants | | Safe Search | Match exact address and all variants | | YouTube Restricted | Match exact address and all variants |
Network policies | Action | Behavior | | --- | --- | | Allow | Match exact address only | | Block | Match exact address and all variants | | Network Override | Match exact address only |
HTTP policies | Action | Behavior | | --- | --- | | Allow | Match exact address only | | Block | Match exact address and all variants | | Do Not Inspect | Match exact address only | | Do Not Isolate | Match exact address only | | Do Not Scan | Match exact address only | | Isolate | Match exact address and all variants |
Other policies | Policy type | Behavior | | --- | --- | | Egress policy | Match exact address only | | Resolver policy | Match exact address only |
To force Gateway to match all email address variants, go to **Traffic policies** > **Traffic settings** > **Policy settings** and turn on **Match extended email addresses**. This setting applies to all firewall, egress, and resolver policies. ### API rate limit You can send 600 requests to the [Gateway Lists](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/lists/) endpoint per minute. If you exceed the rate limit, Cloudflare will block subsequent requests for 120 seconds. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/#page","headline":"Lists","description":"Lists in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/og.png?v=e9d6147d05c883ef","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Tags in Zero Trust. title: Tags image: https://developers.cloudflare.com/cloudflare-one/reusable-components/tags/og.png?v=4229db070d51e29b --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Tags Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/tags/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can label an Access application with up to 25 custom tags. End users can then filter the applications in their [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/) by their tags. ### Create a tag To create a new tag: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Tags**. 2. Select **Add a tag**. 3. Enter up to 35 alphanumeric characters for the tag (for example, `Human Resources`) and select it in the dropdown menu. 4. Select **Save**. You can now [add this tag](#tag-an-access-application) to an Access application. ### Tag an Access application To add a tag to an existing Access application: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Applications**. 2. Select an application and select **Configure**. 3. Go to **Additional settings**. 4. In the **Tags** dropdown, select the tags that you would like to assign to this application. The tag must be [created](#create-a-tag) before you can select it in the dropdown. 5. Select **Save**. The tag will now appear on the application's App Launcher tile. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/tags/#page","headline":"Tags","description":"Tags in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/tags/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/tags/og.png?v=4229db070d51e29b","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Use IP lists in Zero Trust. title: Use IP lists image: https://developers.cloudflare.com/cloudflare-one/reusable-components/use-rules-list/og.png?v=5be60798231069b4 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Use IP lists Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/use-rules-list/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [IP lists](https://developers.cloudflare.com/waf/tools/lists/custom-lists/#ip-lists) are a part of Cloudflare's custom lists. Custom lists contain one or more items of the same type — IP addresses, hostnames or ASNs — that you can reference in rule expressions. IP lists are defined at the account level and can be used to match against `ip.src` and `ip.dst` fields. Currently, Cloudflare Network Firewall only supports IPv4 addresses in these lists, not IPv6. To use this feature: ## 1. Create a [new IP list](https://developers.cloudflare.com/api/resources/rules/subresources/lists/methods/create/). For example: ```bash curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rules/lists \ --header "X-Auth-Email: " \ --header "X-Auth-Key: " \ --header "Content-Type: application/json" \ --data '{ "name": "iplist", "description": "This contains IPs that should be allowed.", "kind": "ip" }' ``` ## 2. Add IPs to the list Next, [create list items](https://developers.cloudflare.com/api/resources/rules/subresources/lists/subresources/items/methods/create/). This will add elements to the current list. ```bash curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rules/lists/{list_id}/items \ --header "X-Auth-Email: " \ --header "X-Auth-Key: " \ --header "Content-Type: application/json" \ --data '[ {"ip":"10.0.0.1"}, {"ip":"10.10.0.0/24"} ]' ``` ## 3. Use the list in a rule Finally, add a Cloudflare Network Firewall rule referencing the list into an existing ruleset: ```bash curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/{ruleset_id}/rules \ --header "Authorization: Bearer " \ --header "Content-Type: application/json" \ --data '{ "action": "skip", "action_parameters": { "ruleset": "current" }, "expression": "ip.src in $iplist", "description": "Allowed IPs from iplist", "enabled": true }' ``` ## Managed lists Note Available for customers with a Cloudflare Network Firewall Advanced plan. You can create rules with managed lists. Managed IP Lists are [lists of IP addresses](https://developers.cloudflare.com/waf/tools/lists/managed-lists/#managed-ip-lists) maintained by Cloudflare and updated frequently. You can access these managed lists when you create rules with either *IP destination address* or *IP source address* in the **Field** dropdown, and *is in list* or *is not in list* in the **Operator** dropdown. For example: | Field | Operator | Value | | --- | --- | --- | | *IP destination address* | *is in list* | *Anonymizers* | ## List types ### Threat intelligence Cloudflare handles millions of HTTP requests each second and blocks billions of cyber threats each day. Cloudflare uses that data to detect malicious actors on the Internet and turns that information into a list of known malicious IP addresses. Cloudflare also integrates with a number of third-party vendors to augment the coverage. The threat intelligence feed categories are described in [Managed IP Lists](https://developers.cloudflare.com/waf/tools/lists/managed-lists/#managed-ip-lists). All of these lists are compatible with Cloudflare Network Firewall. ### IP lists Use [IP lists](https://developers.cloudflare.com/waf/tools/lists/custom-lists/#ip-lists) to group services in networks, like web servers, or for lists of known bad IP addresses to make managing good network endpoints easier. IP lists are helpful for users with very expansive firewall rules with many IP lists. By default, you can add up to 10,000 IPs across all lists. Refer to [Use an IP list](https://developers.cloudflare.com/cloudflare-one/traffic-controls/packet-filtering/add-policies/#use-an-ip-list) to check an example of how to use an IP list. ### Geo-blocking Geo-blocking enables you to selectively allow or block traffic to any country. Refer to [Block a country](https://developers.cloudflare.com/cloudflare-one/traffic-controls/packet-filtering/add-policies/#block-a-country) to check an example of how to block a country. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/use-rules-list/#page","headline":"Use IP lists","description":"Use IP lists in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/use-rules-list/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/use-rules-list/og.png?v=5be60798231069b4","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["REST API"]} ``` --- --- description: Block page in Zero Trust. title: Block page image: https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/og.png?v=23dcd515acfc76b7 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Block page Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) When Gateway blocks traffic with a [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/#block) or [HTTP Block policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#block), you can configure a block page to display in your users' browsers. You can provide a descriptive reason for blocking traffic and contact information, or you can redirect your users' browsers to another page. You can apply these customizations globally for every Block policy, or override the settings on a per-policy basis. ## Prerequisites In order to display the block page as the URL of the blocked domain, your organization's devices must have a [Cloudflare certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) installed. Enterprise users can also [deploy their own root CA certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/). If you do not install a certificate, the block page [will not display correctly](#certificate-error). ## Configure the block page Gateway will display a global block page in the browser of any user whose traffic is blocked. By default, Gateway will display the block page for any DNS Block policies you turn it on for and all HTTP Block policies. You can [turn on or override the global setting](#configure-policy-block-behavior) on a per-policy basis. To configure the global block page: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Reusable components** > **Custom pages**. 2. Under **Account Gateway block page**, Gateway will display the current block page setting. Select **Manage**. 3. Choose whether to use the [default Gateway block page](#use-the-default-block-page), a [URL redirect](#redirect-to-a-block-page), or a [custom Gateway block page](#customize-the-block-page). 4. Select **Save**. ### Use the default block page When you choose **Default Gateway block page**, Gateway will display a [block page hosted by Cloudflare ↗︎](https://blocked.teams.cloudflare.com/). This is the default option for all traffic blocked by Gateway. ### Redirect to a block page Instead of displaying the Cloudflare block page, you can configure Gateway to return a `307` (Temporary Redirect) HTTP response code and redirect to a custom URL. To redirect users to a non-Cloudflare block page: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Reusable components** > **Custom pages**. 2. Under **Account Gateway block page**, select **Manage**. 3. Choose **URL redirect**. 4. Enter the URL you want to redirect blocked traffic to. 5. (Optional) Turn on **Send policy context** to send [additional policy context](#policy-context) to the redirected URL. 6. Select **Save**. Gateway will now redirect users to a custom page when user traffic matches a Block policy with the block page configured. To create an HTTP policy to redirect URLs, refer to the [Redirect action](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#redirect). #### Policy context When you turn on **Send policy context**, Gateway will append details of the matching request to the redirected URL as a query string. Not every context field will be included. Potential policy context fields include:
Policy context fields | Field | Definition | Example | | --- | --- | --- | | User email | Email of the user that made the query. | &cf_user_email=user@example.com | | Site URL | Full URL of the original HTTP request or domain name in DNS query. | &cf_site_uri=https%3A%2F%2Fmalware.testcategory.com%2F | | URL category | Domain categories of the URL to be redirected. | &cf_request_categories=New%20Domains,Newly%20Seen%20Domains | | Original HTTP referer | For HTTP traffic, the original HTTP referer header of the HTTP request. | &cf_referer=https%3A%2F%2Fexample.com%2F | | Rule ID | ID of the Gateway policy that matched the request. | &cf_rule_id=6d48997c-a1ec-4b16-b42e-d43ab4d071d1 | | Source IP | Source IP address of the device that matched the policy. | &cf_source_ip=203.0.113.5 | | Device ID | UUID of the device that matched the policy. | &cf_device_id=6d48997c-a1ec-4b16-b42e-d43ab4d071d1 | | Application names | Name of the application the redirected domain corresponds to, if any. | &cf_application_name=Salesforce | | Filter | The traffic type filter that triggered the block. | &cf_filter=http, &cf_filter=dns, &cf_filter=av, or &cf_filter=l4 | | Account ID | Cloudflare account ID of the associated Zero Trust account. | &cf_account_id=d57c3de47a013c03ca7e237dd3e61d7d | | Query ID | ID of the DNS query for which the redirect took effect. | &cf_query_id=f8dc6fd3-a7a5-44dd-8b77-08430bb4fac3 | | Connection ID | ID of the proxy connection for which the redirect took effect. | &cf_connection_id=f8dc6fd3-a7a5-44dd-8b77-08430bb4fac3 | | Request ID | ID of the HTTP request for which the redirect took effect. | &cf_request_id=f8dc6fd3-a7a5-44dd-8b77-08430bb4fac3 |
#### Redirect precedence Paths and queries in the redirect URL take precedence over the original URL. When you turn on **Send policy context**, Gateway will append context to the end of the redirected URL. For example, if the original URL is `example.com/path/to/page?querystring=X&k=1` and the redirect URL is `cloudflare.com/redirect-path?querystring=Y`, Gateway will redirect requests to: ```txt cloudflare.com/redirect-path?querystring=Y&cf_user_email=user@example.com ``` ### Customize the block page You can customize the Cloudflare-hosted block page by making global changes that Gateway will display every time a user reaches your block page. Customizations will apply regardless of the type of policy (DNS or HTTP) that blocks the traffic. To customize your block page: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Custom pages**. 2. Under **Account Gateway block page**, select **Customize**. 3. Choose **Custom Gateway block page**. Gateway will display a preview of your custom block page. Available customizations include: - Your organization's name - [Logo](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#add-a-logo-image) - Header text - Global block message, which will be displayed above the policy-specific block message - [Mailto link](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#allow-users-to-email-an-administrator) - Background color 4. Select **Save**. 1. Add the following permission to your [`cloudflare_api_token` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token): - `Zero Trust Write` 2. In [`cloudflare_zero_trust_gateway_settings` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_gateway_settings), configure the `block_page` argument with your customizations: ```tf resource "cloudflare_zero_trust_gateway_settings" "team_name" { account_id = var.cloudflare_account_id settings = { block_page = { enabled = true //do not use the default Gateway block page mode = "customized_block_page" //use a custom block page name = "Cloudflare" logo_path = "https://logos.com/a.png" header_text = "--header--" footer_text = "--footer--" mailto_address = "admin@example.com" mailto_subject = "Blocked Request" background_color = "#ffffff" suppress_footer = false } } } ``` Gateway will now display a custom Gateway block page when your users visit a blocked website. #### Add a logo image You can include an external logo image to display on your custom block page. The block page resizes all images to 146x146 pixels. The URL must be valid and no longer than 2048 characters. Accepted file types include SVG, PNG, JPEG, and GIF. #### Allow users to email an administrator You can add a Mailto link to your custom block page, which allows users to directly email you about the blocked site. When users select **Contact your Administrator** on your block page, an email template opens with the email address and subject line you configure, as well as the following diagnostic information: | Field | Description | | --- | --- | | Site URL | The URL of the blocked page. | | Rule ID | The ID of the Gateway policy that blocked the page. | | Source IP | The public source IP of the user device. | | Account ID | The Cloudflare account associated with the block policy. | | User ID | The ID of the user who visited the page. Currently, User IDs are not surfaced in the dashboard and can only be viewed by calling the [API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/users/methods/list/). | | Device ID | The ID of the device that visited the page. This is generated by the Cloudflare One Client. | | Block Reason | Your policy-specific block message. | ## Configure policy block behavior For DNS Block policies, you will need to turn on the block page for each policy you want to display it. For HTTP Block policies, Gateway automatically displays your global block page setting by default. You can override your global block page setting for both policy types within each policy's settings. To turn on the block page or override your global block page setting for an individual policy: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Firewall policies** > **DNS**. 2. Select **Add a policy** to create a new policy, or choose the policy you want to customize and select **Edit**. You can only edit the block page for policies with a Block action. 3. Under **Configure policy settings**, turn on **Modify Gateway block behavior**. 4. Choose your block behavior: - **Use account-level block setting**: Use the global block page setting configured in your account settings. The global setting can be the default Gateway block page, an [HTTP redirect](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page), or a [custom Gateway block page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#customize-the-block-page). - **Override account setting with URL redirect**: Redirect users with a `307` HTTP redirect to a URL you specify on a policy level. 5. (Optional) If your account-level block page setting uses a custom Gateway block page, you can turn on **Add an additional message to your custom block page when traffic matches this policy** to add a custom message to your custom block page when traffic is blocked by this policy. This option will replace the **Message** field. 6. Select **Save policy**. Depending on your settings, Gateway will display a block page in your users' browsers or redirect them to a specified URL when they are blocked by this policy. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Firewall policies** > **HTTP**. 2. Select **Add a policy** to create a new policy, or choose the policy you want to customize and select **Edit**. You can only edit the block page for policies with a Block action. 3. Under **Configure policy settings**, go to **Modify Gateway block behavior**. 4. Choose your block behavior: - **Use account-level block setting**: Use the global block page setting configured in your account settings. The global setting can be the default Gateway block page, an [HTTP redirect](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page), or a [custom Gateway block page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#customize-the-block-page). - **Override account setting with URL redirect**: Redirect users with a `307` HTTP redirect to a URL you specify on a policy level. 5. (Optional) If your account-level block page setting uses a custom Gateway block page, you can turn on **Add an additional message to your custom block page when traffic matches this policy** to add a custom message to your custom block page when traffic is blocked by this policy. This option will replace the **Message** field. 6. Select **Save policy**. Depending on your settings, Gateway will display a block page in your users' browsers or redirect them to a specified URL when they are blocked by this policy. ## Limitations ### Certificate error If your users receive a security risk warning in their browser when visiting a blocked page, check that you have correctly [installed a certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/) on their devices. If a certificate is not installed or the installed certificate is invalid or expired, your user's browser may: - Display an **HTTP Response Code: 526** error page, indicating an insecure upstream. - Close the connection and fail to display any pages. For more information on fixing certificate issues, refer to [Troubleshooting](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/common-issues/#browser-and-certificate-issues). ### Incompatible DNS record types To block the resolution of queries for DNS records with types other than `A` or `AAAA`, Gateway will respond with the `REFUSED (RCODE:5)` DNS return code. Gateway will block the request but will not display a block page. ### Third-party filtering conflict Gateway will not properly filter traffic sent through third-party VPNs or other Internet filtering software, such as [iCloud Private Relay ↗︎](https://support.apple.com/102602) or [Google Chrome IP Protection ↗︎](https://github.com/GoogleChrome/ip-protection#ip-protection). To ensure your DNS policies apply to your traffic, Cloudflare recommends turning off software that may interfere with Gateway. To turn off iCloud Private Relay, refer to the Apple user guides for [macOS ↗︎](https://support.apple.com/guide/mac-help/use-icloud-private-relay-mchlecadabe0/) or [iOS ↗︎](https://support.apple.com/guide/iphone/protect-web-browsing-icloud-private-relay-iph499d287c2/). ### Data center and IP address matching If an HTTP request that matches a block policy does not arrive at the same Cloudflare data center as its DNS query, Gateway will display the default block page instead of your custom block page. This applies to DNS queries sent to any Gateway resolver endpoint, including those over IPv4, IPv6, and encrypted protocols like DoH (DNS over HTTPS) and DoT (DNS over TLS). If a DNS query is routed to a different Cloudflare data center than the corresponding HTTP request (for example, if DoH traffic is sent outside the WARP tunnel), Gateway cannot correlate the two requests and will display the default block page instead of your custom block page. If the HTTP request comes from a different IP address than the DNS request, Gateway may not display the rule ID, custom message, or other fields on the block page. This can happen when a recursive DNS resolver's source IP address differs from the user device's IP address. ### Dual-stack networks On dual-stack networks, the source IP address of the DNS query and the block page connection may differ. The DNS query may go over IPv4 while the browser connects to the block page over IPv6, or the other way around. When this happens, the block page may fail to load. It may also display without policy context (rule ID, block reason, or custom redirect parameters). To resolve this issue, configure a [dedicated DNS resolver IP address](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-resolver-ips/#dedicated-dns-resolver-ip) for your DNS location. With dedicated IP addresses, the block server can identify the account based on the destination IP address regardless of the source address. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#page","headline":"Block page","description":"Block page in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/og.png?v=23dcd515acfc76b7","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: App Launcher customization in Zero Trust. title: App Launcher customization image: https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/app-launcher-customization/og.png?v=d8fb1e86eec0566d --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # App Launcher customization Last updated Apr 30, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/app-launcher-customization/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Only available on Pay-as-you-go and Enterprise plans. You can display your own branding, messages, and links to users when they open the [Access App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/). To customize the App Launcher appearance: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Custom pages**. 2. Find the **App Launcher customization** setting and select **Manage**. 3. Give the App Launcher the look and feel of your organization by adding: - Your organization's name - A logo - A preferred background color for the header - A preferred background color for the page - A custom footer with links to your organization's help desk or other internal resources. Note We recommend lighter background colors because the font defaults to black. 4. Next, customize the landing page that users will see when they login to the App Launcher. Available properties include: - A custom title - A custom subtitle - An image - A preferred color for the **Log in** button - A preferred color for the **Log in** button text All of the properties configured in Step 3 will also apply to the landing page. 5. Once you are satisfied with your customization, select **Save**. The App Launcher screens are now updated. To view your changes, select **Preview**. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/app-launcher-customization/#page","headline":"App Launcher customization","description":"App Launcher customization in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/app-launcher-customization/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/app-launcher-customization/og.png?v=d8fb1e86eec0566d","dateModified":"2026-04-30","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Access login page in Zero Trust. title: Access login page image: https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/og.png?v=ed781ff8ae67fdd4 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Access login page Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can customize the login page that is displayed to end users when they go to an Access application. To change the appearance of your login page: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Custom pages**. 2. Find the **Access login page** setting and select **Manage**. 3. Give the login page the look and feel of your organization by adding: - Your organization's name - A logo - A custom header and footer - A preferred background color Any changes you make will be reflected in real time in the **Preview** card. 4. Once you are satisfied with your customization, select **Save**. The login page is now updated for all of your Access applications. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/#page","headline":"Access login page","description":"Access login page in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/og.png?v=ed781ff8ae67fdd4","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Access custom block pages in Zero Trust. title: Access custom block pages image: https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/og.png?v=7bec1b5ba4c48a3d --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Access custom block pages Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can customize the block page that displays when users fail to authenticate to an Access application. Each application can have a different block page. Gateway block page To customize the page that users see when they are blocked by a Gateway firewall policy, refer to [Gateway block page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/). ## Types of block pages Cloudflare Access offers three different block page options: - **Default**: Displays a Cloudflare branded block page. - **Custom Redirect URL** - Redirects blocked requests to the specified URL. For example, you could redirect the user to a [dynamic Access Denied page ↗︎](https://github.com/cloudflare/cf-identity-dynamic) that fetches their identity and shows the exact reason they were blocked. - **Custom Page Template** - (Only available on Pay-as-you-go and Enterprise plans) Displays a [custom HTML page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/#create-a-custom-block-page) hosted by Cloudflare. ### Custom redirect URL parameters When Access redirects a blocked request to your **Custom Redirect URL**, it includes these query parameters: | Parameter | Description | | --- | --- | | `kid` | The application audience (AUD) tag. | | `account_id` | The Cloudflare account ID that owns the application. Omitted when account context is unavailable. | | `original_url` | The requested hostname and path, including any query string. Included when request state is available. | For example, a request to `app.example.com/admin` can redirect to: ```txt https://denied.example.com/?kid=&account_id=&original_url=app.example.com%2Fadmin ``` Use `account_id` to identify the account when looking up the application through the [Access applications API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/list/). Match `kid` to the application's AUD tag, not its application ID. These parameters provide context for your block page. Do not use them as proof of authentication or authorization: a visitor can modify URL query parameters. ### Identity versus non-identity You can display a different [type of block page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/#types-of-block-pages) to users who fail an identity-based policy versus a non-identity policy. - **Identity failure block page**: Displays when the user is blocked by an identity-based Access policy (such as email, user group, or external evaluation rule), after logging in to their identity provider. - **Non-identity failure block page**: Displays when the user is blocked by a non-identity Access policy (such as country, IP, or device posture). Cloudflare checks non-identity attributes before prompting the user to login. ## Create a custom block page Note Only available on Pay-as-you-go and Enterprise plans. To create a custom block page for Access: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Reusable components** > **Custom pages**. 2. Find the **Access Custom Pages** setting and select **Manage**. 3. Select **Add a page template**. 4. Enter a unique name for the block page. 5. In **Type**, select whether this is an [identity or non-identity block page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/#identity-versus-non-identity). 6. In **Custom HTML**, enter the HTML code for your custom page. For example, ```html

Access denied.

To obtain access, contact your IT administrator.

``` 7. To check the appearance of your custom page, select **Download** and open the HTML file in a browser. 8. Once you are satisfied with your custom page, select **Save**. You can now select this block page when you [configure an Access application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/#page","headline":"Access custom block pages","description":"Access custom block pages in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/og.png?v=7bec1b5ba4c48a3d","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Reference information for Packet filtering (Cloudflare Network Firewall) fields in Zero Trust. title: Packet filtering (Cloudflare Network Firewall) fields image: https://developers.cloudflare.com/cloudflare-one/reusable-components/packet-filtering-fields/og.png?v=27394e68e786906f --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Packet filtering (Cloudflare Network Firewall) fields Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/reusable-components/packet-filtering-fields/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Some Cloudflare Network Firewall fields are available only to customers who purchased Cloudflare Network Firewall's advanced features. Refer to [Cloudflare Network Firewall plans](https://developers.cloudflare.com/cloudflare-network-firewall/plans/) for more information. ## `cf.colo.name` `cf.colo.name` `String` The data center that is handling this traffic. Example value: `sfo06` --- ## `cf.colo.region` `cf.colo.region` `String` Region of the data center that is handling this traffic. Example value: `WNAM` --- ## `icmp` `icmp` `String` The raw ICMP packet as a list of bytes. It should be used in conjunction with the bit\_slice function when other structured fields are lacking. --- ## `icmp.type` `icmp.type` `Number` The [ICMP type ↗︎](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#header_type). Only applies to ICMP packets. Example value: `8` --- ## `icmp.code` `icmp.code` `Number` The [ICMP code ↗︎](https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#header_code). Only applies to ICMP packets. Example value: `2` --- ## `ip` `ip` `String` The raw IP packet as a list of bytes. It should be used in conjunction with the bit\_slice function when other structured fields are lacking. --- ## `ip.dst` `ip.dst` `IP address` The destination address as specified in the IP packet. Example value: `192.0.2.2` --- ## `ip.dst.country` `ip.dst.country` `String` Represents the 2-letter country code associated with the server IP address in [ISO 3166-1 Alpha 2 ↗︎](https://www.iso.org/obp/ui/#search/code/) format. Example value: `GB` For more information on the ISO 3166-1 Alpha 2 format, refer to [ISO 3166-1 Alpha 2 ↗︎](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) on Wikipedia. --- ## `ip.src.country` `ip.src.country` `String` Represents the 2-letter country code associated with the client IP address in [ISO 3166-1 Alpha 2 ↗︎](https://www.iso.org/obp/ui/#search/code/) format. Example value: `GB` For more information on the ISO 3166-1 Alpha 2 format, refer to [ISO 3166-1 Alpha 2 ↗︎](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) on Wikipedia. For Cloudflare Network Firewall, the `ip.geoip.country` field (which is deprecated) will match on either source or destination address. The `ip.geoip.country` field is still available for new and existing rules, but you should use the `ip.src.country` and/or `ip.dst.country` fields instead. --- ## `ip.hdr_len` `ip.hdr_len` `Number` The length of the IPv4 header in bytes. Example value: `5` --- ## `ip.len` `ip.len` `Number` The length of the packet including the header. Example value: `60` --- ## `ip.opt.type` `ip.opt.type` `Number` The first byte of [IP options field ↗︎](https://en.wikipedia.org/wiki/IPv4#Options), if the options field is set. Example value: `25` --- ## `ip.proto` `ip.proto` `String` The transport layer for the packet, if it can be determined. Example values: `icmp`, `tcp` --- ## `ip.src` `ip.src` `IP address` The source address of the IP Packet. --- ## `ip.src.country` `ip.src.country` `String` Represents the 2-letter country code associated with the client IP address in [ISO 3166-1 Alpha 2 ↗︎](https://www.iso.org/obp/ui/#search/code/) format. Example value: `GB` For more information on the ISO 3166-1 Alpha 2 format, refer to [ISO 3166-1 Alpha 2 ↗︎](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) on Wikipedia. --- ## `ip.ttl` `ip.ttl` `Number` The time-to-live of the IP Packet. Example values: `54` --- ## `sip` `sip` `Boolean` Determines if packets are valid L7 protocol [SIP ↗︎](https://datatracker.ietf.org/doc/html/rfc2543). Requires UDP packets to operate. Use a guard clause as shown below to ensure the packet is UDP (wirefilter): `ip.proto == "udp"` --- ## `tcp` `tcp` `String` The raw TCP packet as a list of bytes. It should be used in conjunction with the bit\_slice function when other structured fields are lacking. --- ## `tcp.flags` `tcp.flags` `Number` The numeric value of the TCP flags byte. --- ## `tcp.flags.ack` `tcp.flags.ack` `Boolean` TCP acknowledgment flag. --- ## `tcp.flags.cwr` `tcp.flags.cwr` `Boolean` TCP congestion window reduced flag. --- ## `tcp.flags.ecn` `tcp.flags.ecn` `Boolean` TCP ECN-Echo flag. --- ## `tcp.flags.fin` `tcp.flags.fin` `Boolean` TCP flag indicating this is the last packet from sender. --- ## `tcp.flags.push` `tcp.flags.push` `Boolean` TCP push flag. --- ## `tcp.flags.reset` `tcp.flags.reset` `Boolean` TCP reset flag. --- ## `tcp.flags.syn` `tcp.flags.syn` `Boolean` TCP synchronize flag. --- ## `tcp.flags.urg` `tcp.flags.urg` `Boolean` TCP urgent flag. --- ## `tcp.srcport` `tcp.srcport` `Number` Source port number of the IP packet. Only applies to TCP packets. --- ## `tcp.dstport` `tcp.dstport` `Number` Destination port number of the IP packet. Only applies to TCP packets. --- ## `udp` `udp` `String` The raw UDP packet as a list of bytes. It should be used in conjunction with the bit\_slice function when other structured fields are lacking. --- ## `udp.dstport` `udp.dstport` `Number` Destination port number of the IP packet. Only applies to UDP packets. --- ## `udp.srcport` `udp.srcport` `Number` Source port number of the IP packet. Only applies to UDP packets. --- *GeoIP is the registered trademark of MaxMind, Inc.* Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/reusable-components/packet-filtering-fields/#page","headline":"Packet filtering (Cloudflare Network Firewall) fields","description":"Reference information for Packet filtering (Cloudflare Network Firewall) fields in Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/reusable-components/packet-filtering-fields/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/reusable-components/packet-filtering-fields/og.png?v=27394e68e786906f","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["TCP","UDP","ICMP"]} ``` --- --- description: Reference information for Roles and permissions in Cloudflare One. title: Roles and permissions image: https://developers.cloudflare.com/cloudflare-one/roles-permissions/og.png?v=88bbec68c1656112 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Roles and permissions Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/roles-permissions/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) When creating a Cloudflare Zero Trust account, you will be given the Super Administrator role. As a Super Administrator, you can invite members to join your Zero Trust account and assign them different roles. There is no limit to the number of members which can be added to a given account. Any members with the proper permissions will be able to make configuration changes while actively logged into Zero Trust (unless [read-only mode](https://developers.cloudflare.com/cloudflare-one/api-terraform/#set-dashboard-to-read-only) is enabled). To check the list of members in your account, or to manage roles and permissions, refer to our [Account setup](https://developers.cloudflare.com/fundamentals/manage-members/) documentation. ## Zero Trust roles Only Super Administrators will be able to assign or remove the following roles from users in their account. Scroll to the right to see a full list of permissions for each role. | | Access Read | Access Edit | Gateway Read | Gateway Edit | Gateway Report | DNS Location Read | DNS Location Edit | Billing Read | Billing Edit | DEX Read | DEX Edit | CASB Read | CASB Edit | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Super Administrator | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | | Cloudflare Zero Trust[1](#user-content-fn-1) | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ | | Cloudflare Access | ✅ | ✅ | ✅ | ❌ | ✅ | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Cloudflare Gateway | ✅ | ❌ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Cloudflare Zero Trust Read Only | ✅ | ❌ | ✅ | ❌ | ✅ | ✅ | ❌ | ✅ | ❌ | ✅ | ❌ | ✅ | ❌ | | Cloudflare Zero Trust Reporting | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | ❌ | ✅ | ❌ | ✅ | ❌ | ❌ | ❌ | | Cloudflare Zero Trust DNS Locations Write[2](#user-content-fn-2) | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Cloudflare DEX | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | ❌ | | Cloudflare CASB Read | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | | Cloudflare CASB | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ### Cloudflare Zero Trust PII By default, only Super Administrators can view end users' PII in the Gateway activity logs, such as Device IDs, Source IPs, or user emails. No other roles will have the ability to read PII unless Super Administrators explicitly assign the **Cloudflare Zero Trust PII** role to them. The Cloudflare Zero Trust PII role should be considered an add-on role, to be combined with any role from the table above. For example, Super Administrators may decide to assign the Cloudflare Gateway role to a user, and add the Cloudflare Zero Trust PII role to allow that user to access PII in the Gateway logs. Note The Cloudflare Zero Trust PII role does not apply to Access authentication logs. PII is always visible in Access logs. ## Email security roles For more information on Email security roles, refer to [Account-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#account-scoped-roles). - **Cloudflare Zero Trust**: Can edit Cloudflare [Zero Trust](https://developers.cloudflare.com/cloudflare-one/). Grants administrator access to all Zero Trust products including Access, Gateway, the Cloudflare One Client, Tunnel, Browser Isolation, CASB, DLP, DEX, and Email security. - **Cloudflare Zero Trust PII**: Can read PII in Zero Trust. This includes Email security. - **Email security Analyst** and **Email security Configuration Admin**: Has full access to all admin features in Email security. - **Email security Integration Admin**: Can read and set up integrations only. - **Email security Configuration Admin**: Has administrator access. Cannot take actions on emails, or read emails. - **Email security Analyst**: Has analyst access. Can take action on emails and read emails. - **Email security Reporting**: Can read metrics. - **Email security Read Only**: Can read all information, but cannot take action on anything. - **Email security Policy Admin**: Can read all settings, but only write [allow policies](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/allow-policies/), [trusted domains](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/trusted-domains/), and [blocked senders](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/blocked-senders/). ## Footnotes 1. The **Cloudflare Zero Trust** role grants administrator access to all Zero Trust products including Access, Gateway, the Cloudflare One Client, Tunnel, Browser Isolation, CASB, DLP, DEX, and Email security. [↩](#user-content-fnref-1) 2. Users with the **Cloudflare Zero Trust DNS Locations Write** role can view all DNS locations for an organization but can only create and edit [secure DNS locations](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/#secure-dns-locations). [↩](#user-content-fnref-2) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/roles-permissions/#page","headline":"Roles and permissions","description":"Reference information for Roles and permissions in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/roles-permissions/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/roles-permissions/og.png?v=88bbec68c1656112","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: View tutorials for Cloudflare Zero Trust. title: Tutorials image: https://developers.cloudflare.com/cloudflare-one/tutorials/og.png?v=fa397082f5ea3eb4 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Tutorials Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) | Name | Last Updated | Difficulty | | --- | --- | --- | | [Detect MCP traffic in Gateway logs](https://developers.cloudflare.com/cloudflare-one/tutorials/detect-mcp-traffic-gateway-logs/) | 6 months ago | Advanced | | [Implement regional private DNS servers with Gateway resolver policies](https://developers.cloudflare.com/cloudflare-one/tutorials/regional-private-dns-resolver-policies/) | 11 months ago | Advanced | | [Deploy the Cloudflare One Client on headless Linux machines](https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/) | last year | Beginner | | [Create and secure an AI agent wrapper using AI Gateway and Zero Trust](https://developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/) | last year | Advanced | | [Use Cloudflare Tunnels with Kubernetes client-go credential plugins](https://developers.cloudflare.com/cloudflare-one/tutorials/tunnel-kubectl/) | 2 years ago | Intermediate | | [Send SSO attributes to Access-protected origins with Workers](https://developers.cloudflare.com/cloudflare-one/tutorials/extend-sso-with-workers/) | 2 years ago | Advanced | | [Protect an R2 Bucket with Cloudflare Access](https://developers.cloudflare.com/r2/tutorials/cloudflare-access/) | 3 years ago | Intermediate | | [Use virtual networks to change user egress IPs](https://developers.cloudflare.com/cloudflare-one/tutorials/user-selectable-egress-ips/) | 3 years ago | Intermediate | | [Access and secure a MySQL database using Cloudflare Tunnel and network policies](https://developers.cloudflare.com/cloudflare-one/tutorials/mysql-network-policy/) | 3 years ago | Intermediate | | [Access a web application via its private hostname without the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/tutorials/clientless-access-private-dns/) | 3 years ago | Intermediate | | [Use Microsoft Entra ID Conditional Access policies in Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-conditional-access/) | 3 years ago | Intermediate | | [Protect access to Microsoft 365 with dedicated egress IPs](https://developers.cloudflare.com/cloudflare-one/tutorials/m365-dedicated-egress-ips/) | 3 years ago | Intermediate | | [Monitor Cloudflare Tunnel with Grafana](https://developers.cloudflare.com/cloudflare-one/tutorials/grafana/) | 3 years ago | Intermediate | | [Use Cloudflare R2 as a Zero Trust log destination](https://developers.cloudflare.com/cloudflare-one/tutorials/r2-logs/) | 3 years ago | Beginner | | [Create custom headers for Cloudflare Access-protected origins with Workers](https://developers.cloudflare.com/cloudflare-one/tutorials/access-workers/) | 3 years ago | Intermediate | | [Protect access to Amazon S3 buckets with Cloudflare Zero Trust](https://developers.cloudflare.com/cloudflare-one/tutorials/s3-buckets/) | 3 years ago | Advanced | | [Validate the Access token with FastAPI](https://developers.cloudflare.com/cloudflare-one/tutorials/fastapi/) | 3 years ago | Beginner | | [Isolate risky Entra ID users](https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-risky-users/) | 4 years ago | Advanced | | [Connect through Cloudflare Access using kubectl](https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/) | 4 years ago | Advanced | | [GraphQL Analytics](https://developers.cloudflare.com/cloudflare-one/tutorials/graphql-analytics/) | 5 years ago | Intermediate | | [Integrate Microsoft MCAS with Cloudflare Zero Trust](https://developers.cloudflare.com/cloudflare-one/tutorials/integrate-microsoft-mcas-teams/) | 5 years ago | Intermediate | | [Connect through Cloudflare Access using a CLI](https://developers.cloudflare.com/cloudflare-one/tutorials/cli/) | 6 years ago | Intermediate | | [MongoDB SSH](https://developers.cloudflare.com/cloudflare-one/tutorials/mongodb-tunnel/) | 6 years ago | Advanced | | [Zero Trust GitLab SSH & HTTP](https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/) | 6 years ago | Advanced | | [Require U2F with Okta](https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/) | 6 years ago | Intermediate | | [Display a coaching page](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/coaching-page/) | | Beginner | | [Capture a downloaded file](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/download-capture/) | | Intermediate | | [Store headers and bodies as JSON](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/json-capture/) | | Intermediate | | [Redact a JSON field](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/json-redaction/) | | Intermediate | | [Capture a screenshot](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/screenshot/) | | Beginner | | [Send a Slack notification](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/slack-notification/) | | Beginner | | [Watermark HTML pages](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/watermark/) | | Beginner | Was this helpful? YesNo [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/#page","headline":"Tutorials","description":"View tutorials for Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/og.png?v=fa397082f5ea3eb4","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Use the GraphQL Analytics API to review data for Cloudflare Network Firewall network traffic related to rules matching your traffic. title: GraphQL Analytics image: https://developers.cloudflare.com/cloudflare-one/tutorials/graphql-analytics/og.png?v=6bddf2e3750b7d55 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # GraphQL Analytics Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/graphql-analytics/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Use the GraphQL Analytics API to review data for Cloudflare Network Firewall network traffic related to rules matching your traffic. This contains both rules you configured in the Cloudflare Network Firewall dashboard, and the rules managed by Cloudflare as a part of [Cloudflare Network Firewall Managed rules](https://developers.cloudflare.com/cloudflare-network-firewall/how-to/enable-managed-rulesets/) and [Cloudflare Network Firewall IDS](https://developers.cloudflare.com/cloudflare-network-firewall/about/ids/) features. Before you begin, you must have an [API token](https://developers.cloudflare.com/analytics/graphql-api/getting-started/authentication/). For additional help getting started with GraphQL Analytics, refer to [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api/). ## Obtain Cloudflare Account ID To construct a Network Firewall GraphQL query for an object, you will need a Cloudflare Account ID ### Obtain your Cloudflare Account ID 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), and select your account. 2. The URL in your browser's address bar should show `https://dash.cloudflare.com/` followed by a hex string. The hex string is your Cloudflare Account ID. ### Obtain the rule ID for a firewall rule To construct queries to gather analytics for a particular rule, you need the rule ID for each firewall rule. 1. In the Cloudflare dashboard, go to the **Cloudflare Network Firewall** page. [Go to **Firewall policies** ↗](https://dash.cloudflare.com/?to=/:account/network-security/magic_firewall) 2. In the **Custom rules** tab, locate the rule you need the rule ID for from the list and select the three dots > **Edit**. 3. Locate the **Rule ID** and select the copy button. 4. Select **Cancel** to return to the **Cloudflare Network Firewall** page. ## Explore GraphQL schema with Cloudflare Network Firewall query example In this section, you will run a test query to retrieve a five minute count of all configured Cloudflare Network Firewall rules within five minute intervals. You can copy and paste the code below into GraphiQL. For additional information about the Analytics schema, refer to [Explore the Analytics schema with GraphiQL](https://developers.cloudflare.com/analytics/graphql-api/getting-started/explore-graphql-schema/). ```graphql query MagicFirewallExample($accountTag: string!, $start: Time, $end: Time) { viewer { accounts(filter: { accountTag: $accountTag }) { magicFirewallSamplesAdaptiveGroups( filter: { datetime_geq: $start, datetime_leq: $end } limit: 2 orderBy: [datetimeFiveMinute_DESC] ) { sum { bits packets } dimensions { datetimeFiveMinute ruleId } } } } } ``` ## Example queries for Cloudflare Network Firewall ### Obtain analytics for a specific rule Use the example below to display the total number of packets and bits for the top ten suspected malicious traffic streams within the last hour. After receiving the results, you can sort by packet rates with a five minute average. For each stream, display the: - Source and destination IP addresses - Ingress Cloudflare data centers that received it - Total traffic volume in bits and packets received within the hour - Actions taken by the firewall rule ```graphql query MagicFirewallObtainRules( $accountId: string! $ruleId: string $start: Time $end: Time ) { viewer { accounts(filter: { accountTag: $accountId }) { magicFirewallNetworkAnalyticsAdaptiveGroups( filter: { ruleId: $ruleId, datetime_geq: $start, datetime_leq: $end } limit: 10 orderBy: [avg_packetRateFiveMinutes_DESC] ) { sum { bits packets } dimensions { coloCity ipDestinationAddress ipSourceAddress outcome } } } } } ``` ### Obtain IDS analytics Use the example below to display the total number of packets and bits for the top 10 traffic streams that Cloudflare Network Firewall IDS has detected in the last hour. By setting `verdict` to `drop` and `outcome` as `pass`, we are filtering for traffic that was marked as a detection (i.e. verdict was drop) but was not dropped (for example, outcome was `pass`). This is because currently, Cloudflare Network Firewall IDS only detects malicious traffic but does not drop the traffic. For each stream, display the: - Source and destination IP addresses. - Ingress Cloudflare data centers that received it. - Total traffic volume in bits and packets received within the hour. ```graphql query MagicFirewallObtainIDS($accountTag: string!, $start: Time, $end: Time) { viewer { accounts(filter: { accountTag: $accountTag }) { magicIDPSNetworkAnalyticsAdaptiveGroups( filter: { datetime_geq: $start datetime_leq: $end verdict: drop outcome: pass } limit: 10 orderBy: [avg_packetRateFiveMinutes_DESC] ) { sum { bits packets } dimensions { coloCity ipDestinationAddress ipSourceAddress } } } } } ``` Alternatively, to inspect all traffic that was analyzed, but grouped into malicious traffic and other traffic, the example below can be used. The response will contain two entries for each five minute timestamp. `verdict` will be set to `drop` for malicious traffic, and `verdict` will be set to `pass` for traffic that did not match any of the IDS rules. ```graphql query MagicFirewallTraffic($accountTag: string!, $start: Time, $end: Time) { viewer { accounts(filter: { accountTag: $accountTag }) { magicIDPSNetworkAnalyticsAdaptiveGroups( filter: { datetime_geq: $start, datetime_leq: $end } limit: 10 orderBy: [avg_packetRateFiveMinutes_DESC] ) { sum { bits packets } dimensions { coloCity ipDestinationAddress ipSourceAddress verdict } } } } } ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/graphql-analytics/#page","headline":"GraphQL Analytics","description":"Use the GraphQL Analytics API to review data for Cloudflare Network Firewall network traffic related to rules matching your traffic.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/graphql-analytics/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/graphql-analytics/og.png?v=6bddf2e3750b7d55","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["GraphQL"]} ``` --- --- description: Scan Gateway logs for unauthorized MCP traffic. title: Detect MCP traffic in Gateway logs image: https://developers.cloudflare.com/cloudflare-one/tutorials/detect-mcp-traffic-gateway-logs/og.png?v=820aa1d92e7b6e66 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Detect MCP traffic in Gateway logs Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/detect-mcp-traffic-gateway-logs/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Organizations may lack visibility into Model Context Protocol (MCP) traffic, which can allow employees to connect to remote MCP servers outside of IT oversight. These connections risk the exfiltration of sensitive internal data and credentials, tool injection attacks or software supply chain risks. As an IT administrator, you want to identify shadow MCP traffic to prevent unauthorized data exfiltration while still supporting governed use cases. In this tutorial, you will use the Cloudflare GraphQL Analytics API to scan Gateway HTTP logs for MCP traffic patterns, create DLP profiles that detect MCP JSON-RPC methods, and classify traffic to differentiate between authorized traffic sent to MCP server portals and traffic sent to "shadow" remote MCP servers. ## Prerequisites - A Cloudflare account with a [Zero Trust organization](https://developers.cloudflare.com/cloudflare-one/setup/) - [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) with HTTP filtering enabled and actively proxying user traffic - An [API token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) with the following permissions: - Account-level `Zero Trust: Read` - Account-level `DLP: Write` - Account-level `Gateway: Write` - Your Cloudflare account ID (available in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/login) under **Account Home**) - Familiarity with [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api/) queries - A working knowledge of TypeScript and REST APIs ## 1. Review the Gateway HTTP dataset The `gatewayHttpRequestsAdaptiveGroups` dataset in the GraphQL Analytics API provides aggregated Gateway HTTP log data. Use this dataset to query for MCP-related traffic patterns: - **Dimensions**: `httpHost`, `httpRequestURI`, `action`, `users`, `dlpProfiles` - **Time range**: Up to 30 days of historical data - **Grouping**: Aggregates results by dimension values - **Filtering**: Supports `OR`, `AND`, and `like` operators ## 2. Build the MCP detection query MCP traffic can be identified by three signals: 1. **Domain patterns**: Hostnames containing `mcp` (for example, `mcp.datadog.com`) 2. **URL paths**: Standard MCP endpoints such as `/mcp`, `/mcp/sse`, and `/sse` 3. **DLP matches**: JSON-RPC methods in request bodies (covered in a later step) The following GraphQL query scans Gateway logs for the first two signals: ```js const query = ` query MCPTrafficScan($accountTag: string, $since: string, $until: string) { viewer { accounts(filter: { accountTag: $accountTag }) { gatewayHttpRequestsAdaptiveGroups( filter: { datetime_geq: $since datetime_leq: $until OR: [ { httpHost_like: "%mcp%" } { httpRequestURI_like: "%/mcp%" } { httpRequestURI_like: "%/sse%" } ] } limit: 10000 ) { dimensions { httpHost action users } count } } } } `; const variables = { accountTag: "", since: "", // ISO-8601 format, for example 2025-03-08T00:00:00Z until: "", // Up to 30 days after start date }; const response = await fetch("https://developers.cloudflare.com/service/https://api.cloudflare.com/client/v4/graphql", { method: "POST", headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json", }, body: JSON.stringify({ query, variables }), }); const data = await response.json(); const groups = data.data?.viewer?.accounts?.[0]?.gatewayHttpRequestsAdaptiveGroups || []; ``` ```ts const query = ` query MCPTrafficScan($accountTag: string, $since: string, $until: string) { viewer { accounts(filter: { accountTag: $accountTag }) { gatewayHttpRequestsAdaptiveGroups( filter: { datetime_geq: $since datetime_leq: $until OR: [ { httpHost_like: "%mcp%" } { httpRequestURI_like: "%/mcp%" } { httpRequestURI_like: "%/sse%" } ] } limit: 10000 ) { dimensions { httpHost action users } count } } } } `; const variables = { accountTag: "", since: "", // ISO-8601 format, for example 2025-03-08T00:00:00Z until: "", // Up to 30 days after start date }; const response = await fetch("https://developers.cloudflare.com/service/https://api.cloudflare.com/client/v4/graphql", { method: "POST", headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json", }, body: JSON.stringify({ query, variables }), }); const data = await response.json(); const groups = data.data?.viewer?.accounts?.[0]?.gatewayHttpRequestsAdaptiveGroups || []; ``` Replace `` with your Cloudflare account ID. Replace `` and `` with ISO-8601 timestamps covering your desired time range (up to 30 days). ## 3. Process the query results Each group in the response represents aggregated traffic for a specific `httpHost` and `action` combination. Parse the results to identify unblocked MCP connections: ```js const hits = groups.map((group) => ({ domain: group.dimensions.httpHost, requestCount: group.count, users: group.dimensions.users || [], actions: { allowed: group.dimensions.action === "allow" ? group.count : 0, blocked: group.dimensions.action === "block" ? group.count : 0, }, })); const totalMCPRequests = hits.reduce((sum, h) => sum + h.requestCount, 0); const unblockedHits = hits.filter((h) => h.actions.allowed > 0); console.log(`Found ${totalMCPRequests} MCP requests`); console.log(`${unblockedHits.length} destinations are unblocked`); ``` ```ts interface MCPTrafficHit { domain: string; requestCount: number; users: string[]; actions: { allowed: number; blocked: number; }; } const hits: MCPTrafficHit[] = groups.map((group: any) => ({ domain: group.dimensions.httpHost, requestCount: group.count, users: group.dimensions.users || [], actions: { allowed: group.dimensions.action === "allow" ? group.count : 0, blocked: group.dimensions.action === "block" ? group.count : 0, }, })); const totalMCPRequests = hits.reduce((sum, h) => sum + h.requestCount, 0); const unblockedHits = hits.filter((h) => h.actions.allowed > 0); console.log(`Found ${totalMCPRequests} MCP requests`); console.log(`${unblockedHits.length} destinations are unblocked`); ``` Key insights from the data: - **Unblocked traffic** ( `action` = `allow`) - Active MCP connections that need investigation or blocking - **Blocked traffic** ( `action` = `block`) - Your existing policies are working - **User attribution** - This indicates which employees are connecting to MCP servers ## 4. Create DLP profiles for MCP JSON-RPC detection Gateway HTTP policies can match domains and URL paths, but they cannot inspect request bodies. DLP profiles scan `POST` body content for patterns, which is useful for shadow MCP detection, since MCP uses JSON-RPC over HTTP and has several detectable hallmarks. Every MCP request contains a `"method"` field: ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "read_file", "arguments": { "path": "/etc/passwd" } } } ``` An attacker could run an MCP server on a non-standard domain (for example, `internal-tools.company.com/api/assistant`) without triggering domain-based or path-based rules. You can use DLP scans of the `POST` body for `"method": "tools/call"` and other MCP-specific patterns to provide more robust protection of MCP traffic. ### Review DLP constraints Before building detection patterns, note the following DLP limitations: - **Regex syntax** — Rust regex (differs slightly from JavaScript and PCRE) - **Scan depth** — First 1,024 bytes of the request body only - **POST only** — DLP only scans `POST` requests - **Performance** — Regex patterns must be efficient to avoid catastrophic backtracking ### Build MCP detection patterns MCP indicators can be found in JSON-RPC method fields. The following regex patterns cover the core MCP protocol methods: ```js const DLP_REGEX_PATTERNS = [ { name: "MCP Initialize Method", regex: '"method"\\s{0,5}:\\s{0,5}"initialize"', }, { name: "MCP Tools Call", regex: '"method"\\s{0,5}:\\s{0,5}"tools/call"', }, { name: "MCP Tools List", regex: '"method"\\s{0,5}:\\s{0,5}"tools/list"', }, { name: "MCP Resources Read", regex: '"method"\\s{0,5}:\\s{0,5}"resources/read"', }, { name: "MCP Resources List", regex: '"method"\\s{0,5}:\\s{0,5}"resources/list"', }, { name: "MCP Prompts List", regex: '"method"\\s{0,5}:\\s{0,5}"prompts/(list|get)"', }, { name: "MCP Sampling Create Message", regex: '"method"\\s{0,5}:\\s{0,5}"sampling/createMessage"', }, { name: "MCP Protocol Version", regex: '"protocolVersion"\\s{0,5}:\\s{0,5}"202[4-9]', }, { name: "MCP Notifications Initialized", regex: '"method"\\s{0,5}:\\s{0,5}"notifications/initialized"', }, { name: "MCP Roots List", regex: '"method"\\s{0,5}:\\s{0,5}"roots/list"', }, ]; ``` ```ts const DLP_REGEX_PATTERNS = [ { name: "MCP Initialize Method", regex: '"method"\\s{0,5}:\\s{0,5}"initialize"', }, { name: "MCP Tools Call", regex: '"method"\\s{0,5}:\\s{0,5}"tools/call"', }, { name: "MCP Tools List", regex: '"method"\\s{0,5}:\\s{0,5}"tools/list"', }, { name: "MCP Resources Read", regex: '"method"\\s{0,5}:\\s{0,5}"resources/read"', }, { name: "MCP Resources List", regex: '"method"\\s{0,5}:\\s{0,5}"resources/list"', }, { name: "MCP Prompts List", regex: '"method"\\s{0,5}:\\s{0,5}"prompts/(list|get)"', }, { name: "MCP Sampling Create Message", regex: '"method"\\s{0,5}:\\s{0,5}"sampling/createMessage"', }, { name: "MCP Protocol Version", regex: '"protocolVersion"\\s{0,5}:\\s{0,5}"202[4-9]', }, { name: "MCP Notifications Initialized", regex: '"method"\\s{0,5}:\\s{0,5}"notifications/initialized"', }, { name: "MCP Roots List", regex: '"method"\\s{0,5}:\\s{0,5}"roots/list"', }, ]; ``` Pattern explanation: - `\\s{0,5}` — Allows zero to five whitespace characters to handle both minified and pretty-printed JSON - `"method"` — Double quotes are literal because JSON requires them - `"tools/call"` — Matches the exact MCP method name - `202[4-9]` — Matches MCP protocol versions 2024 through 2029 ### Create the DLP profile via API Send a `POST` request to create a custom DLP profile containing all detection patterns: ```js const dlpProfile = { name: "MCP-Shield: MCP JSON-RPC Detection", description: "Detects MCP protocol JSON-RPC methods in HTTP request bodies.", type: "custom", entries: DLP_REGEX_PATTERNS.map((p) => ({ name: p.name, enabled: true, pattern: { regex: p.regex, validation: "luhn", }, })), }; const response = await fetch( `https://api.cloudflare.com/client/v4/accounts/${accountId}/gateway/rules`, { method: "POST", headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json", }, body: JSON.stringify(dlpRule), }, ); const data = await response.json(); if (data.success) { console.log(`Created DLP profile: ${data.result.id}`); } ``` ```ts const dlpProfile = { name: "MCP-Shield: MCP JSON-RPC Detection", description: "Detects MCP protocol JSON-RPC methods in HTTP request bodies.", type: "custom", entries: DLP_REGEX_PATTERNS.map((p) => ({ name: p.name, enabled: true, pattern: { regex: p.regex, validation: "luhn", }, })), }; const response = await fetch( `https://api.cloudflare.com/client/v4/accounts/${accountId}/gateway/rules`, { method: "POST", headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json", }, body: JSON.stringify(dlpRule), }, ); const data = await response.json(); if (data.success) { console.log(`Created DLP profile: ${data.result.id}`); } ``` Replace `${accountId}` with your Cloudflare account ID and `${apiToken}` with your API token. ### Reference the DLP profile in a Gateway rule After the DLP profile exists, create a Gateway HTTP policy that blocks requests matching the profile: ```js const dlpRule = { name: "MCP-Shield: Block MCP JSON-RPC via DLP", description: "Blocks requests with MCP JSON-RPC patterns detected by DLP", precedence: 85, enabled: true, action: "block", filters: ["http"], traffic: 'any(http.request.body.scan.dlp.profiles[*] == "MCP-Shield: MCP JSON-RPC Detection")', }; ``` ```ts const dlpRule = { name: "MCP-Shield: Block MCP JSON-RPC via DLP", description: "Blocks requests with MCP JSON-RPC patterns detected by DLP", precedence: 85, enabled: true, action: "block", filters: ["http"], traffic: 'any(http.request.body.scan.dlp.profiles[*] == "MCP-Shield: MCP JSON-RPC Detection")', }; ``` This rule triggers when the DLP profile matches any of the regex patterns in the request body. ## 5. Classify Portal traffic and shadow MCP traffic Cloudflare [MCP Server Portals](https://developers.cloudflare.com/cloudflare-one/) provide governed infrastructure for approved MCP access within your organization, including: - **Governed access** — Centralized MCP infrastructure managed by your IT team - **Audit trails** — All MCP requests logged through Gateway with user attribution - **Policy enforcement** — Zero Trust policies apply automatically, including authentication and DLP - **Approved tools** — A curated set of MCP tools and resources vetted by security When analyzing Gateway logs, it is helpful to differentiate between two types of MCP traffic: | Traffic type | Characteristics | Risk level | Action | | --- | --- | --- | --- | | MCP Portal traffic | `httpHost` matches your portal domain (for example, `mcp.yourcompany.com`) | Authorized | Monitor | | Shadow MCP traffic | `httpHost` does not match any portal domain (for example, `mcp.datadog.com`, `api.stripe.com/mcp`) | Investigate | Block, redirect or review | Extend the query processing from [Process the query results](#3-process-the-query-results) to classify traffic by comparing hostnames against your list of approved portal domains: ```js const portalDomains = [ "mcp.yourcompany.com", "mcp-portal.example.com", "approved-mcp.example.com", ]; const results = groups.map((group) => { const isPortalTraffic = portalDomains.some((domain) => group.dimensions.httpHost.includes(domain), ); return { domain: group.dimensions.httpHost, requestCount: group.count, users: group.dimensions.users || [], trafficType: isPortalTraffic ? "portal" : "shadow", riskLevel: isPortalTraffic ? "low" : "high", }; }); const portalTraffic = results.filter((r) => r.trafficType === "portal"); const shadowTraffic = results.filter((r) => r.trafficType === "shadow"); console.log("Portal traffic:", portalTraffic); console.log("Shadow MCP traffic:", shadowTraffic); ``` ```ts const portalDomains = [ "mcp.yourcompany.com", "mcp-portal.example.com", "approved-mcp.example.com", ]; const results = groups.map((group) => { const isPortalTraffic = portalDomains.some((domain) => group.dimensions.httpHost.includes(domain), ); return { domain: group.dimensions.httpHost, requestCount: group.count, users: group.dimensions.users || [], trafficType: isPortalTraffic ? "portal" : "shadow", riskLevel: isPortalTraffic ? "low" : "high", }; }); const portalTraffic = results.filter((r) => r.trafficType === "portal"); const shadowTraffic = results.filter((r) => r.trafficType === "shadow"); console.log("Portal traffic:", portalTraffic); console.log("Shadow MCP traffic:", shadowTraffic); ``` Replace the `portalDomains` array with the actual domains of your approved MCP Server Portals. ## Related resources - [Zero Trust documentation](https://developers.cloudflare.com/cloudflare-one/) - [Gateway policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) - [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) - [GraphQL Analytics API](https://developers.cloudflare.com/analytics/graphql-api/) - [Rules language and wirefilter expressions](https://developers.cloudflare.com/ruleset-engine/rules-language/) - [Pages Functions](https://developers.cloudflare.com/pages/functions/) - [Logpush](https://developers.cloudflare.com/logs/logpush/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/detect-mcp-traffic-gateway-logs/#page","headline":"Detect MCP traffic in Gateway logs","description":"Scan Gateway logs for unauthorized MCP traffic.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/detect-mcp-traffic-gateway-logs/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/detect-mcp-traffic-gateway-logs/og.png?v=820aa1d92e7b6e66","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["MCP","Logging","TypeScript","GraphQL"]} ``` --- --- description: With Cloudflare Browser Isolation and resolver policies, users can connect to private web-based applications via their private hostnames. title: Access a web application via its private hostname without the Cloudflare One Client image: https://developers.cloudflare.com/cloudflare-one/tutorials/clientless-access-private-dns/og.png?v=62607a959113a351 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Access a web application via its private hostname without the Cloudflare One Client Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/clientless-access-private-dns/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) With Cloudflare Browser Isolation and resolver policies, users can connect to private web-based applications via their private hostnames without needing to install the Cloudflare One Client. By the end of this tutorial, users who pass your Gateway DNS and network policies will be able to access your private application at `https://.cloudflareaccess.com/browser/https://internalrecord.com`. ## Before you begin Make sure you have: - [Cloudflare Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) enabled on your account - [Resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) enabled on your account - An HTTP or HTTPS application that users access through a browser ## Create a Cloudflare Tunnel First, install `cloudflared` on a server in your private network: 1. Log in to the Cloudflare dashboard and go to **Networking** > **Tunnels**. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) 2. Select **Create a tunnel**. 3. Enter a name for your tunnel. We suggest choosing a name that reflects the type of resources you want to connect through this tunnel (for example, `enterprise-VPC-01`). 4. Select **Create Tunnel**. 5. Choose your operating system, then copy the installation command and run it in a terminal on your origin server. 6. Wait for the tunnel to connect. Once the connection is established, select **Continue**. ## Add private network routes 1. In the Cloudflare dashboard, go to **Networking** > **Routes**. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 2. Select **Create route** > **Tunnel CIDR**. Select the tunnel you just created, enter the private IP/CIDR of your application server (for example, `10.128.0.175/32`), and select **Create route**. 3. Repeat to create a second route for the private IP/CIDR of your DNS server. The application and DNS server are now connected to Cloudflare. ## Enable Clientless Web Isolation 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Browser isolation** > **Browser isolation settings**. 2. Turn on **Allow users to open a remote browser without the device client**. 3. For **Permissions**, select **Manage**. 4. Select **Add a rule**. 5. Create an expression that defines who can open the Clientless Web Isolation browser. For example, | Rule action | Rule type | Selector | Value | Action | | --- | --- | --- | --- | --- | | Allow | Include | Emails ending in | `@example.com` | Select **Save**. | To test, open a browser and go to `https://.cloudflareaccess.com/browser/https://`. ## Create a Gateway resolver policy 1. Go to **Traffic policies** > **Resolver policies**. 2. Select **Add a policy**. 3. Create an expression to match against the private [domain](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/#domain) or [hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/#host) of the application: | Selector | Operator | Value | | --- | --- | --- | | Domain | in | `internalrecord.com` | 4. In **Select DNS resolver**, select *Configure custom DNS resolvers*. 5. Enter the private IP address of your DNS server. 6. In the dropdown menu, select *` - Private`*. 7. (Optional) Enter a custom port. 8. Select **Create policy**. To test, open a browser and go to `https://.cloudflareaccess.com/browser/https://internalrecord.com`. ## Create a Gateway network policy (recommended) 1. Go to **Traffic policies** > **Firewall policies** > **Network**. 2. Add a [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) that targets the private IP address of your application. You can optionally include any ports or protocols relevant for application access. For example, | Selector | Operator | Value | Logic | Action | | --- | --- | --- | --- | --- | | Destination IP | in | `10.128.0.175` | And | Allow | | Destination Port | in | `80` | Or | | | User Email | matches regex | `.*example.com` | | | Note Device posture checks are not supported because they require the Cloudflare One Client. For best practices on securing private applications, refer to [Build secure access policies](https://developers.cloudflare.com/learning-paths/replace-vpn/build-policies/). ## Connect as a user Users can now access the application at the following URL: `https://.cloudflareaccess.com/browser/https://internalrecord.com` The application will load in an isolated browser. You can optionally [configure remote browser controls](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/#policy-settings) such as disabling copy/paste, printing, or keyboard input. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/clientless-access-private-dns/#page","headline":"Access a web application via its private hostname without the Cloudflare One Client","description":"With Cloudflare Browser Isolation and resolver policies, users can connect to private web-based applications via their private hostnames.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/clientless-access-private-dns/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/clientless-access-private-dns/og.png?v=62607a959113a351","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["DNS","Private networks"]} ``` --- --- description: Using Cloudflare Tunnel's private networks, users can connect to arbitrary non-browser based TCP/UDP applications, like databases. You can set up network policies that implement zero trust controls to define who and what can access those applications using the Cloudflare One Client. title: Access and secure a MySQL database using Cloudflare Tunnel and network policies image: https://developers.cloudflare.com/cloudflare-one/tutorials/mysql-network-policy/og.png?v=059675fab18c359d --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Access and secure a MySQL database using Cloudflare Tunnel and network policies Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/mysql-network-policy/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Using Cloudflare Tunnel's private networks, users can connect to arbitrary non-browser based TCP/UDP applications, like databases. You can set up network policies that implement zero trust controls to define who and what can access those applications using the Cloudflare One Client. By the end of this tutorial, users that pass network policies will be able to access a remote MySQL database available through a Cloudflare Tunnel on TCP port 3306. ## Before you begin Make sure you have: - A MySQL database listening for remote connections and configured with users that can connect remotely - (Optional) [Resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) enabled on your account ## Create a Cloudflare Tunnel Install `cloudflared` on a server in your private network. This server should have connectivity to the MySQL database. 1. Log in to the Cloudflare dashboard and go to **Networking** > **Tunnels**. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) 2. Select **Create a tunnel**. 3. Enter a name for your tunnel. We suggest choosing a name that reflects the type of resources you want to connect through this tunnel (for example, `enterprise-VPC-01`). 4. Select **Create Tunnel**. 5. Choose your operating system, then copy the installation command and run it in a terminal on your origin server. 6. Wait for the tunnel to connect. Once the connection is established, select **Continue**. ## Add private network routes 1. In the Cloudflare dashboard, go to **Networking** > **Routes**. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 2. Select **Create route** > **Tunnel CIDR**. Select the tunnel you just created, enter the private IP/CIDR of your MySQL server (for example, `10.128.0.175/32`), and select **Create route**. 3. (Optional) Repeat to create a second route for the private IP/CIDR of your internal DNS server. The application and (optional) DNS server are now connected to Cloudflare. ## Create a Gateway network policy 1. Go to **Traffic policies** > **Network policies**. 2. Add a [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) that targets the private IP address and the port of the MySQL database (port 3306 by default). The following example allows access to the database to the users that enrolled into the Cloudflare One Client using an `@example.com` email address. The network policies can also take into consideration [device posture checks](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/). | Selector | Operator | Value | Logic | Action | | --- | --- | --- | --- | --- | | Destination IP | in | `10.128.0.175` | And | Allow | | Destination Port | in | `3306` | And | | | User Email | matches regex | `.*example.com` | | | In addition to the Allow rule above, Cloudflare recommends adding a [catch-all block policy](https://developers.cloudflare.com/learning-paths/replace-vpn/build-policies/) to the bottom of your network policy list to enforce a default-deny model. Allowed Cloudflare One Client users can now connect to the MySQL server at `10.128.0.175` using the MySQL client of their choice. ## (Optional) Create a Gateway resolver policy To allow users to access the MySQL database using an internal hostname instead of the private IP address, configure a Gateway resolver policy. 1. Go to **Traffic policies** > **Resolver policies**. 2. Select **Add a policy**. 3. Create an expression to match against the private [domain](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/#domain) or [hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/#host) of the application, like in the following example: | Selector | Operator | Value | | --- | --- | --- | | Domain | in | `internalrecord.com` | 4. In **Select DNS resolver**, select *Configure custom DNS resolvers*. 5. Enter the private IP address of your DNS server. 6. In the dropdown menu, select *` - Private`*. 7. (Optional) Enter a custom port. 8. Select **Create policy**. If your internal DNS server has an `A` record for the MySQL database, users can connect to the server using this record. For example, assuming a BIND server that includes the entry: `mysql IN A 10.128.0.175` Allowed Cloudflare One Client users can connect to the MySQL database at `mysql.internalrecord.com` using the MySQL client of their choice. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/mysql-network-policy/#page","headline":"Access and secure a MySQL database using Cloudflare Tunnel and network policies","description":"Using Cloudflare Tunnel's private networks, users can connect to arbitrary non-browser based TCP/UDP applications, like databases. You can set up network policies that implement zero trust controls to define who and what can access those applications using the Cloudflare One Client.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/mysql-network-policy/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/mysql-network-policy/og.png?v=059675fab18c359d","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["MySQL","Private networks"]} ``` --- --- description: Cloudflare's cloudflared command-line tool allows you to interact with endpoints protected by Cloudflare Access. title: Connect through Cloudflare Access using a CLI image: https://developers.cloudflare.com/cloudflare-one/tutorials/cli/og.png?v=3fbfdc4a0a8c3a67 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Connect through Cloudflare Access using a CLI Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/cli/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare's `cloudflared` command-line tool allows you to interact with endpoints protected by Cloudflare Access. You can use `cloudflared` to interact with a protected application's API. These instructions are not meant for configuring a service to run against an API. The token in this example is tailored to user identity and intended only for an end user interacting with an API via a command-line tool. **This walkthrough covers how to:** - Connect to resources secured by Cloudflare Access from a CLI **Time to complete:** 30 minutes --- ## Authenticate a session from the command line Once you have [installed `cloudflared`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/), you can use it to retrieve a Cloudflare Access [application token](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/). This walkthrough uses the domain `example.com` as a stand-in for a protected API. 1. To generate a token, run the following command: ```sh cloudflared access login https://example.com ``` With this command, `cloudflared` launches a browser window containing the same Access login page found when attempting to access a web application. 2. Select your identity provider and log in. If the browser window does not launch, you can use the unique URL that is automatically printed to the command line. 1. Once you have successfully authenticated, the browser returns the token to `cloudflared` in a cryptographic transfer and stores it. The token is valid for the [session duration](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/) configured by the Access administrator. ## Access your API Once you have retrieved a token, you can access the protected API. The `cloudflared` command-line tool includes a wrapper for transferring data via `curl`, which uses URL syntax (for more, see the [curl ↗︎](https://github.com/curl/curl) GitHub project). The wrapper injects the token into the `curl` request as a query argument named *token*. You can invoke the wrapper as follows: ```sh cloudflared access curl http://example.com ``` It is possible also to use the `put` command with `cloudflared` for any Unix tool to include the token in the request. Read on for other available commands. ## Available commands ### login The `login` command initiates the login flow for an application behind Access. ```sh cloudflared access login http://example.com ``` ### curl The `curl` command invokes the client wrapper and includes the token in the request automatically. ```sh cloudflared access curl http://example.com ``` ### token The `token` command retrieves the token scoped to that specific application for use in other command-line tools. ```sh cloudflared access token -app=http://example.com ``` ## Using the token as an environment variable It is possible to save the token as an environment variable for convenience and concision in scripts that access a protected application. Set up a token as an environment variable as follows: 1. Run the following command to export the token to the shell environment: ```sh export TOKEN=$(cloudflared access token -app=http://example.com) ``` 2. Confirm the token was saved with the following: ```sh echo $TOKEN ``` Once you have exported the token to your environment, use the variable with the Cloudflare Access request header in the script to access a protected endpoint, as in the following example: ```sh curl -H "cf-access-token: $TOKEN" https://example.com/rest/api/2/item/foo-123 ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/cli/#page","headline":"Connect through Cloudflare Access using a CLI","description":"Cloudflare's cloudflared command-line tool allows you to interact with endpoints protected by Cloudflare Access.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/cli/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/cli/og.png?v=3fbfdc4a0a8c3a67","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["CLI"]} ``` --- --- description: Connecting to Cloudflare's network using kubectl. Create a Zero Trust policy for your machine. Create an outbound-only connection between your machine and Cloudflared's network. title: Connect through Cloudflare Access using kubectl image: https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/og.png?v=a5ffc517a4ffc269 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Connect through Cloudflare Access using kubectl Last updated May 6, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can connect to machines over `kubectl` using Cloudflare's Zero Trust platform. **This walkthrough covers how to:** - Build a policy in Cloudflare Access to secure the machine - Connect a machine to Cloudflare's network using kubectl - Connect from a client machine **Before you start** - [Add a website to Cloudflare](https://developers.cloudflare.com/fundamentals/manage-domains/add-site/) **Time to complete:** 30 minutes --- ## Create an Access policy 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Applications**. 2. Select **Create new application**. 3. Select **Self-hosted and private**. 4. Select **Add public hostname** and input a subdomain. This will be the hostname where your application will be available to users. 5. [Create a new policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/) to control who can reach the application, or select existing policies. 6. Follow the remaining [self-hosted application creation steps](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to publish the application. ## Install `cloudflared` Cloudflare Tunnel creates a secure, outbound-only connection between this machine and Cloudflare's network. With an outbound-only model, you can prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports. Cloudflare Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and install `cloudflared` on the DigitalOcean machine by following the instructions listed on the [Downloads](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) page. ## Authenticate `cloudflared` Run the following command to authenticate cloudflared into your Cloudflare account. ```sh cloudflared tunnel login ``` `cloudflared` will open a browser window and prompt you to log in to your Cloudflare account. If you are working on a machine that does not have a browser, or a browser window does not launch, you can copy the URL from the command-line output and visit the URL in a browser on any machine. Choose any hostname presented in the list. Cloudflare will issue a certificate scoped to your account. You do not need to pick the specific hostname where you will serve the Tunnel. ## Create a Tunnel Next, create a tunnel with the command below. ```sh cloudflared tunnel create ``` Replacing `` with a name for the Tunnel. This name can be any value. A single Tunnel can also serve traffic for multiple hostnames to multiple services in your environment, including a mix of connection types like SSH and HTTP. The command will output an ID for the Tunnel and generate an associated credentials file. At any time you can list the Tunnels in your account with the following command. ```sh cloudflared tunnel list ``` ## Configure the Tunnel You can now [configure the tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/#4-create-a-configuration-file) to serve traffic. Create a `YAML` file that `cloudflared` can reach. By default, `cloudflared` will look for the file in the same folder where `cloudflared` has been installed. ```sh vim ~/.cloudflared/config.yml ``` Next, configure the Tunnel, replacing the example ID below with the ID of the Tunnel created above. Additionally, replace the hostname in this example with the hostname of the application configured with Cloudflare Access. ```yaml tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json ingress: - hostname: azure.widgetcorp.tech service: tcp://kubernetes.docker.internal:6443 originRequest: proxyType: socks - service: http_status:404 # Catch-all rule, which responds with 404 if traffic doesn't match any of # the earlier rules ``` ## Route to the Tunnel You can now create a DNS record that will route traffic to this Tunnel. Multiple DNS records can point to a single Tunnel and will send traffic to the configured service as long as the hostname is defined with an [ingress rule](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/#file-structure-for-public-hostnames). 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and go to the **DNS Records** page for your domain. [Go to **Records** ↗](https://dash.cloudflare.com/?to=/:account/:zone/dns/records) 2. Select **Add record**. Choose `CNAME` as the record type. For **Name**, choose the hostname where you want to create a Tunnel. This should match the hostname of the Access policy. 3. For **Target**, input the ID of your Tunnel followed by `.cfargotunnel.com`. For example: ```txt 6ff42ae2-765d-4adf-8112-31c55c1551ef.cfargotunnel.com ``` 4. Select **Save**. ## Run the Tunnel You can now run the Tunnel to connect the target service to Cloudflare. Use the following command to run the Tunnel, replacing `` with the name created for your Tunnel. ```sh cloudflared tunnel run ``` We recommend that you run `cloudflared` [as a service](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/) that is configured to launch on start. ## Connect from a client machine You can now connect from a client machine using `cloudflared`. This example uses a macOS laptop. On macOS, you can install `cloudflared` with the following command using Homebrew. ```sh brew install cloudflared ``` Run the following command to create a connection from the device to Cloudflare. Any available port can be specified. ```sh cloudflared access tcp --hostname azure.widgetcorp.tech --url 127.0.0.1:1234 ``` With this service running, you can run a `kubectl` command and `cloudflared` will launch a browser window and prompt the user to authenticate with your SSO provider. Once authenticated, `cloudflared` will expose the connection to the client machine at the local URL specified in the command. `kubeconfig` does not support proxy command configurations at this time, though the community has submitted plans to do so. In the interim, users can alias the cluster's API server to save time. ```sh alias kubeone="env HTTPS_PROXY=socks5://127.0.0.1:1234 kubectl" ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/#page","headline":"Connect through Cloudflare Access using kubectl","description":"Connecting to Cloudflare's network using kubectl. Create a Zero Trust policy for your machine. Create an outbound-only connection between your machine and Cloudflared's network.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/kubectl/og.png?v=a5ffc517a4ffc269","dateModified":"2026-05-06","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Kubernetes","TCP"]} ``` --- --- description: This tutorial explains how to use Cloudflare AI Gateway and Zero Trust to create a functional and secure website wrapper for an AI agent. title: Create and secure an AI agent wrapper using AI Gateway and Zero Trust image: https://developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/og.png?v=612b12b27c0fbc56 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Create and secure an AI agent wrapper using AI Gateway and Zero Trust Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial explains how to use [Cloudflare AI Gateway](https://developers.cloudflare.com/ai-gateway/) and Zero Trust to create a functional and secure website wrapper for an AI agent. Cloudflare Zero Trust administrators can protect access to the wrapper with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). Additionally, you can enforce [Gateway policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) to control how your users interact with AI agents, including executing AI agents in an isolated browser with [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/), enforcing [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) profiles to prevent your users from sharing sensitive data, and scanning content to avoid answers from AI agents that violate internal corporate guidelines. Creating an AI agent wrapper is also an effective way to enforce tenant control if you have an enterprise plan for a specific AI provider, such as ChatGPT Enterprise. This tutorial uses ChatGPT as an example AI agent. ## Before you begin Make sure you have: - A [Cloudflare Zero Trust organization](https://developers.cloudflare.com/cloudflare-one/setup/). - An API key for your desired AI provider, such as an [OpenAI API key ↗︎](https://platform.openai.com/api-keys) for ChatGPT. ## 1. Create an AI gateway First, create an AI gateway to control your AI app. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to the **AI Gateway** page. [Go to **AI Gateway** ↗](https://dash.cloudflare.com/?to=/:account/ai/ai-gateway) 2. Select **Create Gateway**. 3. Name your gateway. 4. Select **Create**. 5. Configure your desired options for the gateway. 6. [Connect your AI provider](https://developers.cloudflare.com/ai-gateway/get-started/#connect-application) to proxy queries to your AI agent of choice using your AI gateway. 7. (Optional) Turn on [Authenticated Gateway](https://developers.cloudflare.com/ai-gateway/configuration/authentication/). The Authenticated Gateway feature ensures your AI gateway can only be called securely by enforcing a token in the form of a request header `cf-aig-authorization`. 1. Go to **AI** > **AI Gateway**. 2. Select your AI gateway, then go to **Settings**. 3. Turn on **Authenticated Gateway**, then choose **Confirm**. 4. Select **Create authentication token**, then select **Create an AI Gateway authentication token**. 5. Configure your token and copy the token value. When creating your Worker, you will need to pass this token when calling your AI gateway. For more information, refer to [Getting started with AI Gateway](https://developers.cloudflare.com/ai-gateway/get-started/). ## 2. (Optional) Use Guardrails to block unsafe or inappropriate content [Guardrails](https://developers.cloudflare.com/ai-gateway/features/guardrails/) is an built-in AI Gateway security feature that allows Cloudflare to identify unsafe or inappropriate content in prompts and responses based on selected categories. 1. In the Cloudflare dashboard, go to the **AI Gateway** page. [Go to **AI Gateway** ↗](https://dash.cloudflare.com/?to=/:account/ai/ai-gateway) 2. Select your AI gateway. 3. Go to **Guardrails**. 4. Turn on Guardrails. 5. Select **Change** to configure the categories you would like to filter for both prompts and responses. ## 3. Build a Worker to serve the wrapper ### 1. Create the Worker In order to build the Worker, you will need to choose if you want to build it locally using [Wrangler](https://developers.cloudflare.com/workers/wrangler/install-and-update/) or remotely using the [dashboard ↗︎](https://dash.cloudflare.com/). 1. In a terminal, log in to your Cloudflare account: ```bash wrangler login ``` 2. Initiate the project locally: ```bash mkdir ai-agent-wrapper cd ai-agent-wrapper wrangler init ``` 3. Create a Wrangler configuration file: ```toml name = "ai-agent-wrapper" main = "src/index.js" upload_source_maps = true compatibility_date = "2023-10-30" [vars] # Add any environment variables here ``` 4. Add your AI provider's API key as a [secret](https://developers.cloudflare.com/workers/configuration/secrets/): ```bash wrangler secret put ``` You can now build the Worker using the `index.js` file created by Wrangler. 1. In the Cloudflare dashboard, go to the **Workers & Pages** page. [Go to **Workers & Pages** ↗](https://dash.cloudflare.com/?to=/:account/workers-and-pages) 2. Select **Create**. 3. In **Workers**, choose the **Hello world** template. 4. Name your worker, then select **Deploy**. 5. Select your Worker, then go to the **Settings** tab. 6. Go to **Variables and Secrets**, then select **Add**. 7. Choose *Secret* as the type, name your secret (for example, `OPENAI_API_KEY`), and enter the value of your AI provider's API key in **Value**. You can now build the Worker using the online code editor by selecting **Edit code** on your Worker page. ### 2. Build the Worker The following is an example starter Worker that serves a simple front-end to allow a user to interact with an AI provider behind AI Gateway. This example uses OpenAI as its AI provider: ```javascript export default { async fetch(request, env) { if (request.url.endsWith("/api/chat")) { if (request.method === "POST") { try { const { messages } = await request.json(); const response = await fetch( "https://gateway.ai.cloudflare.com/v1/$ACCOUNT_ID/$GATEWAY_ID/openai/chat/completions", { method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${env.OPENAI_API_KEY}`, }, body: JSON.stringify({ model: "gpt-4o-mini", messages: messages, }), }, ); if (!response.ok) { throw new Error(`AI Gateway Error: ${response.status}`); } const result = await response.json(); return new Response( JSON.stringify({ response: result.choices[0].message.content, }), { headers: { "Content-Type": "application/json" }, }, ); } catch (error) { return new Response(JSON.stringify({ error: error.message }), { status: 500, headers: { "Content-Type": "application/json" }, }); } } return new Response("Method not allowed", { status: 405 }); } return new Response(HTML, { headers: { "Content-Type": "text/html" }, }); }, }; const HTML = ` ChatGPT Wrapper

AI Assistant

`; ``` Note that the account ID and gateway ID need to be replaced in the AI Gateway endpoint. You can add these as [environment variables](https://developers.cloudflare.com/workers/configuration/environment-variables/) or [secrets](https://developers.cloudflare.com/workers/configuration/secrets/) in Workers. If you chose to use Authenticated Gateway when creating your AI gateway, make sure to also add your token as a secret and pass its value to the AI gateway in the `cf-aig-authorization` header. ### 3. Publish the Worker Once the Worker code is complete, you need to make the Worker addressable using a hostname controllable by Cloudflare Access. Edit the Wrangler configuration file and add the following information to ensure that the Worker is only accessible using the custom hostname: ```diff name = "ai-agent-wrapper" main = "src/index.js" compatibility_date = "2023-10-30" workers_dev = false +# Replace with your custom domain +routes = [ + { pattern = "", custom_domain = true } +] [vars] # Add any environment variables here ``` To publish the worker, run `wrangler deploy`. If you built your Worker remotely using the [code editor](https://developers.cloudflare.com/workers/get-started/dashboard/) available in the Cloudflare dashboard, you can deploy it by selecting **Deploy**. To ensure that the Worker is only accessible from the custom hostname: 1. In the Cloudflare dashboard, go to the **Workers & Pages** page. [Go to **Workers & Pages** ↗](https://dash.cloudflare.com/?to=/:account/workers-and-pages) 2. Select your Worker. 3. Go to **Settings**. 4. Within **Domains & Routes**, select **Add**. 5. Choose **Custom domain**. 6. Enter your desired custom domain name. 7. Select **Add domain**. The Worker is now behind an addressable public hostname. Make sure to turn off both **workers.dev** and **Preview URLs** so that the Worker can only be accessed with its custom domain. ## 4. Secure the wrapper with Access To secure the AI agent wrapper to ensure that only trusted users can access it: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Applications**. 2. Select **Create new application**. 3. Select **Self-hosted and private**. 4. Select **Add public hostname** and enter the custom domain you set for your Worker. 5. [Configure your Access application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) for your Worker. 6. Add [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/) to control who can connect to your application. Now your AI wrapper can only be accessed by your users that successfully match your Access policies. ## 5. Block access to public AI agents with Gateway You can now block access to all unauthorized public AI agents with a Gateway [HTTP policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Firewall policies** > **HTTP**. 2. Select **Add a policy**. 3. Add the following policy: | Selector | Operator | Value | Action | | --- | --- | --- | --- | | Content Categories | in | *Artificial Intelligence* | Block | 4. Select **Create policy**. This ensures that public AI agents are not accessible using a managed endpoint. Alternatively, you can prevent users from using public AI agents by displaying a [custom block message](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#customize-the-block-page), [redirect](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page), or a [user notification](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#cloudflare-one-client-block-notifications) directing users to the AI agent wrapper. ## 6. Enforce Data Loss Prevention and Clientless Browser Isolation Now that you have full control over access to your AI agent wrapper, you can enforce extra security methods such as Data Loss Prevention (DLP) and Clientless Web Isolation to protect and control data shared with the AI agent. ### Apply Data Loss Prevention profiles You can use [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) to prevent your users from sending sensitive data to the AI agent. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **Profiles**. 2. Ensure that the [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/) you want to enforce are properly configured. 3. Add an HTTP policy to enforce the DLP profile for the hostname for your wrapper. For example: | Selector | Operator | Value | Logic | Action | | --- | --- | --- | --- | --- | | Host | is | `ai-wrapper.example.com` | And | Block | | DLP Profile | in | *AI DLP profile* | | | 4. Select **Create policy**. For more information on creating DLP policies, refer to [Scan HTTP traffic](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/). ### Execute in a clientless isolated browser Because you published your wrapper as a self-hosted Access application, you can execute it in an [isolated session](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) for your users by creating an [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) and configuring it for your application. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Browser isolation** > **Browser isolation settings**. 2. Turn on **Allow users to open a remote browser without the device client**. 3. Go to **Access controls** > **Policies**. 4. Select **Add a policy**. 5. Set the **Action** to *Allow*. 6. In **Add rules**, add identity rules to define who the application should be isolated for. 7. In **Additional settings (optional)**, turn on **Isolate application**. Once the Access policy has been created, you can attach it to your wrapper. 1. Go to **Access controls** > **Applications**. 2. Choose your wrapper application, then select **Configure**. 3. In **Policies**, select **Select existing policies**. 4. Choose the Access policy you previously created. 5. Select **Confirm**, then select **Save**. Because Clientless Web Isolation traffic applies your Gateway HTTP policies, your configured DLP profiles will apply to isolated sessions. For more information on isolating an Access application, refer to [Isolate self-hosted application](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/isolate-application/). ## Additional benefits Organizations that adopt Cloudflare to secure access to AI agents will benefit from improved visibility and configurability. ### Visibility Zero Trust will log all [Access events](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [DLP detections](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#http-logs). In addition, AI Gateway provides [visibility](https://developers.cloudflare.com/ai-gateway/observability/logging/) into user prompts, model response, token usage, and costs. Logs can be exported to external providers with [Logpush](https://developers.cloudflare.com/logs/logpush/). ### Configurability You can configure your wrapper to use a [different AI provider](https://developers.cloudflare.com/ai-gateway/usage/providers/) or give your users the option to choose between multiple AI providers, including AI models running directly on Cloudflare's global network with [Workers AI](https://developers.cloudflare.com/workers-ai/). With this, you can control costs related to AI usage or adopt newer models without impacting your users or the access controls already put in place. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/#page","headline":"Create and secure an AI agent wrapper using AI Gateway and Zero Trust","description":"This tutorial explains how to use Cloudflare AI Gateway and Zero Trust to create a functional and secure website wrapper for an AI agent.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/ai-wrapper-tenant-control/og.png?v=612b12b27c0fbc56","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["AI"]} ``` --- --- description: This tutorial covers how to use a Cloudflare Worker to add custom headers to traffic. The headers will be sent to origin services protected by Cloudflare Access. title: Create custom headers for Cloudflare Access-protected origins with Workers image: https://developers.cloudflare.com/cloudflare-one/tutorials/access-workers/og.png?v=fa530a0104b696ff --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Create custom headers for Cloudflare Access-protected origins with Workers Last updated Jan 28, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/access-workers/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial covers how to use a [Cloudflare Worker](https://developers.cloudflare.com/workers/) to add custom HTTP headers to traffic, and how to send those custom headers to your origin services protected by [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). Some applications and networking implementations require specific custom headers to be passed to the origin, which can be difficult to implement for traffic moving through a Zero Trust proxy. You can configure a Worker to send the [user authorization headers](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/) required by Access. --- ## Before you begin - Secure your origin server with Cloudflare Access ## Before you begin 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to the **Workers & Pages** page. [Go to **Workers & Pages** ↗](https://dash.cloudflare.com/?to=/:account/workers-and-pages) 2. If this is your first Worker, select **Create Worker**. Otherwise, select **Create application**, then select **Create Worker**. 3. Enter an identifiable name for the Worker, then select **Deploy**. 4. Select **Edit code**. 5. Input the following Worker: ```js export default { async fetch(request, env, ctx) { const { headers } = request; const cfaccessemail = headers.get("cf-access-authenticated-user-email"); const requestWithID = new Request(request); requestWithID.headers.set("company-user-id", cfaccessemail); return fetch(requestWithID); }, }; ``` *Worker with custom HTTP headersts* ```ts export default { async fetch(request, env, ctx): Promise { const { headers } = request; const cfaccessemail = headers.get("cf-access-authenticated-user-email"); const requestWithID = new Request(request); requestWithID.headers.set("company-user-id", cfaccessemail); return fetch(requestWithID); }, } satisfies ExportedHandler; ``` 6. Select **Save and deploy**. Your Worker is now ready to send custom headers to your Access-protected origin services. ## Apply the Worker to your hostname 1. Select the Worker you created, then go to **Triggers**. 2. In **Routes**, select **Add route**. 3. Enter the hostname and zone for your origin, then select **Add route**. The Worker will now insert a custom header into requests that match the defined route. For example: *Example custom headerhttp* ```http "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding": "gzip", "Accept-Language": "en-US,en;q=0.9", "Cf-Access-Authenticated-User-Email": "user@example.com", "Company-User-Id": "user@example.com", "Connection": "keep-alive" ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/access-workers/#page","headline":"Create custom headers for Cloudflare Access-protected origins with Workers","description":"This tutorial covers how to use a Cloudflare Worker to add custom headers to traffic. The headers will be sent to origin services protected by Cloudflare Access.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/access-workers/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/access-workers/og.png?v=fa530a0104b696ff","dateModified":"2026-01-28","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["JavaScript"]} ``` --- --- description: This tutorial explains how to deploy the Cloudflare One Client on headless Linux devices using a service token and an installation script. title: Deploy the Cloudflare One Client on headless Linux machines image: https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/og.png?v=d28d8095b38b7468 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Deploy the Cloudflare One Client on headless Linux machines Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial explains how to deploy the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) on Linux devices using a service token and an installation script. This deployment workflow is designed for headless servers - that is, servers which do not have access to a browser for identity provider logins - and for situations where you want to fully automate the onboarding process. Because devices will not register through an identity provider, [identity-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/) and logging will be unavailable. Note This tutorial focuses on deploying the Cloudflare One Client as an endpoint device agent. If you are looking to deploy the Cloudflare One Client as a gateway to a private network, refer to the [Cloudflare Mesh documentation](https://developers.cloudflare.com/mesh/). ## Prerequisites - [Cloudflare Zero Trust account](https://developers.cloudflare.com/cloudflare-one/setup/#2-create-a-zero-trust-organization) - Root or `sudo` access on a supported Linux device - Zero Trust team name - Service token Client ID and Client Secret ## 1. Create a service token Fully automated deployments rely on a service token to enroll the Cloudflare One Client in your Zero Trust organization. You can use the same token to enroll multiple devices, or generate a unique token per device if they require different [device profile settings](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). To create a service token: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Service credentials** > **Service Tokens**. 2. Select **Create Service Token**. 3. Name the service token. The name allows you to easily identify events related to the token in the logs and to revoke the token individually. 4. Choose a **Service Token Duration**. This sets the expiration date for the token. 5. Select **Generate token**. You will see the generated Client ID and Client Secret for the service token, as well as their respective request headers. 6. Copy the Client Secret. Caution This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must generate a new service token. 1. Make a `POST` request to the [Access Service Tokens](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/service_tokens/methods/create/) endpoint:
Required API token permissions At least one of the following token permissions is required: - Access: Service Tokens Write
*Create a service tokenbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/access/service_tokens" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "name": "CI/CD token", "duration": "8760h" }' ``` 2. Copy the `client_id` and `client_secret` values returned in the response. *Responsejson* ```json "result": { "client_id": "88bf3b6d86161464f6509f7219099e57.access", "client_secret": "bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5", "created_at": "2025-09-25T22:26:26Z", "expires_at": "2026-09-25T22:26:26Z", "id": "3537a672-e4d8-4d89-aab9-26cb622918a1", "name": "CI/CD token", "updated_at": "2025-09-25T22:26:26Z", "duration": "8760h", "client_secret_version": 1 } ``` Caution This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must generate a new service token. 1. Add the following permission to your [`cloudflare_api_token` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token): - `Access: Service Tokens Write` 2. Configure the [`cloudflare_zero_trust_access_service_token` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_service_token) resource: ```tf resource "cloudflare_zero_trust_access_service_token" "example_service_token" { account_id = var.cloudflare_account_id name = "Example service token" duration = "8760h" lifecycle { create_before_destroy = true } } ``` 3. Get the Client ID and Client Secret of the service token:
Example: Output to CLI 1. Output the Client ID and Client Secret to the Terraform state file: ```tf output "example_service_token_client_id" { value = cloudflare_zero_trust_access_service_token.example_service_token.client_id } output "example_service_token_client_secret" { value = cloudflare_zero_trust_access_service_token.example_service_token.client_secret sensitive = true } ``` 2. Apply the configuration: ```sh terraform apply ``` 3. Read the Client ID and Client Secret: ```sh terraform output -raw example_service_token_client_id ``` ```sh terraform output -raw example_service_token_client_secret ```
Example: Store in HashiCorp Vault ```tf resource "vault_generic_secret" "example_service_token" { path = "kv/cloudflare/example_service_token" data_json = jsonencode({ "CLIENT_ID" = cloudflare_access_service_token.example_service_token.client_id "CLIENT_SECRET" = cloudflare_access_service_token.example_service_token.client_secret }) } ```
## 2. Configure device enrollment permissions Device enrollment permissions determine the users and devices that can register WARP with your Zero Trust organization. To allow devices to enroll using a service token: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Devices**. Select the **Management** tab. 2. In **Device enrollment permissions**, select **Manage**. 3. In the **Policies** tab, select **Create new policy**. A new tab will open with the policy creation page. 4. For **Action**, select *Service Auth*. 5. For the **Selector** field, you have two options: you can either allow all service tokens ( `Any Access Service Token`) or specific service tokens ( `Service Token`). For example: | Rule Action | Rule type | Selector | Value | | --- | --- | --- | --- | | Service Auth | Include | Service Token | `` | 6. Save the policy. 7. Go back to **Device enrollment permissions** and add the newly created policy to your permissions. 8. Select **Save**. To configure service-token enrollment with Terraform, refer to [Check for a service token](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/#check-for-service-token). ## 3. Create an installation script You can use a shell script to automate WARP installation and registration. The following example shows how to deploy the Cloudflare One Client on Ubuntu 24.04. 1. In a terminal, create a new `.sh` file using a text editor. For example: ```sh umask 077 vim install_warp.sh ``` 2. Press `i` to enter insert mode and add the following lines: ```bash #!/bin/bash set -e # Download and install the Cloudflare One Client function warp() { curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list sudo apt-get update --assume-yes sudo apt-get install --assume-yes cloudflare-warp } # Create an MDM file with your Cloudflare One Client deployment parameters function mdm() { sudo install -m 600 /dev/null /var/lib/cloudflare-warp/mdm.xml sudo tee /var/lib/cloudflare-warp/mdm.xml > /dev/null << "EOF" auth_client_id YOUR_CLIENT_ID auth_client_secret YOUR_CLIENT_SECRET auto_connect 1 onboarding organization your-team-name service_mode warp EOF } #main program warp mdm sudo systemctl restart warp-svc ``` 3. If you are using Debian or RHEL / CentOS, modify the `warp()` function so that it installs the correct [WARP package ↗︎](https://pkg.cloudflareclient.com/) for your OS. 4. Modify the values in the `mdm()` function: 1. For `auth_client_id` and `auth_client_secret`, replace the string values with the Client ID and Client Secret of your [service token](https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/#1-create-a-service-token). 2. For `organization`, replace `your-team-name` with your Zero Trust team name. 3. (Optional) Add or modify other [Cloudflare One Client deployment parameters](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/) according to your preferences. 5. Press `esc`, then type `:x` and press `Enter` to save and exit. ## 4. Install WARP To install the Cloudflare One Client using the example script: 1. Make the script executable: ```sh chmod 700 install_warp.sh ``` 2. Run the script: ```sh sudo ./install_warp.sh ``` 3. Delete the script because it contains the service token secret: ```sh rm install_warp.sh ``` The Cloudflare One Client is now deployed with the configuration parameters stored in the root-only `/var/lib/cloudflare-warp/mdm.xml`. Assuming [`auto_connect`](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#auto_connect) is configured, the Cloudflare One Client will automatically connect to your Zero Trust organization. Verify registration and connection: ```sh sudo warp-cli --accept-tos registration show sudo warp-cli --accept-tos status ``` Successful enrollment creates a device in **Zero Trust** > **Team & Resources** > **Devices** with the email `non_identity@.cloudflareaccess.com`. Verify that `status` reports `Connected`. A command completion or HTTP redirect alone does not prove registration or connectivity. The registration and status commands verify enrollment and the connection to Cloudflare. To verify end-to-end traffic, connect to an included destination using the protocol you intend to use. For Cloudflare Mesh, follow [Verify connectivity](https://developers.cloudflare.com/mesh/guides/connect-client-devices/#2-verify-connectivity). If the client reports `Registration Missing due to: Does not exist in API`, or the `warp-svc` logs show an HTTP `400` enrollment response, enrollment failed. Confirm that the service token policy uses the *Service Auth* action, the policy is attached to device enrollment permissions, and the MDM team name and token values are correct. After correcting or confirming the configuration, restart the service and repeat both verification commands: ```sh sudo systemctl restart warp-svc sudo warp-cli --accept-tos registration show sudo warp-cli --accept-tos status ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/#page","headline":"Deploy the Cloudflare One Client on headless Linux machines","description":"This tutorial explains how to deploy the Cloudflare One Client on headless Linux devices using a service token and an installation script.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/deploy-client-headless-linux/og.png?v=d28d8095b38b7468","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Linux"]} ``` --- --- description: Configure Gateway resolver policies to route DNS queries to region-specific private DNS servers, enabling geo-steering for internal resources across multiple locations. title: Implement regional private DNS servers with Gateway resolver policies image: https://developers.cloudflare.com/cloudflare-one/tutorials/regional-private-dns-resolver-policies/og.png?v=8a057daf93357048 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Implement regional private DNS servers with Gateway resolver policies Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/regional-private-dns-resolver-policies/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Gateway resolver policies allow you to route DNS queries to custom DNS resolvers based on various criteria. This tutorial demonstrates how to configure region-specific private DNS servers to ensure your users are directed to the closest internal resources based on their geographic location. This approach is particularly useful for organizations with internal networks spanning multiple locations where DNS routes and manages access to private network resources. By the end of this tutorial, you will have configured Gateway resolver policies to automatically route DNS queries to region-specific private DNS servers based on user location, providing optimal performance and access to internal resources. This tutorial uses US and EU region servers as example private DNS servers. ## Prerequisites Before you begin, make sure you have: - An Enterprise Zero Trust account - Private DNS servers deployed in multiple regions (for example, US, EU, and APAC) - A [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) connecting your private DNS servers to Cloudflare - Internal domains that need to be resolved (for example, `internal.example.com`) ## 1. Connect private DNS servers with Cloudflare Tunnel First, connect your regional private DNS servers to Cloudflare using Cloudflare Tunnel. For each region where you have a private DNS server, [create a tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#1-create-a-tunnel). For each tunnel, [add the private IP addresses](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/#2-add-private-network-routes) of your DNS servers. For example, `10.0.1.53/32` for the US region and `10.1.1.53/32` for the EU region. Repeat this process for all regional DNS servers. ## 2. Create Gateway resolver policies for each region Once your private DNS servers are connected to Cloudflare, configure Gateway resolver policies to route DNS queries to the appropriate regional DNS server based on user location. ### Create resolver policies for each region For each region where you have a private DNS server: 1. Go to **Traffic policies** > **Resolver policies**. 2. Select **Add a policy**. 3. Name your policy based on the region (for example, `US Internal DNS`). 4. Create an expression to match internal domains and users in that region. For example, to match users in the United States: | Selector | Operator | Value | Logic | | --- | --- | --- | --- | | Domain | in | `internal.example.com` | And | | Source Country IP Geolocation | in | *United States* | | 5. In **Select DNS resolver**, select *Configure custom DNS resolvers*. 6. Enter the private IP address of your regional DNS server (for example, `10.0.1.53` for US or `10.1.1.53` for EU). 7. In the dropdown menu, choose *` - Private`*. 8. (Optional) Select **Add DNS resolver** and enter a secondary IP address to add a backup DNS resolver. 9. Select **Create policy**. 10. Repeat steps 1-9 for each region where you have a private DNS server. For example, to create a policy to match users in the EU region: | Selector | Operator | Value | Logic | | --- | --- | --- | --- | | Domain | in | `internal.example.com` | And | | Source Country IP Geolocation | in | *Austria*, *Belgium*, *France*, *Germany*, *Netherlands* | | ### Create a fallback resolver policy Create a catch-all policy for users in regions without a dedicated DNS server, or if no policies match your traffic: 1. Go to **Traffic policies** > **Resolver policies**. 2. Select **Add a policy**. 3. Name your policy (for example, `Internal DNS Fallback`). 4. Create an expression to match internal domains: | Selector | Operator | Value | | --- | --- | --- | | Domain | in | `internal.example.com` | 5. In **Select DNS resolver**, select *Configure custom DNS resolvers*. 6. Enter the private IP address of your primary DNS server. 7. Select **Create policy**. ## 3. Configure policy order Gateway will apply resolver policies based on [order of precedence](https://developers.cloudflare.com/cloudflare-one/traffic-controls/order-of-enforcement/#order-of-precedence). Ensure your policies are ordered from most specific to least specific: 1. Go to **Traffic policies** > **Resolver policies**. 2. Use the drag handle to reorder policies: - Resolver policies with regional coverage first - Your fallback resolver policy last Gateway will apply the first matching policy. If no policies match your traffic, Gateway will apply the fallback resolver policy. The order between resolver policies with regional coverage does not matter. ## 4. Test your configuration ### Test from different regions To test your configuration, deploy the Cloudflare One Client on a device in each region where you have a private DNS server and run a DNS query to an internal domain. For example, to test the US region: 1. [Deploy the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/) on a device in the US region. 2. From the device, open a terminal and run: ```sh nslookup internal.example.com ``` 3. Verify that the DNS query returns the expected IP address for your internal resource. The response should show the IP address that your US DNS server is configured to return for `internal.example.com`. 4. Repeat the test from devices in other regions to confirm they receive responses from their respective regional DNS servers. Each region may return different IP addresses based on your DNS server configuration. ### Verify in Gateway logs 1. Go to **Insights** > **Logs** > **DNS query logs**. 2. Filter for queries to `internal.example.com`. 3. Check the **Resolver IP** field to confirm queries are being routed to the correct regional DNS servers based on user location. ## Best practices - **Use backup resolvers**: Configure secondary DNS resolvers for each region to ensure high availability. - **Monitor DNS performance**: Use [Gateway Analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/gateway/) to track DNS query performance and identify any issues with regional routing. - **Implement network policies**: Combine resolver policies with [network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) to control access to internal resources based on user identity and device posture. - **Consider virtual networks**: If you have overlapping IP address spaces across regions, use [virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) to isolate traffic. - **Test failover scenarios**: Regularly test what happens when a regional DNS server becomes unavailable to ensure your backup resolvers work as expected. ## Related resources - [Resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) - [Connect private networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) - [Gateway Analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/gateway/) - [Virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/regional-private-dns-resolver-policies/#page","headline":"Implement regional private DNS servers with Gateway resolver policies","description":"Configure Gateway resolver policies to route DNS queries to region-specific private DNS servers, enabling geo-steering for internal resources across multiple locations.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/regional-private-dns-resolver-policies/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/regional-private-dns-resolver-policies/og.png?v=8a057daf93357048","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["DNS","Geolocation","Private networks"]} ``` --- --- description: With an MCAS API call, you can manage a URL category that contains the blocked URLs. Use the output to create a Hostname List that can be used by Gateway HTTP policies to block them. title: Integrate Microsoft MCAS with Cloudflare Zero Trust image: https://developers.cloudflare.com/cloudflare-one/tutorials/integrate-microsoft-mcas-teams/og.png?v=0dca691f3d53a0cd --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Microsoft MCAS with Cloudflare Zero Trust Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/integrate-microsoft-mcas-teams/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Many security teams rely on Microsoft MCAS (Microsoft Cloud App Security), Microsoft's CASB solution, to identify and block threats on the Internet, as well as allow or block access to cloud applications. This tutorial covers how to integrate MCAS with Cloudflare Zero Trust, and create Gateway HTTP policies to ensure visibility and control over data. Microsoft provides an MCAS API endpoint to allow queries to see which applications have been marked as blocked or allowed. With an MCAS API call, you can manage a URL category that contains the blocked URLs returned by the API query, and use the output to create a Hostname List that can be used by Gateway HTTP policies to block them. **Time to complete:** 20 minutes ## Basic configuration In your Microsoft account, you first need to create an API token and URL endpoint to use to query the URLs blocked by MCAS. Follow the guide for [Managing API tokens for Microsoft Cloud App Security ↗︎](https://learn.microsoft.com/defender-cloud-apps/api-authentication) to generate a new API token and a custom API URL for the API endpoint. ## Using the API to query banned applications Once you have the API token and API URL, use curl to get the list of banned applications from Microsoft MCAS: ```sh curl -v "https:///api/discovery_block_scripts/?format=120&type=banned" -H "Authorization: Token " ``` This will return a list of banned hostnames. In this case, Angie's List is the banned application. ![Banned hostnames](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1766,height=922,format=webp/_astro/mcas-domains.CtUPNlL_.png) ### Processing the output As you can see, the banned hostnames are preceded by a `.`. To use this output for a Zero Trust List, we need to do some text processing. 1. Run the curl API call and direct the output to a file, in this case `mcas.txt`: ```sh curl -v "https:///api/discovery_block_scripts/?format=120&type=banned" -H "Authorization: Token " > mcas.txt ``` 2. Remove the leading `.`, for example by running `sed` from the CLI: ```sh sed -i 's/^.//' mcas.txt ``` 3. This will give you the list of hostnames without leading `.`. 4. Replace the file's `.txt` extension with `.csv`. The file can now be imported into Cloudflare Zero Trust as a Hostname list. ## Using the API to query allowed applications If you would like to get a list of all of the MCAS allowed applications, you can use the same API query, but instead of using `type=banned`, use `type=allowed`. This will return a much larger list. ```sh curl -v "https:///api/discovery_block_scripts/?format=120&type=allowed" -H "Authorization: Token " ``` ## Adding a hostname list in Cloudflare One 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Reusable components** > **Lists** 2. Select **Upload CSV**. Even though the hostname list is not in CSV format, it will work with no issues. 3. Add a name for the list, specify *Hostnames* as the list type, and give it a description. 4. Drag and drop your MCAS output file created via the API call, or you can select **Select a file**. 5. Select **Create**. You will see the list of hostnames that have been added to the list. 6. Save the list. Your list is now ready to be referenced by Gateway HTTP policies. ## Creating an HTTP policy 1. Go to **Traffic policies** > **Traffic policies** > **HTTP**. 2. Select **Add a policy**. 3. Create the following policy. | Selector | Operator | Value | Action | | --- | --- | --- | --- | | Host | in list | \ | Block | Now when trying to visit one of the MCAS defined sites, the user will be blocked. ![Access Restricted](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1870,height=1128,format=webp/_astro/mcas-block-page.Bgzcx6ig.png) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/integrate-microsoft-mcas-teams/#page","headline":"Integrate Microsoft MCAS with Cloudflare Zero Trust","description":"With an MCAS API call, you can manage a URL category that contains the blocked URLs. Use the output to create a Hostname List that can be used by Gateway HTTP policies to block them.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/integrate-microsoft-mcas-teams/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/integrate-microsoft-mcas-teams/og.png?v=0dca691f3d53a0cd","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Microsoft"]} ``` --- --- description: Microsoft Entra ID (formerly Azure Active Directory) calculates a user's risk level based on the probability that their account has been compromised. With Cloudflare Zero Trust, you can synchronize the Entra ID risky users list with Cloudflare Access and apply more stringent Zero Trust policies to users at higher risk. title: Isolate risky Entra ID users image: https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-risky-users/og.png?v=369f02318800a6b5 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Isolate risky Entra ID users Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-risky-users/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Microsoft Entra ID (formerly Azure Active Directory) calculates a user's [risk level ↗︎](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-investigate-risk) based on the probability that their account has been compromised. With Cloudflare Zero Trust, you can synchronize the Entra ID risky users list with Cloudflare Access and apply more stringent Zero Trust policies to users at higher risk. This tutorial demonstrates how to automatically redirect users to a remote browser when they are deemed risky by Entra ID. **Time to complete:** 1 hour ## Prerequisites - Microsoft Entra ID Premium P2 license - [Cloudflare Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) add-on - [Gateway HTTP filtering](https://developers.cloudflare.com/cloudflare-one/traffic-controls/get-started/http/) enabled on your devices - [npm ↗︎](https://docs.npmjs.com/getting-started) installation - [Node.js ↗︎](https://nodejs.org/en/) installation ## 1. Set up Entra ID as an identity provider Refer to [our IdP setup instructions](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/entra-id/#set-up-entra-id-as-an-identity-provider) for Entra ID. Note - When you configure the IdP in Cloudflare One, be sure to select **Enable group membership change reauthentication**. - Save the **Application (client) ID**, **Directory (tenant) ID**, and **Client secret** as you will need them again in a later step. ## 2. Add Entra ID API permissions Once the base IdP integration is tested and working, enable additional permissions that will allow a script to create and update risky user groups in Entra ID: 1. In Microsoft Entra ID, go to **App registrations**. 2. Select the application you created for the IdP integration. 3. Go to **API permissions** and select **Add a permission**. 4. Select **Microsoft Graph**. 5. Select **Application permissions** and add the following [permissions ↗︎](https://learn.microsoft.com/en-us/graph/permissions-reference): - `IdentityRiskyUser.ReadAll` - `Directory.ReadWriteAll` - `Group.Create` - `Group.ReadAll` - `GroupMember.ReadAll` - `GroupMember.ReadWriteAll` 6. Select **Grant admin consent**. You will see the list of enabled permissions. ![API permissions in Entra ID](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1057,height=628,format=webp/_astro/risky-users-permissions.BXnsnrQO.png) ## 3. Add risky users to Entra ID group Next, configure an automated script that will populate an Entra ID security group with risky users. To get started quickly, deploy our example Cloudflare Workers script by following the step-by-step instructions below. Alternatively, you can implement the script using [Azure Functions ↗︎](https://learn.microsoft.com/azure/azure-functions/functions-overview) or any other tool. 1. Open a terminal and clone our example project. ```sh npm create cloudflare@latest risky-users -- --template https://github.com/cloudflare/msft-risky-user-ad-sync ``` 2. Go to the project directory. ```sh cd risky-users ``` 3. Modify the [Wrangler configuration file](https://developers.cloudflare.com/workers/wrangler/configuration/) to include the following values: - ``: your Cloudflare [account ID](https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/). - ``: your Entra ID **Directory (tenant) ID**, obtained when [setting up Entra ID as an identity provider](#1-set-up-entra-id-as-an-identity-provider). - ``: your Entra ID **Application (client) ID**, obtained when [setting up Entra ID as an identity provider](#1-set-up-entra-id-as-an-identity-provider). ```jsonc { "$schema": "./node_modules/wrangler/config-schema.json", "name": "risky-users", // Set this to today's date "compatibility_date": "2026-10-19", "main": "src/index.js", "upload_source_maps": true, "workers_dev": false, "account_id": "", "vars": { "AZURE_AD_TENANT_ID": "", "AZURE_AD_CLIENT_ID": "", }, "triggers": { "crons": ["* * * * *"], }, } ``` ```toml "$schema" = "./node_modules/wrangler/config-schema.json" name = "risky-users" # Set this to today's date compatibility_date = "2026-10-19" main = "src/index.js" upload_source_maps = true workers_dev = false account_id = "" [vars] AZURE_AD_TENANT_ID = "" AZURE_AD_CLIENT_ID = "" [triggers] crons = [ "* * * * *" ] ``` Note The [Cron Trigger](https://developers.cloudflare.com/workers/configuration/cron-triggers/) in this example schedules the script to run every minute. Learn more about [supported cron expressions](https://developers.cloudflare.com/workers/configuration/cron-triggers/#supported-cron-expressions). 4. Deploy the Worker to Cloudflare's global network. ```sh npx wrangler deploy ``` 5. Create a secret variable named `AZURE_AD_CLIENT_SECRET`. ```sh wrangler secret put AZURE_AD_CLIENT_SECRET ``` You will be prompted to input the secret's value. Enter the **Client secret** obtained when [setting up Microsoft Entra ID as an identity provider](#1-set-up-azure-ad-as-an-identity-provider). The Worker script will begin executing once per minute. To view realtime logs, run the following command and wait for the script to execute: ```sh wrangler tail --format pretty ``` After the initial run, the auto-generated groups will appear in the Entra ID dashboard. ![Risky user groups in the Entra ID dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1444,height=432,format=webp/_astro/risky-users-groups.DdF4Xs9Y.png) ## 4. Synchronize risky user groups Next, synchronize Entra ID risky user groups with Cloudflare Access: 1. [Enable SCIM synchronization](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/entra-id/#synchronize-users-and-groups). 2. In Entra ID, assign the following groups to your SCIM enterprise application: - `IdentityProtection-RiskyUser-RiskLevel-high` - `IdentityProtection-RiskyUser-RiskLevel-medium` - `IdentityProtection-RiskyUser-RiskLevel-low` Cloudflare Access will now synchronize changes in group membership with Entra ID. You can verify the synchronization status on the SCIM application's **Provisioning** page. ## 5. Create a browser isolation policy Finally, create a [Gateway HTTP policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) to isolate traffic for risky user groups. 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Traffic policies** > **Firewall policies** > **HTTP**. 2. Select **Add a policy**. 3. Build an [Isolate policy](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/) that contains a *User Group Names* rule. For example, the following policy serves `app1.example.com` and `app2.example.com` in a remote browser for all members flagged as high risk: | Selector | Operator | Value | Logic | Action | | --- | --- | --- | --- | --- | | Domain | in | `app1.example.com`, `app2.example.com` | And | Isolate | | User Group Names | in | `IdentityProtection-RiskyUser-RiskLevel-high` | | | To test the policy, refer to the Microsoft documentation for [simulating risky detections ↗︎](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-simulate-risk). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-risky-users/#page","headline":"Isolate risky Entra ID users","description":"Microsoft Entra ID (formerly Azure Active Directory) calculates a user's risk level based on the probability that their account has been compromised. With Cloudflare Zero Trust, you can synchronize the Entra ID risky users list with Cloudflare Access and apply more stringent Zero Trust policies to users at higher risk.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-risky-users/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-risky-users/og.png?v=369f02318800a6b5","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Microsoft Entra ID","SCIM"]} ``` --- --- description: You can build Zero Trust rules to secure connections to MongoDB deployments using Cloudflare Access and Cloudflared Tunnel. title: MongoDB SSH image: https://developers.cloudflare.com/cloudflare-one/tutorials/mongodb-tunnel/og.png?v=b8e4a862129a0658 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # MongoDB SSH Last updated Jun 5, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/mongodb-tunnel/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can build Zero Trust rules to secure connections to MongoDB deployments using Cloudflare Access and Cloudflare Tunnel. Cloudflare Tunnel requires a lightweight daemon, `cloudflared`, running alongside the deployment and as on the client side. In this tutorial, a client running `cloudflared` connects over SSH to a MongoDB deployment running on Kubernetes. The deployment example is structured to connect [Compass ↗︎](https://www.mongodb.com/products/compass) to the MongoDB instance. The MongoDB Kubernetes deployment runs both the MongoDB database service and `cloudflared` as a ingress service that operates like a jump host. **This tutorial covers how to:** - Create a Cloudflare Access rule to secure a MongoDB deployment - Configure a StatefulSet and service definition for the deployment - Configure an Cloudflare Tunnel connection to Cloudflare's edge - Create an SSH configuration file for the client **Time to complete:** 50 minutes --- ## Configure Cloudflare Access You can build a rule in Cloudflare Access to control who can connect to your MongoDB deployment. Cloudflare Access rules are built around a hostname; even though this deployment will be accessible over SSH, the resource will be represented in Cloudflare as a hostname. For example, if you have the website `app.com` in your Cloudflare account, you can build a rule to secure `mongodb.app.com`. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Applications**. 2. Select **Create new application**. 3. Select **Self-hosted and private**. 4. Select **Add public hostname** and enter the subdomain where users will connect to your deployment (for example, `mongodb.app.com`). 5. Add [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) to control who can reach the deployment. You can build a policy that allows anyone in your organization to connect or you can build more granular policies based on signals like identity provider groups, [multifactor method](https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/), or [country](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/groups/). 6. Follow the remaining [self-hosted application creation steps](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to publish the application. ## Configure the Kubernetes deployment To be accessible over SSH, the Kubernetes deployment should manage both the MongoDB standalone service and an SSH proxy service. The configuration below will deploy 1 replica of the database service, available at port 27017, as well as an SSH proxy available at port 22.
StatefulSet Configuration ```yaml apiVersion: apps/v1 kind: StatefulSet metadata: name: mongodb-standalone namespace: mongodb spec: serviceName: database replicas: 1 selector: matchLabels: app: database template: metadata: labels: app: database selector: mongodb-standalone spec: containers: - name: mongodb-standalone image: mongo command: ["mongod"] args: ["--config=/config/mongod.conf"] ports: - containerPort: 27017 protocol: TCP name: mongod volumeMounts: - name: mongodb-conf mountPath: /config readOnly: true - name: mongodb-data mountPath: /data/db - name: tls mountPath: /etc/tls - name: mongodb-socket mountPath: /socket - name: ssh-proxy image: ubuntu:20.04 command: ["/scripts/entrypoint.sh"] ports: - containerPort: 22 protocol: TCP name: ssh-port volumeMounts: - name: mongodb-socket mountPath: /socket - name: scripts mountPath: /scripts readOnly: true - name: ssh-authorized-keys mountPath: /config/ssh readOnly: true resources: requests: cpu: 20m memory: 32Mi volumes: - name: mongodb-socket emptyDir: {} - name: mongodb-conf configMap: name: mongodb-standalone items: - key: mongod.conf path: mongod.conf - name: tls secret: secretName: tls - name: mongodb-data persistentVolumeClaim: claimName: mongodb-standalone - name: scripts configMap: name: scripts items: - key: entrypoint.sh path: entrypoint.sh mode: 0744 - name: ssh-authorized-keys configMap: name: ssh-proxy-config items: - key: authorized_keys path: authorized_keys mode: 0400 ```
The corresponding service definition should also specify the ports and target ports for the containers (in this case, the database service and the SSH proxy service).
Service Definition ```yaml apiVersion: v1 kind: Service metadata: name: database namespace: mongodb labels: app: database spec: clusterIP: None selector: app: database ports: - protocol: TCP port: 27017 targetPort: 27017 --- apiVersion: v1 kind: Service metadata: name: ssh-proxy namespace: mongodb labels: app: database spec: selector: app: database ports: - protocol: TCP port: 22 targetPort: 22 ```
The MongoDB pod and the SSH jump host will share a Unix socket over an empty directory volume. The `entrypoint.sh` file run by the jump host, example below, will start an OpenSSH server. ```bash #!/bin/sh export TZ=America/Chicago ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone apt-get update -y && apt-get install -y openssh-server mkdir /root/.ssh cp /config/ssh/authorized_keys /root/.ssh/authorized_keys chmod 400 /root/.ssh/authorized_keys service ssh start while true; do sleep 30; done; ``` ## Configure Cloudflare Tunnel Next, you can use `cloudflared` to connect to Cloudflare's Edge using Cloudflare Tunnel. Start by [downloading and installing](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/) the Cloudflare Tunnel daemon, `cloudflared`. Once installed, run the following command to authenticate the instance of `cloudflared` into your Cloudflare account. ```sh cloudflared login ``` The command will launch a browser window and prompt you to login with your Cloudflare account. Choose a website that you have added into your account. Once you select one of the sites in your account, Cloudflare will download a certificate file, called `cert.pem` to authenticate this instance of `cloudflared`. The `cert.pem` file uses a certificate to authenticate your instance of `cloudflared` and includes an API key for your account to perform actions like DNS record changes. You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account. ![Download Certificate](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=682,height=477,format=webp/_astro/cert-download.CzGYlCAx.png) ### Create a Tunnel You can now [create a Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/create-local-tunnel/) that will connect `cloudflared` to Cloudflare's edge. You'll configure the details of that Tunnel in the next step. Run the following command to create a Tunnel. You can replace `mongodb` with any name that you choose. This command requires the `cert.pem` file. `cloudflared tunnel create mongodb` Cloudflare will create the Tunnel with that name and generate an ID and credentials file for that Tunnel. ![New Tunnel](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1364,height=954,format=webp/_astro/create.2q9ua5Ht.png) ### Delete the `cert.pem` file The credentials file is separate from the `cert.pem` file. Unlike the `cert.pem` file, the credentials file consists of a token that authenticates only the Named Tunnel you just created. Formatted as `JSON`, the file cannot make changes to your Cloudflare account or create additional Tunnels. If you are done creating Tunnels, you can delete the `cert.pem` file, leave only the credentials file, and continue to manage DNS records directly in the Cloudflare dashboard or API. For additional information on the different functions of the two files, refer to the list of [useful terms](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#certpem). Store the `JSON` file as a Kubernetes secret. ### Configure Cloudflare Tunnel The previous setps used `cloudflared` to generate a credentials file for your Cloudflare account. When run as a service alongside the MongoDB Kubernetes deployment you will need to use a Docker image of `cloudflared`. Cloudflare makes an [official image available ↗︎](https://hub.docker.com/r/cloudflare/cloudflared) in DockerHub. The configuration below will run a single replica of `cloudflared` as an ingress point alongside the MongoDB and SSH proxy services. `cloudflared` will proxy traffic to the SSH proxy service. The `cloudflared` instance will run as its own deployment in a different namespace and, if network policy allows, ingress to any service in the Kubernetes node.
cloudflared Configuration ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: dashboard-tunnel namespace: argotunnel labels: app: dashboard-tunnel spec: replicas: 1 selector: matchLabels: app: dashboard-tunnel template: metadata: labels: app: dashboard-tunnel spec: containers: - name: dashboard-tunnel # Image from https://hub.docker.com/r/cloudflare/cloudflared image: cloudflare/cloudflared:2020.11.11 command: ["cloudflared", "tunnel"] args: ["--config", "/etc/tunnel/config.yaml", "run"] ports: - containerPort: 5000 livenessProbe: tcpSocket: port: 5000 initialDelaySeconds: 60 periodSeconds: 60 volumeMounts: - name: dashboard-tunnel-config mountPath: /etc/tunnel - name: tunnel-credentials mountPath: /etc/credentials volumes: - name: dashboard-tunnel-config configMap: name: dashboard-tunnel-config - name: tunnel-credentials secret: secretName: tunnel-credentials --- apiVersion: v1 kind: ConfigMap metadata: name: dashboard-tunnel-config namespace: argotunnel data: config.yaml: | tunnel: 9a00ef26-4997-4de2-83db-631efc74245c credentials-file: /etc/credentials/k8s-dashboard.json metrics: :5000 protocol: http2 no-autoupdate: true ingress: - hostname: mongodb.widgetcorp.tech originRequest: bastionMode: true - service: http_status:404 ```
## Connect from a client Once deployed, you can run `cloudflared` on the client side to connect to the MongoDB deployment. Add the following lines to your SSH configuration file, replacing the examples with your hostname and details. The `--destination` value should match the URL of the SSH Proxy service configured previously. ```bash Host mongodb ProxyCommand /usr/local/bin/cloudflared access ssh --hostname mongodb.widgetcorp.tech --destination ssh-proxy.mongodb.svc.cluster.local:22 LocalForward 27000 /socket/mongodb-27017.sock User root IdentityFile /Users/username/.ssh/id_rsa ``` This is a one-time step. When you next attempt to make an SSH connection to the deployment, `cloudflared` will launch a browser window and prompt you to authenticate. Once authenticated, you will be connected if you have a valid session. Once the tunnel is established, all requests to `localhost:27000` on your machine will be forwarded to `/socket/mongodb-27017.sock` on the SSH proxy container. You can then set MongoDB Compass to connect to `localhost:27000`. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/mongodb-tunnel/#page","headline":"MongoDB SSH","description":"You can build Zero Trust rules to secure connections to MongoDB deployments using Cloudflare Access and Cloudflared Tunnel.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/mongodb-tunnel/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/mongodb-tunnel/og.png?v=b8e4a862129a0658","dateModified":"2026-06-05","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["MongoDB","SSH","Kubernetes"]} ``` --- --- description: This tutorial covers how to create the metrics endpoint and set up the Prometheus server. title: Monitor Cloudflare Tunnel with Grafana image: https://developers.cloudflare.com/cloudflare-one/tutorials/grafana/og.png?v=745705bdce06f922 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Monitor Cloudflare Tunnel with Grafana Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/grafana/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Grafana ↗︎](https://grafana.com/) is a dashboard tool that visualizes data stored in other databases. You can use Grafana to convert your [tunnel metrics](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/) into actionable insights. It is not possible to push metrics directly from `cloudflared` to Grafana. Instead, `cloudflared` runs a [Prometheus ↗︎](https://prometheus.io) metrics endpoint, which a Prometheus server periodically scrapes. Grafana then uses Prometheus as a data source to present metrics to the administrator. ``` flowchart LR subgraph 192.168.1.1 A[cloudflared]-->B[Metrics endpoint] end B--->C subgraph 192.168.1.2 C[Prometheus server]-->D[Grafana dashboard] end ``` This tutorial covers how to create the metrics endpoint, set up the Prometheus server, and view the data in Grafana. ## Before you begin - You will need a Cloudflare Tunnel. To create a tunnel, refer to our [getting started guide](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/). ## Create the metrics endpoint If your tunnel was created via the CLI, run the following command on the `cloudflared` server (`192.168.1.1`): ```sh cloudflared tunnel --metrics 192.168.1.1:60123 run my-tunnel ``` If your tunnel was created via the dashboard, the [`--metrics`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#metrics) flag must be added to your `cloudflared` system service configuration. Refer to [Add tunnel run parameters](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#add-run-parameters-to-tunnel-service) for instructions on how to do this. ## Set up Prometheus On the Prometheus and Grafana server (`192.168.1.2`): 1. [Download ↗︎](https://prometheus.io/download/) Prometheus. 2. Extract Prometheus: ```sh tar xvfz prometheus-*.tar.gz cd prometheus-* ``` 3. Open `prometheus.yml` in a text editor and add the `cloudflared` job to the end of the file: ```yml # my global config global: scrape_interval: 15s # Set the scrape interval to every 15 seconds. Default is every 1 minute. evaluation_interval: 15s # Evaluate rules every 15 seconds. The default is every 1 minute. # scrape_timeout is set to the global default (10s). # Alertmanager configuration alerting: alertmanagers: - static_configs: - targets: # - alertmanager:9093 # Load rules once and periodically evaluate them according to the global 'evaluation_interval'. rule_files: # - "first_rules.yml" # - "second_rules.yml" # A scrape configuration containing exactly one endpoint to scrape: # Here it's Prometheus itself. scrape_configs: # The job name is added as a label `job=` to any timeseries scraped from this config. - job_name: "prometheus" # metrics_path defaults to '/metrics' # scheme defaults to 'http'. static_configs: - targets: ["localhost:9090"] ## Address of Prometheus dashboard - job_name: "cloudflared" static_configs: - targets: ["198.168.1.1:60123"] ## cloudflared server IP and the --metrics port configured for the tunnel ``` 4. Start Prometheus: ```sh ./prometheus --config.file="prometheus.yml" ``` You can optionally configure Prometheus to run as a service so that it does not need to be manually started if the machine reboots. 5. Open a browser and go to `http://localhost:9090/`. You should be able to access the Prometheus dashboard. 6. To verify that Prometheus is fetching tunnel metrics, enter `cloudflared_tunnel_total_requests` into the expression console and select **Execute**.![Prometheus dashboard showing tunnel metrics data](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2264,height=773,format=webp/_astro/Prometheus-dashboard.CUKRS856.png) Refer to [Available metrics](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/metrics/#available-metrics) to check what other metrics are available. ## Connect Grafana to Prometheus 1. [Download ↗︎](https://grafana.com/grafana/download) and install Grafana. 2. Start Grafana as a system service: ```sh sudo systemctl daemon-reload sudo systemctl start grafana-server ``` 3. Verify that Grafana is running: ```sh sudo systemctl status grafana-server ``` 4. Open a browser and go to `http://localhost:3000/`. The default HTTP port that Grafana listens to is `3000` unless you have configured a different port. 5. On the sign-in page, enter your Grafana credentials. To test without an account, you can enter `admin` for both the username and password and skip the password change step. 6. In Grafana, go to **Connections** > **Data sources**. 7. Select **Add a new data source** and select **Prometheus**. 8. In the **Prometheus server URL** field, enter the IP address and port of your Prometheus dashboard ( `http://localhost:9090`). 9. Select **Save & test**. ## Build Grafana dashboard 1. In Grafana, go to **Dashboards** > **New** > **New dashboard**. 2. Select **Add visualization**. 3. Select **Prometheus**. 4. In the metrics field, enter `cloudflared_tunnel_total_requests` and select **Run queries**. You will see a graph showing the number of requests as a function of time. ![Grafana dashboard showing a tunnel metrics graph](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2268,height=1872,format=webp/_astro/Grafana-dashboard.Bz0eyO9h.png) You can add operations to the queries to modify what is displayed. For example, you could show all tunnel requests over a recent period of time, such as a day, rather than all tunnel requests since metrics began reporting. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/grafana/#page","headline":"Monitor Cloudflare Tunnel with Grafana","description":"This tutorial covers how to create the metrics endpoint and set up the Prometheus server.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/grafana/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/grafana/og.png?v=745705bdce06f922","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Grafana"]} ``` --- --- description: This tutorial demonstrates how to secure access to Amazon S3 buckets with Cloudflare Zero Trust so that data in these buckets is not publicly exposed on the Internet. title: Protect access to Amazon S3 buckets with Cloudflare Zero Trust image: https://developers.cloudflare.com/cloudflare-one/tutorials/s3-buckets/og.png?v=de1e7947eab69dc1 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Protect access to Amazon S3 buckets with Cloudflare Zero Trust Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/s3-buckets/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial demonstrates how to secure access to Amazon S3 buckets with Cloudflare Zero Trust so that data in these buckets is not publicly exposed on the Internet. You can combine Cloudflare Access and AWS VPC endpoints. Enterprise may also use Cloudflare Gateway egress policies with dedicated egress IPs. ## Method 1: Via Cloudflare Access and VPC endpoints ``` flowchart TB cf1[/Cloudflare One Client or clientless users/]--Access policy-->cf2{{Cloudflare}} cf2--Cloudflare Tunnel-->vpc1 subgraph VPC vpc1[EC2 VM]-->vpc2[VPC endpoint] end vpc2-->s3_1 subgraph S3 service s3_1([S3 bucket]) end i1[/Users outside
Zero Trust/]-. "S3 access denied" .->s3_1 ``` ### Prerequisites - S3 bucket to be protected by Cloudflare Zero Trust - AWS VPC with one EC2 virtual machine (VM) hosting the [Cloudflare Tunnel daemon](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) - S3 bucket and AWS VPC configured in the same [AWS region ↗︎](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html) ### 1. Create a VPC endpoint in AWS 1. In the [AWS dashboard ↗︎](https://aws.amazon.com/console/), go to **Services** > **Networking & Content Delivery** > **VPC**. 2. Under **Virtual private cloud**, go to **Endpoints**. 3. Select **Create endpoint** and name the endpoint. 4. Choose *AWS services* as the service category. 5. In **Services**, search and select the S3 service in the same region of the VPC. For example, for the AWS region **Europe (London) - eu-west-2**, the corresponding S3 service is named `com.amazonaws.eu-west-2.s3` with a type of Gateway. 6. In **VPC**, select your VPC that contains the EC2 VM hosting the Cloudflare tunnel daemon. 7. In **Route tables**, select the route table associated with the VPC. 8. In **Policy**, choose *Full access*. 9. Select **Create endpoint**. After you create the VPC endpoint, a new entry in the VPC route table with the target being your VPC endpoint. The entry will have the format `vpce-xxxxxxxxxxxxxxxxx`. ### 2. Set up a bucket policy for VPC access 1. Go to **Services** > **Storage** > **S3**. 2. In Amazon S3, go to **Buckets** > **\** > **Permissions**. 3. Disable **Block all public access**. 4. In **Bucket policy**, add the following policy: ```json { "Version": "2012-10-17", "Id": "VPCe", "Statement": [ { "Sid": "VPCe", "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::", "arn:aws:s3:::/*" ], "Condition": { "StringEquals": { "aws:SourceVpce": "" } } } ] } ``` Your bucket policy will allow your VPC to access your S3 bucket. ### 3. Enable static website hosting for the S3 bucket 1. Return to Amazon S3, then go to **Buckets** > **\** > **Properties**. 2. In **Static website hosting**, select **Edit**. 3. Enable **Static website hosting**. 4. Specify the Index and Error documents for the S3 bucket. 5. Select **Save changes**. A bucket website endpoint will be available at `http://.s3-website..amazonaws.com`. Because of the bucket policy, this website endpoint will only be accessible from the VPC with the VPC endpoint configured. ### 4. Add a published application to the Cloudflare Tunnel 1. In the Cloudflare dashboard, go to **Networking** > **Tunnels**. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) 2. Select your tunnel, then go to the **Routes** tab. 3. Select **Add route**, then select **Published application**. 4. Enter a subdomain your organization will use to access the S3 bucket. For example, `s3-bucket..com`. 5. In **Service URL**, enter `http://.s3-website..amazonaws.com`. 6. In **Additional application settings** > **HTTP Settings**, input the **HTTP Host Header** as `.s3-website..amazonaws.com`. 7. Select **Save hostname**. Your Cloudflare Tunnel will terminate at the AWS VPC using your public hostname. ### 5. Restrict S3 access with an Access policy 1. Go to **Access controls** > **Applications**. 2. Select **Create new application**. 3. Select **Self-hosted and private**. 4. Select **Add public hostname** and enter the public hostname used by your Tunnel. For example, `s3-bucket..com`. 5. Add [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) to determine which users and applications may access your bucket. You can optionally create a [service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) policy to automatically authenticate access to your S3 bucket. 6. Follow the remaining [self-hosted application creation steps](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to publish the application. Users and applications that successfully authenticate via Cloudflare Access can access your S3 bucket at `https://s3-bucket..com`. ## Method 2: Via Cloudflare Gateway egress policies Note This method is only available on Enterprise plans. ``` flowchart TB cf1[/Cloudflare One Client users/]--Egress policy-->cf2{{Cloudflare}} cf2--Egress with dedicated IP-->i1[Internet] i1-->s3_1 subgraph S3 Service s3_1([S3 bucket]) end i2[/Users outside
Zero Trust/]-. "IPs denied" .->s3_1 ``` ### Prerequisites - Cloudflare Zero Trust account with [dedicated egress IPs](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) - S3 bucket to be protected by Cloudflare Zero Trust ### 1. Set up a bucket policy to restrict access to a specific IP address 1. In the [AWS dashboard ↗︎](https://aws.amazon.com/console/), go to **Services** > **Storage** > **S3**. 2. Go to **Buckets** > **\** > **Permissions**. 3. Disable **Block all public access**. 4. In **Bucket policy**, add the following policy: ```json { "Version": "2012-10-17", "Id": "SourceIP", "Statement": [ { "Sid": "SourceIP", "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::", "arn:aws:s3:::/*" ], "Condition": { "IpAddress": { "aws:SourceIp": "/32" } } } ] } ``` ### 2. Enable static website hosting for the S3 bucket 1. Return to your bucket, then go to **Properties**. 2. In **Static website hosting**, select **Edit**. 3. Enable **Static website hosting**. 4. Specify the Index and Error documents for the S3 bucket. 5. Select **Save changes**. A bucket website endpoint will be available at `http://.s3-website..amazonaws.com`. Because of the bucket policy, the website endpoint will only be accessible to traffic sourced from the dedicated egress IP specified. ### 3. Setup a dedicated egress IP policy 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Egress policies**. Select **Add a policy**. 2. Create a policy that specifies which proxied traffic Gateway should assign a [dedicated egress IP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) to. For more information, refer to [Egress policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/). 3. In **Select an egress IP**, choose *Use dedicated Cloudflare egress IPs*. Select the dedicated egress IP defined in your bucket policy. 4. Select **Create policy**. Traffic proxied by Gateway and assigned your specified egress IP can access your S3 bucket at `http://.s3-website..amazonaws.com`. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/s3-buckets/#page","headline":"Protect access to Amazon S3 buckets with Cloudflare Zero Trust","description":"This tutorial demonstrates how to secure access to Amazon S3 buckets with Cloudflare Zero Trust so that data in these buckets is not publicly exposed on the Internet.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/s3-buckets/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/s3-buckets/og.png?v=de1e7947eab69dc1","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["S3"]} ``` --- --- description: This tutorial covers how to secure access to your Microsoft 365 applications with Cloudflare Gateway dedicated egress IPs. title: Protect access to Microsoft 365 with dedicated egress IPs image: https://developers.cloudflare.com/cloudflare-one/tutorials/m365-dedicated-egress-ips/og.png?v=70ccd05096641baf --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Protect access to Microsoft 365 with dedicated egress IPs Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/m365-dedicated-egress-ips/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Only available on Zero Trust Enterprise plans. This tutorial covers how to secure access to your Microsoft 365 applications with Cloudflare Gateway dedicated egress IPs. You can map a named location in Microsoft Entra ID to a location associated with your dedicated egress IPs. Traffic will egress from Cloudflare with these IP addresses. If users attempt to access your Microsoft applications without these IPs, Entra ID will block access. ## Before you begin Make sure you have: - In Cloudflare, a Zero Trust Enterprise plan with [dedicated egress IPs](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) - In Microsoft 365, an organization managed with [Microsoft Entra ID ↗︎](https://learn.microsoft.com/en-us/entra/identity/) ## Create an egress policy in Cloudflare Gateway 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Traffic policies** > **Egress policies**. 2. Select **Add a policy**. 3. Name your policy, then add conditions to check users are configured in Microsoft Entra ID. For example, you can check for [identity conditions](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/): | Selector | Operator | Value | | --- | --- | --- | | User Group Names | in | `Sales and Marketing`, `Retail`, `U.S. Sales` | Additionally, you can check for [device posture conditions](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/): | Selector | Operator | Value | Logic | | --- | --- | --- | --- | | Passed Device Posture Check | is | `CrowdStrike Overall ZTA score (Crowdstrike s2s)` | And | | Passed Device Posture Check | is | `AppCheckMac - Required Software (Application)` | | 4. Enable **Use dedicated Cloudflare egress IPs**. Select your desired IPv4 and IPv6 addresses. For example: | Primary IPv4 address | IPv6 address | | --- | --- | | `203.0.113.0` | `2001:db8::/32` | ## Create a named IP range location in Microsoft Entra ID 1. Log in to the [Microsoft Azure portal ↗︎](https://aka.ms/azureportal). 2. In the sidebar, select **Microsoft Entra ID**. 3. Go to **Security** > **Named locations**. 4. Select **IP ranges location**. 5. Name your location, then add the IP addresses used in your Cloudflare dedicated egress IP policy. 6. Select **Upload**. This named location corresponds with the locations of your dedicated egress IPs. ## Create a conditional access policy in Microsoft Entra ID 1. In **Protect**, go to **Conditional Access**. 2. Select **Create new policy**. 3. Configure which Entra ID users you want to limit access for, and which traffic, applications, or actions you want to protect. 4. In **Conditions**, select **Locations**. Enable **Configure**. 5. In **Include**, select *Any location*. In **Exclude**, select the named location you created. 6. In **Access controls**, go to **Grant**. Enable *Block access*. Your policy will block access for your selected users from any location except those using your dedicated egress IPs. ## Test your policies 1. Using [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/), sign in to your Zero Trust organization with a user's account. 2. Go to any Microsoft 365 app within your organization. Entra ID should allow access. 3. Disconnect the Cloudflare One Client from your Zero Trust organization. Entra ID should block access to any Microsoft 365 applications. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/m365-dedicated-egress-ips/#page","headline":"Protect access to Microsoft 365 with dedicated egress IPs","description":"This tutorial covers how to secure access to your Microsoft 365 applications with Cloudflare Gateway dedicated egress IPs.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/m365-dedicated-egress-ips/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/m365-dedicated-egress-ips/og.png?v=70ccd05096641baf","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Microsoft","IPv4","IPv6"]} ``` --- --- description: This tutorial covers how to Integrate Cloudflare Access with Okta. It also covers the steps to set up Cloudflare Access and integrate Okta with Zero Trust. title: Require U2F with Okta image: https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/og.png?v=72e774539b743495 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Require U2F with Okta Last updated Apr 30, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Many identity providers, like Okta, support multiple multifactor authentication (MFA) options simultaneously. For example, Okta will allow you to login with your password and a temporary code generated in an app or a U2F hard key like a Yubikey. Some second factor methods are more resistant to phishing. U2F options require you to have access to a physical device, also known as a hardware key. Without that key, a user cannot impersonate you even if they have your password. You can build rules in Cloudflare Access to require that users authenticate with a hardware key - even if your provider supports multiple options. When users login with a less secure option, like an app-based code, Access will block them. **This tutorial covers how to:** - Integrate Cloudflare Access with Okta - Configure Okta for U2F enrollment - Build an [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) that require users login with a hardware key - Specify that policy to apply to certain Access applications The first two sections of this tutorial link to guides to set up Cloudflare Access and integrate Okta. If you already use Cloudflare Access with Okta, you can skip ahead to the fourth section. **Time to complete:** 20 minutes --- ## Configure Cloudflare Access Before you begin, you'll need to follow [these instructions](https://developers.cloudflare.com/cloudflare-one/setup/) to set up Cloudflare Access in your account. The hardware key feature is available on any plan, including the free plan. ## Integrate Okta Follow [these instructions](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/okta/) to integrate Okta with your Cloudflare Access account. Once integrated, Access will be able to apply rules using identity, group membership, and multifactor method from Okta. ## Configure Okta for U2F An Okta administrator in your organization must first [enable U2F support ↗︎](https://help.okta.com/en/prod/Content/Topics/Security/MFA.htm) in your Okta account **and** [configure users ↗︎](https://help.okta.com/en/prod/Content/Topics/Security/healthinsight/required-factors.htm) to be prompted for it. This is a global setting; if your account has already configured U2F, you do not need to do anything unique to use it with Cloudflare Access. ## Test U2F in Access You can begin building U2F policies by testing your Okta integration. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**. 2. In **Manage your App Launcher**, select **Manage**. 3. Choose **Login methods**. 4. Choose the row for Okta and select **Test**. Cloudflare Access will prompt you to login with your Okta account. For the purposes of the test, use a second factor option like an app-based code. Okta will return `amr` values to Cloudflare Access - these are standard indicators of multifactor methods shared between identity control systems. The `mfa` value is sent by Okta to tell Cloudflare Access that you used a multifactor authentication option. The `pwd` value indicates you used a password. In this example, the `otp` value is sent because the user authenticatd with an app-based code. You can test with a hardkey by logging out of Okta and returning to the list of providers in Access. Select **Test** again, but this time use your hardware key as a second factor. Cloudflare Access will now see Okta share `hwk` in the `amr` fields. ![Test MFA](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1670,height=944,format=webp/_astro/with-hwk.CL1DMkwd.png) ## Build a Zero Trust policy to require U2F You can use this information to build a rule in Access. Go to the `Applications` list in the Cloudflare Access section of the dashboard. Choose an application that you have already built or create a new one. This example adds the requirement to an existing application. Select **Edit** to edit the existing `Allow` rule. Add a `Require` rule and select `Authentication Method` from the list. Choose `hwk` as the required `Authentication Method`. Select **Save rule**. ![Require Rule](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1688,height=1224,format=webp/_astro/require-hwk.D9ImfCao.png) Optional: you can also configure Cloudflare Access to only show users Okta for this application if you have multiple other providers integrated. In the `Authentication` Tab, choose `Okta` as the only option to show users. ## Testing the rule You can now test the rule. Visit the application and attempt to login using an app-based code or method other than a hardware security key. Access will block the attempt. ![Blocked](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1280,height=800,format=webp/_astro/blocked-user.DutI7nnY.png) If you sign out of Okta, and reattempt with a hardware key, Access will then allow the connection. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/#page","headline":"Require U2F with Okta","description":"This tutorial covers how to Integrate Cloudflare Access with Okta. It also covers the steps to set up Cloudflare Access and integrate Okta with Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/okta-u2f/og.png?v=72e774539b743495","dateModified":"2026-04-30","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Okta"]} ``` --- --- description: This tutorial will walk you through extending the single-sign-on (SSO) capabilities of Cloudflare Access with our serverless computing platform, Cloudflare Workers. title: Send SSO attributes to Access-protected origins with Workers image: https://developers.cloudflare.com/cloudflare-one/tutorials/extend-sso-with-workers/og.png?v=311ab6fe42dab3d9 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Send SSO attributes to Access-protected origins with Workers Last updated Aug 25, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/extend-sso-with-workers/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial will walk you through extending the single-sign-on (SSO) capabilities of [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) with our serverless computing platform, [Cloudflare Workers](https://developers.cloudflare.com/workers/). Specifically, this guide will demonstrate how to modify requests sent to your secured origin to include additional information from the Cloudflare Access authentication event. **Time to complete:** 45 minutes ## Authentication flow [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is an authentication proxy in charge of validating a user's identity before they connect to your application. As shown in the diagram below, Access inserts a [JWT](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/) into the request, which can then be [verified](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#validate-jwts) by the origin server. ![Standard authentication flow for a request to an Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=931,height=576,format=webp/_astro/access-standard-flow.CLZ6SIBs.png) You can extend this functionality by using a Cloudflare Worker to insert additional HTTP headers into the request. In this example, we will add the [device posture attributes](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/#enforce-device-posture) `firewall_activated` and `disk_encrypted`, but you can include any attributes that Cloudflare Access collects from the authentication event. ![Extended authentication flow uses a Worker to pass additional request headers to the origin](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1008,height=576,format=webp/_astro/access-extended-flow-serverless.DKpY2r43.png) ## Benefits This approach allows you to: - **Enhance security:** By incorporating additional information from the authentication event, you can implement more robust security measures. For example, you can use device posture data to enforce access based on device compliance. - **Improve user experience:** You can personalize the user experience by tailoring content or functionality based on user attributes. For example, you can display different content based on the user's role or location. - **Simplify development:** By using Cloudflare Workers, you can easily extend your Cloudflare Access configuration without modifying your origin application code. ## Before you begin - Add a [self-hosted application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to Cloudflare Access. - Enable the [Disk encryption](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/disk-encryption/) and [Firewall](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/firewall/) device posture checks. - Install [Wrangler](https://developers.cloudflare.com/workers/wrangler/install-and-update/) on your local machine. ## 1. Create the Worker 1. Create a new Workers project:npmyarnpnpm ``` npm create cloudflare@latest -- device-posture-worker ``` ``` yarn create cloudflare device-posture-worker ``` ``` pnpm create cloudflare@latest device-posture-worker ``` For setup, select the following options: - For *What would you like to start with?*, choose `Hello World example`. - For *Which template would you like to use?*, choose `Worker only`. - For *Which language do you want to use?*, choose `JavaScript`. - For *Do you want to use git for version control?*, choose `Yes`. - For *Do you want to add an AGENTS.md file to help AI coding tools understand Cloudflare APIs?*, choose `Yes`. - For *Do you want to deploy your application?*, choose `No` (we will be making some changes before deploying). 2. Change to the project directory: ```sh $ cd device-posture-worker ``` 3. Copy-paste the following code into `src/index.js`. Be sure to replace `` with your Zero Trust team name. *index.jsjs* ```js import { parse } from "cookie"; export default { async fetch(request, env, ctx) { // The name of the cookie const COOKIE_NAME = "CF_Authorization"; const CF_GET_IDENTITY = "https://.cloudflareaccess.com/cdn-cgi/access/get-identity"; const cookie = parse(request.headers.get("Cookie") || ""); if (cookie[COOKIE_NAME] != null) { try { let id = await (await fetch(CF_GET_IDENTITY, request)).json(); let diskEncryptionStatus = false; let firewallStatus = false; for (const checkId in id.devicePosture) { const check = id.devicePosture[checkId]; if (check.type === "disk_encryption") { console.log(check.type); diskEncryptionStatus = check.success; } if (check.type === "firewall") { console.log(check.type); firewallStatus = check.success; break; } } //clone request (immutable otherwise) and insert posture values in new header set let newRequest = await new Request(request); newRequest.headers.set( "Cf-Access-Firewall-Activated", firewallStatus, ); newRequest.headers.set("Cf-Access-Disk-Encrypted", firewallStatus); //sent modified request to origin return await fetch(newRequest); } catch (e) { console.log(e); return await fetch(request); } } return await fetch(request); }, }; ``` ## 2. View the user's identity The script in `index.js` uses the [`get-identity`](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/#user-identity) endpoint to fetch a user's complete identity from a Cloudflare Access authentication event. To view a list of available data fields, log in to your Access application and append `/cdn-cgi/access/get-identity` to the URL. For example, if `www.example.com` is behind Access, go to `https://www.example.com/cdn-cgi/access/get-identity`. Below is an example of a user identity that includes the `disk_encryption` and `firewall` posture checks. The Worker inserts the posture check results into the request headers **Cf-Access-Firewall-Activated** and **Cf-Access-Disk-Encrypted**. *Example user identityjson* ```json { "id": "P51Tuu01fWHMBjIBvrCK1lK-eUDWs2aQMv03WDqT5oY", "name": "John Doe", "email": "john.doe@cloudflare.com", "amr": [ "pwd" ], "oidc_fields": { "principalName": "XXXXXX_cloudflare.com#EXT#@XXXXXXcloudflare.onmicrosoft.com" }, "groups": [ { "id": "fdaedb59-e9be-4ab7-8001-3e069da54185", "name": "XXXXX" } ], "idp": { "id": "b9f4d68e-dac1-48b0-b728-ae05a5f0d4b2", "type": "azureAD" }, "geo": { "country": "FR" }, "user_uuid": "ce40d564-c72f-475f-a9b8-f395f19ad986", "account_id": "121287a0c6e6260ec930655e6b39a3a8", "iat": 1724056537, "devicePosture": { "f6f9391e-6776-4878-9c60-0cc807dc7dc8": { "id": "f6f9391e-6776-4878-9c60-0cc807dc7dc8", "schedule": "5m", "timestamp": "2024-08-19T08:31:59.274Z", "description": "", "type": "disk_encryption", "check": { "drives": { "C": { "encrypted": true } } }, "success": false, "rule_name": "Disk Encryption - Windows", "input": { "requireAll": true, "checkDisks": [] }, "a0a8e83d-be75-4aa6-bfa0-5791da6e9186": { "id": "a0a8e83d-be75-4aa6-bfa0-5791da6e9186", "schedule": "5m", "timestamp": "2024-08-19T08:31:59.274Z", "description": "", "type": "firewall", "check": { "firewall": false }, "success": false, "rule_name": "Local Firewall Check - Windows", "input": { "enabled": true } } ... } ``` ## 3. Route the Worker to your application In the [Wrangler configuration file](https://developers.cloudflare.com/workers/wrangler/configuration/), [set up a route](https://developers.cloudflare.com/workers/configuration/routing/routes/) that maps the Worker to your Access application domain: ```jsonc { "route": { "pattern": "app.example.com/*", "zone_name": "example.com" } } ``` ```toml [route] pattern = "app.example.com/*" zone_name = "example.com" ``` ## 4. Deploy the Worker ```sh npx wrangler deploy ``` The Worker will now insert the **Cf-Access-Firewall-Activated** and **Cf-Access-Disk-Encrypted** headers into requests that pass your application's Access policies. *Example request headersjson* ```json { "headers": { "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding": "gzip", "Accept-Language": "en-US,en;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-GB;q=0.6", "Cf-Access-Authenticated-User-Email": "John.Doe@cloudflare.com", "Cf-Access-Disk-Encrypted": "false", "Cf-Access-Firewall-Activated": "false", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" } } ``` You can verify that these headers are received by the origin server. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/extend-sso-with-workers/#page","headline":"Send SSO attributes to Access-protected origins with Workers","description":"This tutorial will walk you through extending the single-sign-on (SSO) capabilities of Cloudflare Access with our serverless computing platform, Cloudflare Workers.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/extend-sso-with-workers/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/extend-sso-with-workers/og.png?v=311ab6fe42dab3d9","dateModified":"2026-08-25","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["SSO"]} ``` --- --- description: This tutorial covers how to build a Cloudflare R2 bucket to store Zero Trust logs. It also shows how to connect the bucket to the Zero Trust Logpush service. title: Use Cloudflare R2 as a Zero Trust log destination image: https://developers.cloudflare.com/cloudflare-one/tutorials/r2-logs/og.png?v=548215f7eb23ae7e --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Use Cloudflare R2 as a Zero Trust log destination Last updated Mar 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/r2-logs/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Only available on Zero Trust Enterprise plans. This tutorial covers how to build a [Cloudflare R2 bucket](https://developers.cloudflare.com/r2/buckets/) to store logs, and how to connect the bucket to the Zero Trust [Logpush service](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/) to store logs persistently and export them into other tools. ## Before you begin - Ensure Cloudflare R2 and the Zero Trust Logpush integration are included in your plan. For more information, contact your account team. ## Create a Cloudflare R2 bucket 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to the **R2 Overview** page. [Go to **Overview** ↗](https://dash.cloudflare.com/?to=/:account/r2/overview) 2. Select **Create bucket**. 3. Enter an identifiable name for the bucket, then select **Create bucket**. ## Create an R2 API token 1. Return to **R2**, then select **Manage R2 API tokens**. 2. Select **Create API token**. 3. In **Permissions**, select **Object Read & Write**. 4. In **Specify bucket(s)**, choose *Apply to specific buckets only*. Select the bucket you created. 5. Configure other token settings to your preferences. 6. Select **Create API Token**. 7. Copy the **Access Key ID**, **Secret Access Key**, and endpoint URL values. You will not be able to access these values again. 8. Select **Finish**. ## Connect a Zero Trust Logpush job 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Insights** > **Logs**. Select **Manage Logpush**. 2. Select **Connect a service**. 3. Choose which data sets and fields you want to send to your bucket. Select **Next**. 4. Select **S3 Compatible**. 5. In **S3 Compatible Bucket Path**, enter the name of your bucket. 6. In **Bucket region**, enter `auto`. 7. Enter the values for **Access Key ID**, **Secret Access Key**, and **Endpoint URL** in their corresponding fields. 8. Select **Push**. If prompted, you do not need to prove ownership with a token challenge. The Logpush job will send the selected Zero Trust logs to your R2 bucket. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/r2-logs/#page","headline":"Use Cloudflare R2 as a Zero Trust log destination","description":"This tutorial covers how to build a Cloudflare R2 bucket to store Zero Trust logs. It also shows how to connect the bucket to the Zero Trust Logpush service.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/r2-logs/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/r2-logs/og.png?v=548215f7eb23ae7e","dateModified":"2026-03-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Logging"]} ``` --- --- description: This tutorial explains how to use Cloudflare Tunnels with Kubernetes client-go credential plugins for authentication. By following these steps, you can securely access your Kubernetes cluster through a Cloudflare Tunnel. title: Use Cloudflare Tunnels with Kubernetes client-go credential plugins image: https://developers.cloudflare.com/cloudflare-one/tutorials/tunnel-kubectl/og.png?v=c450efa947b5a411 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Use Cloudflare Tunnels with Kubernetes client-go credential plugins Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/tunnel-kubectl/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial explains how to use Cloudflare Tunnels with Kubernetes client-go credential plugins for authentication. By following these steps, you can securely access your Kubernetes cluster through a Cloudflare Tunnel using the `kubectl` command-line tool. ## Prerequisites - A Cloudflare account - The Cloudflare Tunnel client ( `cloudflared`) installed on your machine - Access to a Kubernetes cluster - `kubectl` installed on your machine ## 1. Set up a Cloudflare Tunnel 1. Authenticate `cloudflared` with your Cloudflare account: ```sh cloudflared tunnel login ``` 2. Create a new tunnel: ```sh cloudflared tunnel create k8s-tunnel ``` 3. Configure your tunnel by creating a configuration file named `config.yml`: ```yaml tunnel: credentials-file: /path/to/credentials.json ingress: - hostname: k8s.example.com service: tcp://kubernetes.default.svc.cluster.local:443 - service: http_status:404 ``` Replace `` with your tunnel ID and adjust the hostname as needed. 4. Start the tunnel: ```sh cloudflared tunnel run k8s-tunnel ``` ## 2. Configure the Kubernetes API server Ensure your Kubernetes API server is configured to accept authentication from Cloudflare Tunnels. This may involve setting up an authentication webhook or configuring the API server to trust the Cloudflare Tunnel's client certificates. ## 3. Set up client-go credential plugin 1. Create a script named `cloudflare-k8s-auth.sh` with the following content: ```bash #!/bin/bash echo '{ "apiVersion": "client.authentication.k8s.io/v1beta1", "kind": "ExecCredential", "status": { "token": "'"$(cloudflared access token -app=https://k8s.example.com)"'" } }' ``` Make the script executable: ```sh chmod +x cloudflare-k8s-auth.sh ``` 2. Update your `~/.kube/config` file to use the credential plugin: ```yaml apiVersion: v1 kind: Config clusters: - cluster: server: https://k8s.example.com name: cloudflare-k8s users: - name: cloudflare-user user: exec: apiVersion: client.authentication.k8s.io/v1beta1 command: /path/to/cloudflare-k8s-auth.sh interactiveMode: Never contexts: - context: cluster: cloudflare-k8s user: cloudflare-user name: cloudflare-k8s-context current-context: cloudflare-k8s-context ``` ## 4. Use kubectl with Cloudflare Tunnel Now you can use `kubectl` commands as usual. The client-go credential plugin will automatically handle authentication through the Cloudflare Tunnel: ```sh kubectl get pods ``` ## Troubleshooting If you encounter issues: - Ensure `cloudflared` is running and the tunnel is active - Check that your `~/.kube/config` file is correctly configured - Verify that the Kubernetes API server is properly set up to accept authentication from Cloudflare Tunnels - Review the Cloudflare Tunnel logs for any error messages For more information, refer to the [Cloudflare Tunnels documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) and the [Kubernetes client-go credential plugins documentation ↗︎](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/tunnel-kubectl/#page","headline":"Use Cloudflare Tunnels with Kubernetes client-go credential plugins","description":"This tutorial explains how to use Cloudflare Tunnels with Kubernetes client-go credential plugins for authentication. By following these steps, you can securely access your Kubernetes cluster through a Cloudflare Tunnel.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/tunnel-kubectl/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/tunnel-kubectl/og.png?v=c450efa947b5a411","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Kubernetes"]} ``` --- --- description: With Conditional Access in Microsoft Entra ID, administrators can enforce policies on applications and users directly in EntraID. title: Use Microsoft Entra ID Conditional Access policies in Cloudflare Access image: https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-conditional-access/og.png?v=b50f1759619e6480 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Use Microsoft Entra ID Conditional Access policies in Cloudflare Access Last updated May 6, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-conditional-access/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) With [Conditional Access ↗︎](https://learn.microsoft.com/entra/identity/conditional-access/overview) in Microsoft Entra ID (formerly Azure Active Directory), administrators can enforce policies on applications and users directly in Entra ID. Conditional Access has a set of checks that are specialized to Windows and are often preferred by organizations with Windows power users. ## Before you begin Make sure you have: - Global admin rights to Microsoft Entra ID account - Configured users in the Microsoft Entra ID account ## Set up an identity provider for your application Refer to [our IdP setup instructions](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/entra-id/#set-up-entra-id-as-an-identity-provider) for Entra ID. ## Add API permission in Entra ID Once the base IdP integration is tested and working, grant permission for Cloudflare to read Conditional Access policies from Entra ID. 1. In Microsoft Entra ID, go to **App registrations**. 2. Select the application you created for the IdP integration. 3. Go to **API permissions** and select **Add a permission**. 4. Select **Microsoft Graph**. 5. Select **Application permissions** and add `Policy.Read.ConditionalAccess`. Note You must select **Application permissions**; delegated permissions will not work for this feature. 6. Select **Grant admin consent**. ## Configure Conditional Access in Entra ID 1. In Microsoft Entra ID, go to **Enterprise applications** > **Conditional Access**. 2. Go to **Authentication Contexts**. 3. [Create an authentication context ↗︎](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-cloud-apps#authentication-context) to reference in your Cloudflare Access policies. Give the authentication context a descriptive name (for example, `Require compliant devices`). 4. Next, go to **Policies**. 5. [Create a new Conditional Access policy ↗︎](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies) or select an existing policy. 6. Assign the conditional access policy to an authentication context: 1. In the policy builder, select **Target resources**. 2. In the **Select what this policy applies to** dropdown, select *Authentication context*. 3. Select the authentication context that will use this policy. 4. Save the policy. ## Sync Conditional Access with Zero Trust To import your Conditional Access policies into Cloudflare Access: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**. 2. In **Manage your App Launcher**, select **Manage**. 3. Choose **Login methods**. 4. Find your Microsoft Entra ID integration and select **Edit**. 5. Enable **Azure AD Policy Sync**. 6. Select **Save**. ## Create an Access application To enforce your Conditional Access policies on a Cloudflare Access application: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Applications**. 2. Select **Create new application**. 3. Select **Self-hosted and private**. 4. Select **Add public hostname** and enter the target URL of the protected application. 5. Select **Create new policy** and build an [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) using the *Azure AD - Auth context* selector. For example: | Action | Rule type | Selector | Value | | --- | --- | --- | --- | | Allow | Include | Emails ending in | `@example.com` | | | Require | Azure AD - Auth context | `Require compliant devices` | 6. Add this policy to your application configuration. 7. For **Identity providers**, select your Microsoft Entra ID integration. 8. Follow the remaining [self-hosted application creation steps](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to publish the application. Users will only be allowed access if they pass the Microsoft Entra ID Conditional Access policies associated with this authentication context. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-conditional-access/#page","headline":"Use Microsoft Entra ID Conditional Access policies in Cloudflare Access","description":"With Conditional Access in Microsoft Entra ID, administrators can enforce policies on applications and users directly in EntraID.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-conditional-access/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/entra-id-conditional-access/og.png?v=b50f1759619e6480","dateModified":"2026-05-06","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Microsoft Entra ID"]} ``` --- --- description: This tutorial gives administrators an easy way to allow their users to change their egress IP address between any of your assigned dedicated egress IP addresses. title: Use virtual networks to change user egress IPs image: https://developers.cloudflare.com/cloudflare-one/tutorials/user-selectable-egress-ips/og.png?v=4bacf9e9102fae9d --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Use virtual networks to change user egress IPs Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/user-selectable-egress-ips/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Note Only available on Enterprise plans. This tutorial gives administrators an easy way to allow their users to change their egress IP address between any of your assigned dedicated egress IP addresses. Your users can choose which egress IP to use by switching virtual networks directly from in the Cloudflare One Client. Changing egress IPs can be useful in quality assurance (QA) and other similar scenarios in which users both use their local egress location and either switch to or simulate other remote locations. ## Before you begin Make sure you have: - [Deployed the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/) on your users' devices. - [Configured tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/) to connect your private network to Cloudflare. This tutorial assumes you have: - Created two tunnels [through the dashboard](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/). - Routed `10.0.0.0/8` through one tunnel. - Routed `192.168.88.0/24` through the other tunnel. - Received multiple [dedicated egress IP addresses](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/). ## Create a virtual network for each egress route First, create [virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) corresponding to your dedicated egress IPs. 1. In the Cloudflare dashboard, go to **Networking** > **Routes**. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 2. In **Virtual networks**, select **Create virtual network**. 3. Name your virtual network. We recommend using a name related to the location of the corresponding dedicated egress IP. For example, if your users will egress from the Americas, you can name the virtual network `vnet-AMER`. 4. Select **Save**. 5. Repeat Steps 2-4 for each dedicated egress IP you want users to switch between. For example, you can create another virtual network called `vnet-EMEA` for egress from Europe, the Middle East, and Africa. 1. Create a [virtual network](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/tunnel-virtual-networks/) corresponding to one of your dedicated egress IPs. We recommend using a name related to the location of the corresponding dedicated egress IP. For example, if your users will egress from the Americas, you can name the virtual network `vnet-AMER`.
Required API token permissions At least one of the following token permissions is required: - Cloudflare One Networks Write - Cloudflare Tunnel Write
*Create a virtual networkbash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/virtual_networks" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "comment": "Virtual network to egress from the Americas", "is_default": false, "name": "vnet-AMER" }' ``` For more information, refer to [Create a virtual network](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/virtual_networks/methods/create/). 2. Repeat Step 1 for each dedicated egress IP you want users to switch between. For example, you can create another virtual network called `vnet-EMEA` for egress from Europe, the Middle East, and Africa. ## Assign each virtual network to each tunnel After creating your virtual networks, route your private network CIDRs over each virtual network. This ensures that users can reach all services on your network regardless of which egress IP they use. 1. Go to **Networking** > **Routes**. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) 2. Select **Create route**, then choose **Tunnel CIDR**. 3. Select the tunnel that routes `10.0.0.0/8` and enter `10.0.0.0/8` as the network. 4. Under **Virtual network**, choose your first virtual network. For example, `vnet-AMER`. 5. Select **Create route**. 6. To route `10.0.0.0/8` over another virtual network, repeat Steps 2-5 using a different virtual network (for example, `vnet-EMEA`). 7. Repeat for each virtual network you created and for each private network tunnel route. 1. Assign your first virtual network to your private network route. For example, assign `vnet-AMER` to your tunnel that routes `10.0.0.0/8`:
Required API token permissions At least one of the following token permissions is required: - Cloudflare One Networks Write - Cloudflare Tunnel Write
*Update a tunnel routebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID" \ --request PATCH \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "network": "10.0.0.0/8", "tunnel_id": "", "virtual_network_id": "" }' ``` For more information, refer to [Update a tunnel route](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/edit/). 2. Repeat this process for each virtual network you created. For example:
Required API token permissions At least one of the following token permissions is required: - Cloudflare One Networks Write - Cloudflare Tunnel Write
*Update a tunnel routebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID" \ --request PATCH \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "network": "10.0.0.0/8", "tunnel_id": "", "virtual_network_id": "" }' ``` 3. Repeat Steps 1-2 for each private network tunnel route. Each tunnel connected to your private network should have each of your virtual networks assigned to it. For example, if you have tunnels routing `10.0.0.0/8` and `192.168.88.0/24`, both tunnels should have the `vnet-AMER` and `vnet-EMEA` virtual networks assigned. | Tunnel | CIDR | Virtual network | | --- | --- | --- | | **Tunnel 1** | `10.0.0.0/8` | `vnet-AMER` | | | `10.0.0.0/8` | `vnet-EMEA` | | **Tunnel 2** | `192.168.88.0/24` | `vnet-AMER` | | | `192.168.88.0/24` | `vnet-EMEA` | ## Create virtual network egress policies Next, assign your dedicated egress IPs to each virtual network using Gateway egress policies. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Egress policies**. 2. Select **Add a policy**. 3. Name your policy. We recommend including the country or region traffic will egress from. 4. Add the virtual network with the *Virtual Network* selector. For example: | Selector | Operator | Value | | --- | --- | --- | | Virtual Network | is | *vnet-AMER* | 5. In **Select an egress IP**, choose **Use dedicated Cloudflare egress IPs**. Choose the dedicated IPv4 and IPv6 addresses you want traffic to egress with. 6. Select **Create policy**. 7. Repeat Steps 1-6 to create a separate egress policy for each virtual network you created. 1. Add a Gateway egress policy that matches the corresponding virtual network. For example: *Create a Zero Trust Gateway rulebash* ```bash curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \ --request POST \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "action": "egress", "description": "Egress via North America by connecting to vnet-AMER", "enabled": true, "filters": [ "egress" ], "name": "Egress AMER vnet", "precedence": 0, "traffic": "net.vnet_id == ", "rule_settings": { "egress": { "ipv4": "", "ipv4_fallback": "", "ipv6": "" } } }' ``` For more information, refer to [Create a Zero Trust Gateway rule](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/create/). 2. Repeat Step 1 to create an egress policy for each virtual network you created. Each policy you create should correspond to a different primary dedicated egress IP. ## Test virtual network egress
Windows, macOS, and Linux 1. On your user's device, log in to your Zero Trust organization in the Cloudflare One Client. 2. In a terminal, run the following command to check the default egress IP address. ```sh curl ifconfig.me -4 ``` The command should output your organization's default egress IP. 3. In the client GUI, use the **VNET** dropdown to switch to a virtual network you created.
Version 2026.1 and earlier In the Cloudflare One Client, select the gear icon > **Virtual Networks**.
4. Check the egress IP address by running curl ifconfig.me -4 again. The command should output the IP address specified in your egress policy.
iOS and Android 1. On your user's device, log in to your Zero Trust organization in the Cloudflare One Agent app. 2. In a browser, go to ifconfig.me ↗︎. Your organization's default egress IP should appear in **IP Address**. 3. In Cloudflare One Agent, go to **Advanced** > **Connection options** > **Virtual networks**. Choose a virtual network you created. 4. Check the egress IP address by reloading the browser page from Step 1. The IP address specified in your egress policy should appear in **IP Address**.
While your users are connected to a virtual network, their traffic will route via the dedicated egress IP specified. You can repeat these steps to test that each virtual network is egressing from the correct IP. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/user-selectable-egress-ips/#page","headline":"Use virtual networks to change user egress IPs","description":"This tutorial gives administrators an easy way to allow their users to change their egress IP address between any of your assigned dedicated egress IP addresses.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/user-selectable-egress-ips/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/user-selectable-egress-ips/og.png?v=4bacf9e9102fae9d","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["IPv4","IPv6","Private networks"]} ``` --- --- description: This tutorial covers how to validate that the Access JWT is on requests made to FastAPI apps. The code is written in Python. title: Validate the Access token with FastAPI image: https://developers.cloudflare.com/cloudflare-one/tutorials/fastapi/og.png?v=6aaaa7c44c65c195 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Validate the Access token with FastAPI Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/fastapi/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This tutorial covers how to validate that the [Access JWT](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/) is on requests made to FastAPI apps. **Time to complete:** 15 minutes ## Prerequisites - A [self-hosted Access application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) for your FastAPI app - The [AUD tag](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/#get-your-aud-tag) for your Access application ## 1. Create a validation function 1. In your FastAPI project, create a new file called `cloudflare.py` that contains the following code: ```python from fastapi import Request, HTTPException # The Application Audience (AUD) tag for your application POLICY_AUD = "XXXXX" # Your CF Access team domain TEAM_DOMAIN = "https://.cloudflareaccess.com" CERTS_URL = "{}/cdn-cgi/access/certs".format(TEAM_DOMAIN) async def validate_cloudflare(request: Request): """ Validate that the request is authenticated by Cloudflare Access. """ if verify_token(request) != True: raise HTTPException(status_code=400, detail="Not authenticated properly!") def _get_public_keys(): """ Returns: List of RSA public keys usable by PyJWT. """ r = requests.get(CERTS_URL) public_keys = [] jwk_set = r.json() for key_dict in jwk_set["keys"]: public_key = jwt.algorithms.RSAAlgorithm.from_jwk(json.dumps(key_dict)) public_keys.append(public_key) return public_keys def verify_token(request): """ Verify the token in the request. """ token = "" if "CF_Authorization" in request.cookies: token = request.cookies["CF_Authorization"] else: raise HTTPException(status_code=400, detail="missing required cf authorization token") keys = _get_public_keys() # Loop through the keys since we can't pass the key set to the decoder valid_token = False for key in keys: try: # decode returns the claims that has the email when needed jwt.decode(token, key=key, audience=POLICY_AUD, algorithms=["RS256"]) valid_token = True break except: raise HTTPException(status_code=400, detail="Error decoding token") if not valid_token: raise HTTPException(status_code=400, detail="Invalid token") return True ``` ## 2. Use the validation function in your app You can now add the validation function as a dependency in your FastAPI app. One way to do this is by creating an [`APIRouter` instance ↗︎](https://fastapi.tiangolo.com/tutorial/bigger-applications/#another-module-with-apirouter). The following example executes the validation function on each request made to paths that start with `/admin`: ```python from fastapi import APIRouter, Depends, HTTPException from cloudflare import validate_cloudflare router = APIRouter( prefix="/admin", tags=["admin"], dependencies=[Depends(validate_cloudflare)] responses={404: {"description": "Not found"}}, ) @router.get("/") async def root(): return {"message": "Hello World"} ``` Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/fastapi/#page","headline":"Validate the Access token with FastAPI","description":"This tutorial covers how to validate that the Access JWT is on requests made to FastAPI apps. The code is written in Python.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/fastapi/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/fastapi/og.png?v=6aaaa7c44c65c195","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Python"]} ``` --- --- description: Learn how to add Zero Trust rules to a self-hosted instance of GitLab. This tutorial walks you through deploying GitLab in DigitalOcean. title: Zero Trust GitLab SSH & HTTP image: https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/og.png?v=a44249b886b3ab0f --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Zero Trust GitLab SSH & HTTP Last updated May 6, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can use Cloudflare Access to add Zero Trust rules to a self-hosted instance of GitLab. Combined with Cloudflare Tunnel, users can connect through HTTP and SSH and authenticate with your team's identity provider. **This walkthrough covers how to:** - Deploy an instance of GitLab - Lock down all inbound connections to that instance and use Cloudflare Tunnel to set outbound connections to Cloudflare - Build policies with Cloudflare Access to control who can reach GitLab - Connect over HTTP and SSH through Cloudflare **Time to complete:** 1 hour --- ## Deploying GitLab This section walks through deploying GitLab in DigitalOcean. If you have already deployed GitLab, you can skip this section. Create a Droplet that has 16 GB of RAM and 6 CPUs. This should make it possible to support 500 users, based on [GitLab's resource recommendations ↗︎](https://docs.gitlab.com/ee/install/requirements.html). ![Create Droplet](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3104,height=1978,format=webp/_astro/create-droplet.5w9w-Z20.png) GitLab will provide an external IP that is exposed to the Internet (for now). You will need to connect to the deployed server using this external IP for the initial configuration. You can secure connections to the IP by [adding SSH keys ↗︎](https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2) to your DigitalOcean account. This example uses a macOS machine to configure the Droplet. Copy the IP address assigned to the machine from DigitalOcean. ![Machine IP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3104,height=1978,format=webp/_astro/show-ip.BX4xqubr.png) Open Terminal and run the following command, replacing the IP address with the IP assigned by DigitalOcean. ```sh ssh root@134.209.124.123 ``` Next, install GitLab. This example uses the [Ubuntu package ↗︎](https://about.gitlab.com/install/#ubuntu) and the steps in the GitLab documentation, with a few exceptions called out below. Run the following commands to begin. ```sh sudo apt-get update sudo apt-get install -y curl openssh-server ca-certificates curl https://packages.gitlab.com/install/repositories/gitlab/gitlab-ee/script.deb.sh | sudo bash ``` The commands above download the GitLab software to this machine. You must now install it. This is the first place this tutorial will diverge from the operations in the GitLab documentation. The next step in the GitLab-provided tutorial sets an external hostname. Instead, you can just install the software. ```sh sudo apt-get install gitlab-ee ``` After a minute or so, GitLab will be installed. ![Install GitLab](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1276,height=866,format=webp/_astro/install-gitlab.COTmg1AD.png) However, the application is not running yet. You can check to see what ports are listening to confirm by using `ss`. ```sh sudo ss -lntup ``` The result should be only the services currently active on the machine: ```bash sudo ss -lntup ``` ```bash Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process udp UNCONN 0 0 *:9094 *:* tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=29,fd=3)) tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=29,fd=4)) ``` To start GitLab, run the software's reconfigure command. ```sh sudo gitlab-ctl reconfigure ``` GitLab will launch its component services. Once complete, confirm that GitLab is running and listening on both ports 22 and 80. ![GitLab Services](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1418,height=534,format=webp/_astro/gitlab-services.DWHydQAd.png) ```bash sudo ss -lntup ``` ```bash Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process udp UNCONN 0 0 *:9094 *:* tcp LISTEN 0 4096 127.0.0.1:9236 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8150 0.0.0.0:* tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=29,fd=3)) tcp LISTEN 0 4096 127.0.0.1:8151 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:3000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8153 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8154 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8155 0.0.0.0:* tcp LISTEN 0 511 0.0.0.0:8060 0.0.0.0:* users:(("nginx",pid=324,fd=8)) tcp LISTEN 0 4096 127.0.0.1:9121 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:9090 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:9187 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:9093 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:9229 0.0.0.0:* tcp LISTEN 0 1024 127.0.0.1:8080 0.0.0.0:* tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=324,fd=7)) tcp LISTEN 0 4096 127.0.0.1:9168 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:8082 0.0.0.0:* tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=29,fd=4)) tcp LISTEN 0 4096 *:9094 *:* ``` Users connect to GitLab over SSH (port 22 here) and HTTP for the web app (port 80). In the next step, you will make it possible for users to try both through Cloudflare Access. I'll leave this running and head over to the Cloudflare dashboard. ## Securing GitLab with Zero Trust rules ### Building Zero Trust policies You can use Cloudflare Access to build Zero Trust rules to determine who can connect to both the web application of GitLab (HTTP) and who can connect over SSH. When a user makes a request to a site protected by Access, that request hits Cloudflare's network first. Access can then check if the user is allowed to reach the application. When integrated with Cloudflare Tunnel, the Zero Trust architecture looks like this: ![GitLab Services](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=960,height=540,format=webp/_astro/teams-diagram.DZV8IyTp.png) To determine who can reach the application, Cloudflare Access relies on integration with identity providers like Okta, Microsoft Entra ID, or Google to issue the identity cards that get checked at the door. While a VPN allows users free range on a private network unless someone builds an active rule to stop them, Access enforces that identity check on every request (and at any granularity configured). For GitLab, start by building two policies. Users will connect to GitLab in a couple of methods: in the web app and over SSH. Create policies to secure a subdomain for each. First, the web app. Before you build the rule, you'll need to follow [these instructions](https://developers.cloudflare.com/cloudflare-one/setup/) to set up Cloudflare Access in your account. Once enabled, go to the **Applications** page in Zero Trust. Select **Create new application**. Select **Self-hosted and private**. ![Self Hosted](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1898,height=1260,format=webp/_astro/policy.V6-L7e37.png) You will be prompted to add a subdomain that will represent the resource. This must be a subdomain of a domain in your Cloudflare account. You will need separate subdomains for the web application and SSH flows. This example uses `gitlab.widgetcorp.tech` for the web application and `gitlab-ssh.widgetcorp.tech` for SSH connectivity. You can decide which identity providers will be allowed to authenticate. By default, all configured providers are allowed. Add rules to determine who can reach the site. Select **Create** to publish the application. Repeat these steps for the second application, `gitlab-ssh.widgetcorp.tech`. ## Cloudflare Tunnel Cloudflare Tunnel creates a secure, outbound-only, connection between this machine and Cloudflare's network. With an outbound-only model, you can prevent any direct access to this machine and lock down any externally exposed points of ingress. And with that, no open firewall ports. Cloudflare Tunnel is made possible through a lightweight daemon from Cloudflare called `cloudflared`. Download and install `cloudflared` on the DigitalOcean machine by following the instructions listed on the [Downloads](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/) page. Once installed, authenticate the instance of `cloudflared` with the following command. ```sh cloudflared login ``` The command will print a URL that you must visit to login with your Cloudflare account. Choose a website that you have added into your account. Once you select one of the sites in your account, Cloudflare will download a certificate file to authenticate this instance of `cloudflared`. You can now use `cloudflared` to control Cloudflare Tunnel connections in your Cloudflare account. ![Download Cert](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=682,height=477,format=webp/_astro/cert-download.CzGYlCAx.png) ### Connecting to Cloudflare You can now connect GitLab to Cloudflare using Cloudflare Tunnel. 1. Create a new Tunnel by running the following command. ```sh cloudflared tunnel create gitlab ``` `cloudflared` will generate a unique ID for this Tunnel, for example `6ff42ae2-765d-4adf-8112-31c55c1551ef`. You can use this Tunnel both for SSH and HTTP traffic. 2. You will need to configure Cloudflare Tunnel to proxy traffic to both destinations. The configuration below will take traffic bound for the DNS record that will be created for the web app and the DNS record to represent SSH traffic to the right port. You use the text editor of your choice to edit the configuration file. The example relies on `Vi`. ```sh vim ~/.cloudflared/config.yml ``` 3. Configure the Tunnel to serve traffic. ```yml tunnel: 6ff42ae2-765d-4adf-8112-31c55c1551ef credentials-file: /root/.cloudflared/6ff42ae2-765d-4adf-8112-31c55c1551ef.json ingress: - hostname: gitlab.widgetcorp.tech service: http://localhost:80 - hostname: gitlab-ssh.widgetcorp.tech service: ssh://localhost:22 # Catch-all rule, which just responds with 404 if traffic doesn't match any of # the earlier rules - service: http_status:404 ``` ![Self Hosted](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1392,height=814,format=webp/_astro/config-file.C9yhlhb3.png) 4. You can test that the configuration file is set correctly with the following command: ```sh cloudflared tunnel ingress validate ``` `cloudflared` should indicate the Tunnel is okay. You can now begin running the Tunnel. ```sh cloudflared tunnel run ``` ![Tunnel Run](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1392,height=1038,format=webp/_astro/tunnel-run.0yb8I0dS.png) Note This command should be run as a `systemd` service for long-term use; if it terminates, GitLab will be unavailable. ### Configure DNS records You can now create DNS records for GitLab in the Cloudflare dashboard. Remember, you will still need two records - one for the web application and one for SSH traffic. 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and go to the **DNS Records** page for your domain. [Go to **Records** ↗](https://dash.cloudflare.com/?to=/:account/:zone/dns/records) 2. Select **Add record**. Choose `CNAME` as the record type. 3. In the **Name** field, input `gitlab`. 4. In the **Target** field, input the ID of the Tunnel created followed by `cfargotunnel.com`. In this example, that value is: ```txt 6ff42ae2-765d-4adf-8112-31c55c1551ef.cfargotunnel.com ``` 5. Select **Save**. 6. Repeat the process again by creating a second `CNAME` record, with the same **Target**, but input `gitlab-ssh` for the **Name**. Both records should then appear, pointing to the same Tunnel. The ingress rules defined in the configuration file above will direct traffic to the appropriate port. ![View DNS](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3104,height=1978,format=webp/_astro/view-dns.D18Ri4DU.png) ### Connecting to the web application You can now test the end-to-end configuration for the web application. Visit the subdomain created for the web application. Cloudflare Access will prompt you to authenticate. Login with your provider. Once authenticated, you should see the GitLab web application. ![GitLab Web](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3104,height=1978,format=webp/_astro/gitlab-web.Jd4Y_aFN.png) Register your own account and create a Blank project to test SSH in the next step. ![Blank Project](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3104,height=1978,format=webp/_astro/blank-project.fZ_spCg9.png) GitLab will create a new project and repository. Note To pull or push code, you must also add an SSH key to your profile in GitLab. ### Configuring SSH To push and pull code over SSH, you will need to install `cloudflared` on the client machine as well. This example uses a macOS laptop. On macOS, you can install `cloudflared` with the following command. ```sh brew install cloudflared ``` While you need to install `cloudflared`, you do not need to wrap your SSH commands in any unique way. Instead, you will need to make a one-time change to your SSH configuration file. ```sh vim /Users/samrhea/.ssh/config ``` Input the following values; replacing `gitlab-ssh.widgetcorp.tech` with the hostname you created. ```txt Host gitlab-ssh.widgetcorp.tech ProxyCommand /usr/local/bin/cloudflared access ssh --hostname %h ``` You can now test the SSH flow by attempting to clone the project created earlier. ```sh git clone git@gitlab-ssh.widgetcorp.tech:samrhea/demo ``` `cloudflared` will prompt you to login with my identity provider and, once successful, issue a token to your device to allow you to authenticate. ![GitLab Clone](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1364,height=954,format=webp/_astro/git-clone.JvUcJ24A.png) ### Lock down exposed ports You can now configure your DigitalOcean firewall with a single rule, block any inbound traffic, to prevent direct access. ![Set Rules](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2624,height=1120,format=webp/_astro/disable-ingress.DuP5QaLx.png) Cloudflare Tunnel will continue to run outbound-only connections and I can avoid this machine getting caught up in a crypto mining operation, or something worse. ## View logs You can also view logs of the events that are allowed and blocked. Open the `Access` page of the `Logs` section in Zero Trust. ## Troubleshooting If you are using Git Large File Storage (LFS), note that Git LFS is not automatically supported by `cloudflared`. To access repositories protected by Cloudflare Access, you need to authenticate manually by running: ```sh cloudflared access login ``` Replace `` with the Cloudflare Access-protected URL. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/#page","headline":"Zero Trust GitLab SSH & HTTP","description":"Learn how to add Zero Trust rules to a self-hosted instance of GitLab. This tutorial walks you through deploying GitLab in DigitalOcean.","url":"https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/og.png?v=a44249b886b3ab0f","dateModified":"2026-05-06","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["SSH"]} ``` --- --- description: Review recent changes to Cloudflare One. title: Changelog image: https://developers.cloudflare.com/cloudflare-one/changelog/og.png?v=dd4319fb842ef5a5 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Changelog Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/cloudflare-one.xml) ## 2026-10-19 [Cloud Workload Security](https://developers.cloudflare.com/cloudflare-one/cloud-workload-security/) **Cloud Workload Security is now available in Beta** [Cloud Workload Security (CWS)](https://developers.cloudflare.com/cloudflare-one/cloud-workload-security/) is now available in Beta. Apply policy controls to cloud API requests before they reach your cloud provider. Define policies with request filters and Rego checks. For example, block requests that would make an R2 bucket public. Use workloads and policy sets to target your cloud environments. Manage your policies in the Cloudflare dashboard. Run the CWS proxy in your environment and route client requests through it to enforce your policies. CWS requires a Zero Trust subscription. The Zero Trust Free plan is sufficient. To configure your first guardrail, follow [Get started with Cloud Workload Security](https://developers.cloudflare.com/cloudflare-one/cloud-workload-security/get-started/). ## 2026-10-16 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **50,000 routes per account and Tunnels for Platforms** Two changes make it easier to run Cloudflare Tunnel at scale. #### 50,000 routes per account by default The default limit for [routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) is now 50,000 per account, up from 1,000. This limit covers [CIDR routes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/) and [hostname routes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) for [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/). The new limit applies to every account automatically, with no action required. Published applications (public hostnames) are not routes and are not affected by this limit. Each tunnel supports roughly 5,000–10,000 published applications, depending on the size of its configuration. For details, refer to [Published application limits](https://developers.cloudflare.com/tunnel/concepts/routing/#published-application-limits). #### Tunnels for Platforms Every account includes 1,000 tunnels. With [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/), you can now run more than 1,000 tunnels in a single account — for example, one tunnel per device, per end customer, or per development environment. ![Buy additional tunnels from the Tunnels page in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1512,height=802,format=webp/_astro/tunnels-for-platforms.DuPYMNzo.gif) To buy additional tunnels, go to **Networking** > **Tunnels** and select **Buy more tunnels** in the **Usage** card. Additional tunnels are billed at $4.50 per tunnel per month. Enterprise customers can contact their account team for committed or usage-based pricing. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) For pricing, limits, and best practices for managing large tunnel fleets, refer to [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/). ## 2026-10-15 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Application Library now supports custom applications** Starting today, you can create [custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) in the [Application Library](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/) and reference them in Gateway DNS, Network, and HTTP policies. You can define an application with hostnames, IP subnets, or both. Then, optionally add TCP or UDP ports or port ranges to restrict HTTP and Network matching. ![Custom application form with a name, application ID, category, two hostnames, and a TCP port 443 constraint](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1928,height=1108,format=webp/_astro/custom-application-create.hLzR_NQZ.png) This release also improves search and filtering in the Application Library, updates the interfaces, data, and metrics used to review applications, and makes it easier to select and manage applications in the Gateway policy builder. ![Gateway HTTP policy builder with a custom application selected in the Application selector under the Artificial Intelligence category](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1472,height=1324,format=webp/_astro/custom-application-gateway-policy-builder.DFnrNoHS.png) For more information, refer to [Custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) and [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2026-10-15 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Validate data loss prevention matches with Cloudflare Workers** Data loss prevention (DLP) custom pattern entries can use Cloudflare Workers in your account to validate matches with organization-specific logic. Your Worker can adjust a match's confidence or reject the match. For setup steps and the Worker contract, refer to [Validate data loss prevention matches with Cloudflare Workers](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/custom-validation-workers/). ## 2026-10-15 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **BGP route filtering for IPsec and GRE tunnels** Cloudflare WAN and Magic Transit IPsec and GRE tunnels now support BGP import and export filtering. Create reusable filter profiles that specify an `allow` or `deny` action and a list of Classless Inter-Domain Routing (CIDR) targets with exact, more-specific, or prefix-length matching. Each tunnel supports one import filter and one export filter. You can create and assign profiles through the dashboard, API, or Terraform. Profile changes apply without resetting the BGP session. For configuration details, refer to: - [Filter BGP routes for Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-routes/#filter-bgp-routes) - [Filter BGP routes for Magic Transit](https://developers.cloudflare.com/magic-transit/how-to/configure-routes/#filter-bgp-routes) ## 2026-10-15 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Workers](https://developers.cloudflare.com/workers/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway and Workers integration is now in public beta** Cloudflare Gateway now integrates with Cloudflare Workers in public beta on all Zero Trust plans. You can use the **Forward** action in [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) to run your own code on matching, permitted traffic without managing a separate proxy. The **Forward** action lets you transform HTTP requests and responses, return a coaching page, or run background tasks such as Slack notifications and R2 captures. Your Worker receives the request and [Gateway context](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/available-context/), including connection metadata, user identity, and device posture when available. ![A matching Gateway Forward policy sends HTTP traffic to a Worker, which processes requests and responses for Internet or private-network upstream services.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2048,height=1053,format=webp/_astro/gateway-workers-forward.CFUFJAE0.png) Gateway handles the proxy connection, TLS decryption, and upstream routing. It evaluates HTTP request policies before Forward policies and inspects the final response before returning it to the user. Gateway inspects the original request body before delivering it to your Worker. A body-inspection Block decision can interrupt the Worker. To get started, [deploy a Worker and configure a Forward policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/forward-traffic/), or adapt one of the [Worker templates](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/). ## 2026-10-14 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Account context in Access deny redirects** App-aware Cloudflare Access deny redirects include an `account_id` query parameter when account context is available. Custom block pages can use it to identify the account that owns the application represented by `kid`. For example, a custom redirect can include: ```txt https://denied.example.com/?kid=&account_id=&original_url=app.example.com%2Fadmin ``` The account ID helps block-page integrations look up applications through account-scoped APIs. It is context, not proof of authentication or authorization. For parameter descriptions and an example, refer to [Custom redirect URL parameters](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/#custom-redirect-url-parameters). ## 2026-10-14 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Infrastructure applications support a configurable session duration** [Infrastructure applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now have a configurable session duration with a default value of 24 hours. You can set the session duration when creating or editing an infrastructure application in the dashboard or via the API. ![Session duration setting in infrastructure application configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2824,height=522,format=webp/_astro/infrastructure-ssh-session-duration.DI7ApX89.png) When the session duration elapses, any active SSH connections through that application will be closed, and users will need to reconnect. Previously, infrastructure applications did not enforce a session duration limit. Sessions could persist beyond 24 hours in some cases, but were never guaranteed beyond 10 hours due to [Gateway connection limits](https://developers.cloudflare.com/cloudflare-one/access-controls/troubleshooting/#long-lived-ssh-sessions-disconnect). When a target matches multiple infrastructure applications, the shortest session duration applies. For more information, refer to [Session duration](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#session-duration). ## 2026-10-13 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Request Gateway DNS64 through DNS locations and EDNS** You can now request DNS64 through Cloudflare Gateway DNS location settings or Extension Mechanisms for DNS (EDNS) options. DNS64 synthesizes `AAAA` records from `A` records for IPv6-only networks. These networks require network address translation from IPv6 to IPv4 (NAT64). Turn on **Enable DNS64** for a location, or include an empty EDNS option `65051` in individual queries. Both mechanisms support UDP, TCP, DNS over TLS (DoT), and DNS over HTTPS (DoH). For example, request DNS64 through EDNS with `dig`: ```bash dig @"" ipv4only.arpa AAAA +ednsopt=65051 +short ``` The existing `cf-dns-options: dns64` DoH header remains supported independently. DNS64 is off by default. Each mechanism independently requests synthesis. For configuration, API update behavior, and request examples, refer to [DNS64](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns64/). ## 2026-10-12 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.8.2110.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply. ## 2026-10-12 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.8.2110.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply. ## 2026-10-12 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.8.2110.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply. ## 2026-10-12 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Unified dashboard navigation for Zero Trust** The Cloudflare dashboard now combines Zero Trust and main dashboard navigation. You can move between Cloudflare products from the same navigation. All customers can browse Zero Trust products from the primary navigation. Zero Trust customers can also access other services from this navigation. These include the developer platform, account memberships, and resource tagging. As part of this change, the Zero Trust Network items were removed in favor of the new experiences available under *Networking* navigation, and Resolvers & Proxies was moved under Traffic Controls (previously Traffic Policies). This update is available to all customers starting today. For more information, refer to the [Cloudflare One documentation](https://developers.cloudflare.com/cloudflare-one/). ## 2026-10-07 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.8.2100.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Faster connects and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. **Additional changes and improvements** - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default. - Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering. - Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration. - Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report “No network” after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-10-07 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.8.2100.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across tunnel reconnections. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved connection reliability on devices with very large hosts files. The client now detects a large hosts file, allows more time for its initial DNS check, and shows a banner letting the user know that connecting may take longer. - Faster tunnel reconnections and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. - A service recovery mechanism, backed by a Windows scheduled task, now starts the client service on system unlock if it is not already running. This is enabled by default. **Additional changes and improvements** - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering. - Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration. - Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep. - Fixed the client service failing to restart after an unexpected termination. - Fixed the client UI getting stuck in a connecting state after sleep and wake even though the tunnel was connected. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report “No network” after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - A Windows DNS client regression may cause connectivity check failures on systems containing large hosts files. While this release includes a fix to mitigate this issue, users may still experience reduced DNS performance and connectivity check failures. ## 2026-10-07 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.8.2100.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Faster tunnel reconnections and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. - Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default. **Additional changes and improvements** - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering. - Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration. - Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep. - Fixed the client window not appearing on first launch after a fresh install on RHEL 10. - Fixed duplicate WARP routing policy rules accumulating on reconnect. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report “No network” after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - When in DNS Only mode, the client may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration. Local Domain Fallback works as expected in other client modes. ## 2026-10-07 [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Organizations](https://developers.cloudflare.com/fundamentals/organizations/) **Cloudflare Organizations is generally available** Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners. Organizations provides a top-level container for centrally managing accounts, members, analytics, and shared policies. Organization Super Administrators receive implicit access to every account in their Organization without requiring separate account memberships. Enterprise customers can manage accounts in a single-tier Organization. MSSP/Distributor partners can use nested sub-organizations to manage customer accounts. Organization Roles remains in beta, and current product limitations still apply. For more information, refer to [Cloudflare Organizations](https://developers.cloudflare.com/fundamentals/organizations/) and [current limitations](https://developers.cloudflare.com/fundamentals/organizations/limitations/). ## 2026-10-05 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **Detect organization-specific risks with CASB custom finding types** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) now supports [**custom finding types**](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/), giving security teams full control over the security conditions CASB detects across their SaaS and cloud integrations. In addition to CASB's library of standard finding types, you can now write your own detection logic using [Rego ↗︎](https://www.openpolicyagent.org/docs/policy-language), the open-source policy language from Open Policy Agent (OPA). Use custom finding types to match your organization's own thresholds and exceptions, such as flagging admin accounts without two-factor authentication, and get higher-confidence findings to act on. ![Create a custom finding type with a name, severity, scope, and Rego detection logic](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1194,height=1194,format=webp/_astro/create-custom-finding-type.CF3GXoPZ.png) #### Key capabilities - **Write your own detection logic** — Define exactly what CASB flags using Rego expressions evaluated against asset data from your connected integrations. - **Target any supported provider and asset class** — Scope a custom finding type to a provider (such as Google Workspace or Microsoft 365) and asset class (such as users, files, or groups), and apply it to all integrations for that provider or a selected subset. - **Built-in validation** — Select **Validate** to check your expression for syntax errors and schema issues before you create the finding type. - **Inspect and duplicate standard finding types** — Open any standard finding type to view its detection logic, then duplicate it as the starting point for a custom finding type. - **Works with CASB policies** — Use custom finding types in [CASB remediation policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) to send matching findings to Slack, ServiceNow, or any other webhook destination. #### Get started 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Findings library**. 2. Select **Create finding**. 3. Enter a name, description, and severity. 4. Select a provider and asset class, then set the integration scope. 5. Write your Rego expression and select **Validate**. 6. Select **Create finding**. CASB evaluates the custom finding type against assets as they are created or updated within the selected scope. Matching assets appear as posture finding instances under **Posture Findings**. #### Learn more - Learn how to [create and manage custom finding types](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/) in Cloudflare One. - Learn how to [manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare One. - Learn how to [create and manage CASB remediation policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) in Cloudflare One. CASB custom finding types are now available in Cloudflare One. ## 2026-10-05 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **BGP over IPsec and GRE tunnels generally available** BGP peering over IPsec and GRE tunnels is generally available for Cloudflare WAN and Magic Transit. You can use it for production workloads. BGP peering exchanges routes dynamically between your devices and your Cloudflare virtual network routing table. You no longer need to update static routes manually as your network changes. BGP over IPsec and GRE tunnels is available to all accounts that use [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing). No enablement is required. BGP over CNI remains in closed beta. For configuration details, refer to: - [Configure BGP routes for Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-routes/#configure-bgp-routes) - [Configure BGP routes for Magic Transit](https://developers.cloudflare.com/magic-transit/how-to/configure-routes/#configure-bgp-routes) ## 2026-10-02 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New strict service token authentication setting for Access** The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows: - If authentication or authorization fails, Access always returns `401` or `403` instead of redirecting the client to the login page with `302`. - Only Service Auth policies can authorize the request. Access ignores Allow policies and any `CF_Authorization` cookie sent with the request. - Access does not return a `CF_Authorization` cookie to the client after successful authentication. Subsequent requests should continue to use service token headers. - Failed requests for recognized service tokens appear in [Access authentication logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#non-identity-authentication). Zero Trust organizations created on or after October 5, 2026 have strict service token authentication turned on by default and cannot turn it off. Cloudflare recommends that existing organizations turn it on as well. Organizations created before October 5, 2026 can configure the setting in the dashboard or through the API. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**. [Go to **Access settings** ↗](https://one.dash.cloudflare.com/?to=/:account/access-controls/settings) 2. Under **Manage service tokens**, turn on **Strict service token authentication**. 3. In the confirmation dialog, select **Enable**. To turn off strict service token authentication, turn off the setting and select **Disable**. ```bash curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/access/organizations" \ --request PATCH \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "strict_service_token_auth": true }' ``` To turn off strict service token authentication, set `strict_service_token_auth` to `false`. For behavior and configuration details, refer to [Strict service token authentication](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#strict-service-token-authentication). ## 2026-10-01 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Simplified permissions for tagging targets with Access for Infrastructure** You can now tag [targets](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets) using only the `Zero Trust Write` API token permission. Previously, tagging targets through the API required both `Zero Trust Write` and `Tag Write` permissions on the API token. This change applies to inline target tagging through the [Infrastructure Access Targets API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/). Tagging resources through the general [Resource Tagging API](https://developers.cloudflare.com/resource-tagging/) still requires the `Tag Admin`, `Tag Write`, or equivalent role. For more information, refer to [Tag targets](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets). ## 2026-09-30 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.8.2033.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None For Zero Trust documentation, see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/ For Consumer documentation, see: https://developers.cloudflare.com/warp-client/ ## 2026-09-30 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Role-based access control for Browser Isolation policies** [Isolation policies](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/) support role-based access control (RBAC). Because isolation policies are Gateway HTTP policies with the *Isolate* action, Gateway's account-level and resource-scoped roles apply to them directly. Use the `Zero Trust HTTP Policies Admin` account-level role to grant access to all HTTP policies in the account. You can also assign a [resource-scoped role](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/) to let a team member manage a specific isolation policy without exposing other Gateway resources. [Policy settings](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/#policy-settings) such as copy/paste, file download/upload, keyboard, and printing are part of the policy object and follow the same permissions. For setup instructions, refer to [Granular permissions for Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/). ## 2026-09-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.8.2028.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.8.2028.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-29 [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Workers VPC](https://developers.cloudflare.com/workers-vpc/) **Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs** You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and `cloudflared` replica received each session. [Gateway network logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#network-logs) and [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) now identify two new kinds of traffic: - **Mesh** — Traffic sent from or delivered to a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) node. Previously, Mesh nodes were logged the same way as devices running the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/), because Mesh nodes run the client in headless mode. - **Workers VPC** — Traffic sent by a Worker through a [Workers VPC](https://developers.cloudflare.com/workers-vpc/) binding. Previously, Workers VPC sessions were not recorded in Network Session Logs. ![Viewing Mesh and Workers VPC traffic in Gateway network logs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1439,height=796,format=webp/_astro/2026-09-28-mesh-workers-vpc-network-logs.iGvLKYk7.gif) #### Gateway network logs To view these values in the dashboard, go to **Zero Trust** > **Insights & Logs** > **Logs** > **Network logs**, select **Columns**, and turn on **Traffic Source** and **Traffic Destination**. Both values also appear under **Network query details** when you open a log entry. #### Network Session Logs The `zero_trust_network_sessions` dataset, available through [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/), includes the following fields: | Field | Description | | --- | --- | | `OnrampType` | How the session entered Cloudflare One. Values: `CF1_CLIENT`, `MESH`, `WORKERS_VPC`, `MAGIC`, `OTHER`. | | `Offramp` | Where the session was routed. Sessions routed to a Mesh node report `MESH`. | | `SourceName` | Name of the Worker that started the session. Only populated for Workers VPC sessions. | | `SourceID` | Stable identifier of the Worker that started the session. Only populated for Workers VPC sessions. | | `DestinationReplicaID` | The replica that served the session, such as a specific replica of a Mesh node or a `cloudflared` replica of a Cloudflare Tunnel. | For example, `OnrampType = 'WORKERS_VPC' AND Offramp = 'MESH'` returns every session where a Worker reached a service behind a Mesh node, and `SourceName` tells you which Worker it was. Redeploy your Workers `SourceName` and `SourceID` are only populated for Workers deployed after 29 September 2026. To include them for an existing Worker, redeploy it — for example, with `npx wrangler deploy`. No code changes are required. #### See which tunnel and replica received a session With `DestinationReplicaID`, you can now confirm which [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and which `cloudflared` replica received traffic for a specific session. Combine it with the existing `DestinationTunnelID` field to trace a session to an exact tunnel replica — or Mesh node replica — when you run multiple replicas for high availability. The replica ID matches the **Connector ID** shown in the dashboard, so you can [stream that replica's logs](https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming) with `cloudflared tail --connector-id`. Sessions logged before this change are not backfilled. For all available fields, refer to [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/). ## 2026-09-25 [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Managed Rulesets supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Managed Rulesets are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. For the full list of feature availability, refer to [Check feature availability before upgrading](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-09-24 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **MCP server portals are now generally available** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity. Since the open beta, MCP server portals have added: - [Gateway routing](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#route-portal-traffic-through-gateway) for HTTP logging and data loss prevention (DLP) scanning - [Code Mode policies](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode-policies) that control how portals reduce tool definitions and token use - [Static OAuth client credentials](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#configure-manual-oauth-credentials) for providers that do not support Dynamic Client Registration - [Session management](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#manage-portal-sessions) for reconnecting servers and changing authorizations from the portal - [Service token authentication](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token) for autonomous agents and machine-to-machine access - [Logpush support](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/) for exporting portal activity to external storage or a security information and event management (SIEM) system To create a portal and connect an MCP client, refer to [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/). ## 2026-09-23 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Traffic Destination selector in Gateway policies** Gateway [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) policies now include a **Traffic Destination** selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN. #### Available traffic destination values | UI name | API value | Description | | --- | --- | --- | | Internet | `internet` | Traffic to the public Internet | | Cloudflare WAN | `cloudflare_wan` | Traffic through a [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/) connection | | Cloudflare Tunnel | `cloudflare_tunnel` | Traffic to a private origin through [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) | | Cloudflare One Client | `device_client` | Traffic to another device running the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) | | Mesh | `mesh` | Traffic through a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) node | The selector uses the `net.offramp.type` API field in both HTTP and Network policies. | UI name | API example | | --- | --- | | Traffic Destination | `net.offramp.type == "internet"` | For more information, refer to [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/). ## 2026-09-23 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) **Add Mesh participants with guided onboarding** [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) now makes it faster to add and manage participants from the dashboard. Select **Add participant** from **Networking** > **Mesh** to deploy a [Mesh node](https://developers.cloudflare.com/mesh/get-started/) or find the information needed to connect a [client device](https://developers.cloudflare.com/mesh/guides/connect-client-devices/). ![Adding a Cloudflare Mesh node through the guided dashboard workflow](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1200,height=680,format=webp/_astro/guided-participant-onboarding-clicks.B0r-5ElX.gif) The updated dashboard includes the following improvements: - **More Mesh node deployment options** — Install a node on Linux, Kubernetes, Docker Compose, or Docker CLI. The dashboard provides requirements, commands, configuration, and links for each method. Refer to [Run Mesh in Docker / Kubernetes](https://developers.cloudflare.com/mesh/guides/run-mesh-in-containers/) for container deployment details. - **Client device installation guidance** — Access platform-specific [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) installers, mobile QR codes, and your Cloudflare One organization name. Use the organization name to log in from the client after installation. - **Unified participant management** — View [Mesh nodes and enrolled client devices](https://developers.cloudflare.com/mesh/guides/connect-client-devices/#1-enroll-the-cloudflare-one-client) in one table. Search devices, filter participants by type or status, open device details, and load additional results from each participant source. If one source fails, participants from the other source remain available while you retry the request. You must still install the Cloudflare One Client, log in to your organization, and test the connection. For complete setup instructions, refer to [Get started with Cloudflare Mesh](https://developers.cloudflare.com/mesh/get-started/). ## 2026-09-22 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Automatically manage inactive Access service tokens** Cloudflare Access administrators can now automatically disable or delete inactive service tokens. Administrators can set an inactivity period from 30 to 365 days and choose what Access does when a token reaches that limit. To be eligible for cleanup, a token must be older than the configured period, must not have successfully authenticated during that period, and must not be directly referenced by an Access policy rule. Cleanup runs gradually in the background, so eligible tokens may not be disabled or deleted immediately. For configuration instructions, refer to [Manage inactive service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#manage-inactive-service-tokens). ## 2026-09-22 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Private MCP server support for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now connect to MCP servers available only on your private network. The portal uses [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) to reach [private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) and IP addresses without exposing the MCP server to the public Internet. Connect the server network to Cloudflare with [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/), [Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/), or another [Cloudflare One connector](https://developers.cloudflare.com/cloudflare-one/networks/connectors/). Configure a private hostname or CIDR route, then turn on **Route traffic through Cloudflare Gateway** when you add the server. OAuth authorization server endpoints, such as the authorization and token endpoints, must be accessible on the public Internet. If Cloudflare automatically registers the OAuth client through Dynamic Client Registration (DCR), the registration endpoint must also be accessible on the public Internet. For setup instructions, refer to [Connect a private MCP server](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-a-private-mcp-server). ## 2026-09-21 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.8.1755.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-21 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.8.1755.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-18 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Unified Routing generally available** Unified Routing is generally available for Cloudflare WAN and Magic Transit. Unified Routing improves the integration between Cloudflare One and the standard connectivity onramps supported by Cloudflare WAN. It is capable of many new features including Automatic Return Routing, BGP and custom client subnets. We recommend Unified Routing for all new accounts. For details, refer to [Cloudflare WAN traffic steering](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) and [Magic Transit traffic steering](https://developers.cloudflare.com/magic-transit/reference/traffic-steering/#unified-routing). ## 2026-09-18 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027** Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of `cloudflared`. After the deprecation takes effect, Cloudflare will no longer publish new `cloudflared` releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025. Apple has also deprecated Intel-based Mac computers. macOS 26 Tahoe, released in September 2025, was the final macOS release to support Intel-based Macs. macOS 27, released in September 2026, no longer supports them. Focusing development on currently supported architectures allows `cloudflared` to align with operating system support and continue receiving updates on supported platforms. For available downloads and supported platforms, refer to the [Cloudflare Tunnel downloads](https://developers.cloudflare.com/tunnel/downloads/) documentation. ## 2026-09-15 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Access for Infrastructure now supports tagged targets and tag-based target criteria** [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now integrates with [Resource Tagging](https://developers.cloudflare.com/resource-tagging/). You can attach key-value tags to [infrastructure targets](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#1-add-a-target) and use them in access policies. You can manage tags on targets inline when you create or edit a target or through the central [Resource Tagging API](https://developers.cloudflare.com/resource-tagging/how-to/manage-tags/). Cloudflare keeps tags in sync across both methods. Infrastructure applications also support a target criteria model with `include`, `require`, and `exclude` operators. Each operator can match targets by hostname, tag, or both. - **Include** matches targets that have any of the specified values. - **Require** matches targets that have all of the specified values. - **Exclude** rejects targets that have any of the specified values. ![Infrastructure application builder showing target criteria with an included tag, port 22, and SSH as the selected protocol](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2372,height=1616,format=webp/_astro/tags-in-infra-app.ja2Tp-Gq.png) For more information, refer to [Add an infrastructure application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/). ## 2026-09-14 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Require fresh authentication for SAML identity providers** Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on **Require reauthentication** in the Cloudflare dashboard, or set `force_authn` to `true` through the API. Access will then set `ForceAuthn` to `true` in signed and unsigned SAML authentication requests. This option is useful when an application requires users to reauthenticate at the identity provider instead of relying on an existing identity provider session. The default value is `false`. For configuration details, refer to [Require fresh authentication at the identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-saml/#require-fresh-authentication-at-the-identity-provider). ## 2026-09-14 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Discover where sensitive data goes before you create a Data Loss Prevention policy** **Passive Detection** for [Cloudflare Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs. The dashboard brings together detections from sampled HTTP request and response bodies. Select an entry to follow its detections over time, review destinations, and check policy coverage. You do not need a Gateway DLP policy to get these insights, and existing Gateway policies continue to apply. ![Passive Detection dashboard showing detection totals, data type distribution, policy coverage, and detection entries](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1200,height=593,format=webp/_astro/passive-detection.B_-_POtg.gif) Passive Detection is generally available. The detection entries available to your account depend on your [Zero Trust plan](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). To get started, refer to the [Passive Detection documentation](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/passive-detection/). ## 2026-09-09 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.8.1290.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-09 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.8.1290.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-09 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Improved iOS tap-to-type experience for Browser Isolation** [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) has improved the tap-to-type experience for users on iOS devices. Previously, Browser Isolation displayed a full-screen overlay with the message `tap to type` when users focused a text field. The prompt now appears inline over the focused text field, reducing disruption when users enter text in isolated sessions. If the focused text field is too small to display the full prompt, Browser Isolation displays a keyboard icon in the center of the text field instead. ![Inline tap-to-type prompt over a focused text field in Browser Isolation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1320,height=605,format=webp/_astro/tap-to-type.UmUg_KNp.jpg) iOS users should tap twice to begin entering text. This update applies automatically to Browser Isolation sessions on iOS. For more information on why this interaction is required, refer to [iOS limitations](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/known-limitations/#ios). ## 2026-09-09 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **New CASB integration for Zoom** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) now integrates with Zoom. The integration connects through Cloudflare's pre-built OAuth application — no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes. Zoom is widely used for meetings, webinars, and collaboration. Misconfigurations in account settings, meeting security controls, and recording access can expose organizations to data leakage, unauthorized access, and compliance risk. Cloudflare CASB ingests Zoom account data via API to surface security findings across these areas. #### Key capabilities Starting today, security teams can scan for security findings across the following assets: - **Account settings** — Detect weak password policies, unlocked security controls, and two-factor authentication gaps across your Zoom account - **User accounts** — Identify users not enforcing SSO, accounts with insecure host keys, unverified or inactive users, and unsafe overrides of account-level security settings - **Meetings** — Surface meetings without passwords or waiting rooms, meetings using Personal Meeting IDs (PMIs), and meetings with external domain hosts - **Recordings** — Detect publicly accessible cloud recordings, recordings without passcodes, and weak recording password configurations - **Content** — Identify sensitive information in meeting and recording content via DLP Profile matching #### Learn more This integration is available to all Cloudflare Zero Trust customers today. New customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the Cloudflare One dashboard under **Cloud & SaaS findings** > **Integrations**. The integration begins scanning immediately and surfaces findings in the dashboard within minutes. ## 2026-09-02 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Define custom applications for breakout and prioritized traffic from the Cloudflare One Appliance dashboard** You can now define [custom applications](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/#create-edit-or-delete-a-custom-application) for [breakout](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/) and [prioritized](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/prioritized-traffic/) traffic on the [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) directly from the dashboard, without calling the API. ![Adding a custom application by hostname, IP subnet, and source subnet from the Traffic Steering tab of an appliance profile](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1034,format=webp/_astro/2026-09-01-appliance-custom-application-traffic-steering.D25Ga9-d.gif) - In **Traffic Steering** > **Breakout traffic** or **Prioritized traffic**, select **Assign application traffic** > **Add** to create a custom application matched by **Hostnames**, **IP subnets**, and/or the new **Source subnets** field, alongside Cloudflare-managed applications. - Edit or delete an existing custom application from the same panel, no API round-trip required. - **Source subnets** lets you match traffic by its source IP range, complementing the existing [source LAN interface breakout criteria](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/#breakout-by-source). This complements the existing API and Terraform workflow for managing applications. For details, refer to [Breakout traffic](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/) and [Prioritized traffic](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/prioritized-traffic/). ## 2026-09-02 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Configure DHCP options from the dashboard on Cloudflare One Appliance** You can now configure [custom DHCP options](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/dhcp/dhcp-options/) directly from the dashboard when the [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) is acting as the DHCP server for a LAN. ![Adding a custom DHCP option to a LAN's DHCP server from the Network Configuration tab of an appliance profile](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1034,format=webp/_astro/2026-09-01-appliance-dhcp-options-ui.B5OEZmib.gif) - In **LAN configuration**, under **DHCP server options**, select **Add DHCP option** to choose from common options for PXE / iPXE boot, VoIP phone provisioning, and vendor-specific configuration, or select **Add custom option** to enter your own option code, type, and value. - This complements the existing [API and Terraform workflow](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/dhcp/dhcp-options/#configure-dhcp-options) for configuring DHCP options. For details, refer to [DHCP server options](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/dhcp/dhcp-options/). ## 2026-09-02 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) **Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once** You can now create multiple [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) routes from the Routes page in a single action, instead of submitting one route at a time. ![Creating multiple Cloudflare Tunnel and Cloudflare Mesh routes at once from the Routes page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1034,format=webp/_astro/2026-09-01-tunnel-mesh-bulk.zu4fOWN3.gif) When creating a route, you can now: - **Add multiple destinations at once** — Enter a comma-separated list of CIDR ranges or hostnames to create several routes of the same type and connector together. - **Queue up multiple routes** — Select **Add another** to stage additional routes, including different types or connectors, before creating them all in one action. - **Retry only what failed** — If some routes in a batch fail (for example, an invalid CIDR), the routes that were created successfully are removed from the form automatically, so you only need to fix and resubmit the ones that failed. The same Routes UI already supports bulk creation for [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) static routes, so you can add multiple WAN destinations or queue up several WAN routes before creating them together as well. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) For setup steps, refer to [Add routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/). ## 2026-08-28 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.7.1376.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms. ## 2026-08-28 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.7.1376.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). Fixed a rare but critical issue where the client could fail to connect or switch organizations due to an invalid registration after switching installed client versions. Additionally, this hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms. ## 2026-08-28 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.7.1377.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms. ## 2026-08-26 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Access service token secrets use a scannable format** Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format `cfast_[40 alphanumeric characters][8-character checksum]`. The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives. Existing service token secrets continue to work and do not require rotation. Both formats use the same Client ID and the same `CF-Access-Client-Id` and `CF-Access-Client-Secret` authentication headers. For more information, refer to [Service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). ## 2026-08-25 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Grace periods for service token rotation** Cloudflare Access administrators can now choose a grace period when rotating a service token secret. Both secrets remain valid during the grace period, giving administrators time to update services without interrupting authentication. The dashboard offers grace periods from one hour to 30 days. Administrators can also revoke the previous secret immediately. The API accepts an RFC 3339 expiration time for custom rotation schedules. For configuration instructions, refer to [Rotate service token secrets](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#rotate-service-token-secrets). ## 2026-08-25 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Temporarily turn off Access service tokens** Cloudflare Access administrators can now temporarily turn off service tokens without deleting them. A disabled token cannot authenticate, but its configuration remains available so administrators can turn it on again later. Turning off a token also stops any previous secret in an active rotation grace period. Use this control to contain suspected credential exposure or pause an automated service. For configuration instructions, refer to [Turn a service token on or off](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#turn-a-service-token-on-or-off). ## 2026-08-25 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **MCP server portals support MCP 2026-07-28 specification** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support the stateless MCP `2026-07-28` specification for client and upstream server connections. The portal's `/mcp` endpoint automatically accepts stateless MCP `2026-07-28` requests and earlier 2025 Streamable HTTP clients. When the portal connects to an upstream Streamable HTTP server, it checks for MCP `2026-07-28` support and falls back to the 2025 handshake when needed. Client and upstream protocol selection are independent, so clients and servers can upgrade separately without portal configuration changes. SSE connections continue to use the legacy protocol. For details, refer to [MCP server portal transport and protocol compatibility](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#transport). ## 2026-08-24 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Download the Cloudflare One Virtual Appliance for your hypervisor from the dashboard** When you register a [Cloudflare One Virtual Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/), you can now select your hypervisor and download the appliance directly from the dashboard — no need to look up asset URLs. ![Selecting a hypervisor and downloading the Cloudflare One Virtual Appliance from the Connectors page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2813,height=1241,format=webp/_astro/2026-08-24-virtual-appliance-self-serve-download.Ca2YGpCA.png) - On the **Connectors** page, select **Add an appliance**, choose **Virtual appliance**, then select your hypervisor: **VMware ESXi**, **Proxmox**, or **libvirt/KVM**. - Download the OVA image (VMware ESXi) or the install script (Proxmox and libvirt/KVM) for the selected hypervisor. - Use **View setup guide** to open deployment instructions for your platform. This complements the existing self-serve [registration and license key generation](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-virtual-appliance/#register-a-virtual-appliance-and-generate-a-license-key) in the dashboard. For details, refer to [Configure a Cloudflare One Virtual Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-virtual-appliance/#configure-a-virtual-machine). ## 2026-08-21 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **Automatically remediate Microsoft 365 and Google Workspace findings with API-based CASB remediation policies** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) is an API-based (agentless) tool that continuously scans your SaaS and cloud applications for security misconfigurations and data exposure. You can now use **CASB remediation policies** to automatically fix a finding or send a webhook the moment CASB detects it, without manual triage. #### Remediate Microsoft 365 and Google Workspace findings A policy can perform a first-party remediation action directly against the SaaS integration API. When a policy triggers, Cloudflare revokes the external sharing configuration without human intervention. Remediation is currently supported for file-sharing findings in Microsoft 365 and Google Workspace. Support for additional finding types and integrations is coming soon. For the full list of supported finding types, refer to [Run remediations](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/#run-remediations) in the CASB remediation policies documentation. #### Send webhooks A policy can send posture finding data to Slack, ServiceNow, or any other webhook destination. Webhook actions are supported for all posture finding types across CASB integrations. A single policy can perform both actions: remediate a finding and send a webhook. #### Get started 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Policies**. 2. Select **Create a policy**. 3. Under **Basic information**, enter a **Policy name** and, optionally, a **Description**. 4. Under **Choose how you want to trigger the policy**, select a **Vendor**, **Integration**, and **Finding type**. 5. Under **Define what to do with findings that match your trigger**, choose **Run Remediation**, **Send webhooks**, or both. 6. Under **Status**, turn on **Enable policy**. 7. Select **Create policy**. #### Learn more - Learn how to [create and manage CASB remediation policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) in Cloudflare One. - Configure [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/) as a policy destination. - Learn how to [manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare One. CASB remediation policies are now available in Cloudflare One. ## 2026-08-21 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Test Data Loss Prevention profiles without sending traffic through Gateway** **Test scan** lets you check how [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) evaluates sample content before you apply a profile to production traffic. Paste text, upload a file, or upload a HAR file, then select the profiles you want to test. ![Test scan results showing matched profiles, detection entries, and match context](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1200,height=587,format=webp/_astro/dlp-test-scan.Dm6EgN6x.gif) Test scan sends content directly to the DLP scanner. Gateway policies are not evaluated, no traffic passes through Gateway, and no Gateway activity logs are created. Results include matched profiles, detection entries, confidence levels, match context, proximity keywords, file metadata, antivirus status, and OCR output. Test scan is available to all Cloudflare Zero Trust customers. Profile availability depends on your [Zero Trust plan](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). For more details, refer to the [Test scan documentation](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/test-scan/). ## 2026-08-19 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.7.1343.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. - When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. **Additional changes and improvements** - Fixed a process leak in the Windows GUI that could exhaust system resources during IPC client-creation failures. - Fixed being unable to switch organizations when the client was stuck in the "Device not in organization" state. - Fixed an issue where Microsoft Defender would falsely flag the Cloudflare One Client installation as malicious when installing with Intune. - Made the Windows domain-joined posture check more reliable. - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. **Known issues** - If a user upgrades to version 2026.7.1343.0, downgrades to an earlier version, re-registers, and then upgrades back to 2026.7.1343.0, the client might fail to connect or switch organizations. To resolve this issue, run `warp-cli registration delete` or `warp-cli registration delete-all`. ## 2026-08-19 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.7.1343.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. - When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. **Additional changes and improvements** - Fixed the client not allowing login to another organization when currently showing "Device not in organization." - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed crash when trying to connect to captive portal on Wi-Fi. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. **Known issues** - None ## 2026-08-19 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.7.1343.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. - When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. **Additional changes and improvements** - Fixed the client not allowing login to another organization when currently showing "Device not in organization." - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. - Fixed hostname routes not working for Cloudflare Mesh when the IP addresses of the hostnames are local addresses. **Known issues** - When in DNS Only mode, the client may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration. Local Domain Fallback works as expected in other client modes. ## 2026-08-19 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) **Access resource lists now support resource-scoped roles** Members with only resource-scoped Access roles can now open Access resource list pages in the Cloudflare dashboard and call list endpoints in the API. They no longer need an additional account-scoped read-only role to list resources. The dashboard and API return only resources included in the member's permission policy scopes. Filtering applies to Access applications, policies, service tokens, and identity providers. This allows administrators to delegate specific Access resources without granting account-wide visibility. Previously, the dashboard blocked these list pages and API list requests returned `403` responses. For members with the Cloudflare Access App Admin role, policy lists include policies attached directly to the selected application. Reusable policies appear only when the member has the Cloudflare Access Policy Admin role for those policies. For role definitions and assignment details, refer to [Resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) and [Role scopes](https://developers.cloudflare.com/fundamentals/manage-members/scope/). ## 2026-08-19 [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Threat Intel Lists supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Threat Intel Lists are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. This feature requires a Cloudflare Advanced Network Firewall subscription. Support for additional features - Rate Limiting and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-08-18 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Configure origin application settings for Cloudflare Tunnel in the dashboard** You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/). These settings control how `cloudflared` connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files. ![Configure origin application settings in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/tunnel-origin-settings-dashboard.CsC2RwFC.gif) When editing a published application, expand **Additional application settings** to configure parameters organized into three categories: - **HTTP** — Set a custom HTTP Host header or disable chunked encoding. - **TLS** — Configure origin server name, CA pool, TLS timeout, disable TLS verification, match SNI to host, or enable HTTP/2 to origin. - **Connection** — Tune connect timeout, keep-alive timeout, keep-alive connections, TCP keep-alive interval, proxy type, or disable Happy Eyeballs. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) For the full list of origin parameters, refer to [Origin parameters](https://developers.cloudflare.com/tunnel/reference/origin-parameters/). ## 2026-08-17 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Post-quantum key exchange for MX deployments** Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on the SMTP connections we make to receive and deliver mail. Deploying Email Security in front of a provider that supports post-quantum hybrid key agreement (like Google Workspace) will create a TLS 1.3 connection using post-quantum key agreement. Inbound MX connections and outbound delivery connections now negotiate the [X25519MLKEM768](https://developers.cloudflare.com/ssl/post-quantum-cryptography/#hybrid-key-agreement) hybrid key agreement when the peer supports it, protecting SMTP traffic against [harvest-now, decrypt-later ↗︎](https://blog.cloudflare.com/pq-2024/) attacks. Support is backwards compatible and enabled automatically for all customers. Senders and receivers that do not yet advertise post-quantum key agreement continue to connect with classical key exchange. This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-08-14 [Workers](https://developers.cloudflare.com/workers/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **You can now enable Access on a Worker or all Workers at once** You now have two new ways to protect your [Workers](https://developers.cloudflare.com/workers/) with [Cloudflare Access](https://developers.cloudflare.com/workers/configuration/cloudflare-access/). **Protect an application across all its domains at once** Until now, if a Worker was reachable on a route, a Custom Domain, and a `workers.dev` URL, you had to manually add each one to an Access application and keep the list in sync whenever routes or domains changed. Now, Access attaches the policy to the Worker itself, so every associated domain and preview URL stays protected even when its routes or domains change. ![Access setting for protecting a single Worker](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1476,height=689,format=webp/_astro/protect-one-worker.BSpeeOry.png) **Protect all new and existing Workers by default** Make all Workers private by default, so every existing and newly created Worker requires sign-in before anyone can reach it. ![Account-wide Access setting that protects all Workers](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2436,height=1432,format=webp/_astro/protect-all-workers._AWy-S-E.png) If a specific Worker should remain publicly accessible, add a Worker-level bypass to exempt it. ![Make a Worker public when all Workers are protected](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1228,height=756,format=webp/_astro/make-worker-public.D3yjPjtf.png) Whether you protect a single application or all Workers at once, you can choose whether to protect preview deployments only or both previews and production, and control who can sign in by Cloudflare account membership, email address, or email domain. For more advanced policy options, edit the policy in [Zero Trust ↗︎](https://dash.cloudflare.com/?to=/:account/one/access/apps). ![Access policy configuration for controlling who can sign in](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1276,height=1220,format=webp/_astro/choose-who-can-sign-in.DKf3kWAK.png) **View all of your Worker Access policies** You can view and manage all of your Access policies in the **Access** tab of the Workers & Pages section in the dashboard. ![Access tab showing all configured Access policies](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1646,height=1366,format=webp/_astro/access-policies.DN7yCwHX.png) **See who is accessing your Worker** When Access is enabled on your Worker, every authenticated request includes `ctx.access`. Call [`ctx.access.getIdentity()`](https://developers.cloudflare.com/workers/runtime-apis/context/#access) to get the user's email, name, and groups — no manual JWT validation required. ```js export default { async fetch(request, env, ctx) { if (!ctx.access) { return new Response("Access did not run", { status: 401 }); } const identity = await ctx.access.getIdentity(); return Response.json({ aud: ctx.access.aud, email: identity?.email }); }, }; ``` **Test Access locally** You can now test Cloudflare Access locally with `wrangler dev`. Add a `dev` block to your `wrangler.jsonc`: ```json { "access": { "dev": { "aud": "my-app", "identity": { "email": "admin@example.com" } } } } ``` Your Worker will receive this identity through `ctx.access` and `ctx.access.getIdentity()`, letting you test authenticated and unauthenticated flows without deploying. Remove the `dev` block to simulate unauthenticated requests. **API and programmatic access** You can also set up these policies through the [Workers API](https://developers.cloudflare.com/workers/configuration/cloudflare-access/) instead of the dashboard. ## 2026-08-13 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Detect and control software package downloads with package registry security** Cloudflare Gateway can now detect software package downloads and give you policy control over supply chain traffic. When a developer or CI/CD pipeline downloads a package through Gateway, the proxy identifies the registry protocol from the request URL and extracts the package ecosystem, name, version, and namespace. You can then write [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) using `pkg.*` selectors to allow or block package downloads. #### Supported ecosystems Gateway detects package downloads for the following ecosystems: | Ecosystem | Namespace | | --- | --- | | npm | Scope (for example, `@babel`) | | PyPI | -- | | RubyGems | -- | | Cargo | -- | | Go | Module path | | Maven | Group ID | | NuGet | -- | #### Selectors In the dashboard, select **Package Ecosystem** to access the package registry selectors. After selecting a single ecosystem, nested fields for package name, version, and namespace become available. Five `pkg.*` selectors are available for HTTP policies with the Allow and Block actions: | Selector | Description | | --- | --- | | `pkg.ecosystem` | The package ecosystem detected from the request URL. | | `pkg.name` | The package name extracted from the download URL. | | `pkg.version` | The package version, with support for ecosystem-aware comparison operators. | | `pkg.namespace` | The package namespace, when the ecosystem supports one. | | `pkg.purl` | The [Package URL (PURL) ↗︎](https://github.com/package-url/purl-spec) derived from the detected coordinates. Available in the API only. | Detection is based on the registry protocol rather than the hostname, so it works the same way whether traffic goes to a public registry, a corporate proxy such as Artifactory or Nexus, or a self-hosted mirror. Package registry security requires [TLS decryption](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/) to be turned on. For more information, refer to [Package registry security](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/package-registry-security/). ## 2026-08-12 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Block emails by content with blocked content rules** Cloudflare Email security now lets administrators write their own content-based blocking rules. A new **Blocked content** area under **Policies & rules** lets you define a plaintext string or a regular expression, choose whether to scan the message subject, body, or both, and automatically block any message that matches. - Create rules using either **plaintext** matches or **regular expressions** — useful for blocking targeted phishing campaigns, known-bad phrases, or content patterns unique to your organization. - Choose the **search location** for each rule: **subject**, **body**, or **subject and body**. - Use the built-in **regular expression checker** to validate your pattern against sample text before saving, so you can confirm the rule matches what you expect and avoid false positives. - Matching messages are marked with a malicious [disposition](https://developers.cloudflare.com/cloudflare-one/email-security/reference/dispositions-and-attributes/) and prevented from reaching users' inboxes. Blocked content rules currently only support the block action. This feature is available for the following Email security packages: - **Enterprise** - **Enterprise + PhishGuard** To get started, refer to [Blocked content](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/blocked-content/). ## 2026-08-12 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Independent MFA supports FIDO2 for infrastructure applications** [Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) applications support independent multi-factor authentication (MFA) with FIDO2 keys. You can allow `ssh_fido2_key`, `piv_key`, or both in application-level and policy-level MFA settings. Users enroll FIDO2 keys through the App Launcher and connect with the generated SSH identity. FIDO2 keys for SSH are separate from browser-based WebAuthn security keys and Personal Identity Verification (PIV) keys. For setup instructions, refer to [Enroll a FIDO2 key for infrastructure apps](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-fido2-key-for-infrastructure-apps) and [Configure MFA for infrastructure applications](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications). ## 2026-08-12 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **MCP protocol detection and AI Security dashboard** Cloudflare Gateway now automatically detects [Model Context Protocol (MCP) ↗︎](https://www.cloudflare.com/learning/ai/what-is-model-context-protocol-mcp/) traffic flowing through your network. MCP is the standard protocol used by AI agents to connect to external tools and data sources. Gateway identifies MCP requests by inspecting protocol-specific headers and payload characteristics. #### MCP policy selector A new **Is MCP** selector (`experimental.is_mcp`) is available in [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#is-mcp). Use this selector to build Gateway rules that allow, block, or isolate MCP traffic. This selector is currently in beta and may change before general availability. For example, the following policy blocks MCP traffic that does not arrive through an approved [MCP portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/): | Selector | Operator | Value | Logic | Action | | --- | --- | --- | --- | --- | | Is MCP | is | *True* | And | Block | | Traffic Source | is not | *MCP portal* | | | ![Example Gateway policy that blocks MCP traffic not arriving through an MCP portal](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1104,height=664,format=webp/_astro/gateway-block-unknown-mcp.B2Ainj8x.png) #### AI security report A new **AI security report** dashboard under **Insights & Logs > Dashboards** provides visibility into MCP usage across your organization. The dashboard includes: - Total MCP request volume, unique users, and unique MCP servers - A timeseries chart of unique MCP servers observed over time - A summary of Gateway policies that target MCP traffic ![AI security report dashboard showing MCP detection data including total MCP requests, users, servers, and Gateway policies for MCP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2406,height=928,format=webp/_astro/gateway-mcp-dashboard.C9jPahkp.png) For more information, refer to [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). ## 2026-08-12 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Traffic Source selector in Gateway policies** Gateway [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) policies now include a **Traffic Source** selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint. #### Available traffic source values | UI name | API value | Description | | --- | --- | --- | | Device client | `device_client` | Traffic from the [Cloudflare One Client (WARP)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) | | Mesh | `mesh` | Traffic from a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) connector | | Cloudflare WAN | `cloudflare_wan` | Traffic from [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/zero-trust/cloudflare-gateway/) (Magic WAN) | | Clientless RDP | `clientless_rdp` | Traffic from a clientless RDP session | | Proxy endpoint | `proxy_endpoint` | Traffic from a [proxy endpoint](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) (PAC file) | | Clientless Browser Isolation | `agentless_biso` | Traffic from [clientless Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) | | MCP portal | `mcp_portal` | Traffic from an [MCP portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) | The selector uses the `net.onramp.type` API field in both HTTP and Network policies. | UI name | API example | | --- | --- | | Traffic Source | `net.onramp.type == "device_client"` | #### Browser Isolation selector A **Browser Isolation** selector is also available in Network and HTTP policies. This selector identifies whether the current session is running inside [Remote Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/), allowing administrators to apply different policy behavior to isolated traffic. | UI name | API example | | --- | --- | | Browser Isolation | `net.is_isolated == true` | For more information, refer to [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/). ## 2026-08-11 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Hostname routing is now generally available, with a new public IP range for initial resolved IPs** [Hostname routing ↗︎](https://blog.cloudflare.com/tunnel-hostname-routing/) is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: - **Cloudflare Tunnel**: route a [private hostname](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) (for example, `wiki.internal.local`) to a private application behind your tunnel, or a [public hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) (for example, `bank.example.com`) to egress through a specific tunnel and anchor traffic to a dedicated exit node. - **Cloudflare Mesh**: attract a [private or public hostname's traffic](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) to a Mesh node. Alongside GA, the default IPv4 range used for initial resolved IPs (also called token IPs) is changing from a Carrier-Grade NAT (CGNAT) range to a public Cloudflare-owned range: - **IPv4**: `172.64.128.0/20` - **IPv6**: `2606:4700:0cf1:4000::/64` This is the default range. You can [configure a custom initial resolved IP range](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/) for IPv4 if it conflicts with your existing network. **Why this is changing:** Starting with [Chrome 142 ↗︎](https://developer.chrome.com/release-notes/142), Local Network Access (LNA) restrictions block background requests to CGNAT addresses (`100.64.0.0/10`), which included the previous initial resolved IP default (`100.80.0.0/16`). LNA is implemented at the Chromium engine level, so it affects all Chromium-based browsers (for example, Microsoft Edge, Brave, and Opera), not only Google Chrome. This could silently break hostname-based Gateway features for users of these browsers, and required Chrome Enterprise policy workarounds. The new default range is public Cloudflare address space, so it is not affected by this restriction. **What is affected:** Initial resolved IPs are used by several features that associate a DNS query with the network connection that follows it: - [Private](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) and [public](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) hostname routing for Cloudflare Tunnel - [Hostname routes](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) for Cloudflare Mesh - [Access private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) on non-HTTPS ports - [Egress policy host selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/host-selectors/) (Domain, Host, Application, and Content Categories) You can check your account's current range, or configure a custom range, at any time from **Networking** > **IP addresses** > **Address space** > **Custom IPs**, or using the [Initial Resolved IP Subnet API](). [Go to **Custom IPs** ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space/custom-ips) For full instructions, refer to [Configure initial resolved IPs](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/). The IPv6 range (`2606:4700:0cf1:4000::/64`) is unchanged and is not affected by this restriction. The default IPv4 range, and all Cloudflare One IPv6 ranges, are automatically routed through the Cloudflare One Client and do not require any Split Tunnel configuration. Refer to [Automatically managed ranges](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) for details. If you were relying on a Chrome Enterprise policy workaround (such as `LocalNetworkAccessRestrictionsTemporaryOptOut`) while your account was still on the legacy CGNAT-based range, refer to [Google Chrome restricts access to private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#google-chrome-restricts-access-to-private-hostnames) for next steps. ## 2026-08-10 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.6.905.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix addresses an uncommon and intermittent case on Windows devices where the device is unable to reconnect after the device is woken from sleep. ## 2026-08-10 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Stream live logs from Cloudflare Tunnel in the dashboard** Real-time Tunnel log streaming is now available in the Cloudflare dashboard under **Networking** > **Tunnels**. This brings the same live debugging capability previously only available in the Cloudflare One dashboard, including multi-connector aggregated streaming for high-availability deployments. ![Stream live logs from a tunnel in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/tunnel-live-logs-core-dashboard.Dtm7Jg51.gif) In the tunnel detail view, a new **Live logs** tab lets you: - **Stream logs from single or multiple connectors** — In [highly available](https://developers.cloudflare.com/tunnel/configuration/#replicas-and-high-availability) deployments with multiple `cloudflared` replicas, logs from all connectors are merged into a single stream grouped by hostname, making it easy to identify which host machine produced each log entry. - **Filter by log level, event type, and HTTP method** — Narrow the stream to only the events you care about (HTTP, TCP, UDP, or `cloudflared` internal), at any log level. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) For more information, refer to [Tunnel observability](https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming) and [Tunnel log streams](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/). ## 2026-08-07 [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Container image for Cloudflare Mesh** [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes can now run as Docker containers. The [`cloudflare/mesh` ↗︎](https://hub.docker.com/r/cloudflare/mesh) image is available on Docker Hub for Docker Compose, Kubernetes, and any OCI-compatible runtime — no host-level package installation required. The image supports `amd64` and `arm64` architectures and includes built-in [source NAT](https://developers.cloudflare.com/mesh/guides/run-mesh-in-containers/#source-nat) so return traffic routes correctly without VPC route table changes. #### Deployment patterns - **Docker Compose** — add a `cloudflare-mesh` service to your `compose.yaml` and connect your entire stack to a private network. - **Kubernetes StatefulSet** — deploy a standalone Mesh node with persistent registration state. - **Kubernetes sidecar** — add the Mesh image as a sidecar container in a Pod to connect an application to Cloudflare without application changes. - **CI/CD** — pull the image in a pipeline step, join the Mesh, run integration tests against private infrastructure, and tear down. The node disappears when the container exits. For [high availability](https://developers.cloudflare.com/mesh/features/high-availability/), run multiple replicas with the same Mesh node token. Cloudflare operates replicas in active-passive mode with automatic failover. [Go to **Mesh** ↗](https://dash.cloudflare.com/?to=/:account/mesh) For setup steps, runtime configuration, and deployment examples, refer to [Run Mesh in Docker / Kubernetes](https://developers.cloudflare.com/mesh/guides/run-mesh-in-containers/). ## 2026-08-05 [AI Gateway](https://developers.cloudflare.com/ai-gateway/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Identity-aware controls are now available in AI Gateway** AI Gateway now integrates with Cloudflare Access, giving you two new capabilities: - **Protect your gateway endpoint.** Put your AI Gateway behind Access so you can set policies that control who is allowed to call a specific gateway's endpoint. - **Identity-aware controls.** When traffic reaches AI Gateway through an Access-protected custom domain, AI Gateway can use the authenticated user's Access identity in logs, analytics, routing, and spend controls. With identity-aware controls, you can set spend limits by authenticated user, control which gateways different users can access, filter logs by user, and build policies without passing user IDs from the client application. AI Gateway adds the verified Access user ID to request metadata as `cf.user_id`. For setup instructions, refer to [Cloudflare Access](https://developers.cloudflare.com/ai-gateway/configuration/cloudflare-access/). ## 2026-08-03 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Control authorization cookies for multi-domain Access applications** Cloudflare Access administrators can now control whether a self-hosted application preemptively sets authorization cookies across its public hostnames. Previously, Access automatically used eager redirects for applications with five or fewer hostnames. Applications with more than five hostnames received cookies as users visited each hostname. Administrators can now choose either behavior, regardless of the number of hostnames. The new **Eager redirect cookie** setting is turned on by default for new applications. After a user signs in, Access redirects the browser through each hostname and sets a `CF_Authorization` cookie. This supports applications that need to make requests across hostnames before the user visits each one. For applications with many hostnames, the redirect chain can cause sign-in loops in some browsers. Turn off the setting to issue the cookie only when a user visits each hostname. To configure the setting, refer to [Authorization cookie](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#eager-redirect-cookie). ## 2026-07-31 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.7.1210.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Improved connection reliability: the client now swaps protocol order after repeated connectivity-check failures, which helps when HTTP/3 is blocked after the QUIC handshake. - Fixed issue where a certificate error could be incorrectly displayed right after the connection is established. - A [DNS search domain](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) parsing failure no longer prevents connection. - Fixed a [MASQUE](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#device-tunnel-protocol) issue where the tunnel could stall while uploading at a high rate. - Fixed being unable to [switch organizations](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/switch-organizations/) when the client was stuck in the "Device not in organization" state. - Fixed the Home Screen dropdown popup not anchoring correctly. - Fixed a crash during dialog dismissal. - Increased tolerance for configurations with a large number of [local domain fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) resolver IPs, so DNS resolution behaves correctly even when more fallback resolvers are configured than recommended. - Fixed a networking issue where IPv6 multicast routes were being assigned to the WARP tunnel interface. - Fixed fatal errors on UI load on Windows 10. - Fixed a crash during Windows notification initialization. - Made the Windows [domain-joined posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/domain-joined/) more reliable. - Fixed orphaned credentials left behind on multi-user uninstall. - A successful re-authentication will cause the [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) to be re-evaluated. - Improved [dashboard-managed client updates](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) by running the updater only when needed. ## 2026-07-31 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.7.1210.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Improved connection reliability: the client now swaps protocol order after repeated connectivity-check failures, which helps when HTTP/3 is blocked after the QUIC handshake. - Fixed issue where a certificate error could be incorrectly displayed right after the connection is established. - A [DNS search domain](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) parsing failure no longer prevents connection. - Fixed a [MASQUE](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#device-tunnel-protocol) issue where the tunnel could stall while uploading at a high rate. - Fixed being unable to [switch organizations](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/switch-organizations/) when the client was stuck in the "Device not in organization" state. - Fixed the Home Screen dropdown popup not anchoring correctly. - Fixed a crash during dialog dismissal. - Increased tolerance for configurations with a large number of [local domain fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) resolver IPs, so DNS resolution behaves correctly even when more fallback resolvers are configured than recommended. - Fixed the WARP client stealing window focus (for example, during reauth). - Fixed a client crash when connecting to a captive portal over Wi-Fi. - Fixed the system tray icon showing "disconnected" while the UI showed "connected". - A successful re-authentication will cause the [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) to be re-evaluated. - Improved [dashboard-managed client updates](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) by running the updater only when needed. ## 2026-07-31 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Static OAuth client credentials for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now connect to upstream MCP servers that require a pre-registered OAuth client. This supports OAuth providers that do not offer Dynamic Client Registration or have disabled it. This unlocks portal connections to major SaaS providers such as Slack and GitHub, whose MCP servers do not yet support DCR. When adding an MCP server, administrators can enter the client ID and client secret from an OAuth application registered with the upstream provider. The configuration also supports custom OAuth endpoints, scopes, and the `client_secret_post` and `client_secret_basic` token endpoint authentication methods. Cloudflare stores the client secret encrypted. Users still authenticate to the upstream server with their own accounts when they connect through a portal. For setup instructions, refer to [Configure manual OAuth credentials](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#configure-manual-oauth-credentials). ## 2026-07-30 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Admins can turn on Code Mode by default for MCP portal users** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) now support four Code Mode policies: *Off*, *Opt-in*, *On by default*, and *Enforced*. Admins can choose whether Code Mode is unavailable, optional, enabled by default, or required for every session. Existing portals retain their current behavior. Portals that previously allowed Code Mode use *Opt-in*, while portals that did not allow Code Mode use *Off*. New portals also use *Opt-in* by default. Clients turn on Code Mode for an *Opt-in* portal with `?codemode=search_and_execute`. The *On by default* policy lets clients opt out with `?codemode=off`, which avoids nested code execution when a client runs its own Code Mode implementation. The *Off* and *Enforced* policies ignore client overrides. The Cloudflare API exposes these policies through the `code_mode` field: ```json { "code_mode": "default_on" } ``` The supported values are `off`, `opt_in`, `default_on`, and `enforced`. The previous `allow_code_mode` boolean is deprecated. For configuration details and client behavior, refer to [Code Mode policies](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode-policies). ## 2026-07-28 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Control Cloudflare Gateway DNS caching with a maximum TTL setting** You can now set a maximum time-to-live (TTL) for DNS responses returned by Gateway. When an upstream DNS record has a TTL that exceeds the configured maximum, Gateway caps it to your specified value. This ensures that DNS policy changes - such as blocking a newly identified malicious domain - take effect faster across all clients. ![The maximum DNS TTL setting in Traffic policies > Traffic settings, showing a numeric input field that accepts values between 60 and 36,000 seconds](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2170,height=294,format=webp/_astro/gateway-max-ttl-traffic-settings.BRF3NUMp.png) The setting is available at two levels: - **Account level** - In **Traffic Policies** > **Traffic Settings**, under **Proxy and inspection**. This sets the default cap for all DNS locations. - **Per-location** - Each [DNS location](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/) can inherit the account setting, disable the cap, or override it with a custom value. Two new fields are also available in DNS logs: `upstream_record_ttls` (the original TTL from the upstream response) and `applied_max_ttl` (the cap Gateway applied). These appear in the DNS logs column picker and in Logpush datasets. For more information, refer to [Maximum DNS TTL](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/maximum-dns-ttl/). ## 2026-07-21 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.6.880.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel. ## 2026-07-21 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.6.880.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel. ## 2026-07-21 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.6.880.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel. ## 2026-07-20 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Browser-based login for plaintext HTTP private applications** Cloudflare Access now uses the standard browser-based login flow for [private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) served over plaintext HTTP on port `80`. Previously, plaintext HTTP private apps fell back to the same session flow used for SSH, RDP, and other non-HTTP protocols: users got an `Authentication required` pop-up from the Cloudflare One Client, then had to select the notification to open a browser and log in. Now, users hitting an HTTP private app see the Access login page directly in the browser and receive a standard Access [application token](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/) on success. This brings the HTTP experience in line with HTTPS apps (with [Gateway TLS decryption](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/) turned on). No configuration change is required. The Cloudflare One Client is still required to route traffic to the private network, but it no longer manages the Access session for HTTP apps. Other non-HTTP protocols (SSH, RDP, arbitrary TCP/UDP) continue to use the Cloudflare One Client notification flow. ## 2026-07-17 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Restart, reboot, or shut down a Cloudflare One Appliance from the dashboard** You can now restart, reboot, or shut down a [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) directly from the dashboard or via API. ![Restarting a Cloudflare One Appliance from the Operations section of the Edit Appliance page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/2026-07-17-appliance-restart-reboot-shutdown.DKqTLOh6.gif) - **Restart** — Restart managed services. Purges temporary and (optionally) persistent state. - **Reboot** — Power cycle the appliance. Optionally, purge persistent state. Re-applies configuration starting from scratch. - **Shutdown** — Power off the appliance. Optionally, purge persistent state. The machine will be offline until manually powered on again. In the dashboard, go to **Networking** > **Connectors** > **Appliances**, select an appliance, then **Edit** > **Operations** to send an operation. Via API, `POST` to the `/accounts/{account_id}/magic/connectors/{connector_id}/interrupts` endpoint. For details, refer to [Appliance operations](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/maintenance/appliance-operations/). ## 2026-07-17 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **New header control options for Gateway HTTP policies** Cloudflare Gateway now supports advanced header control on [Allow policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#allow). Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables. #### Header operations Gateway HTTP policies using the Allow action support three operations in `rule_settings`: | Operation | API field | Behavior | | --- | --- | --- | | Add | `add_headers` | Appends a value to the header. Existing values are preserved. | | Overwrite | `set_headers` | Replaces the header value. Creates the header if it does not exist. | | Delete | `delete_headers` | Removes the header from the request. | Gateway applies operations in order: delete, then overwrite, then add. #### Dynamic variables Header values can include dynamic variables using the `@{...}` syntax. Gateway resolves variables at request time from identity, device, and network context. | Variable | Description | | --- | --- | | `@{identity.email}` | User email from the identity provider | | `@{identity.name}` | User display name from the identity provider | | `@{identity.id}` | Cloudflare identity UUID | | `@{identity.groups}` | Identity provider group memberships | | `@{identity.SAML}` | SAML attributes (if configured) | | `@{identity.OIDC}` | OIDC claims (if configured) | | `@{source.ip}` | Source IP of the connection | | `@{destination.ip}` | Destination IP of the request | | `@{device.id}` | Cloudflare One Client device UUID | | `@{device.posture}` | Device posture check results (JSON string) | You can mix static text and dynamic variables in a single header value. For example, `user-@{identity.email}` resolves to `user-jdoe@example.com`. For more information, refer to [Custom headers](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tenant-control/). ## 2026-07-16 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Bulk print PDFs for browser-based RDP** Users in browser-based RDP sessions can now print multiple PDF files as a single print job. Copy the files to your clipboard on the remote machine, then select **Print all PDFs** in the clipboard panel. The files are combined into one PDF and sent to your local printer. ![The clipboard panel showing the Print all PDFs option for multiple selected PDF files.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=768,height=432,format=webp/_astro/rdp-bulk-print.DT4sCcI-.png) Bulk print is available in Chromium-based browsers and Firefox. For more information, refer to [Print PDFs for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#print-pdfs). ## 2026-07-15 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [DNS](https://developers.cloudflare.com/dns/) **Internal DNS is now generally available** [Internal DNS](https://developers.cloudflare.com/dns/internal-dns/) is now generally available. Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane you already use for public DNS, Zero Trust, and application services. #### Why it matters - **Consolidate DNS operations.** Public and private DNS run on one platform, with one API, one audit trail, and one place to set policy. - **Simplify split-horizon DNS.** Internal and external resolution are defined as separate [views](https://developers.cloudflare.com/dns/internal-dns/dns-views/) over shared zones, managed from a single control plane — so there is no drift to chase down. - **Extend Zero Trust to DNS.** Resolver policies decide which users and devices resolve against which view, enforced by the same [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) that already governs the rest of your traffic. Setting up Internal DNS takes three steps: create a zone, create a view, and define a resolver policy. ```json POST /zones { "account": { "id": "" }, "name": "corp.internal", "type": "internal" } ``` Internal DNS is included with [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) for Enterprise customers. To get started, refer to the [Internal DNS documentation](https://developers.cloudflare.com/dns/internal-dns/). ## 2026-07-10 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Source code detection improvements** Data Loss Prevention (DLP) source code detection now focuses on identifying whole source code file uploads and downloads. Previously, source code detection performed partial scans resulting in a higher rate of false positives. Since only whole source code files are evaluated, code embedded in other content — such as chat messages, documentation, or code samples — is no longer flagged as source code, removing a common source of false positives. Source code detection requires a minimum of 500 characters to evaluate a file. Files below this threshold are not flagged to reduce noise. This threshold filters out small fragments that lack enough context for reliable classification. Enable and set [confidence levels](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/#confidence-thresholds) to tune match sensitivity. A higher confidence level reduces false positives by requiring stronger signals that the content is truly source code. A lower confidence level catches more files at the cost of additional noise. Source code detection applies to standalone source code files in [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). It does not detect source code embedded within other file types or payloads, such as `.docx` files or chat messages. For more information, refer to [Source Code predefined profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#source-code). ## 2026-07-09 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **Wi-Fi signal and network performance analytics for Cloudflare One Client devices** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into device, network, and application performance across your Cloudflare SASE deployment. The **Device Monitoring** page now analyzes hardware and network data between a Cloudflare One Client device and Cloudflare's edge, so you can diagnose connectivity and performance issues. Previously, this data was only available in raw DEX Device State Event logs, which required you to build your own analytics to interpret it. ![Device Monitoring summary with connection status, connection mode, Wi-Fi signal strength, traffic performance, and device health](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1652,height=664,format=webp/_astro/dex-device-monitoring-summary.CBxeSd6b.png) A summary at the top of the page shows the health of each category at a glance, using **Good**, **Fair**, and **Poor** labels: - **Connection** — connection status, Cloudflare One Client mode, and tunnel type over time - **Wi-Fi signal strength** — signal measured in dBm over time, with thresholds that flag a weak signal - **Traffic performance** — upstream and downstream performance, including network throughput on the active interface - **Device health** — hardware metrics such as CPU, memory, and disk ![Wi-Fi signal strength and network throughput charts on the Device Monitoring page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1666,height=732,format=webp/_astro/dex-device-monitoring-wifi-network.CoEBznAm.png) You can filter by category and adjust the time range to correlate a device's metrics with a user's reported issue. These analytics are available to all Cloudflare One customers at no additional cost. To learn more, refer to the [DEX monitoring documentation](https://developers.cloudflare.com/cloudflare-one/insights/dex/monitoring/). ## 2026-07-09 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) **Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026** On **October 5, 2026**, two changes take effect across the [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/) and [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/): the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the `connections` field. If you manage private network routes or read tunnel connection details through the API, `cloudflared`, Terraform, or another integration, review the changes in the following sections and migrate before the removal date. #### Route endpoints The CIDR-encoded route endpoints are deprecated in favor of the standard, `route_id`-based endpoints that already exist today. Both sets of endpoints route a private network through [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) or [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) (the API still refers to Mesh nodes as `warp_connector`) — only the request shape changes. **Deprecated endpoints (removed October 5, 2026):** - Create a tunnel route (CIDR Endpoint): [`POST /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/subresources/networks/methods/create/) - Update a tunnel route (CIDR Endpoint): [`PATCH /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/subresources/networks/methods/edit/) - Delete a tunnel route (CIDR Endpoint): [`DELETE /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/subresources/networks/methods/delete/) **Replacement endpoints:** - Create a tunnel route: [`POST /accounts/{account_id}/teamnet/routes`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/create/) - Update a tunnel route: [`PATCH /accounts/{account_id}/teamnet/routes/{route_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/edit/) - Delete a tunnel route: [`DELETE /accounts/{account_id}/teamnet/routes/{route_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/delete/) #### What is changing | | Deprecated (CIDR-encoded path) | Replacement | | --- | --- | --- | | Route identifier | URL-encoded CIDR in the path (`/network/{ip_network_encoded}`) | `route_id` in the path (`network` moves to the request body on create) | | Create | `POST .../teamnet/routes/network/{ip_network_encoded}` | `POST .../teamnet/routes` with `network` and `tunnel_id` in the body | | Update | `PATCH .../teamnet/routes/network/{ip_network_encoded}` | `PATCH .../teamnet/routes/{route_id}` | | Delete | `DELETE .../teamnet/routes/network/{ip_network_encoded}` | `DELETE .../teamnet/routes/{route_id}` | #### Action required 1. Capture each route's `route_id` by calling [List tunnel routes](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/list/), or read it from the response the first time you create a route with the replacement endpoint. 2. Update any scripts, backend services, or CI/CD pipelines that call the CIDR-encoded endpoints directly. 3. If you manage routes with the `cloudflared tunnel route ip add | delete` commands, upgrade `cloudflared` to the [latest version ↗︎](https://github.com/cloudflare/cloudflared/releases). 4. If you manage routes with Terraform, make sure you are on a current version of the [`cloudflare_zero_trust_tunnel_cloudflared_route` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared_route) resource and the [Cloudflare Terraform provider ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs). ```bash # Before: create a route by URL-encoding the CIDR into the path curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/network/172.16.0.0%2F16 \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{"tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}' # After: create a route with the network in the request body curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{"network": "172.16.0.0/16", "tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}' # After: update or delete a route using its route_id curl -X PATCH https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{"comment": "Updated comment for this route."}' curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Cloudflare Tunnel and Cloudflare Mesh connections Starting the same day, the `connections` array is removed from list and get responses for [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes (the `cfd_tunnel` and `warp_connector` API resources). Query the dedicated connections endpoint instead of reading the field off the tunnel or node object. This affects: - [`GET /accounts/{account_id}/cfd_tunnel`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/list/) — `connections` removed from each item in `result` - [`GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/get/) — `connections` removed from `result` - [`GET /accounts/{account_id}/warp_connector`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/list/) — `connections` removed from each item in `result` - [`GET /accounts/{account_id}/warp_connector/{tunnel_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/get/) — `connections` removed from `result` #### Action required Fetch connection details from the tunnel-specific connections endpoint instead of parsing it off the list or get response. For Cloudflare Tunnel, call [`GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/connections/methods/get/). For Cloudflare Mesh, call [`GET /accounts/{account_id}/warp_connector/{tunnel_id}/connections`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/subresources/connections/methods/get/). ```bash # Before: read connections off the tunnel object curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" # After: query connections directly curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` Update any dashboards, monitoring scripts, or automation that parses `connections` from the tunnel list or get response. `cloudflared` and the Cloudflare Terraform provider do not read this field, so no changes are required on their side for this part of the update. #### Why we are making these changes - **Smaller, faster responses.** Cloudflare Tunnel and Cloudflare Mesh nodes with many connections no longer inflate every list and get call — connection detail is only fetched when you need it. - **A single way to identify a route.** Consolidating on `route_id` removes the need to URL-encode CIDR ranges into the path and matches how every other resource in the Zero Trust Networks API is addressed. - **Consistency across the API.** Both changes align these endpoints with Cloudflare's standard REST conventions for resource identifiers and nested detail endpoints. To learn more, refer to the [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/), the [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/), and [Routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) documentation. ## 2026-07-08 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **IPsec downgrade protection (beta)** Cloudflare IPsec now supports the [`IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` ↗︎](https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-downgrade-prevention/) IKEv2 extension to protect against downgrade attacks on IPsec tunnels. IKEv2's original authentication design has each endpoint sign only its own outbound messages, not the full handshake transcript. A quantum-capable [on-path attacker ↗︎](https://www.cloudflare.com/learning/security/threats/on-path-attack/) can exploit this to bypass post-quantum key exchange by downgrading the connection to classical cryptography. The `IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` extension addresses this by having both peers sign the entire handshake transcript during the authentication exchange, preventing an attacker from manipulating the negotiation without detection. Key details: - Available in beta for Cloudflare WAN and Magic Transit IPsec tunnels. - Cloudflare sends the `IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` notification unconditionally as a responder when the feature flag is enabled. - Both the initiator (your device) and responder (Cloudflare) must support the extension for downgrade protection to be effective. - This feature is currently gated by a per-account feature flag. Contact your account team to turn it on. Refer to [Downgrade protection](https://developers.cloudflare.com/cloudflare-wan/reference/gre-ipsec-tunnels/#improved-downgrade-protection-beta) for more details. ## 2026-07-08 [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **IP lists, IDS, and SIP rules supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) IP lists, IDS, and SIP rules are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. These features require a Cloudflare Advanced Network Firewall subscription. Support for additional features - Threat Intel Lists, Rate Limiting, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-07-07 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.6.850.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix addresses a Windows authentication issue in the embedded WebView2 browser. Single sign-on could fail to use the Windows primary account, causing users to be prompted for an interactive sign-in. The embedded authentication browser now allows SSO providers to use the OS primary account when available. ## 2026-07-07 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **File transfer controls for browser-based RDP (beta)** You can now configure file transfer controls for browser-based RDP with Cloudflare Access, allowing you to restrict whether users can upload or download files between their local machine and the remote Windows server. ![File transfer connection settings in the Access policy configuration.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1356,height=692,format=webp/_astro/file-transfer-policy-control.CiSEa5rr.png) This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting file transfers, you can prevent sensitive data from being moved out of the remote session to a user's personal device. #### Configuration options File transfer controls are configured per policy within your Access application, alongside existing [text clipboard controls](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#connection-settings). For each policy, you can select one of the following options: - **Client to remote RDP session allowed** — Users can upload files from their local machine into the browser-based RDP session. - **Remote RDP session to client allowed** — Users can download files from the browser-based RDP session to their local machine. - **Both directions allowed** — Users can upload and download files between their local machine and the browser-based RDP session. - **Disable copying/pasting** — Users are not allowed to transfer files between their local machine and the browser-based RDP session. By default, file transfer is denied for new policies. For existing Access applications created before this feature was available, file transfer remains denied. #### How it works To upload, drag files into the browser window or select the settings gear icon on the left side of the RDP session. To download, copy a file in the remote session and select the settings gear to download it, download multiple files as a zip, or print PDFs to a local printer. ![The clipboard side panel showing files available for transfer.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=812,height=532,format=webp/_astro/clipboard-side-panel.Us2RfXfs.png) ![A remote document ready for download or local printing.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=770,height=442,format=webp/_astro/remote-doc-ready-for-download-or-print-local.Dcm5hrGD.png) This feature is in beta and available on all Zero Trust plans. For more information, refer to [File transfer for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#transfer-files). ## 2026-07-07 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Browser Isolation support for authorization proxy endpoints** [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) now supports Gateway [authorization proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint). You can apply [HTTP Isolate policies](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/) to traffic routed through authorization proxy endpoints, the same way you can for traffic from the Cloudflare One Client. Previously, only [source IP proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#source-ip-endpoint) supported Browser Isolation, and only with non-identity policies. Because authorization proxy endpoints authenticate users through an identity provider, you can now apply identity-based Isolate policies to PAC file-proxied traffic without requiring the Cloudflare One Client. To get started, [create an authorization proxy endpoint](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and [build an Isolate policy](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/). ## 2026-07-06 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Self-serve registration of Cloudflare One Virtual Appliance in the dashboard** You can now register a [Cloudflare One Virtual Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) and generate its license key directly from the dashboard, without contacting your account team. ![Registering a Cloudflare One Virtual Appliance and generating its authentication key from the Connectors page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=988,format=webp/_astro/2026-07-06-virtual-appliance-self-serve-ui.Dn2NC_ql.gif) - On the **Connectors** page, select **Add an appliance** and choose **Virtual appliance** to register a virtual appliance and generate its authentication key. - Use **Regenerate authentication key** from a virtual appliance connector's menu to rotate its key. The previous key is immediately and irrevocably revoked. - The authentication key is shown only once — copy and store it securely. This complements the existing [API and Terraform self-serve workflow](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-virtual-appliance/#register-a-virtual-appliance-and-generate-a-license-key) for provisioning virtual appliances. Hardware appliances continue to use the existing account-team fulfillment workflow. For details, refer to [Configure a Cloudflare One Virtual Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-virtual-appliance/). ## 2026-07-02 [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Hostname routing for Cloudflare Mesh** You can now add [hostname routes](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) to a Cloudflare Mesh node, in addition to CIDR routes. 1. [Client device](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) Requests `wiki.internal.local` 2. DNS query↓ 3. [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) Returns a token IP, then rewrites the destination to the real private IP. `172.64.128.0/20` 4. [Hostname route](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes)↓ 5. [Mesh node](https://developers.cloudflare.com/mesh/) Forwards traffic to the host on the local network 6. ↓ 7. Private host `wiki.internal.local` · `10.0.0.50` Instead of managing IP ranges, you can attract traffic for a hostname to a Mesh node: - **Private hostname** (for example, `wiki.internal.local`) — reach an internal application by name, which is useful when it has an unknown or ephemeral IP. On Mesh you do not need to run a DNS server; a local hosts-file entry on the node is enough, or you can use a Gateway resolver policy for split DNS. - **Public hostname** (for example, `www.example.com`) — route that hostname's traffic through the node and egress via the node's public IP. [Go to **Mesh** ↗](https://dash.cloudflare.com/?to=/:account/mesh) For setup steps, prerequisites, and DNS options, refer to [Hostname routes](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes). ## 2026-07-01 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.6.836.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This package is the same release as 2026.6.822.0, with a fix for our RPM package. Previously the repository served a single build to every OS version, so an install could pull a dependency that isn't available on that release. The repository now serves the correct build for each operating system version, so installs automatically pull the dependencies that version requires. Debian and Ubuntu were not affected. If you installed version 2026.6.822.0 on an RPM-based distribution, we recommend refreshing your repository configuration: ```bash sudo curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo sudo dnf clean all sudo dnf install cloudflare-warp ``` ## 2026-07-01 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Fix redirect URL fragment encoding for single-page applications** Access now correctly preserves URL fragment characters (`/`, `?`, `=`, `&`, `;`) when redirecting users back to an application after login. Previously, these characters were encoded with `encodeURIComponent`, which mangled fragment-based routes used by single-page applications (SPAs). For example, an SPA URL like `https://app.example.com/#/dashboard?tab=settings&view=advanced` would previously redirect to a broken URL after login. This is now handled correctly. If your SPA users were experiencing broken navigation after authenticating through Access, this fix resolves the issue without any configuration changes. ## 2026-07-01 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Independent MFA for infrastructure applications** [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now supports independent multi-factor authentication (MFA) for SSH connections using YubiKey PIV keys. This adds a hardware-backed second factor to SSH access, ensuring that a compromised device session alone is not sufficient to reach your servers. With per-application and per-policy configuration, you can enforce PIV key authentication for sensitive usernames (for example, `root`) while applying different requirements for other usernames. You can also set an MFA session duration to control how often users must re-authenticate. #### Enrollment Users enroll their YubiKey PIV key through the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/). For enrollment instructions and SSH client setup, refer to [Enroll a PIV key for infrastructure apps](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-piv-key-for-infrastructure-apps). #### Configuration For setup instructions, refer to [Enforce MFA for infrastructure applications](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications). ## 2026-06-30 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) **New permissions and roles for Gateway policies and lists** You can now assign granular, resource-scoped roles for [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) firewall policies and [Zero Trust lists](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/). Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control. #### What is new When you [add a member](https://developers.cloudflare.com/fundamentals/manage-members/manage/) or create a [permission policy](https://developers.cloudflare.com/fundamentals/manage-members/policies/), the following resource-scoped roles are now available: | Role | Description | | --- | --- | | Zero Trust Gateway Firewall Policies Admin | Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies. | | Zero Trust Gateway DNS Policies Admin | Can view and edit Gateway DNS policies. | | Zero Trust Gateway HTTP Policies Admin | Can view and edit Gateway HTTP policies. | | Zero Trust Gateway Network Policies Admin | Can view and edit Gateway Network policies. | | Zero Trust Gateway Egress Policies Admin | Can view and edit Gateway Egress policies. | | Zero Trust Gateway Resolver Policies Admin | Can view and edit Gateway Resolver policies. | | Zero Trust Gateway Policies Admin | Can view and edit all Gateway policies. | | Zero Trust Gateway Policies Read | Can view all Gateway policies. | | Zero Trust Gateway Read Only | Can view all Gateway resources. | | Zero Trust DNS Locations Admin | Can view and edit DNS locations. | | Zero Trust Proxy Endpoints Admin | Can view and edit Gateway Proxy Endpoints. | | Zero Trust Account Lists Admin | Can view and edit all Gateway and Access lists. | | Zero Trust Account Lists Read | Can view all Gateway and Access lists. | These roles allow you to: - Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration. - Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes. - Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration. You can also now assign *Resource-scoped roles*. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. **Existing account-level roles continue to work.** A member with the `Cloudflare Gateway` or `Cloudflare Zero Trust` role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens. #### Get started - Refer to [Granular permissions for Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/) for setup instructions and supported resources. - Learn how to [create permission policies](https://developers.cloudflare.com/fundamentals/manage-members/policies/) that use these roles. ## 2026-06-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.6.822.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. **Additional Changes and improvements** - Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in Windows Accessibility settings. - Path MTU Discovery (PMTUD) is now enabled by default. - The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications. - Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Fixed a high CPU issue when the device wakes from sleep. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. **Known issues** - Single sign-on in the embedded WebView2 authentication browser may fail to use the Windows primary account, prompting for an interactive sign-in. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - In rare cases, a registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click "Ok" with the default highlighted option. ## 2026-06-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.6.822.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. **Additional Changes and improvements** - Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. - Path MTU Discovery (PMTUD) is now enabled by default. - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - When deploying with Microsoft Intune, the client may be repeatedly reinstalled because Intune adds the client's embedded framework bundles to its install-detection list, and those frameworks cannot be detected as installed on their own. See [Repeated reinstalls on macOS with Microsoft Intune](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#repeated-reinstalls-on-macos-with-microsoft-intune) for the workaround. ## 2026-06-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.6.822.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. **Additional changes and improvements** - Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. - [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) functionality using the Cloudflare One Client is now supported on RHEL 9 and 10. - Cloudflare Mesh now supports [hostname-based routing](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes). - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the system display settings. - Path MTU Discovery (PMTUD) is now enabled by default. - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Fixed an issue where some Debian releases experienced inaccurate version reporting for posture checks. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. For RHEL deployments, this release introduces a dependency on the [Extra Packages for Enterprise Linux](https://docs.fedoraproject.org/en-US/epel/) repository (EPEL). The EPEL repository provides packages that support the captive portal detection’s in-app browser authentication and system tray icon. See [Getting started with EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/) for instructions on enabling EPEL. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. ## 2026-06-26 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Service token support for MCP server portals** You can now connect autonomous agents and bots to an [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) using an [Access service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). Service token sessions can reach upstream MCP servers through the portal without a browser-based OAuth flow. To set this up: - Add a [Service Auth policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#service-auth) that matches your service token to the portal's Access application. - Add a Service Auth policy that matches the same token to each linked MCP server's Access application. - Turn **Require user auth** off ( `on_behalf: false`) for each linked server so the portal uses the admin credential instead of a per-user OAuth grant. The bot connects with `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers and sees the tools from every linked server it is authorized for. Servers that still require per-user OAuth are excluded from service token sessions because a service token cannot complete a per-user OAuth grant. For step-by-step setup, refer to [Connect with a service token](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token). ## 2026-06-24 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.6.782.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release introduces upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. **Additional changes and improvements** This release also introduces multiple fixes and improvements including: - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. - Path MTU Discovery (PMTUD) is now enabled by default. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. ## 2026-06-23 [Data Localization Suite](https://developers.cloudflare.com/data-localization/) **Regionalized IP Bindings for Regional Services** Regional Services now supports **Regionalized IP Bindings**, letting you regionalize traffic at the IP layer for prefixes you bring to Cloudflare through [Bring Your Own IP (BYOIP)](https://developers.cloudflare.com/byoip/). Where [Regional Hostnames](https://developers.cloudflare.com/data-localization/regional-services/regional-hostnames/) regionalize traffic by hostname, Regionalized IP Bindings let you bind a CIDR from one of your prefixes to a region — ideal for address-map deployments and any service you address by IP rather than hostname. Cloudflare then terminates TLS and processes traffic to those addresses only within the data centers in that region. Regionalized IP Bindings requires the Regional Services and Regional Services for BYOIP entitlements. Contact your account team to enable them. To get started, refer to [Regionalized IP Bindings](https://developers.cloudflare.com/data-localization/regional-services/ip-bindings/). ## 2026-06-19 [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Manage all your routes from one page in the dashboard** The **Routes** page in the Cloudflare dashboard now shows the routes across all of your connectors — [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) and [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) routes alongside [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) and [Magic Transit](https://developers.cloudflare.com/magic-transit/) static routes — in a single table, instead of a separate routes view per product. ![The unified Routes page in the Cloudflare dashboard, showing routes across connectors in a single table](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/2026-06-19-unified-routes.B3igBY20.gif) From the unified Routes page you can: - **Visualize your network with an interactive map** that shows how your destinations flow through to your connectors — including equal-cost multi-path (ECMP) routes where the same prefix is served by several connectors. Select a node to filter the table down to the routes behind it. - **See every route in one table**, with its destination, type, connector, priority, and source, and filter or sort to find what you need. - **Create, edit, and delete routes** of any supported type without leaving the page. When adding a Cloudflare WAN or Magic Transit static route, you now pick the next hop by **connector name** instead of typing its IP. - **Manage [virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/virtual-networks/)** from a dedicated tab. - **Test a route** to see which connector and next hop a destination resolves to before you commit a change. To find it, go to **Networking** > **Routes** in the dashboard sidebar. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) Your existing routes, APIs, and configurations are unchanged — this is a dashboard experience that brings them together in one place. Learn how to [add routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) and [manage virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/virtual-networks/). ## 2026-06-18 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Cloudflare identity provider is now the default for new accounts** When you create a new Zero Trust organization, Cloudflare now adds the [Cloudflare identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method. Previously, new organizations started with [one-time PIN (OTP)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/). With the Cloudflare identity provider, your users authenticate using their existing Cloudflare account credentials, and authentication is restricted to members of your account. You can still add OTP or connect any [third-party identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/) whenever you need to. This change only applies to newly created accounts. Existing organizations keep the login methods they already have configured. If you would like to use the Cloudflare Identity Provider in an existing account, you must enable it. ## 2026-06-11 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Define custom topics for AI prompt protection** You can now define custom topics for AI prompt protection. Predefined [AI prompt topics](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics) cover common content and intent categories such as PII, source code, and jailbreak attempts. Custom topics let you detect unique or proprietary concepts that are not included in predefined categories. You describe a custom topic in natural language, and Cloudflare DLP detects whether a prompt matches that topic based on context rather than specific keywords. For example, a topic that describes confidential merger discussions matches a prompt that paraphrases the deal, even when the prompt never uses the word merger or names the companies involved. To detect literal values such as internal codenames or product identifiers, use a [custom wordlist or pattern entry](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#custom-wordlist-datasets) instead. Custom topics run through the same [application granular controls](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#granular-controls) path as predefined AI prompt topics. Custom topics are available for ChatGPT, Google Gemini, Perplexity, and Claude. #### Create a custom AI prompt topic 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **Detection entries**. 2. Select **AI prompt topics**, then select **Custom Prompt Topic**. 3. Describe the topic in natural language. Be specific about the concept you want to detect. For example, describe unreleased product roadmap details or confidential customer contract terms. 4. Add this detection entry to an existing DLP profile, or [create a new DLP profile](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/#build-a-custom-profile). 5. Use the profile in a Gateway HTTP policy to log or block prompts that match the topic. Note Write the description as a concept to classify, not a list of keywords. For example, describe "internal financial forecasts and unreleased revenue figures" rather than listing specific document names. For more information, refer to [AI prompt topics](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics). ## 2026-06-05 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Workers VPC](https://developers.cloudflare.com/workers-vpc/) **Filter Workers' public Internet traffic using Gateway policies** Workers using a [VPC Network](https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/) binding with `network_id: "cf1:network"` now egress to public Internet destinations through [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today. 1. [Worker](https://developers.cloudflare.com/workers/) Calls `env.EGRESS.fetch()` 2. [VPC binding](https://developers.cloudflare.com/workers-vpc/)↓ 3. [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) Bind via [`cf1:network`](https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/) 4. ↓ 5. [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) Policies applied: [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/) [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) 6. ↓ 7. ↗Public Internet Any public hostname or IP [Gateway logsDNSHTTPNetwork](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) What you get by default: - **Visibility.** Worker egress shows up in Gateway [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) logs alongside your other traffic, so you can audit what your Workers are calling and when. - **Enforcement.** Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block. ```jsonc { "vpc_networks": [ { "binding": "EGRESS", "network_id": "cf1:network", "remote": true, }, ], } ``` ```toml [[vpc_networks]] binding = "EGRESS" network_id = "cf1:network" remote = true ``` ```js // Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://developers.cloudflare.com/service/https://api.example.com/data"); ``` ```ts // Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://developers.cloudflare.com/service/https://api.example.com/data"); ``` For configuration options, refer to [VPC Networks](https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/). For policy authoring, refer to [Cloudflare Gateway traffic policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2026-06-04 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Share identity providers across accounts with IdP federation** Cloudflare Access now supports [IdP federation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/idp-federation/), which allows organizations to share a single identity provider across multiple Cloudflare accounts. Instead of configuring the same IdP (for example, Okta or Entra ID) separately in every account, you configure it once in a source account and share it with the other accounts in your organization. Each recipient account gets a read-only IdP connection that routes authentication back to the source account through a bridge — a hidden application in the source account that brokers the cross-account login. End users sign in with their existing IdP credentials, and each account's Access policies evaluate the resulting identity just like any other IdP login. Key capabilities: - **One IdP, many accounts** — Configure your IdP once and share it with all accounts in your organization. - **Lifecycle management** — As accounts join or leave your Cloudflare organization, their IdP connections are provisioned and removed automatically — no manual cleanup required. - **Immutable recipient connections** — IdP connections in recipient accounts cannot be accidentally modified or deleted. To get started, refer to [IdP federation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/idp-federation/). ## 2026-06-03 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **SAML assertion encryption for identity providers** Cloudflare Access now supports SAML assertion encryption for identity provider integrations. When turned on, your identity provider encrypts SAML assertions using a Cloudflare-managed certificate before sending them through the user's browser. Only Access can decrypt these assertions, protecting sensitive identity data even after TLS termination. Without encryption, SAML assertions are transmitted in plaintext and could be visible to browser extensions or client-side malware. ![SAML encryption toggle in the identity provider configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1698,height=344,format=webp/_astro/saml-encryption.J5jmiYv8.png) SAML encryption includes built-in certificate lifecycle management: - **Automatic certificate generation**: Access generates an encryption certificate when you turn on SAML encryption for an identity provider. - **Certificate rotation**: Rotate certificates without downtime. The previous certificate remains valid until expiration, giving you time to update your IdP. - **PEM export**: Copy the certificate in PEM format for manual upload to your IdP, or point your IdP to the SAML metadata endpoint for automatic retrieval. To get started, refer to [Encrypt SAML assertions](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-saml/#encrypt-saml-assertions). ## 2026-06-02 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Cisco IOS XE** The Cisco IOS XE third-party integration guide for Cloudflare WAN has been updated to include: - Post Quantum Cryptography (PQC) - Policy-Based Routing (PBR) - IP Service Level Agreement (IP SLA) This link will take you directly to the updated [Cisco IOS XE](https://developers.cloudflare.com/cloudflare-wan/configuration/third-party/cisco-ios-xe/) guide. ## 2026-05-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.5.1155.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks (United inflight Wi-Fi was the reported case). The browser now reliably loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.5.1155.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details. - Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications. - Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. **Known issues** - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. ## 2026-05-28 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Tool and prompt aliases for MCP server portals** When you connect third-party MCP servers through [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/), you have no control over how the server author named tools or wrote descriptions. Unclear names make it harder for AI agents to select the right tool and harder for users to understand what is available. You can now [rename tools and prompts](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases) and rewrite their descriptions directly on the portal, without modifying the upstream server. For example, a tool named `super_cool_tool` can become `search_customer_records` with a description tailored to your organization. ![Edit tool modal showing name and description fields for an MCP server tool](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1640,height=1144,format=webp/_astro/portal-edit-tool-modal.DrxORhBl.png) Modified tools display a **Modified** label in the tools list so administrators can see which tools have been customized at a glance. ![Tools authorized list showing a modified label on a renamed tool](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1862,height=700,format=webp/_astro/portal-tools-authorized-modified.B674Xvip.png) Aliases override the metadata that MCP clients receive. You can set them at two levels: - **Per portal**: Applies only within a specific portal. Takes precedence over server-level aliases. - **Per server**: Applies across all portals that use the server. You can reset an alias at any time to restore the original upstream name. For more information, refer to [Tool and prompt aliases](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases). ## 2026-05-28 [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **High availability replica management for Cloudflare Mesh** The [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) dashboard now shows per-replica details for [high availability](https://developers.cloudflare.com/mesh/features/high-availability/) nodes. You can see which replica is active, view each replica's Mesh IP and connection details, and manually trigger failover — all from the node detail page. ![Mesh HA replica tabs showing active and passive replicas with per-replica Mesh IPs and a manual failover option](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1155,format=webp/_astro/mesh-ha-replicas.Dvf1GMmQ.gif) #### What's new - **Replica tabs** on the node detail page — switch between replicas to see each one's Mesh IP, edge data center, origin IP, platform, version, and uptime. - **Active/passive badges** identify which replica is currently routing traffic. - **Manual failover** — promote a passive replica to active with a single click. The previous active replica switches to standby. - **HA badge** in the overview table identifies nodes running multiple replicas. - **Active replica IP** shown in the overview table — the dashboard now resolves which replica is active and displays the correct Mesh IP. #### Manual failover To manually promote a passive replica: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/?to=/:account/mesh), go to **Networking** > **Mesh**. 2. Select an HA-enabled node. 3. Select the passive replica tab. 4. Select **Promote to active** and confirm. Traffic reroutes to the promoted replica immediately. Refer to [High availability](https://developers.cloudflare.com/mesh/features/high-availability/) for details on failover behavior. ## 2026-05-27 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Write regex using natural language in Cloudflare One** [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) policy selectors which support regular expressions can now be authored in the dashboard using natural language. When building a [policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/expression-syntax/) with a regex-based selector (like `matches regex`), you can describe what you want to match in plain English and the Cloudflare Agent will generate and validate a corresponding regular expression. ![Write policy regex using natural language](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1000,height=638,format=webp/_astro/gateway-regex-ai-generation.CtJ0S6FS.png) To get started, select a regex-compatible selector in the [Gateway policy builder](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and select the icon. You'll see an input field for natural language, such as "any URL starting with /api/v1" or ".com, .net, and .app hosts which contain `gooogle` in the host." You can also use the tool to explain existing regular expressions. If a policy already contains a regex pattern, you can instantly generate a plain-language description. A built-in feedback mechanism allows you to rate each interaction to help improve output quality over time. For more information, refer to [Cloudflare One firewall policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and expect to see the same functionality supported soon in [Data loss prevention profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/). ## 2026-05-27 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Cloudflare Tunnel now runs connectivity pre-checks at startup** Starting with [`cloudflared` version 2026.5.2 ↗︎](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) automates the entire [connectivity pre-checks workflow](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked. ![cloudflared connectivity pre-checks output](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1012,format=webp/_astro/cloudflared-connectivity-prechecks.DRwN6tGe.gif) On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks: - **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs. - **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`. - **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates. Results are printed in a scannable CLI table with three states: - ✅ **Pass** — the check succeeded. - ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up. - ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`). If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors. Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide. To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/). ## 2026-05-26 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.4.1390.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Fixed a proxy mode connection stall issue. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-26 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.4.1390.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Fixed a proxy mode connection stall issue. **Known issues** - Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. ## 2026-05-26 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.4.1390.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. - Fixed a proxy mode connection stall issue. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-21 [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) **Granular permissions for Cloudflare Tunnel and Cloudflare Mesh** You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) instances and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. #### What is new When you [add a member](https://developers.cloudflare.com/fundamentals/manage-members/manage/) or create a [permission policy](https://developers.cloudflare.com/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) instances and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes as scopable resource types. You can: - Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions. - Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network. - Scope a single policy to one or many Tunnels and Mesh nodes at once. #### How it works Granular permissions are a parallel layer to existing account-level roles — they do not replace them. - **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens. - **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource. - **Resource enumeration is authorization-aware.** Listing endpoints ( `GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to. #### Get started - Configure [granular permissions for Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/guides/granular-permissions/). - Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://developers.cloudflare.com/cloudflare-one/networks/connectors/granular-permissions/). - Review the [resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference. ## 2026-05-19 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Cloudflare as identity provider and account membership selector** Cloudflare Access now supports using Cloudflare itself as an [identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/). If you publish an Access application and select Cloudflare as the login method, users can sign in with their existing Cloudflare account — no one-time PINs, no third-party IdP configuration, and no shared email inboxes. Authentication is backed by Cloudflare's own account security (including multi-factor authentication), making it both simpler to set up and more secure than OTP-based login for most use cases. Cloudflare is now the **default identity provider for all newly created Zero Trust accounts**, replacing One-time PIN. This also enables two new capabilities: - **Cloudflare Account Member selector** — A new [policy selector](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#selectors) that matches users based on their membership in a Cloudflare account. You can target the current account or specify a different account ID for cross-account access scenarios. - **Restrict to account members** — An identity provider configuration option that limits authentication to users who are members of your Cloudflare account. To get started, add Cloudflare as an [identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/) in your Zero Trust settings. ## 2026-05-19 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **CASB adds support for Claude Compliance API** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) now integrates with the [Claude Compliance API ↗︎](https://support.claude.com/en/articles/13015708-access-the-compliance-api). This enhancement gives security teams visibility into Claude usage patterns, admin activity, and compliance-relevant events across their organization. The Claude Compliance API provides structured access to audit logs and administrative actions within Claude Enterprise and Claude Platform. Cloudflare CASB ingests this data to surface security findings that help organizations enhance their security posture and enforce AI governance. #### Key capabilities Starting today, security teams can scan for security findings across the following assets: - **Public projects** — Projects set to public visibility - **Project attachment** — Files and documents added to projects that violate DLP policies - **Chat files** — User-uploaded and provider-generated files that violate DLP policies - **Chat messages** — User prompts and provider responses that violate DLP policies - **Artifacts** — Provider-generated documents and files that violate DLP policies #### Learn more This [integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) is available to all Cloudflare One customers. New Cloudflare customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the dashboard. The integration begins scanning immediately and surfaces findings in the dashboard within minutes. ## 2026-05-18 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) **Network Analytics support for Unified Routing** [Network Analytics](https://developers.cloudflare.com/analytics/network-analytics/) is now fully supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. Traffic that traverses Unified Routing onramps and offramps is now visible in Network Analytics with the same dimensions and filters as traffic on the standard data plane. This closes a parity gap for customers who had moved tunnels onto Unified Routing and lost visibility into their dataplane traffic in the Network Analytics dashboard. No configuration change is required — analytics data is collected automatically for all accounts with Unified Routing enabled. For the remaining beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-05-12 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Refreshed Access login page** The [Access login page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/) and [one-time password (OTP)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/) page now feature a refreshed design that improves visual consistency, user trust, and mobile responsiveness. **Before:** ![Screenshot of the previous Access login page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=532,height=906,format=webp/_astro/access-login-old.CwNVkCQH.png) **After:** ![Screenshot of the updated Access login page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=541,height=722,format=webp/_astro/access-login-new.Y7WUfg9G.png) The updated login experience includes: - **Unified authentication card** - All sign-in options (identity provider buttons, email input, OTP) now appear in a single card with consistent styling, replacing the previous multi-section layout. - **Consistent button styling** - Identity provider buttons use a uniform size and layout for easier scanning and selection. - **Better mobile experience** - Responsive layout improvements ensure the login page renders correctly on phones and tablets. - **Dark mode support** - The login page now supports dark mode. ## 2026-05-12 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New accounts assigned a single IPv4 anycast address** New Magic Transit and Cloudflare WAN accounts are now assigned a single IPv4 anycast address by default. Cloudflare handles failures on its network automatically by advertising your endpoint IP from multiple nodes across many globally distributed data centers. To handle failures on your network, configure two tunnels from separate routers. To request additional anycast IP addresses for your account, contact your account team. For tunnel configuration guidance, refer to [Configure tunnel endpoints](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-tunnel-endpoints/) for Cloudflare WAN or [Configure tunnel endpoints](https://developers.cloudflare.com/magic-transit/how-to/configure-tunnel-endpoints/) for Magic Transit. ## 2026-05-12 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Create Gateway firewall policies with natural language** Cloudflare Gateway now supports natural language policy creation for [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) firewall policies. Administrators can describe the outcome they want in plain language, and Cloudflare will generate a complete policy rule that populates the policy builder form. ![Create with AI button on the Gateway firewall policies page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2360,height=1088,format=webp/_astro/gateway-create-with-ai.BYG07coh.png) To create a policy with natural language, select **Create with AI** on any Gateway firewall policy tab. Choose a policy type, describe what the policy should do, and a fully configured rule will appear in the policy builder for review. You can edit any field before saving, or re-generate with a different prompt. The generated policy incorporates your account context - including lists, DLP profiles, applications, and device posture checks - so that references to your existing resources resolve automatically. A built-in feedback mechanism allows you to rate each generated policy and provide optional comments, which Cloudflare uses to improve output quality over time. For more information, refer to [Gateway firewall policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2026-05-11 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.4.1350.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. **Known issues** - Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. ## 2026-05-11 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.4.1350.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-11 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.4.1350.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-11 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) **NAT-T support for IKE on UDP port 500** Cloudflare IPsec now supports the standard NAT traversal (NAT-T) flow, where IKE begins on UDP port `500` and switches to UDP port `4500` after NAT is detected. Previously, devices behind NAT had to be configured to initiate IKE on UDP port `4500` directly. Devices that started on UDP port `500` could not complete the IKE handshake when NAT was in the path. This required custom configuration on devices such as VeloCloud SD-WAN edges, Cisco IOS-XE routers, and Juniper SRX firewalls, and was not possible on every platform. What changed: - Devices behind NAT can now initiate IKE on either UDP port `500` or UDP port `4500`. - Devices that start IKE on UDP port `500` and switch to UDP port `4500` after NAT detection now complete the handshake successfully. - No configuration change is required on Cloudflare. The change is available for all IPsec tunnels on Cloudflare WAN and Magic Transit. This change does not affect existing tunnels: - Tunnels using UDP port `500` with no NAT detected continue to operate as before. - Tunnels configured to start IKE on UDP port `4500` continue to operate as before. - NAT detection logic is unchanged. For configuration details, refer to [GRE and IPsec tunnels](https://developers.cloudflare.com/cloudflare-wan/reference/gre-ipsec-tunnels/). ## 2026-05-07 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Custom DHCP options on Cloudflare One Appliance** When the Cloudflare One Appliance is acting as the DHCP server for a LAN, you can now configure custom DHCP options on the leases it issues. This unlocks workflows such as PXE / iPXE boot, VoIP phone provisioning, and vendor-specific client configuration. Each option is defined by `option_number`, `value`, and one of four value types: `text`, `integer`, `hex`, or `ip`. Configurations are validated on the appliance before being applied — invalid configurations are rejected and the underlying error is returned to the API caller, so a bad option will not disrupt the live DHCP service. For details, refer to [DHCP server options](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/dhcp/dhcp-options/). ## 2026-05-07 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Source-based breakout and prioritization on Cloudflare One Appliance** Breakout and traffic prioritization rules on the Cloudflare One Appliance can now match by **source** in addition to destination application. You can pin breakout or priority behavior to: - A source LAN interface — VLANs attached to that LAN are included automatically. - A source IP address, range, or CIDR block. This is the natural way to break out a guest VLAN to the local Internet, or to prioritize traffic from a specific subnet, without enumerating destination applications. For details, refer to [Breakout traffic](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/#breakout-by-source). ## 2026-05-07 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Self-serve provisioning of Cloudflare One Virtual Appliance via API** You can now create, rotate, and delete Cloudflare One Virtual Appliance instances and their license keys directly via the API and Terraform. - Create a virtual appliance and receive a license key: `POST /accounts/{account_id}/magic/connectors` with `device.provision_license: true`. - Rotate the license key for an existing virtual appliance: `PATCH /accounts/{account_id}/magic/connectors/{connector_id}` with `provision_license: true`. The previous key is immediately and irrevocably revoked. - Delete a virtual appliance to release the associated licensed device. The license key is returned in the response only once, at create or rotate time. Copy and store it securely. For details, refer to [Configure a Cloudflare One Virtual Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-virtual-appliance/). ## 2026-05-06 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Cloudy Summaries in PhishNet O365** PhishNet users can now access **Cloudy summaries** directly within the email investigation experience. When reviewing a message in PhishNet, users will see an AI-generated summary that provides additional context and key details about the email. These summaries help users quickly understand the nature of a message without needing to manually parse through headers, body content, and detection signals. Cloudy surfaces the most relevant information so users can make faster, more informed decisions about suspicious emails. **These summaries are not trained on customer data.** They are generated using the outputs of our existing detection models and analysis systems. This feature is available for PhishNet with Office 365. Support for Gmail will be available by the end of the quarter. ## 2026-05-06 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **IPv6 CIDR routes for Cloudflare Mesh** [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes now support IPv6 CIDR routes. You can advertise both IPv4 and IPv6 subnets through your Mesh nodes, making IPv6-only or dual-stack private networks reachable from any enrolled device. ![IPv6 CIDR routes on a Mesh node in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2906,height=1352,format=webp/_astro/mesh-ipv6-routes.CC-jlZkw.png) To add an IPv6 route, follow the same steps as [adding an IPv4 route](https://developers.cloudflare.com/mesh/features/routes/#add-a-route) — enter the IPv6 CIDR (for example, `fd00::/64`) when configuring the route in the [dashboard ↗︎](https://dash.cloudflare.com/?to=/:account/mesh) or via the API. ## 2026-04-30 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Post-quantum IPsec interoperability with third-party devices** Cloudflare IPsec now supports post-quantum key agreement with compatible third-party devices. [Cisco ↗︎](https://www.cisco.com/) and [Fortinet ↗︎](https://www.fortinet.com/) are the first third-party vendors validated to interoperate with Cloudflare IPsec using ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). Post-quantum IPsec uses [RFC 9370 ↗︎](https://datatracker.ietf.org/doc/rfc9370/) and [draft-ietf-ipsecme-ikev2-mlkem ↗︎](https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-mlkem/) to negotiate hybrid key agreement during the IKEv2 `IKE_INTERMEDIATE` phase. This combines classical Diffie-Hellman (Group 20) with ML-KEM-768 or ML-KEM-1024 to protect against [harvest-now, decrypt-later ↗︎](https://en.wikipedia.org/wiki/Harvest_now,_decrypt_later) attacks. Key details: - Compatible with Cisco 8000 Series Secure Routers with IOS XR Release 26.1.1 and Fortinet FortiOS 7.6.6 and later. - Uses ML-KEM-768 or ML-KEM-1024 as an additional Key Exchange to DH Group 20. - Follows RFC 9370 and draft-ietf-ipsecme-ikev2-mlkem standards. - No additional licensing required. Post-quantum IPsec with third-party devices is now generally available with confirmed interoperability for the platforms listed above. Cloudflare intends to support interoperability with more vendors as they build out support for draft-ietf-ipsecme-ikev2-mlkem. Contact your account team to discuss support for additional vendors. For supported key exchange methods and the list of validated platforms, refer to [GRE and IPsec tunnels](https://developers.cloudflare.com/cloudflare-wan/reference/gre-ipsec-tunnels/#tested-third-party-vendor-interoperability). ## 2026-04-30 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Classify sensitive content with Data Classification** Cloudflare DLP now includes **Data Classification**, which lets administrators organize and label sensitive content using labels, templates, and reusable data classes. With Data Classification, administrators can define labels such as sensitivity schemas and levels, and data tag groups and tags. Administrators can also build from Cloudflare-managed templates and create reusable data classes that combine detection entries, other data classes, sensitivity levels, and data tags. You can then use those classifications in custom DLP profiles to identify the severity of sensitive content, understand where it exists, and apply that logic consistently across DLP profiles. For more information, refer to [Data Classification](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/data-classification/). ## 2026-04-30 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **New predefined detection entries are available** Cloudflare DLP now includes new predefined detection entries. The expanded catalog includes detections for specific credential types, webhooks, addresses, tax identifiers, national IDs, financial data, and crypto wallets. Examples include `GitHub PAT`, `OpenAI API Key`, `Slack Webhook`, `Discord Webhook`, `US Physical Address`, and `Bitcoin Wallet`. For the full list, refer to [Predefined detection entries](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/predefined-detection-entries/). ## 2026-04-29 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **Digital experience tests to authenticated resources and enhanced configuration** [Digital experience tests](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/) now support testing applications protected by Cloudflare Access or third-party authentication. All authentication secrets are managed via [Cloudflare Secret Store](https://developers.cloudflare.com/secrets-store/). Digital experience tests also have enhanced configuration options including: - New HTTP methods (DELETE, PATCH, POST, PUT) - Secret Store headers, custom plain text headers, and custom request bodies - Advanced settings: follow redirects, response bodies, response headers, and allow untrusted certificates ![Digital experience test configuration for Cloudflare Access applications](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2840,height=1374,format=webp/_astro/dex_test_auth_config.CD3G3zb_.png)![Digital experience enhanced test configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2840,height=1496,format=webp/_astro/dex_test_enhanced_config.Nsv7Vcob.png) ## 2026-04-29 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway Authorization Proxy and hosted PAC files are now generally available** The [Gateway Authorization Proxy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and [hosted PAC files](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) are now generally available for all plan types. Authorization proxy endpoints add an identity-aware option alongside the existing [source IP proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#source-ip-endpoint), using [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) authentication to verify who a user is before applying Gateway filtering — without installing the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). Cloudflare-hosted PAC files let you create and distribute PAC files directly from Cloudflare One on Cloudflare's global network. These features are ideal for environments where deploying a device client is not an option, such as virtual desktops (VDI) or compliance-restricted endpoints. To get started, refer to the [proxy endpoints documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/). ## 2026-04-28 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **Internet outage notifications for devices** [Digital Experience](https://developers.cloudflare.com/cloudflare-one/insights/dex/) will display a dashboard notification when an Internet outage or traffic anomaly may impact a [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) device based on its geographic location or network connection. This Internet outage and traffic anomaly data is pulled from [Cloudflare Radar ↗︎](https://radar.cloudflare.com/). All Internet outage and traffic anomaly observations can be viewed in the [Radar Outage Center ↗︎](https://radar.cloudflare.com/outage-center). ![Digital Experience Monitoring dashboard notification for Internet outage impacting Cloudflare One Client devices](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2076,height=314,format=webp/_astro/dex_radar_ux_notification.CpdrUVYA.png)![Digital Experience Monitoring dashboard analytics for Internet outage impacting Cloudflare One Client devices](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2068,height=909,format=webp/_astro/dex_radar_analytics.GaPxWM6C.png) ## 2026-04-28 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **Cloudflare One Client speed tests** IT teams can now remotely run speed tests from the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) to Cloudflare's network edge. Each speed test includes the following metrics: - Internet speed: download and upload throughput - Latency: download, upload, unloaded latency, and jitter - Network quality score: video streaming, webchat/real-time communication (RTC) In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Insights** > **Digital experience** > **Diagnostics** and select **Run diagnostics** to use the feature today. ![Cloudflare One client speed test result](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2906,height=1730,format=webp/_astro/dex_speed_test.DukupcRs.png) ## 2026-04-28 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Create and manage DLP detection entries outside of profiles** You can now create, view, and manage DLP detection entries outside of profiles. Detection entries are no longer hidden inside individual profiles. Administrators can manage detection entries directly from the **Detection entries** section and use them in custom DLP profiles. For more information, refer to [Configure detection entries](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/). ## 2026-04-28 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Detect PII records with a new predefined DLP profile** Cloudflare DLP now includes a new predefined profile designed to detect PII records that contain multiple types of personal data: **Personally Identifiable Information (PII) Record**. Most predefined and custom DLP profiles match when any enabled detection entry matches. The **Personally Identifiable Information (PII) Record** profile is different. It only matches when at least three unique detection entries are found in close proximity, which reduces false positives from standalone values that may not represent a real PII record. Detection entries included in the profile: - AU Passport Number - American Express Card Number - Diners Club Card Number - US Driver's License Number - Email Address - Full Name - US Mailing Address - Mastercard Card Number - US Individual Tax Identification Number (ITIN) - US Passport Number - US Phone Number - Union Pay Card Number - United States SSN Numeric Detection - Visa Card Number For more information, refer to [predefined DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ## 2026-04-24 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Network Session Logs now available for all on-ramps** [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) are now generated for all traffic proxied through Cloudflare Gateway, regardless of on-ramp type. This includes traffic from [proxy endpoints (PAC files)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) and [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) egress — on-ramps that previously did not generate session logs. Customers who already consume the `zero_trust_network_sessions` dataset via [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/) or [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/) may see increased log volume if they use these on-ramps. For field definitions, refer to [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/). For traffic analysis, refer to [Network session analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/network-sessions/). ## 2026-04-23 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **AAGUID restrictions and AMR matching for Access independent MFA** [Independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/) in Cloudflare Access now supports two additional organization-level controls: - **[Restrict authenticators by AAGUID](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#restrict-authenticators-by-aaguid)** — Limit enrollment to a specific set of WebAuthn authenticators using their [AAGUID ↗︎](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-registry-v2.0-id-20180227.html#authenticator-attestation-guid). This is useful for organizations that require FIPS-validated security keys or company-issued hardware. AAGUIDs are managed through a new [List](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/) type. - **[AMR matching](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#use-identity-provider-mfa)** — Skip the independent MFA prompt when the identity provider has already performed an equivalent MFA. Access reads the `amr` claim defined in [RFC 8176 ↗︎](https://datatracker.ietf.org/doc/html/rfc8176) and matches supported values such as `hwk`, `otp`, and `fpt` to the authenticator types allowed on the application or policy. This prevents users from having to complete MFA twice when their identity provider already enforces it. To get started, refer to [Independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/). ## 2026-04-21 [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Country rules supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Country rules are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. This feature requires a Cloudflare Advanced Network Firewall subscription. You can create firewall rules that match traffic based on source or destination country to enforce geographic access policies across your network. This is the first of the Cloudflare Advanced Network Firewall features to become available in Unified Routing. Support for additional features - IP Lists, ASN Lists, Threat Intel Lists, IDS, Rate Limiting, SIP, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-04-20 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Network session analytics dashboard** The new [Network session analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/network-sessions/) dashboard is now available in Cloudflare One. This dashboard provides visibility into your network traffic patterns, helping you understand how traffic flows through your Cloudflare One infrastructure. ![Cloudflare One Network Session Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2926,height=1574,format=webp/_astro/cf1-network-session-analytics.Gl90hEcp.png) #### What you can do with Network session analytics - **Analyze geographic distribution**: View a world map showing where your network traffic originates, with a list of top locations by session count. - **Monitor key metrics**: Track session count, total bytes transferred, and unique users. - **Identify connection issues**: Analyze connection close reasons to troubleshoot network problems. - **Review protocol usage**: See which network protocols (TCP, UDP, ICMP) are most used. #### Dashboard features - **Summary metrics**: Session count, bytes total, and unique users - **Traffic by location**: World map visualization and location list with top traffic sources - **Top protocols**: Breakdown of TCP, UDP, ICMP, and ICMPv6 traffic - **Connection close reasons**: Insights into why sessions terminated (client closed, origin closed, timeouts, errors) #### How to access 1. Log in to [Cloudflare One ↗︎](https://dash.cloudflare.com). 2. Go to **Zero Trust** > **Insights** > **Dashboards**. 3. Select **Network session analytics**. For more information, refer to the [Network session analytics documentation](https://developers.cloudflare.com/cloudflare-one/insights/analytics/network-sessions/). ## 2026-04-17 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Homepage and sign-out for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) display a homepage when users visit the portal domain in a browser. ![MCP server portal homepage showing connection status and setup instructions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1037,height=631,format=webp/_astro/portals-homepage-disconnected.BHbOwayQ.png) The homepage shows: - The portal name and organization branding - The MCP endpoint URL with a copy button - Per-client connection instructions for Claude Desktop, Workers AI Playground, OpenCode, Windsurf, and other MCP clients Authenticated users see their email address and a **Sign out** button. Selecting **Sign out** revokes all portal-level OAuth grants, deletes upstream server OAuth states, and redirects through Cloudflare Access logout. A confirmation page shows a summary of the revoked sessions. For more information, refer to [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#portal-homepage). ## 2026-04-15 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Independent MFA for Access applications** Cloudflare Access now supports independent multi-factor authentication (MFA), allowing you to enforce MFA requirements without relying on your identity provider (IdP). With per-application and per-policy configuration, you can enforce stricter authentication methods like hardware security keys on sensitive applications without requiring them across your entire organization. This reduces the risk of MFA fatigue for your broader user population while adding additional security where it matters most. This feature also addresses common gaps in IdP-based MFA, such as inconsistent MFA policies across different identity providers or the need for additional security layers beyond what the IdP provides. Independent MFA supports the following authenticator types: - **Authenticator application** — Time-based one-time passwords (TOTP) using apps like Google Authenticator, Microsoft Authenticator, or Authy. - **Security key** — Hardware security keys such as YubiKeys. - **Biometrics** — Built-in device authenticators including Apple Touch ID, Apple Face ID, and Windows Hello. Note Infrastructure applications do not yet support independent MFA. #### Configuration levels You can configure MFA requirements at three levels: | Level | Description | | --- | --- | | **Organization** | Enforce MFA by default for all applications in your account. | | **Application** | Require or turn off MFA for a specific application. | | **Policy** | Require or turn off MFA for users who match a specific policy. | Settings at lower levels (policy) override settings at higher levels (organization), giving you granular control over MFA enforcement. #### User enrollment Users enroll their authenticators through the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/). To help with onboarding, administrators can share a direct enrollment link: `.cloudflareaccess.com/AddMfaDevice`. To get started with Independent MFA, refer to [Independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/). ## 2026-04-15 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New, streamlined creation experience for Access Applications and Gateway Policies** The Cloudflare One dashboard now features redesigned builders for two core workflows: creating Gateway policies and configuring self-hosted Access applications. #### Gateway rule builder The Gateway rule builder now features a redesigned user experience, bringing it in line with the Access policy builder experience. Improvements include: - **Streamlined UX** with clearer states and improved user interactions - **Wirefilter editing** for viewing and editing Gateway rules directly from wirefilter expressions - **Preview state** to review the impact of your policy in a simple graphic ![New Gateway rule builder](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1280,height=1494,format=webp/_astro/gateway-rule-builder.BxvzsN8s.png) For more information, refer to [Traffic policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). #### Access application builder for self-hosted apps The self-hosted Access application builder now offers a simplified creation workflow with fewer steps from setup to save. Improvements include: - **New application selection experience** that makes choosing the right application type before you begin easier. - **Streamlined creation flow** with fewer clicks to build and save an application - **Inline policy creation** for building Access policies directly within the application creation flow - **Preview state** to understand how your policies enforce user access before saving ![New Access application builder](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1970,height=1104,format=webp/_astro/access-application-builder.B__yqGin.png) For more information, refer to [self-hosted applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/). ## 2026-04-15 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **Last seen timestamp for Cloudflare One Client devices is more consistent** The last seen timestamp for [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) devices is now more consistent across the dashboard. IT teams will see more consistent information about the most recent client event between a device and Cloudflare's network. ## 2026-04-14 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **DLP account-level settings** **Account-level DLP settings are now available** in Cloudflare One. You can now configure advanced DLP settings at the account level, including OCR, AI context analysis, and payload masking. This provides consistent enforcement across all DLP profiles and simplifies configuration management. Key changes: - **Consistent enforcement**: Settings configured at the account level apply to all DLP profiles - **Simplified migration**: Settings enabled on any profile are automatically migrated to account level - **Deprecation notice**: Profile-level advanced settings will be deprecated in a future release **Migration details:** During the migration period, if a setting is enabled on any profile, it will automatically be enabled at the account level. This means profiles that previously had a setting disabled may now have it enabled if another profile in the account had it enabled. Settings are evaluated using OR logic - a setting is enabled if it is turned on at either the account level or the profile level. However, profile-level settings cannot be enabled when the account-level setting is off. For more details, refer to the [DLP settings documentation](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-settings/). ## 2026-04-14 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Introducing Cloudflare Mesh** [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) is now available ([blog post ↗︎](https://blog.cloudflare.com/mesh/)). Mesh connects your services and devices with post-quantum encrypted networking, allowing you to route traffic privately between servers, laptops, and phones over TCP, UDP, and ICMP. ![Cloudflare Mesh network map showing nodes and devices connected through Cloudflare](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2070,height=875,format=webp/_astro/mesh-network-map.CED6jNHK.gif) #### What Cloudflare Mesh does - Assigns a private [Mesh IP](https://developers.cloudflare.com/mesh/concepts/#mesh-ips) to every enrolled device and node. - Enables any participant to reach any other participant by IP — including client-to-client, without deploying any infrastructure. - Supports [CIDR routes](https://developers.cloudflare.com/mesh/features/routes/) for subnet routing through Mesh nodes. - Supports [high availability](https://developers.cloudflare.com/mesh/features/high-availability/) with active-passive replicas for nodes with routes. - All traffic flows through Cloudflare, so [Gateway network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/), [device posture checks](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/), and access rules apply to every connection. #### What changed - **WARP Connector** is now **Cloudflare Mesh**. Existing WARP Connectors are now called mesh nodes. All existing deployments continue to work — no migration required. - **Peer-to-peer connectivity** is now called **Mesh connectivity** and is part of the Cloudflare Mesh documentation. - **Mesh node limit** increased from 10 to **50 per account**. - New [dashboard experience ↗︎](https://dash.cloudflare.com/?to=/:account/mesh) at **Networking** > **Mesh** with an interactive network map, node management, route configuration, diagnostics, and a setup wizard. #### Get started Refer to the [Cloudflare Mesh documentation](https://developers.cloudflare.com/mesh/) to set up your first Mesh network. ## 2026-04-14 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Detect Cloudflare API tokens with DLP** The **Credentials and Secrets** DLP profile now includes three new predefined entries for detecting Cloudflare API credentials: | Entry name | Token prefix | Detects | | --- | --- | --- | | Cloudflare User API Key | `cfk_` | User-scoped API keys | | Cloudflare User API Token | `cfut_` | User-scoped API tokens | | Cloudflare Account Owned API Token | `cfat_` | Account-scoped API tokens | These detections target the new [Cloudflare API credential format](https://developers.cloudflare.com/fundamentals/api/get-started/token-formats/), which uses a structured prefix and a CRC32 checksum suffix. The identifiable prefix makes it possible to detect leaked credentials with high confidence and low false positive rates — no surrounding context such as `Authorization: Bearer` headers is required. Credentials generated before this format change will not be matched by these entries. #### How to enable Cloudflare API token detections 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **DLP** > **DLP Profiles**. 2. Select the **Credentials and Secrets** profile. 3. Turn on one or more of the new Cloudflare API token entries. 4. Use the profile in a Gateway HTTP policy to log or block traffic containing these credentials. Example policy: | Selector | Operator | Value | Action | | --- | --- | --- | --- | | DLP Profile | in | *Credentials and Secrets* | Block | You can also enable individual entries to scope detection to specific credential types — for example, enabling **Account Owned API Token** detection without enabling **User API Key** detection. For more information, refer to [predefined DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ## 2026-04-14 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Configure how sensitive data appears in DLP payload logs** You can now configure how sensitive data matches are displayed in your DLP payload match logs — giving your incident response team the context they need to validate alerts without compromising your security posture. To get started, go to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), select **Zero Trust** > **Data loss prevention** > **DLP settings** and find the **Payload log masking** card. Previously, all DLP payload logs used a single masking mode that obscured matched data entirely and hid the original character count, making it difficult to distinguish true positives from false positives. This update introduces three options: - **Full Mask (default):** Masks the match while preserving character count and visual formatting (for example, `***-**-****` for a Social Security Number). This is an improvement over the previous default, which did not preserve character count. - **Partial Mask:** Reveals 25% of the matched content while masking the remainder (for example, `***-**-6789`). - **Clear Text:** Stores the full, unmasked violation for deep investigation (for example, `123-45-6789`). **Important:** The masking level you select is applied at detection time, before the payload is encrypted. This means the chosen format is what your team will see after decrypting the log with your private key — the existing encryption workflow is unchanged. **Applies to all enabled detections:** When a masking level other than Full Mask is selected, it applies to all sensitive data matches found within a payload window — not just the match that triggered the policy. Any data matched by your enabled DLP detection entries will be masked at the selected level. For more information, refer to [DLP logging options](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules). ## 2026-04-10 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) **Canvas Remoting optimizes performance for productivity applications** Remote Browser Isolation now supports **Canvas Remoting**, improving performance for HTML5 Canvas applications by sending vector draw commands instead of rasterized bitmaps. #### Key improvements - **10x bandwidth reduction:** Microsoft Word and other Office apps use 90% less bandwidth - **Smooth performance:** Google Sheets maintains consistent 30fps rendering - **Responsive terminals:** Web-based development environments and AI notebooks work in real-time - **Zero configuration:** Enabled by default for all Browser Isolation customers #### How it works Instead of sending rasterized bitmaps for every Canvas update, Browser Isolation now: 1. Captures Canvas draw commands at the source 2. Converts them to lightweight vector instructions 3. Renders Canvas content on the client This reduces bandwidth from hundreds of kilobytes per second to tens of kilobytes per second. #### Managing Canvas Remoting To temporarily disable for troubleshooting: - Right-click the isolated webpage background - Select **Disable Canvas Remoting** - Re-enable the same way by selecting **Enable Canvas Remoting** #### Limitations Currently supports 2D Canvas contexts only. WebGL and 3D graphics applications continue using bitmap rendering. For more information, refer to [Canvas Remoting](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/canvas-remoting/). ## 2026-04-09 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **Send CASB posture finding instances with webhooks** You can now use **CASB webhooks** in Cloudflare One to send posture finding instances to external systems such as chat platforms, ticketing systems, SIEMs, SOAR tools, and custom automation services. This gives security teams a simple way to route CASB posture findings into the tools and workflows they already use for triage and response. To get started, go to **Integrations** > **Webhooks** in the Cloudflare One dashboard to create a webhook destination. After you configure a webhook, open a posture finding instance and select **Send webhook** to send it. #### Key capabilities - **Flexible authentication** — Configure destinations using **None**, **Basic Auth**, **Bearer Auth**, **Static Headers**, or **HMAC-Signing**. - **Built-in testing** — Use **Test delivery** to send a test request before sending a live finding instance. - **Posture finding workflows** — Send posture finding instances directly from the finding details workflow in **Cloud & SaaS findings**. - **HTTPS destinations** — Configure webhook destinations with public `https://` URLs. #### Learn more - Configure [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/) in Cloudflare. - Learn how to [manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare. CASB webhooks are now available in Cloudflare One. ## 2026-04-08 [Risk Score](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) **User risk scoring for high risk browsing activity** Cloudflare One's **User Risk Scoring** now incorporates direct signals from **Gateway DNS traffic patterns**. This update allows security teams to automatically elevate a user's risk score when they visit high-risk or malicious domains, providing a more holistic view of internal threats. #### Why this matters Browsing activity is a primary indicator of potential compromise. By tying Gateway DNS logs to specific users, administrators can now flag individuals interacting with: - **Security threats**: Domains associated with malware, phishing, or command-and-control (C2) centers. - **High-risk content**: Categories such as questionable content or violence that may violate corporate compliance. Even if a Gateway policy is set to **Block** the traffic, the interaction is still captured as a "hit" to ensure the user's risk profile reflects the attempted activity. #### New risk behaviors Two new behaviors are now available in the dashboard: - **Suspicious Security Domain Visited**: Triggers when a user visits a domain in the security threats or security risk categories. - **High risk domain visited**: Triggers when a user visits domains categorized as questionable content, violence, or CIPA. To learn more and get started, refer to the [User Risk Scoring documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/). ## 2026-04-07 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Windows (version 2026.3.851.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for Windows will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** - Fixed an issue causing Windows client tunnel interface initialization failure which prevented clients from establishing a tunnel for connection. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. - Fixed packet capture failing on tunnel interface when the tunnel interface is renamed by SCCM VPN boundary support. - Fixed unnecessary registration deletion caused by RDP connections in multi-user mode. - Fixed increased tunnel interface start-up time due to a race between duplicate address detection (DAD) and disabling NetBT. - Fixed tunnel failing to connect when the system DNS search list contains unexpected characters. - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. - Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. - Fixed an issue where degraded Windows Management Instrumentation (WMI) state could put the client in a failed connection state loop during initialization. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. This warning will be omitted from future release notes. This Windows update was released in July 2025. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. This warning will be omitted from future release notes. This Microsoft Security Intelligence update was released in May 2025. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. ## 2026-04-07 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **User Submission Triage Status Tracking** Cloudflare Email security now supports **Triage Status Tracking for User Submissions**. This enhancement gives SOC teams a streamlined way to track, manage, and prioritize user-submitted emails directly within the Cloudflare One dashboard. - The User Submissions table now includes a **Status** column with three states: **Unreviewed** (new submissions awaiting triage), **Reviewed** (submissions assessed by the SOC team), and **Escalated** (submissions escalated to team submissions for further investigation). Analysts can quickly update statuses and filter the table to focus on what needs attention. - SOC teams can now organize their triage workflows, avoid duplicate reviews, and make sure critical threats get escalated for deeper investigation—bringing order to the chaos of high-volume submission management. Triage Status Tracking is **automatically available** for all Email security customers using the user submissions feature. No additional configuration is required; customers just need to make sure user submissions are being sent to their user submission aliases. This applies to all Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-04-07 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Link aggregation (LACP) support for Cloudflare One Appliance** Cloudflare One Appliance now supports Link Aggregation Control Protocol (LACP), allowing you to bundle up to six physical LAN ports into a single logical interface. Link aggregation increases available bandwidth and eliminates single points of failure on the LAN side of the appliance. This feature is available in beta on physical appliance hardware with the latest OS. No entitlement is required. To configure a Link Aggregation Group, refer to [Configure link aggregation groups](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/link-aggregation/). ## 2026-04-06 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **DANE Support for MX Deployments** Cloudflare Email Security now supports DANE (DNS-based Authentication of Named Entities) for MX deployments. This enhancement strengthens email transport security by enabling DNSSEC-backed certificate verification for our regional MX records. - Regional MX hostnames now publish DANE TLSA records backed by DNSSEC, enabling DANE-capable SMTP senders to cryptographically validate certificate identities before establishing TLS connections—moving beyond opportunistic encryption to verified encrypted delivery. - DANE support is automatically available for all customers using regional MX deployments. No additional configuration is required; DANE-capable mail infrastructure will automatically validate MX certificates using the published records. This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-04-06 [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Organizations](https://developers.cloudflare.com/fundamentals/organizations/) **Organizations is now in public beta for enterprises** We're announcing the public beta of **Organizations** for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location. **What's New** **Organizations \[BETA]**: [Organizations](https://developers.cloudflare.com/fundamentals/organizations/) are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 accounts and 5000 zones, giving larger teams a single place to administer resources at scale. **Self-serve onboarding**: Enterprise customers can [create an Organization](https://developers.cloudflare.com/fundamentals/organizations/setup/) in the dashboard and assign accounts where they are already Super Administrators. **Centralized Account Management**: At launch, every Organization member has the Organization Super Admin role. Organization Super Admins can invite other users and manage any child account under the Organization implicitly. **Shared policies**: Share [WAF](https://developers.cloudflare.com/waf/custom-rules/) or [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/tiered-policies/organizations/) policies across multiple accounts within your Organization to simplify centralized policy management. **Implicit access**: Members of an Organization automatically receive Super Administrator permissions across child accounts, removing the need for explicit membership on each account. Additional Org-level roles will be available over the course of the year. **Unified analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts from a single dashboard for centralized visibility into traffic patterns and security events. **Terraform provider support**: Manage Organizations with infrastructure as code from day one. Provision organizations, assign accounts, and configure settings programmatically with the [Cloudflare Terraform provider ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/organization). **Shared policies**: Share [WAF](https://developers.cloudflare.com/waf/custom-rules/) or [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) policies across multiple accounts within your Organization to simplify centralized policy management. Note Organizations is in Public Beta. You must have an Enterprise account to create an organization, but once created, you can add accounts of any plan type where you are a Super Administrator. For more info: - [Get started with Organizations](https://developers.cloudflare.com/fundamentals/organizations/) - [Set up your Organization](https://developers.cloudflare.com/fundamentals/organizations/setup/) - [Review limitations](https://developers.cloudflare.com/fundamentals/organizations/limitations/) ## 2026-04-02 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for macOS (version 2026.3.846.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for macOS will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. - Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. ## 2026-04-02 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Client for Linux (version 2026.3.846.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for Linux will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. - Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. ## 2026-04-02 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Session management for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support in-session management of upstream MCP server connections. Users can return to the server selection page at any time to enable or disable servers, reauthenticate, or change which data a server has access to — all without leaving their MCP client. To return to the server selection page, ask your AI agent with a prompt like "take me back to the server selection page." The portal responds with an authorization URL via [MCP elicitation ↗︎](https://modelcontextprotocol.io/specification/2025-03-26/server/elicitation) that you open in your browser: ```txt https://./authorize?elicitationId= ``` From the server selection page you can: - **Enable or disable servers** — Toggle individual upstream MCP servers on or off. Disabling a server removes its tools from the active session, which reduces context window usage. - **Log out and reauthenticate** — Log out of a server and log back in to change which data the server has access to, or to reauthenticate with different permissions. Users can also enable or disable a server inline by asking their AI agent directly, for example "enable the wiki server" or "disable my Jira server." The portal also automatically prompts connected users to authorize new servers when an admin adds them to the portal. This requires the use of [managed OAuth](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/#enable-managed-oauth-on-an-mcp-server-portal). For more information, refer to [Manage portal sessions](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#manage-portal-sessions). ## 2026-04-01 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Logs UI refresh** Access authentication logs and Gateway activity logs (DNS, Network, and HTTP) now feature a refreshed user interface that gives you more flexibility when viewing and analyzing your logs. ![Screenshot of the new logs UI showing DNS query logs with customizable columns and filtering options](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2984,height=842,format=webp/_astro/cf1-new-logs-ui.DxF4x0l-.png) The updated UI includes: - **Filter by field** - Select any field value to add it as a filter and narrow down your results. - **Customizable fields** - Choose which fields to display in the log table. Querying for fewer fields improves log loading performance. - **View details** - Select a timestamp to view the full details of a log entry. - **Switch to classic view** - Return to the previous log viewer interface if needed. For more information, refer to [Access authentication logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). ## 2026-03-26 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Code Mode for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support [Code Mode MCP server patterns](https://developers.cloudflare.com/agents/model-context-protocol/codemode/), a technique that reduces context window usage by replacing individual tool definitions with a single code execution tool. Code Mode is turned on by default on all portals. To turn it off, edit the portal in **Access controls** > **AI controls** and turn off **Code Mode** under **Basic information**. When Code Mode is active, the portal exposes a single `code` tool instead of listing every tool from every upstream MCP server. The connected AI agent writes JavaScript that calls typed `codemode.*` methods for each upstream tool. The generated code runs in an isolated [Dynamic Worker](https://developers.cloudflare.com/dynamic-workers/) environment, keeping authentication credentials and environment variables out of the model context. To use Code Mode, append `?codemode=search_and_execute` to your portal URL when connecting from an MCP client: ```txt https://./mcp?codemode=search_and_execute ``` For more information, refer to [Code Mode](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode). ## 2026-03-26 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Context optimization for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support two context optimization options that reduce how many tokens tool definitions consume in the model's context window. Both options are activated by appending the `optimize_context` query parameter to the portal URL. #### `minimize_tools` Strips tool descriptions and input schemas from all upstream tools, leaving only their names. The portal exposes a special `query` tool that agents use to retrieve full definitions on demand. This provides up to 5x savings in token usage. ```txt https://./mcp?optimize_context=minimize_tools ``` #### `search_and_execute` Hides all upstream tools and exposes only two tools: `query` and `execute`. The `query` tool searches and retrieves tool definitions. The `execute` tool runs the upstream tools in an isolated [Dynamic Worker](https://developers.cloudflare.com/dynamic-workers/) environment. This reduces the initial token cost to a small constant, regardless of how many tools are available through the portal. ```txt https://./mcp?optimize_context=search_and_execute ``` For more information, refer to [Optimize context](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#optimize-context). ## 2026-03-26 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Streaming ZIP file scanning removes per-file size limits** DLP now processes ZIP files using a streaming handler that scans archive contents element-by-element as data arrives. This removes previous file size limitations and improves memory efficiency when scanning large archives. Microsoft Office documents (DOCX, XLSX, PPTX) also benefit from this improvement, as they use ZIP as a container format. This improvement is automatic — no configuration changes are required. ## 2026-03-25 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Detect and sanitize HAR files** HTTP Archive (HAR) files are used by engineering and support teams to capture and share web traffic logs for troubleshooting. However, these files routinely contain highly sensitive data — including session cookies, authorization headers, and other credentials — that can pose a significant risk if uploaded to third-party services without being reviewed or cleaned first. Gateway now includes a predefined DLP profile called **Unsanitized HAR** that detects HAR files in HTTP traffic. You can use this profile in a Gateway HTTP policy to either block HAR file uploads entirely or redirect users to a sanitization tool before allowing the upload to proceed. #### How to configure a HAR file policy In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Firewall Policies** > **HTTP** and create a new HTTP policy using the **DLP Profile** selector: | Selector | Operator | Value | Action | | --- | --- | --- | --- | | DLP Profile | in | *Unsanitized HAR* | | Then choose one of the following actions: - **Block**: Prevents the upload of any HAR file that has not been sanitized by Cloudflare's sanitizer. Use this for strict environments where HAR file sharing must be disallowed entirely. - **Block** with **Gateway Redirect**: Intercepts the upload and redirects the user to `https://har-sanitizer.pages.dev/`, where they can sanitize the file. Once sanitized, the user can re-upload the clean file and proceed with their workflow. #### Sanitized HAR recognition HAR files processed by the Cloudflare HAR sanitizer receive a tamper-evident sanitized marker. DLP recognizes this marker and will not re-trigger the policy on a file that has already been sanitized and has not been modified since. If a previously sanitized file is edited, it will be treated as unsanitized and flagged again. #### Visibility in Gateway logs Gateway logs will reflect whether a detected HAR file was classified as **Unsanitized** or **Sanitized**, giving your security team full visibility into HAR file activity across your organization. For more information, refer to [predefined DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ## 2026-03-24 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **OIDC Claims filtering now available in Gateway Firewall, Resolver, and Egress policies** Cloudflare Gateway now supports [OIDC Claims](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/#oidc-claims) as a selector in Firewall, Resolver, and Egress policies. Administrators can use custom OIDC claims from their identity provider to build fine-grained, identity-based traffic policies across all Gateway policy types. With this update, you can: - Filter traffic in [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) firewall policies based on OIDC claim values. - Apply custom [resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) to route DNS queries to specific resolvers depending on a user's OIDC claims. - Control [egress policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/) to assign dedicated egress IPs based on OIDC claim attributes. For example, you can create a policy that routes traffic differently for users with `department=engineering` in their OIDC claims, or restrict access to certain destinations based on a user's role claim. To get started, configure [custom OIDC claims](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/#custom-oidc-claims) on your identity provider and use the **OIDC Claims** selector in the Gateway policy builder. For more information, refer to [Identity-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/). ## 2026-03-20 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Managed OAuth for Cloudflare Access** Cloudflare Access supports managed OAuth, which allows non-browser clients — such as CLIs, AI agents, SDKs, and scripts — to authenticate with Access-protected applications using a standard OAuth 2.0 authorization code flow. Previously, non-browser clients that attempted to access a protected application received a `302` redirect to a login page they could not complete. The established workaround was `cloudflared access curl`, which required installing additional tooling. With managed OAuth, clients instead receive a `401` response with a `WWW-Authenticate` header that points to Access's OAuth discovery endpoints ([RFC 8414 ↗︎](https://datatracker.ietf.org/doc/html/rfc8414) and [RFC 9728 ↗︎](https://datatracker.ietf.org/doc/html/rfc9728)). The client opens the end user's browser to the Access login page. The end user authenticates with their identity provider, and the client receives an OAuth access token for subsequent requests. Access enforces the same policies as a browser login; the OAuth layer is a new transport mechanism, not a separate authentication path. Managed OAuth can be enabled on any self-hosted Access application or [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/). It is opt-in for existing applications to avoid interfering with those that run their own OAuth servers and rely on their own `WWW-Authenticate` headers. Note For MCP server portals, managed OAuth is enabled by default on new portals. It remains opt-in for self-hosted applications. To enable managed OAuth, go to **Zero Trust** > **Access controls** > **Applications**, edit the application, and turn on **Managed OAuth** under **Advanced settings**. You can also enable it via the API by setting `oauth_configuration.enabled` to `true` on the [Access applications endpoint](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/update/). ![Managed OAuth settings in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2914,height=1042,format=webp/_astro/managed-oauth.BirLnBpy.png) For setup instructions, refer to [Enable managed OAuth](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/). ## 2026-03-20 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Route MCP server portal traffic through Cloudflare Gateway** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now route traffic through [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) for richer HTTP request logging and data loss prevention (DLP) scanning. When Gateway routing is turned on, portal traffic appears in your [Gateway HTTP logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). You can create [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) with [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/) to detect and block sensitive data sent to upstream MCP servers. Note DLP [AI prompt profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#ai-prompt) do not apply to MCP server portal traffic. To enable Gateway routing, go to **Access controls** > **AI controls**, edit the portal, and turn on **Route traffic through Cloudflare Gateway** under **Basic information**. ![Route MCP server portal traffic through Cloudflare Gateway](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1568,height=158,format=webp/_astro/portal-route-through-gateway.0KMUAXBm.png) For more details, refer to [Route traffic through Gateway](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#route-portal-traffic-through-gateway). ## 2026-03-20 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Stream logs from multiple replicas of Cloudflare Tunnel simultaneously** In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all [replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) of that tunnel and supports streaming logs from multiple replicas at once. ![View replicas and stream logs from multiple connectors](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1040,format=webp/_astro/tunnel-multiconn.DEOEaLlu.gif) Previously, you could only stream logs from one replica at a time. With this update: - **Replicas on the tunnel overview** — All active replicas for the selected tunnel now appear on that tunnel's overview page under **Connectors**. Select any replica to stream its logs. - **Multi-connector log streaming** — Stream logs from multiple replicas simultaneously, making it easier to correlate events across your infrastructure during debugging or incident response. To try it out, log in to [Cloudflare One ↗︎](https://one.dash.cloudflare.com/) and go to **Networks** > **Connectors** > **Cloudflare Tunnels**. Select **View logs** next to the tunnel you want to monitor. For more information, refer to [Tunnel log streams](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) and [Deploy replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas/). ## 2026-03-15 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Unlimited result paging in Investigations** Investigations now support unlimited result paging in both the dashboard and the API, removing the previous 1,000-record cap. Security teams can page through complete result sets when searching across large mail volumes, giving SOC analysts and automated workflows deeper visibility for forensics and threat hunting. In the dashboard, infinite paging is now supported in the Investigations view. The 1,000-record ceiling has been removed, so you can navigate through the full result set directly in the UI. The [Investigations API](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/methods/list) now returns up to 10,000 records per page (up from 1,000), with no cap on total result volume across pages. For high-volume use cases, we recommend: - **[Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/email-security-logs/) to a SIEM** for full-fidelity datasets and long-term retention. - **SOAR playbooks** against the async bulk action API for large-scale remediation. Bulk actions initiated from the dashboard remain capped at 1,000 messages per action. - **The Investigations API** for report exports larger than 1,000 results, which is the dashboard download cap. This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-03-10 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for macOS (version 2026.3.566.1)** A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and introduces a brand new visual style for the client interface. The new Cloudflare One Client interface changes connectivity management from a toggle to a button and brings useful connectivity settings to the home screen. The redesign also introduces a collapsible navigation bar. When expanded, more client information can be accessed including connectivity, settings, and device profile information. If you have any feedback or questions, visit the [Cloudflare Community forum](https://community.cloudflare.com/t/introducing-the-new-cloudflare-one-client-interface/901362) and let us know. **Changes and improvements** - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed emergency disconnect state from a previous organization incorrectly persisting after switching organizations. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm to Cubic for improved reliability across platforms. - Fixed initiating managed network detection checks when no network is available, which caused device profile flapping. **Known issues** - The client may become stuck in a `Connecting` state. To resolve this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Alternatively, change the client's operation mode. - The client may display an empty white screen upon the device waking from sleep. To resolve this issue, exit and then open the client to re-launch it. - Canceling login during a single MDM configuration setup results in an empty page with no way to resume authentication. To work around this issue, exit and relaunch the client. ## 2026-03-10 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Windows (version 2026.3.566.1)** A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and introduces a brand new visual style for the client interface. The new Cloudflare One Client interface changes connectivity management from a toggle to a button and brings useful connectivity settings to the home screen. The redesign also introduces a collapsible navigation bar. When expanded, more client information can be accessed including connectivity, settings, and device profile information. If you have any feedback or questions, visit the [Cloudflare Community forum](https://community.cloudflare.com/t/introducing-the-new-cloudflare-one-client-interface/901362) and let us know. **Changes and improvements** - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm to Cubic for improved reliability across platforms. - Fixed packet capture failing on tunnel interface when the tunnel interface is renamed by SCCM VPN boundary support. - Fixed unnecessary registration deletion caused by RDP connections in multi-user mode. - Fixed increased tunnel interface start-up time due to a race between duplicate address detection (DAD) and disabling NetBT. - Fixed tunnel failing to connect when the system DNS search list contains unexpected characters. - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed emergency disconnect state from a previous organization incorrectly persisting after switching organizations. - Fixed initiating managed network detection checks when no network is available, which caused device profile flapping. **Known issues** - The client may unexpectedly terminate during captive portal login. To work around this issue, use a web browser to authenticate with the captive portal and then re-launch the client. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - The client may become stuck in a `Connecting` state. To resolve this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Alternatively, change the client's operation mode. - The client may display an empty white screen upon the device waking from sleep. To resolve this issue, exit and then open the client to re-launch it. - Canceling login during a single MDM configuration setup results in an empty page with no way to resume authentication. To work around this issue, exit and relaunch the client. - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. This warning will be omitted from future release notes. This Microsoft Security Intelligence update was released in May 2025. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. ## 2026-03-04 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **User risk score selector in Access policies** You can now use [user risk scores](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) in your [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). The new **User Risk Score** selector allows you to create Access policies that respond to user behavior patterns detected by Cloudflare's risk scoring system, including impossible travel, high DLP policy matches, and more. For more information, refer to [Use risk scores in Access policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/#use-risk-scores-in-access-policies). ## 2026-03-04 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway Authorization Proxy and hosted PAC files (open beta)** The [Gateway Authorization Proxy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and [PAC file hosting](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) are now in open beta for all plan types. Previously, [proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#source-ip-endpoint) relied on static source IP addresses to authorize traffic, providing no user-level identity in logs or policies. The new authorization proxy replaces IP-based authorization with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) authentication, verifying who a user is before applying Gateway filtering without installing the WARP client. This is ideal for environments where you cannot deploy a device client, such as virtual desktops (VDI), mergers and acquisitions, or compliance-restricted endpoints. #### Key capabilities - **Identity-aware proxy traffic** — Users authenticate through your identity provider (Okta, Microsoft Entra ID, Google Workspace, and others) via Cloudflare Access. Logs now show exactly which user accessed which site, and you can write [identity-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/) like "only the Finance team can access this accounting tool." - **Multiple identity providers** — Display one or multiple login methods simultaneously, giving flexibility for organizations managing users across different identity systems. - **Cloudflare-hosted PAC files** — Create and host [PAC files](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) directly in Cloudflare One with pre-configured templates for Okta and Azure, hosted at `https://pac.cloudflare-gateway.com//` on Cloudflare's global network. - **Simplified billing** — Each user occupies a seat, exactly like they do with the Cloudflare One Client. No new metrics to track. #### Get started 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Traffic controls** > **Proxy endpoints**. 2. [Create an authorization proxy endpoint](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and configure Access policies. 3. [Create a hosted PAC file](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) or write your own. 4. [Configure browsers](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#3b-configure-browser-to-use-pac-file) to use the PAC file URL. 5. [Install the Cloudflare certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) for HTTPS inspection. For more details, refer to the [proxy endpoints documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) and the [announcement blog post ↗︎](https://blog.cloudflare.com/gateway-authorization-proxy-identity-aware-policies/). ## 2026-03-02 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Copy Cloudflare One resources as JSON or POST requests** You can now copy Cloudflare One resources as JSON or as a ready-to-use API POST request directly from the dashboard. This makes it simple to transition workflows into API calls, automation scripts, or infrastructure-as-code pipelines. To use this feature, click the overflow menu (⋮) on any supported resource and select **Copy as JSON** or **Copy as POST request**. The copied output includes only the fields present on your resource, giving you a clean and minimal starting point for your own API calls. Initially supported resources: - Access applications - Access policies - Gateway policies - Resolver policies - Service tokens - Identity providers We will continue to add support for more resources throughout 2026. ## 2026-03-01 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Clipboard controls for browser-based RDP** You can now configure clipboard controls for browser-based RDP with Cloudflare Access. Clipboard controls allow administrators to restrict whether users can copy or paste text between their local machine and the remote Windows server. ![Enable users to copy and paste content from their local machine to remote RDP sessions in the Cloudflare One dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2000,height=546,format=webp/_astro/rdp-clipboard-controls.B0ZmliDb.png) This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting clipboard access, you can prevent sensitive data from being transferred out of the remote session to a user's personal device. #### Configuration options Clipboard controls are configured per policy within your Access application. For each policy, you can independently allow or deny: - **Copy from local client to remote RDP session** — Users can copy/paste text from their local machine into the browser-based RDP session. - **Copy from remote RDP session to local client** — Users can copy/paste text from the browser-based RDP session to their local machine. By default, both directions are denied for new policies. For existing Access applications created before this feature was available, clipboard access remains enabled to preserve backwards compatibility. When a user attempts a restricted clipboard action, the clipboard content is replaced with an error message informing them that the action is not allowed. For more information, refer to [Clipboard controls for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#clipboard-controls). ## 2026-02-27 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Export MCP server portal logs with Logpush** Availability Only available on Enterprise plans. [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) now supports [Logpush](https://developers.cloudflare.com/logs/logpush/) integration. You can automatically export MCP server portal activity logs to third-party storage destinations or security information and event management (SIEM) tools for analysis and auditing. #### Available log fields The MCP server portal logs dataset includes fields such as: - `Datetime` — Timestamp of the request - `PortalID` / `PortalAUD` — Portal identifiers - `ServerID` / `ServerURL` — Upstream MCP server details - `Method` — JSON-RPC method (for example, `tools/call`, `prompts/get`, `resources/read`) - `ToolCallName` / `PromptGetName` / `ResourceReadURI` — Method-specific identifiers - `UserID` / `UserEmail` — Authenticated user information - `Success` / `Error` — Request outcome - `ServerResponseDurationMs` — Response time from upstream server For the complete field reference, refer to [MCP portal logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/mcp_portal_logs/). #### Set up Logpush To configure Logpush for MCP server portal logs, refer to [Logpush integration](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). Note MCP server portals is currently in beta. ## 2026-02-27 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **New protocols added for Gateway Protocol Detection (Beta)** Gateway [Protocol Detection](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/) now supports seven additional protocols in beta: | Protocol | Notes | | --- | --- | | IMAP | Internet Message Access Protocol — email retrieval | | POP3 | Post Office Protocol v3 — email retrieval | | SMTP | Simple Mail Transfer Protocol — email sending | | MYSQL | MySQL database wire protocol | | RSYNC-DAEMON | rsync daemon protocol | | LDAP | Lightweight Directory Access Protocol | | NTP | Network Time Protocol | These protocols join the existing set of detected protocols (HTTP, HTTP2, SSH, TLS, DCERPC, MQTT, and TPKT) and can be used with the *Detected Protocol* selector in [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) to identify and filter traffic based on the application-layer protocol, without relying on port-based identification. If protocol detection is enabled on your account, these protocols will automatically be logged when detected in your Gateway network traffic. For more information on using Protocol Detection, refer to the [Protocol detection documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/). ## 2026-02-24 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Windows (version 2026.1.150.0)** A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features. **Changes and improvements** - Improvements to [multi-user mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/). Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost. - Added a new feature to [manage NetBIOS over TCP/IP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#netbios-over-tcpip) functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in [device profile settings](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for the Windows [client certificate posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) to ensure logged results are from checks that run once users log in. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. - Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. - Fixed an issue causing DNS requests to fail with clients in Traffic and DNS mode. - Improved service shutdown behavior in cases where the daemon is unresponsive. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2026-02-24 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for macOS (version 2026.1.150.0)** A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. **Changes and improvements** - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. - Fixed an issue with DNS server configuration failures that caused tunnel connection delays. - Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. - Fixed an issue causing DNS requests to fail with clients in Traffic and DNS mode. ## 2026-02-24 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Linux (version 2026.1.150.0)** A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com). **Changes and improvements** - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. - Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. - Fixed issues causing DNS requests to fail with clients in Traffic and DNS mode or DNS only mode. ## 2026-02-20 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **Understand CASB findings instantly with Cloudy Summaries** You can now easily understand your SaaS security posture findings and why they were detected with **Cloudy Summaries in CASB**. This feature integrates Cloudflare's Cloudy AI directly into your CASB Posture Findings to automatically generate clear, plain-language summaries of complex security misconfigurations, third-party app risks, and data exposures. This allows security teams and IT administrators to drastically reduce triage time by immediately understanding the context, potential impact, and necessary remediation steps for any given finding—without needing to be an expert in every connected SaaS application. To view a summary, simply navigate to your Posture Findings in the Cloudflare One dashboard (under **Cloud and SaaS findings**) and open the finding details of a specific instance of a Finding. Cloudy Summaries are supported on all available integrations, including Microsoft 365, Google Workspace, Salesforce, GitHub, AWS, Slack, and Dropbox. See the full list of supported integrations [here](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/). #### Key capabilities - **Contextual explanations** — Quickly understand the specifics of a finding with plain-language summaries detailing exactly what was detected, from publicly shared sensitive files to risky third-party app scopes. - **Clear risk assessment** — Instantly grasp the potential security impact of the finding, such as data breach risks, unauthorized account access, or email spoofing vulnerabilities. - **Actionable guidance** — Get clear recommendations and next steps on how to effectively remediate the issue and secure your environment. - **Built-in feedback** — Help improve future AI summarization accuracy by submitting feedback directly using the thumbs-up and thumbs-down buttons. #### Learn more - Learn more about managing [CASB Posture Findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/) in Cloudflare. Cloudy Summaries in CASB are available to all Cloudflare CASB users today. ## 2026-02-20 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard** [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) is now available in the main Cloudflare Dashboard at [Networking > Tunnels ↗︎](https://dash.cloudflare.com/?to=/:account/tunnels), bringing first-class Tunnel management to developers using Tunnel for securing origin servers. ![Manage Tunnels in the Core Dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=894,format=webp/_astro/tunnel-core-dashboard.BGPqaHfo.gif) This new experience provides everything you need to manage Tunnels for [public applications](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), including: - **Full Tunnel lifecycle management**: Create, configure, delete, and monitor all your Tunnels in one place. - **Native integrations**: View Tunnels by name when configuring [DNS records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/) and [Workers VPC](https://developers.cloudflare.com/workers-vpc/) — no more copy-pasting UUIDs. - **Real-time visibility**: Monitor [replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) and Tunnel [health status](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/#tunnel-status) directly in the dashboard. - **Routing map**: Manage all ingress routes for your Tunnel, including [public applications](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), [private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/), [private CIDRs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/), and [Workers VPC services](https://developers.cloudflare.com/workers-vpc/), from a single interactive interface. #### Choose the right dashboard for your use case **Core Dashboard**: Navigate to [Networking > Tunnels ↗︎](https://dash.cloudflare.com/?to=/:account/tunnels) to manage Tunnels for: - Securing origin servers and [public applications](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) with CDN, WAF, Load Balancing, and DDoS protection - Connecting [Workers to private services](https://developers.cloudflare.com/workers-vpc/) via Workers VPC **Cloudflare One Dashboard**: Navigate to [Zero Trust > Networks > Connectors ↗︎](https://one.dash.cloudflare.com/?to=/:account/networks/connectors) to manage Tunnels for: - Securing your public applications with [Zero Trust access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) - Connecting users to [private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) - Building a [private mesh network](https://developers.cloudflare.com/reference-architecture/architectures/sase/#connecting-networks) Both dashboards provide complete Tunnel management capabilities — choose based on your primary workflow. #### Get started New to Tunnel? Learn how to [get started with Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) or explore advanced use cases like [securing SSH servers](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/) or [running Tunnels in Kubernetes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/). ## 2026-02-19 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **DEX Supports EU Customer Metadata Boundary** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into [WARP](https://developers.cloudflare.com/warp-client/) device connectivity and performance to any internal or external application. Now, all DEX logs are fully compatible with Cloudflare's [Customer Metadata Boundary](https://developers.cloudflare.com/data-localization/metadata-boundary/) (CMB) setting for the 'EU' (European Union), which ensures that DEX logs will not be stored outside the 'EU' when the option is configured. If a Cloudflare One customer using DEX enables CMB 'EU', they will not see any DEX data in the Cloudflare One dashboard. Customers can ingest DEX data via [LogPush](https://developers.cloudflare.com/logs/logpush/), and build their own analytics and dashboards. If a customer enables CMB in their account, they will see the following message in the Digital Experience dashboard: "DEX data is unavailable because Customer Metadata Boundary configuration is on. Use Cloudflare LogPush to export DEX datasets." ![Digital Experience Monitoring message when Customer Metadata Boundary for the EU is enabled](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2143,height=1221,format=webp/_astro/dex_supports_cmb.6YOLXjHN.png) ## 2026-02-17 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Streamlined clientless browser isolation for private applications** A new **Allow clientless access** setting makes it easier to connect users without a device client to internal applications, without using public DNS. ![Allow clientless access setting in the Cloudflare One dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1117,height=206,format=webp/_astro/allow-clientless-access.BHKwQuVt.png) Previously, to provide clientless access to a private hostname or IP without a [published application](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/#add-a-published-application-route), you had to create a separate [bookmark application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/) pointing to a prefixed [Clientless Web Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) URL (for example, `https://.cloudflareaccess.com/browser/https://10.0.0.1/`). This bookmark was visible to all users in the App Launcher, regardless of whether they had access to the underlying application. Now, you can manage clientless access directly within your [private self-hosted application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). When **Allow clientless access** is turned on, users who pass your Access application policies will see a tile in their App Launcher pointing to the prefixed URL. Users must have [remote browser permissions](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) to open the link. ## 2026-02-17 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Policies for bookmark applications** You can now assign [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) to [bookmark applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/). This lets you control which users see a bookmark in the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/) based on identity, device posture, and other policy rules. Previously, bookmark applications were visible to all users in your organization. With policy support, you can now: - **Tailor the App Launcher to each user** — Users only see the applications they have access to, reducing clutter and preventing accidental clicks on irrelevant resources. - **Restrict visibility of sensitive bookmarks** — Limit who can view bookmarks to internal tools or partner resources based on group membership, identity provider, or device posture. Bookmarks support all [Access policy configurations](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) except purpose justification, temporary authentication, and application isolation. If no policy is assigned, the bookmark remains visible to all users (maintaining backwards compatibility). For more information, refer to [Add bookmarks](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/). ## 2026-02-17 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Network Flow](https://developers.cloudflare.com/network-flow/) **Cloudflare One Product Name Updates** We are updating naming related to some of our Networking products to better clarify their place in the Zero Trust and Secure Access Service Edge (SASE) journey. We are retiring some older brand names in favor of names that describe exactly what the products do within your network. We are doing this to help customers build better, clearer mental models for comprehensive SASE architecture delivered on Cloudflare. #### What's changing - **Magic WAN** → **Cloudflare WAN** - **Magic WAN IPsec** → **Cloudflare IPsec** - **Magic WAN GRE** → **Cloudflare GRE** - **Magic WAN Connector** → **Cloudflare One Appliance** - **Magic Firewall** → **Cloudflare Network Firewall** - **Magic Network Monitoring** → **Network Flow** - **Magic Cloud Networking** → **Cloudflare One Multi-cloud Networking** **No action is required by you** — all functionality, existing configurations, and billing will remain exactly the same. For more information, visit the [Cloudflare One documentation](https://developers.cloudflare.com/cloudflare-one/). ## 2026-02-13 [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Fine-grained permissions for Access policies and service tokens** Fine-grained permissions for **Access policies** and **Access service tokens** are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources. #### New roles - **Cloudflare Access policy admin**: Can edit a specific [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) in an account. - **Cloudflare Access service token admin**: Can edit a specific [Access service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) in an account. These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets. For more information: - [Resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) - [Role scopes](https://developers.cloudflare.com/fundamentals/manage-members/scope/) Note Resource-scoped roles is currently in beta. ## 2026-02-12 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Anycast IPs displayed on the dashboard** Cloudflare WAN now displays your Anycast IP addresses directly in the dashboard when you configure IPsec or GRE tunnels. Previously, customers received their Anycast IPs during onboarding or had to retrieve them with an API call. The dashboard now pre-loads these addresses, reducing setup friction and preventing configuration errors. No action is required. All Cloudflare WAN customers can see their Anycast IPs in the tunnel configuration form automatically. For more information, refer to [Configure tunnel endpoints](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-tunnel-endpoints/). ## 2026-02-11 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Post-quantum encryption support for Cloudflare One Appliance** Cloudflare One Appliance version 2026.2.0 adds [post-quantum encryption](https://developers.cloudflare.com/ssl/post-quantum-cryptography/) support using hybrid ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism). The appliance now uses TLS 1.3 with hybrid ML-KEM for its connection to the Cloudflare edge. During the TLS handshake, the appliance and the edge share a symmetric secret over the TLS connection and inject it into the ESP layer of IPsec. This protects IPsec data plane traffic against harvest-now, decrypt-later attacks. This upgrade deploys automatically to all appliances during their configured interrupt windows with no manual action required. For more information, refer to [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/). ## 2026-02-02 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Improved Accessibility and Search for Monitoring** We have updated the Monitoring page to provide a more streamlined and insightful experience for administrators, improving both data visualization and dashboard accessibility. - **Enhanced Visual Layout**: Optimized contrast and the introduction of stacked bar charts for clearer data visualization and trend analysis. ![visual-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3212,height=2344,format=webp/_astro/monitoring-bar-charts.Bi-4BuXC.png) - **Improved Accessibility & Usability**: - **Widget Search**: Added search functionality to multiple widgets, including Policies, Submitters, and Impersonation. - **Actionable UI**: All available actions are now accessible via dedicated buttons. - **State Indicators**: Improved UI states to clearly communicate loading, empty datasets, and error conditions. ![buttons-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3178,height=664,format=webp/_astro/monitoring-buttons.DORPJvP_.png) - **Granular Data Breakdowns**: New views for dispositions by month, malicious email details, link actions, and impersonations. ![monthly-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3202,height=1486,format=webp/_astro/monitoring-monthly-dispositions.CYuI5d9y.png) This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-01-30 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **BGP over GRE and IPsec tunnels** Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using IPsec and GRE tunnel on-ramps (beta). Using BGP peering allows customers to: - Automate the process of adding or removing networks and subnets. - Take advantage of failure detection and session recovery features. With this functionality, customers can: - Establish an eBGP session between their devices and the Magic WAN / Magic Transit service when connected via IPsec and GRE tunnel on-ramps. - Secure the session by MD5 authentication to prevent misconfigurations. - Exchange routes dynamically between their devices and their Magic routing table. For configuration details, refer to: - [Configure BGP routes for Magic WAN](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-routes/#configure-bgp-routes) - [Configure BGP routes for Magic Transit](https://developers.cloudflare.com/magic-transit/how-to/configure-routes/#configure-bgp-routes) ## 2026-01-27 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Windows (version 2026.1.89.1)** A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes, improvements, and new features. **Changes and improvements** - Improvements to [multi-user mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/). Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost. - Added a new feature to [manage NetBIOS over TCP/IP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#netbios-over-tcpip) functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in [device profile settings](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for the Windows [client certificate posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) to ensure logged results are from checks that run once users log in. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2026-01-27 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for macOS (version 2026.1.89.1)** A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. ## 2026-01-27 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Configure Cloudflare source IPs (beta)** Cloudflare source IPs are the IP addresses used by Cloudflare services (such as Load Balancing, Gateway, and Browser Isolation) when sending traffic to your private networks. For customers using legacy mode routing, traffic to private networks is sourced from public Cloudflare IPs, which may cause IP conflicts. For customers using Unified Routing mode (beta), traffic to private networks is sourced from dedicated, non-Internet-routable private IPv4 range to ensure: - Symmetric routing over private network connections - Proper firewall state preservation - Private traffic stays on secure paths Key details: - **IPv4**: Sourced from `100.64.0.0/12` by default, configurable to any `/12` CIDR - **IPv6**: Sourced from `2606:4700:cf1:5000::/64` (not configurable) - **Affected connectors**: GRE, IPsec, CNI, WARP Connector, and WARP Client (Cloudflare Tunnel is not affected) Configuring Cloudflare source IPs requires Unified Routing (beta) and the `Cloudflare One Networks Write` permission. For configuration details, refer to [Configure Cloudflare source IPs](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-cloudflare-source-ips/). ## 2026-01-22 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Require Access protection for zones** You can now require Cloudflare Access protection for all hostnames in your account. When enabled, traffic to any hostname that does not have a matching Access application is automatically blocked. This deny-by-default approach prevents accidental exposure of internal resources to the public Internet. If a developer deploys a new application or creates a DNS record without configuring an Access application, the traffic is blocked rather than exposed. ![Require Cloudflare Access protection in the dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2160,height=738,format=webp/_astro/require-cloudflare-access-protection.BAUmTYOs.png) #### How it works - **Blocked by default**: Traffic to all hostnames in the account is blocked unless an Access application exists for that hostname. - **Explicit access required**: To allow traffic, create an Access application with an Allow or Bypass policy. - **Hostname exemptions**: You can exempt specific hostnames from this requirement. To turn on this feature, refer to [Require Access protection](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/require-access-protection/). ## 2026-01-22 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **New granular API token permissions for Cloudflare Access** Three new API token permissions are available for Cloudflare Access, giving you finer-grained control when building automations and integrations: - **Access: Organizations Revoke** — Grants the ability to [revoke user sessions](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/#revoke-user-sessions) in a Zero Trust organization. Use this permission when you need a token that can terminate active sessions without broader write access to organization settings. - **Access: Population Read** — Grants read access to the [SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that only need to read synced user and group data. - **Access: Population Write** — Grants write access to the [SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that need to create or modify synced user and group data. These permissions are scoped at the account level and can be combined with existing Access permissions. For a full list of available permissions, refer to [API token permissions](https://developers.cloudflare.com/fundamentals/api/reference/permissions/). ## 2026-01-15 [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Network Flow](https://developers.cloudflare.com/network-flow/) **Network Services navigation update** The Network Services menu structure in Cloudflare's dashboard has been updated to reflect solutions and capabilities instead of product names. This will make it easier for you to find what you need and better reflects how our services work together. Your existing configurations will remain the same, and you will have access to all of the same features and functionality. The changes visible in your dashboard may vary based on the products you use. Overall, changes relate to [Magic Transit ↗︎](https://developers.cloudflare.com/magic-transit/), [Magic WAN ↗︎](https://developers.cloudflare.com/magic-wan/), and [Magic Firewall ↗︎](https://developers.cloudflare.com/cloudflare-network-firewall/). **Summary of changes:** - A new **Overview** page provides access to the most common tasks across Magic Transit and Magic WAN. - Product names have been removed from top-level navigation. - Magic Transit and Magic WAN configuration is now organized under **Routes** and **Connectors**. For example, you will find IP Prefixes under **Routes**, and your GRE/IPsec Tunnels under **Connectors.** - Magic Firewall policies are now called **Firewall Policies.** - Magic WAN Connectors and Connector On-Ramps are now referenced in the dashboard as **Appliances** and **Appliance profiles.** They can be found under **Connectors > Appliances.** - Network analytics, network health, and real-time analytics are now available under **Insights.** - Packet Captures are found under **Insights > Diagnostics.** - You can manage your Sites from **Insights > Network health.** - You can find Magic Network Monitoring under **Insights > Network flow**. If you would like to provide feedback, complete [this form ↗︎](https://forms.gle/htWyjRsTjw1usdis5). You can also find these details in the January 7, 2026 email titled **\[FYI] Upcoming Network Services Dashboard Navigation Update**. Preview: ![Networking Navigation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3000,height=1052,format=webp/_astro/networking-overview-and-navigation.CeMgEFaZ.png) ## 2026-01-15 [Risk Score](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) **Support for CrowdStrike device scores in User Risk Scoring** Cloudflare One has expanded its \[User Risk Scoring] (/cloudflare-one/insights/risk-score/) capabilities by introducing two new behaviors for organizations using the \[CrowdStrike integration] (/cloudflare-one/integrations/service-providers/crowdstrike/). Administrators can now automatically escalate the risk score of a user if their device matches specific CrowdStrike Zero Trust Assessment (ZTA) score ranges. This allows for more granular security policies that respond dynamically to the health of the endpoint. New risk behaviors The following risk scoring behaviors are now available: - CrowdStrike low device score: Automatically increases a user's risk score when the connected device reports a "Low" score from CrowdStrike. - CrowdStrike medium device score: Automatically increases a user's risk score when the connected device reports a "Medium" score from CrowdStrike. These scores are derived from \[CrowdStrike device posture attributes] (/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes), including OS signals and sensor configurations. ## 2026-01-15 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Verify WARP Connector connectivity with a simple ping** We have made it easier to validate connectivity when deploying [WARP Connector](https://developers.cloudflare.com/mesh/) as part of your [software-defined private network](https://developers.cloudflare.com/reference-architecture/architectures/sase/#connecting-networks). You can now `ping` the WARP Connector host directly on its LAN IP address immediately after installation. This provides a fast, familiar way to confirm that the Connector is online and reachable within your network before testing access to downstream services. Starting with [version 2025.10.186.0](https://developers.cloudflare.com/changelog/post/2026-01-13-warp-linux-ga/), WARP Connector responds to traffic addressed to its own LAN IP, giving you immediate visibility into Connector reachability. Learn more about deploying [WARP Connector](https://developers.cloudflare.com/mesh/) and building private network connectivity with [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/). ## 2026-01-13 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Windows (version 2025.10.186.0)** A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features. New features include the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect), and a new WARP client device posture check for [Antivirus](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/antivirus/). **Changes and improvements** - Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint. - Fixed an issue that caused occasional audio degradation and increased CPU usage on Windows by optimizing route configurations for large [domain-based split tunnel rules](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels). - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Fixed an issue where sending large messages to the daemon by Inter-Process Communication (IPC) could cause the daemon to fail and result in service interruptions. - Added support for a new WARP client device posture check for [Antivirus](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/antivirus/). The check confirms the presence of an antivirus program on a Windows device with the option to check if the antivirus is up to date. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2026-01-13 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for macOS (version 2025.10.186.0)** A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features, including the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint. ## 2026-01-13 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Linux (version 2025.10.186.0)** A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features, including the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com). **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - Linux [disk encryption posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption/) now supports non-filesystem encryption types like `dm-crypt`. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Fixed an issue where the GUI becomes unresponsive when the **Re-Authenticate in browser** button is clicked. - Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint. ## 2026-01-12 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Enhanced visibility for post-delivery actions** The Action Log now provides enriched data for post-delivery actions to improve troubleshooting. In addition to success confirmations, failed actions now display the targeted Destination folder and a specific failure reason within the Activity field. Note Error messages will vary depending on whether you are using Google Workspace or Microsoft 365. ![failure-log-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2348,height=1692,format=webp/_astro/enhanced-visibility-post-delivery-actions.BNiyPtJU.png) This update allows you to see the full lifecycle of a failed action. For instance, if an administrator tries to move an email that has already been deleted or moved manually, the log will now show the multiple retry attempts and the specific destination error. This applies to all Email Security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2026-01-08 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Cloudflare admin activity logs capture creation of DNS over HTTP (DoH) users** Cloudflare [admin activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/) now capture each time a [DNS over HTTP (DoH) user](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-over-https/) is created. These logs can be viewed from the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com/), pulled via the [Cloudflare API](https://developers.cloudflare.com/api/), and exported through [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). ## 2025-12-31 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Breakout traffic visibility via NetFlow** Magic WAN Connector now exports NetFlow data for breakout traffic to Magic Network Monitoring (MNM), providing visibility into traffic that bypasses Cloudflare's security filtering. This feature allows you to: - Monitor breakout traffic statistics in the Cloudflare dashboard. - View traffic patterns for applications configured to bypass Cloudflare. - Maintain visibility across all traffic passing through your Magic WAN Connector. For more information, refer to [NetFlow statistics](https://developers.cloudflare.com/cloudflare-wan/analytics/netflow-analytics/). ## 2025-12-17 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Shadow IT - domain level SaaS analytics** Zero Trust has again upgraded its **Shadow IT analytics**, providing you with unprecedented visibility into your organizations use of SaaS tools. With this dashboard, you can review who is using an application and volumes of data transfer to the application. With this update, you can review data transfer metrics at the domain level, rather than just the application level, providing more granular insight into your data transfer patterns. ![New Domain Level Metrics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=452,format=webp/_astro/shadow-it-domain.DoZnGAtf.png) These metrics can be filtered by all available filters on the dashboard, including user, application, or content category. Both the analytics and policies are accessible in the Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control. ## 2025-12-16 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New duplicate action for supported Cloudflare One resources** You can now duplicate specific Cloudflare One resources with a single click from the dashboard. Initially supported resources: - Access Applications - Access Policies - Gateway Policies To try this out, simply click on the overflow menu (⋮) from the resource table and click *Duplicate*. We will continue to add the Duplicate action for resources throughout 2026. ## 2025-12-09 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Windows (version 2025.10.118.1)** A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Fixed an issue where sending large messages to the WARP daemon by Inter-Process Communication (IPC) could cause WARP to crash and result in service interruptions. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2025-12-09 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for macOS (version 2025.10.118.1)** A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. ## 2025-12-03 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Reclassifications to Submissions** We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare. Submissions are leveraged to tune future variants of campaigns. To respect data sanctity, providing a submission does not change the original disposition of the emails submitted. ![nav\_example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=756,height=628,format=webp/_astro/reclassification-submission.B6nL5Hw7.png) This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-11-18 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Adjustment to Final Disposition Column** #### Adjustment to Final Disposition column #### The **Final Disposition** column in **Submissions** > **Team Submissions** tab is changing for non-Phishguard customers. #### What's Changing - Column will be called **Status** instead of **Final Disposition** - Column status values will now be: **Submitted**, **Accepted** or **Rejected**. #### Next Steps We will listen carefully to your feedback and continue to find comprehensive ways to communicate updates on your submissions. Your submissions will continue to be addressed at an even greater rate than before, fuelling faster and more accurate email security improvement. ## 2025-11-17 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New Cloudflare One Navigation and Product Experience** The Zero Trust dashboard and navigation is receiving significant and exciting updates. The dashboard is being restructured to better support common tasks and workflows, and various pages have been moved and consolidated. There is a new guided experience on login detailing the changes, and you can use the Zero Trust dashboard search to find product pages by both their new and old names, as well as your created resources. To replay the guided experience, you can find it in Overview > Get Started. ![Cloudflare One Dash Changes](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1388,height=1546,format=webp/_astro/cf1-dash-changes.Uk_Y-2V-.png) Notable changes - Product names have been removed from many top-level navigation items to help bring clarity to what they help you accomplish. For example, you can find Gateway policies under ‘Traffic policies' and CASB findings under ‘Cloud & SaaS findings.' - You can view all analytics, logs, and real-time monitoring tools from ‘Insights.' - ‘Networks' better maps the ways that your corporate network interacts with Cloudflare. Some pages like Tunnels, are now a tab rather than a full page as part of these changes. You can find them at Networks > Connectors. - Settings are now located closer to the tools and resources they impact. For example, this means you'll find your WARP configurations at Team & Resources > Devices. ![New Cloudflare One Navigation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=514,height=1112,format=webp/_astro/new-cf1-navigation.B7-E-9CV.png) No changes to our API endpoint structure or to any backend services have been made as part of this effort. ## 2025-11-14 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Generate Cloudflare Access SSH certificate authority (CA) directly from the Cloudflare dashboard** SSH with [Cloudflare Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) allows you to use short-lived SSH certificates to eliminate SSH key management and reduce security risks associated with lost or stolen keys. Previously, users had to generate this certificate by using the [Cloudflare API ↗︎](https://developers.cloudflare.com/api/) directly. With this update, you can now create and manage this certificate in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com) from the **Access controls** > **Service credentials** page. ![Navigate to Access controls and then Service credentials to see where you can generate an SSH CA](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2710,height=1180,format=webp/_astro/SSH-CA-generation.DYa9RnX1.png) For more details, refer to [Generate a Cloudflare SSH CA](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#generate-a-cloudflare-ssh-ca). ## 2025-11-14 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **New SaaS Security weekly digests with API CASB** You can now stay on top of your SaaS security posture with the new **CASB Weekly Digest** notification. This opt-in email digest is delivered to your inbox every Monday morning and provides a high-level summary of your organization's Cloudflare API CASB findings from the previous week. This allows security teams and IT administrators to get proactive, at-a-glance visibility into new risks and integration health without having to log in to the dashboard. To opt in, navigate to **Manage Account** > **Notifications** in the Cloudflare dashboard to configure the **CASB Weekly Digest** alert type. #### Key capabilities - **At-a-glance summary** — Review new high/critical findings, most frequent finding types, and new content exposures from the past 7 days. - **Integration health** — Instantly see the status of all your connected SaaS integrations (Healthy, Unhealthy, or Paused) to spot API connection issues. - **Proactive alerting** — The digest is sent automatically to all subscribed users every Monday morning. - **Easy to configure** — Users can opt in by enabling the notification in the Cloudflare dashboard under **Manage Account** > **Notifications**. #### Learn more - Configure [notification preferences](https://developers.cloudflare.com/notifications/) in Cloudflare. The CASB Weekly Digest notification is available to all Cloudflare users today. ## 2025-11-12 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **DEX Logpush jobs** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into WARP device metrics, connectivity, and network performance across your Cloudflare SASE deployment. We've released four new WARP and DEX device data sets that can be exported via [Cloudflare Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). These Logpush data sets can be exported to R2, a cloud bucket, or a SIEM to build a customized logging and analytics experience. 1. [DEX Application Tests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dex_application_tests/) 2. [DEX Device State Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dex_device_state_events/) 3. [WARP Config Changes](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/warp_config_changes/) 4. [WARP Toggle Changes](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/warp_toggle_changes/) To create a new DEX or WARP Logpush job, customers can go to the account level of the Cloudflare dashboard > Analytics & Logs > Logpush to get started. ![DEX logpush job creation dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2549,height=1283,format=webp/_astro/dex_logpush_datasets.CtCk36pX.png) ## 2025-11-11 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Windows (version 2025.9.558.0)** A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues. **Changes and improvements** - Fixed an inconsistency with [Global WARP override](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#disconnect-warp-on-all-devices) settings in multi-user environments when switching between users. - The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues. - Fixed an issue where deleting a registration was erroneously reported as having failed. - Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). - Improvements for the [OS version](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) WARP client check. Windows Updated Build Revision (UBR) numbers can now be checked by the client to ensure devices have required security patches and features installed. - The WARP client now supports Windows 11 ARM-based machines. For information on known limitations, refer to the [Known limitations page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#cloudflare-one-client-disconnected-on-windows-arm). **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server). - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2025-11-11 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for macOS (version 2025.9.558.0)** A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues. **Changes and improvements** - The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues. - Fixed an issue where deleting a registration was erroneously reported as having failed. - Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). **Known issues** - Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server). ## 2025-11-11 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **WARP client for Linux (version 2025.9.558.0)** A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues. WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com/). **Changes and improvements** - The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues. - Fixed an issue where deleting a registration was erroneously reported as having failed. - Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). ## 2025-11-11 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **cloudflared proxy-dns command will be removed starting February 2, 2026** Starting February 2, 2026, the `cloudflared proxy-dns` command will be removed from all new `cloudflared` [releases](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/). This change is being made to enhance security and address a potential vulnerability in an underlying DNS library. This vulnerability is specific to the `proxy-dns` command and does not affect any other `cloudflared` features, such as the core [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) service. The `proxy-dns` command, which runs a client-side [DNS-over-HTTPS (DoH)](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/) proxy, has been an officially undocumented feature for several years. This functionality is fully and securely supported by our actively developed products. Versions of `cloudflared` released before this date will not be affected and will continue to operate. However, note that our [official support policy](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#deprecated-releases) for any `cloudflared` release is one year from its release date. #### Migration paths We strongly advise users of this undocumented feature to migrate to one of the following officially supported solutions before February 2, 2026, to continue benefiting from secure [DNS-over-HTTPS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/). #### End-user devices The preferred method for enabling DNS-over-HTTPS on user devices is the [Cloudflare WARP client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). The WARP client automatically secures and proxies all DNS traffic from your device, integrating it with your organization's [Zero Trust policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and [posture checks](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/). #### Servers, routers, and IoT devices For scenarios where installing a client on every device is not possible (such as servers, routers, or IoT devices), we recommend using the [WARP Connector](https://developers.cloudflare.com/mesh/). Instead of running `cloudflared proxy-dns` on a machine, you can install the WARP Connector on a single Linux host within your private network. This connector will act as a gateway, securely routing all DNS and network traffic from your [entire subnet](https://developers.cloudflare.com/mesh/features/routes/) to Cloudflare for [filtering and logging](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2025-11-06 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Automatic Return Routing (Beta)** Magic WAN now supports Automatic Return Routing (ARR), allowing customers to configure Magic on-ramps (IPsec/GRE/CNI) to learn the return path for traffic flows without requiring static routes. Key benefits: - **Route-less mode**: Static or dynamic routes are optional when using ARR. - **Overlapping IP space support**: Traffic originating from customer sites can use overlapping private IP ranges. - **Symmetric routing**: Return traffic is guaranteed to use the same connection as the original on-ramp. This feature is currently in beta and requires the new Unified Routing mode (beta). For configuration details, refer to [Configure Automatic Return Routing](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-routes/#configure-automatic-return-routing). ## 2025-11-06 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Designate WAN link for breakout traffic** Magic WAN Connector now allows you to designate a specific WAN port for breakout traffic, giving you deterministic control over the egress path for latency-sensitive applications. With this feature, you can: - Pin breakout traffic for specific applications to a preferred WAN port. - Ensure critical traffic (such as Zoom or Teams) always uses your fastest or most reliable connection. - Benefit from automatic failover to standard WAN port priority if the preferred port goes down. This is useful for organizations with multiple ISP uplinks who need predictable egress behavior for performance-sensitive traffic. For configuration details, refer to [Designate WAN ports for breakout apps](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/application-based-policies/breakout-traffic/#designate-wan-ports-for-breakout-apps). ## 2025-11-06 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Applications to be remapped to the new categories** We have previously added new application categories to better reflect their content and improve HTTP traffic management: refer to [Changelog](https://developers.cloudflare.com/cloudflare-one/changelog/gateway/#2025-10-28). While the new categories are live now, we want to ensure you have ample time to review and adjust any existing rules you have configured against old categories. The remapping of existing applications into these new categories will be completed by January 30, 2026. This timeline allows you a dedicated period to: - Review the new category structure. - Identify any policies you have that target the older categories. - Adjust your rules to reference the new, more precise categories before the old mappings change. Once the applications have been fully remapped by January 30, 2026, you might observe some changes in the traffic being mitigated or allowed by your existing policies. We encourage you to use the intervening time to prepare for a smooth transition. **Applications being remappedd** | Application Name | Existing Category | New Category | | --- | --- | --- | | Google Photos | File Sharing | Photography & Graphic Design | | Flickr | File Sharing | Photography & Graphic Design | | ADP | Human Resources | Business | | Greenhouse | Human Resources | Business | | myCigna | Human Resources | Health & Fitness | | UnitedHealthcare | Human Resources | Health & Fitness | | ZipRecruiter | Human Resources | Business | | Amazon Business | Human Resources | Business | | Jobcenter | Human Resources | Business | | Jobsuche | Human Resources | Business | | Zenjob | Human Resources | Business | | DocuSign | Legal | Business | | Postident | Legal | Business | | Adobe Creative Cloud | Productivity | Photography & Graphic Design | | Airtable | Productivity | Development | | Autodesk Fusion360 | Productivity | IT Management | | Coursera | Productivity | Education | | Microsoft Power BI | Productivity | Business | | Tableau | Productivity | Business | | Duolingo | Productivity | Education | | Adobe Reader | Productivity | Business | | AnpiReport | Productivity | Travel | | ビズリーチ | Productivity | Business | | doda (デューダ) | Productivity | Business | | 求人ボックス | Productivity | Business | | マイナビ2026 | Productivity | Business | | Power Apps | Productivity | Business | | RECRUIT AGENT | Productivity | Business | | シフトボード | Productivity | Business | | スタンバイ | Productivity | Business | | Doctolib | Productivity | Health & Fitness | | Miro | Productivity | Photography & Graphic Design | | MyFitnessPal | Productivity | Health & Fitness | | Sentry Mobile | Productivity | Travel | | Slido | Productivity | Photography & Graphic Design | | Arista Networks | Productivity | IT Management | | Atlassian | Productivity | Business | | CoderPad | Productivity | Business | | eAgreements | Productivity | Business | | Vmware | Productivity | IT Management | | Vmware Vcenter | Productivity | IT Management | | AWS Skill Builder | Productivity | Education | | Microsoft Office 365 (GCC) | Productivity | Business | | Microsoft Exchange Online (GCC) | Productivity | Business | | Canva | Sales & Marketing | Photography & Graphic Design | | Instacart | Shopping | Food & Drink | | Wawa | Shopping | Food & Drink | | McDonald's | Shopping | Food & Drink | | Vrbo | Shopping | Travel | | American Airlines | Shopping | Travel | | Booking.com | Shopping | Travel | | Ticketmaster | Shopping | Entertainment & Events | | Airbnb | Shopping | Travel | | DoorDash | Shopping | Food & Drink | | Expedia | Shopping | Travel | | EasyPark | Shopping | Travel | | UEFA Tickets | Shopping | Entertainment & Events | | DHL Express | Shopping | Business | | UPS | Shopping | Business | For more information on creating HTTP policies, refer to [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2025-10-28 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Access private hostname applications support all ports/protocols** [Cloudflare Access for private hostname applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) can now secure traffic on all ports and protocols. Previously, applying Zero Trust policies to private applications required the application to use HTTPS on port `443` and support Server Name Indicator (SNI). This update removes that limitation. As long as the application is reachable via a Cloudflare off-ramp, you can now enforce your critical security controls — like single sign-on (SSO), MFA, device posture, and variable session lengths — to any private application. This allows you to extend Zero Trust security to services like SSH, RDP, internal databases, and other non-HTTPS applications. ![Example private application on non-443 port](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1283,height=496,format=webp/_astro/internal_private_app_any_port.DNXnEy0u.png) For example, you can now create a self-hosted application in Access for `ssh.testapp.local` running on port `22`. You can then build a policy that only allows engineers in your organization to connect after they pass an SSO/MFA check and are using a corporate device. This feature is generally available across all plans. ## 2025-10-28 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **CASB introduces new granular roles** Cloudflare CASB (Cloud Access Security Broker) now supports two new granular roles to provide more precise access control for your security teams: - **Cloudflare CASB Read:** Provides read-only access to view CASB findings and dashboards. This role is ideal for security analysts, compliance auditors, or team members who need visibility without modification rights. - **Cloudflare CASB:** Provides full administrative access to configure and manage all aspects of the CASB product. These new roles help you better enforce the principle of least privilege. You can now grant specific members access to CASB security findings without assigning them broader permissions, such as the **Super Administrator** or **Administrator** roles. To enable [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/), scans in CASB, account members will need the **Cloudflare Zero Trust** role. You can find these new roles when inviting members or creating API tokens in the Cloudflare dashboard under **Manage Account** > **Members**. To learn more about managing roles and permissions, refer to the [Manage account members and roles documentation](https://developers.cloudflare.com/fundamentals/manage-members/roles/). ## 2025-10-28 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **New Application Categories added for HTTP Traffic Management** To give you precision and flexibility while creating policies to block unwanted traffic, we are introducing new, more granular application categories in the Gateway product. We have added the following categories to provide more precise organization and allow for finer-grained policy creation, designed around how users interact with different types of applications: - Business - Education - Entertainment & Events - Food & Drink - Health & Fitness - Lifestyle - Navigation - Photography & Graphic Design - Travel The new categories are live now, but we are providing a transition period for existing applications to be fully remapped to these new categories. The full remapping will be completed by January 30, 2026. We encourage you to use this time to: - Review the new category structure. - Identify and adjust any existing HTTP policies that reference older categories to ensure a smooth transition. For more information on creating HTTP policies, refer to [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2025-10-20 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Schedule DNS policies from the UI** Admins can now create [scheduled DNS policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/timed-policies/) directly from the Zero Trust dashboard, without using the API. You can configure policies to be active during specific, recurring times, such as blocking social media during business hours or gaming sites on school nights. - **Preset Schedules**: Use built-in templates for common scenarios like Business Hours, School Days, Weekends, and more. - **Custom Schedules**: Define your own schedule with specific days and up to three non-overlapping time ranges per day. - **Timezone Control**: Choose to enforce a schedule in a specific timezone (for example, US Eastern) or based on the local time of each user. - **Combined with Duration**: Policies can have both a schedule and a duration. If both are set, the duration's expiration takes precedence. You can see the flow in the demo GIF: ![Schedule DNS policies demo](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1053,height=879,format=webp/_astro/gateway-dns-scheduled-policies-ui.Cf4l1OTE.gif) This update makes time-based DNS policies accessible to all Gateway customers, removing the technical barrier of the API. ## 2025-10-17 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **On-Demand Security Report** You can now generate on-demand security reports directly from the Cloudflare dashboard. This new feature provides a comprehensive overview of your email security posture, making it easier than ever to demonstrate the value of Cloudflare’s Email security to executives and other decision makers. These reports offer several key benefits: - **Executive Summary:** Quickly view the performance of Email security with a high-level executive summary. - **Actionable Insights:** Dive deep into trend data, breakdowns of threat types, and analysis of top targets to identify and address vulnerabilities. - **Configuration Transparency:** Gain a clear view of your policy, submission, and domain configurations to ensure optimal setup. - **Account Takeover Risks:** Get a snapshot of your M365 risky users (requires a Microsoft Entra ID P2 license and [M365 SaaS integration ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/microsoft-365/)). To get started, refer to [Download a security report](https://developers.cloudflare.com/cloudflare-one/email-security/monitoring/download-report/#download-a-security-report). ![Report](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1009,height=571,format=webp/_astro/report.CbkPa8Jt.png) This feature is available across the following Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-10-10 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **New domain categories added** We have added three new domain categories under the Technology parent category, to better reflect online content and improve DNS filtering. **New categories added** | Parent ID | Parent Name | Category ID | Category Name | | --- | --- | --- | --- | | 26 | Technology | 194 | Keep Awake Software | | 26 | Technology | 192 | Remote Access | | 26 | Technology | 193 | Shareware/Freeware | Refer to [Gateway domain categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) to learn more. ## 2025-10-02 [Cloudflare Fundamentals](https://developers.cloudflare.com/fundamentals/) [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Fine-grained Permissioning for Access for Apps, IdPs, & Targets now in Public Beta** Fine-grained permissions for **Access Applications, Identity Providers (IdPs), and Targets** is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources. #### What's New - **[Access Applications ↗︎](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/)**: Grant admin permissions to specific Access Applications. - **[Identity Providers ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/)**: Grant admin permissions to individual Identity Providers. - **[Targets ↗︎](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#1-add-a-target)**: Grant admin rights to specific Targets ![Updated Permissions Policy UX](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3004,height=1410,format=webp/_astro/2025-10-01-fine-grained-permissioning-ux.BWVmQsVF.png) Note During the public beta, members must also be assigned an account-scoped, read only role to view resources in the dashboard. This restriction will be lifted in a future release. - **Account Read Only** plus a fine-grained permission for a specific App, IdP, or Target - **Cloudflare Zero Trust Read Only** plus fine-grained permission for a specific App, IdP, or Target For more info: - [Get started with Cloudflare Permissioning](https://developers.cloudflare.com/fundamentals/manage-members/roles/) - [Manage Member Permissioning via the UI & API](https://developers.cloudflare.com/fundamentals/manage-members/manage) ## 2025-10-01 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Expanded File Type Controls for Executables and Disk Images** You can now enhance your security posture by blocking additional application installer and disk image file types with Cloudflare Gateway. Preventing the download of unauthorized software packages is a critical step in securing endpoints from malware and unwanted applications. We have expanded Gateway's file type controls to include: - Apple Disk Image (dmg) - Microsoft Software Installer (msix, appx) - Apple Software Package (pkg) You can find these new options within the [*Upload File Types* and *Download File Types* selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-types) when creating or editing an HTTP policy. The file types are categorized as follows: - **System**: *Apple Disk Image (dmg)* - **Executable**: *Microsoft Software Installer (msix)*, *Microsoft Software Installer (appx)*, *Apple Software Package (pkg)* To ensure these file types are blocked effectively, please note the following behaviors: - DMG: Due to their file structure, DMG files are blocked at the very end of the transfer. A user's download may appear to progress but will fail at the last moment, preventing the browser from saving the file. - MSIX: To comprehensively block Microsoft Software Installers, you should also include the file type *Unscannable*. MSIX files larger than 100 MB are identified as Unscannable ZIP files during inspection. To get started, go to your HTTP policies in Zero Trust. For a full list of file types, refer to [supported file types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#supported-file-types). ## 2025-09-30 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Application granular controls for operations in SaaS applications** Gateway users can now apply granular controls to their file sharing and AI chat applications through [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies). The new feature offers two methods of controlling SaaS applications: - **Application Controls** are curated groupings of Operations which provide an easy way for users to achieve a specific outcome. Application Controls may include *Upload*, *Download*, *Prompt*, *Voice*, and *Share* depending on the application. - **Operations** are controls aligned to the most granular action a user can take. This provides a fine-grained approach to enforcing policy and generally aligns to the SaaS providers API specifications in naming and function. Get started using [Application Granular Controls](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/granular-controls) and refer to the list of [supported applications](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/granular-controls/#compatible-applications). ## 2025-09-25 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Refine DLP Scans with New Body Phase Selector** You can now more precisely control your HTTP DLP policies by specifying whether to scan the request or response body, helping to reduce false positives and target specific data flows. In the Gateway HTTP policy builder, you will find a new selector called *Body Phase*. This allows you to define the direction of traffic the DLP engine will inspect: - *Request Body*: Scans data sent from a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts. - *Response Body*: Scans data sent to a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data. For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to *Request Body*, the policy will only trigger if the user attempts to upload or submit an SSN, ignoring the content of the web page itself. All policies without this selector will continue to scan both request and response bodies to ensure continued protection. For more information, refer to [Gateway HTTP policy selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#body-phase). ## 2025-09-23 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Invalid Submissions Feedback** Email security relies on your submissions to continuously improve our detection models. However, we often receive submissions in formats that cannot be ingested, such as incomplete EMLs, screenshots, or text files. To ensure all customer feedback is actionable, we have launched two new features to manage invalid submissions sent to our team and user [submission aliases](https://developers.cloudflare.com/cloudflare-one/email-security/settings/submission-settings/submission-addresses/): - **Email Notifications:** We now automatically notify users by email when they provide an invalid submission, educating them on the correct format. To disable notifications, go to **[Settings ↗︎](https://one.dash.cloudflare.com/?to=/:account/email-security/settings)** > **Invalid submission emails** and turn the feature off. ![EmailSec-Invalid-Submissions-Toggle](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1096,height=175,format=webp/_astro/EmailSec-Invalid-Submissions-Toggle.DXjbR6aX.png) - **Invalid Submission dashboard:** You can quickly identify which users need education to provide valid submissions so Cloudflare can provide continuous protection. ![EmailSec-Invalid-Submissions-Dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1132,height=511,format=webp/_astro/EmailSec-Invalid-Submissions-Dashboard.zuf1on2n.png) Learn more about this feature on [invalid submissions](https://developers.cloudflare.com/cloudflare-one/email-security/submissions/invalid-submissions/). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-09-22 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Access Remote Desktop Protocol (RDP) destinations securely from your browser — now generally available!** [Browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is now generally available for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. Since we announced our [open beta](https://developers.cloudflare.com/changelog/post/2025-07-01-browser-based-rdp-open-beta/), we've made a few improvements: - Support for targets with IPv6. - Support for [Magic WAN](https://developers.cloudflare.com/cloudflare-wan/) and [WARP Connector](https://developers.cloudflare.com/mesh/) as on-ramps. - More robust error messaging on the login page to help you if you encounter an issue. - Worldwide keyboard support. Whether your day-to-day is in Portuguese, Chinese, or something in between, your browser-based RDP experience will look and feel exactly like you are using a desktop RDP client. - Cleaned up some other miscellaneous issues, including but not limited to enhanced support for Entra ID accounts and support for usernames with spaces, quotes, and special characters. As a refresher, here are some benefits browser-based RDP provides: - **Control how users authenticate to internal RDP resources** with single sign-on (SSO), multi-factor authentication (MFA), and granular access policies. - **Record who is accessing which servers and when** to support regulatory compliance requirements and to gain greater visibility in the event of a security event. - **Eliminate the need to install and manage software on user devices**. You will only need a web browser. - **Reduce your attack surface** by keeping your RDP servers off the public Internet and protecting them from common threats like credential stuffing or brute-force attacks. ![Example of a browser-based RDP Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2132,height=1814,format=webp/_astro/browser-based-rdp-access-app.BNXce1JL.png) To get started, refer to [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). ## 2025-09-18 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Connect and secure any private or public app by hostname, not IP — with hostname routing for Cloudflare Tunnel** You can now route private traffic to [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) based on a hostname or domain, moving beyond the limitations of IP-based routing. This new capability is **free for all Cloudflare One customers**. Previously, Tunnel routes could only be defined by IP address or [CIDR range](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/). This created a challenge for modern applications with dynamic or ephemeral IP addresses, often forcing administrators to maintain complex and brittle IP lists. ![Hostname-based routing in Cloudflare Tunnel](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1990,height=530,format=webp/_astro/tunnel-hostname-routing.DSi8MP_7.webp) **What’s new:** - **Hostname & Domain Routing**: Create routes for individual hostnames (e.g., `payroll.acme.local`) or entire domains (e.g., `*.acme.local`) and direct their traffic to a specific Tunnel. - **Simplified Zero Trust Policies**: Build resilient policies in Cloudflare Access and Gateway using stable hostnames, making it dramatically easier to apply per-resource authorization for your private applications. - **Precise Egress Control**: Route traffic for public hostnames (e.g., `bank.example.com`) through a specific Tunnel to enforce a dedicated source IP, solving the IP allowlist problem for third-party services. - **No More IP Lists**: This feature makes the workaround of maintaining dynamic IP Lists for Tunnel connections obsolete. Get started in the Tunnels section of the Zero Trust dashboard with your first [private hostname](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) or [public hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) route. Learn more in our [blog post ↗︎](https://blog.cloudflare.com/tunnel-hostname-routing/). ## 2025-09-16 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New AI-Enabled Search for Zero Trust Dashboard** Zero Trust Dashboard has a brand new, AI-powered search functionality. You can search your account by resources (applications, policies, device profiles, settings, etc.), pages, products, and more. ![Example search results in the Zero Trust dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1750,height=1568,format=webp/_astro/searchexample.Di8yS8ju.png) **Ask Cloudy** — You can also ask Cloudy, our AI agent, questions about Cloudflare Zero Trust. Cloudy is trained on our developer documentation and implementation guides, so it can tell you how to configure functionality, best practices, and can make recommendations. Cloudy can then stay open with you as you move between pages to build configuration or answer more questions. **Find Recents** — Recent searches and Cloudy questions also have a new tab under Zero Trust Overview. ## 2025-09-11 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Regional Email Processing for Germany, India, or Australia** We’re excited to announce that Email security customers can now choose their preferred mail processing location directly from the UI when onboarding a domain. This feature is available for the following onboarding methods: **MX**, **BCC**, and **Journaling**. #### What’s new Customers can now select where their email is processed. The following regions are supported: - **Germany** - **India** - **Australia** Global processing remains the default option, providing flexibility to meet both compliance requirements or operational preferences. #### How to use it When onboarding a domain with MX, BCC, or Journaling: 1. Select the desired processing location (Germany, India, or Australia). 2. The UI will display updated processing addresses specific to that region. 3. For MX onboarding, if your domain is managed by Cloudflare, you can automatically update MX records directly from the UI. #### Availability This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** #### What’s next We’re expanding the list of processing locations to match our [Data Localization Suite (DLS)](https://developers.cloudflare.com/data-localization/) footprint, giving customers the broadest set of regional options in the market without the complexity of self-hosting. ## 2025-09-11 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **DNS filtering for private network onramps** [Magic WAN](https://developers.cloudflare.com/cloudflare-wan/zero-trust/cloudflare-gateway/#dns-filtering) and [WARP Connector](https://developers.cloudflare.com/mesh/features/routes/#dns-filtering) users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet. Routing DNS traffic to the Gateway resolver allows DNS resolution and filtering for traffic coming from private networks while preserving source internal IP visibility. This ensures Magic WAN users have full integration with our Cloudflare One features, including [Internal DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/#internal-dns) and [hostname-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/#selector-prerequisites). To configure DNS filtering, change your Magic WAN or WARP Connector DNS settings to use Cloudflare's shared resolver IPs, `172.64.36.1` and `172.64.36.2`. Once you configure DNS resolution and filtering, you can use *Source Internal IP* as a traffic selector in your [resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) for routing private DNS traffic to your [Internal DNS](https://developers.cloudflare.com/dns/internal-dns/). ## 2025-09-08 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Custom IKE ID for IPsec Tunnels** Now, Magic WAN customers can configure a custom IKE ID for their IPsec tunnels. Customers that are using Magic WAN and a VeloCloud SD-WAN device together can utilize this new feature to create a high availability configuration. This feature is available via API only. Customers can read the Magic WAN documentation to learn more about the [Custom IKE ID feature and the API call to configure it](https://developers.cloudflare.com/cloudflare-wan/configuration/common-settings/custom-ike-id-ipsec/). ## 2025-09-05 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Bidirectional tunnel health checks are compatible with all Magic on-ramps** All bidirectional tunnel health check return packets are accepted by any Magic on-ramp. Previously, when a Magic tunnel had a bidirectional health check configured, the bidirectional health check would pass when the return packets came back to Cloudflare over the same tunnel that was traversed by the forward packets. There are SD-WAN devices, like VeloCloud, that do not offer controls to steer traffic over one tunnel versus another in a high availability tunnel configuration. Now, when a Magic tunnel has a bidirectional health check configured, the bidirectional health check will pass when the return packet traverses over any tunnel in a high availability configuration. ## 2025-09-02 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Cloudflare Tunnel and Networks API will no longer return deleted resources by default starting December 1, 2025** Starting **December 1, 2025**, list endpoints for the [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/) and [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/) will no longer return deleted tunnels, routes, subnets and virtual networks by default. This change makes the API behavior more intuitive by only returning active resources unless otherwise specified. No action is required if you already explicitly set `is_deleted=false` or if you only need to list active resources. This change affects the following API endpoints: - List all tunnels: [`GET /accounts/{account_id}/tunnels`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/methods/list/) - List [Cloudflare Tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/): [`GET /accounts/{account_id}/cfd_tunnel`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/list/) - List [WARP Connector](https://developers.cloudflare.com/mesh/) tunnels: [`GET /accounts/{account_id}/warp_connector`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/list/) - List tunnel routes: [`GET /accounts/{account_id}/teamnet/routes`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/list/) - List subnets: [`GET /accounts/{account_id}/zerotrust/subnets`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/subnets/methods/list/) - List virtual networks: [`GET /accounts/{account_id}/teamnet/virtual_networks`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/virtual_networks/methods/list/) #### What is changing? The default behavior of the `is_deleted` query parameter will be updated. | Scenario | Previous behavior (before December 1, 2025) | New behavior (from December 1, 2025) | | --- | --- | --- | | `is_deleted` parameter is omitted | Returns **active & deleted** tunnels, routes, subnets and virtual networks | Returns **only active** tunnels, routes, subnets and virtual networks | #### Action required If you need to retrieve deleted (or all) resources, please update your API calls to explicitly include the `is_deleted` parameter before **December 1, 2025**. To get a list of only deleted resources, you must now explicitly add the `is_deleted=true` query parameter to your request: ```bash # Example: Get ONLY deleted Tunnels curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/tunnels?is_deleted=true" \ -H "Authorization: Bearer $API_TOKEN" # Example: Get ONLY deleted Virtual Networks curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/virtual_networks?is_deleted=true" \ -H "Authorization: Bearer $API_TOKEN" ``` Following this change, retrieving a complete list of both active and deleted resources will require two separate API calls: one to get active items (by omitting the parameter or using `is_deleted=false`) and one to get deleted items (`is_deleted=true`). #### Why we’re making this change This update is based on user feedback and aims to: - **Create a more intuitive default:** Aligning with common API design principles where list operations return only active resources by default. - **Reduce unexpected results:** Prevents users from accidentally operating on deleted resources that were returned unexpectedly. - **Improve performance:** For most users, the default query result will now be smaller and more relevant. To learn more, please visit the [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/) and [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/) documentation. ## 2025-09-01 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Updated Email security roles** To provide more granular controls, we refined the [existing roles](https://developers.cloudflare.com/cloudflare-one/roles-permissions/#email-security-roles) for Email security and launched a new Email security role as well. All Email security roles no longer have read or write access to any of the other Zero Trust products: - **Email Configuration Admin** - **Email Integration Admin** - **Email security Read Only** - **Email security Analyst** - **Email security Policy Admin** - **Email security Reporting** To configure [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/email-security/policies/outbound/outbound-dlp/) or [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/#set-up-clientless-web-isolation), you now need to be an admin for the Zero Trust dashboard with the **Cloudflare Zero Trust** role. Also through customer feedback, we have created a new additive role to allow **Email security Analyst** to create, edit, and delete Email security policies, without needing to provide access via the **Email Configuration Admin** role. This role is called **Email security Policy Admin**, which can read all settings, but has write access to [allow policies](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/allow-policies/), [trusted domains](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/trusted-domains/), and [blocked senders](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/blocked-senders/). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-08-29 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One WARP Diagnostic AI Analyzer** We're excited to share a new AI feature, the [WARP diagnostic analyzer ↗︎](https://blog.cloudflare.com/ai-troubleshoot-warp-and-network-connectivity-issues/), to help you troubleshoot and resolve WARP connectivity issues faster. This beta feature is now available in the [Cloudflare One dashboard ↗︎](https://dash.cloudflare.com/one/) to all users. The AI analyzer makes it easier for you to identify the root cause of client connectivity issues by parsing [remote captures](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/#start-a-remote-capture) of [WARP diagnostic logs](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#warp-diag-logs). The WARP diagnostic analyzer provides a summary of impact that may be experienced on the device, lists notable events that may contribute to performance issues, and recommended troubleshooting steps and articles to help you resolve these issues. Refer to [WARP diagnostics analyzer (beta)](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/#diagnostics-analyzer-beta) to learn more about how to maximize using the WARP diagnostic analyzer to troubleshoot the WARP client. ## 2025-08-29 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **DEX MCP Server** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into device connectivity and performance across your Cloudflare SASE deployment. We've released an MCP server [(Model Context Protocol) ↗︎](https://cloudflare.com/learning/ai/what-is-model-context-protocol-mcp/) for DEX. The DEX MCP server is an AI tool that allows customers to ask a question like, "Show me the connectivity and performance metrics for the device used by carly‌@acme.com", and receive an answer that contains data from the DEX API. Any Cloudflare One customer using a Free, Pay-as-you-go, or Enterprise account can access the DEX MCP Server. This feature is available to everyone. Customers can test the new DEX MCP server in less than one minute. To learn more, read the [DEX MCP server documentation](https://developers.cloudflare.com/cloudflare-one/insights/dex/dex-mcp-server/). ## 2025-08-27 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Shadow IT - SaaS analytics dashboard** Zero Trust has significantly upgraded its **Shadow IT analytics**, providing you with unprecedented visibility into your organizations use of SaaS tools. With this dashboard, you can review who is using an application and volumes of data transfer to the application. You can review these metrics against application type, such as Artificial Intelligence or Social Media. You can also mark applications with an approval status, including **Unreviewed**, **In Review**, **Approved**, and **Unapproved** designating how they can be used in your organization. ![Cloudflare One Analytics Dashboards](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2814,height=1486,format=webp/_astro/shadow-it-analytics.BLNnG72w.png) These application statuses can also be used in Gateway HTTP policies, so you can block, isolate, limit uploads and downloads, and more based on the application status. Both the analytics and policies are accessible in the Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control. ## 2025-08-26 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **New CASB integrations for ChatGPT, Claude, and Gemini** [Cloudflare CASB ↗︎](https://www.cloudflare.com/zero-trust/products/casb/) now supports three of the most widely used GenAI platforms — **OpenAI ChatGPT**, **Anthropic Claude**, and **Google Gemini**. These API-based integrations give security teams agentless visibility into posture, data, and compliance risks across their organization’s use of generative AI. ![Cloudflare CASB showing selection of new findings for ChatGPT, Claude, and Gemini integrations.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2335,height=1776,format=webp/_astro/casb-ai-integrations-preview.B-zsSA1P.png) #### Key capabilities - **Agentless connections** — connect ChatGPT, Claude, and Gemini tenants via API; no endpoint software required - **Posture management** — detect insecure settings and misconfigurations that could lead to data exposure - **DLP detection** — identify sensitive data in uploaded chat attachments or files - **GenAI-specific insights** — surface risks unique to each provider’s capabilities #### Learn more - [ChatGPT integration docs ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/openai/) - [Claude integration docs ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) - [Gemini integration docs ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/google-workspace/gemini/) These integrations are available to all Cloudflare One customers today. ## 2025-08-26 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Manage and restrict access to internal MCP servers with Cloudflare Access** You can now control who within your organization has access to internal MCP servers, by putting internal MCP servers behind [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). [Self-hosted applications](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/linked-apps/) in Cloudflare Access now support OAuth for MCP server authentication. This allows Cloudflare to delegate access from any self-hosted application to an MCP server via OAuth. The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the authorized user, using that user's specific permissions and scopes. For example, if you have an MCP server designed for internal use within your organization, you can configure Access policies to ensure that only authorized users can access it, regardless of which MCP client they use. Support for internal, self-hosted MCP servers also works with MCP server portals, allowing you to provide a single MCP endpoint for multiple MCP servers. For more on MCP server portals, read the [blog post ↗︎](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) on the Cloudflare Blog. ## 2025-08-26 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **MCP server portals** ![MCP server portal](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1557,height=420,format=webp/_astro/mcp-server-portal.BOKqTCoI.png) An [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint. Key benefits include: - **Streamlined access to multiple MCP servers**: MCP server portals support both unauthenticated MCP servers as well as MCP servers secured using any third-party or custom OAuth provider. Users log in to the portal URL through Cloudflare Access and are prompted to authenticate separately to each server that requires OAuth. - **Customized tools per portal**: Admins can tailor an MCP portal to a particular use case by choosing the specific tools and prompt templates that they want to make available to users through the portal. This allows users to access a curated set of tools and prompts — the less external context exposed to the AI model, the better the AI responses tend to be. - **Observability**: Once the user's AI agent is connected to the portal, Cloudflare Access logs the individual requests made using the tools in the portal. This is available in an open beta for all customers across all plans! For more information check out our [blog ↗︎](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) for this release. ## 2025-08-25 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **New DLP topic based detection entries for AI prompt protection** You now have access to a comprehensive suite of capabilities to secure your organization's use of generative AI. AI prompt protection introduces four key features that work together to provide deep visibility and granular control. 1. **Prompt Detection for AI Applications** DLP can now natively detect and inspect user prompts submitted to popular AI applications, including **Google Gemini**, **ChatGPT**, **Claude**, and **Perplexity**. 2. **Prompt Analysis and Topic Classification** Our DLP engine performs deep analysis on each prompt, applying [topic classification](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics). These topics are grouped into two evaluation categories: - **Content:** PII, Source Code, Credentials and Secrets, Financial Information, and Customer Data. - **Intent:** Jailbreak attempts, requests for malicious code, or attempts to extract PII. To help you apply these topics quickly, we have also released five new predefined profiles (for example, AI Prompt: AI Security, AI Prompt: PII) that bundle these new topics. ![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=728,height=439,format=webp/_astro/ai-prompt-detection-entry.4QmdkAuv.png) 3. **Granular Guardrails** You can now build guardrails using Gateway HTTP policies with [application granular controls](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#granular-controls). Apply a DLP profile containing an [AI prompt topic detection](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics) to individual AI applications (for example, `ChatGPT`) and specific user actions (for example, `SendPrompt`) to block sensitive prompts.![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=731,height=511,format=webp/_astro/ai-prompt-policy.CF3H2rbK.png) 4. **Full Prompt Logging** To aid in incident investigation, an optional setting in your Gateway policy allows you to [capture prompt logs](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-generative-ai-prompt-content) to store the full interaction of prompts that trigger a policy match. To make investigations easier, logs can be filtered by `conversation_id`, allowing you to reconstruct the full context of an interaction that led to a policy violation.![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=728,height=444,format=webp/_astro/ai-prompt-log.ywQDc5qN.png) AI prompt protection is now available in open beta. To learn more about it, read the [blog ↗︎](https://blog.cloudflare.com/ai-prompt-protection/#closing-the-loop-logging) or refer to [AI prompt topics](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics). ## 2025-08-21 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway BYOIP Dedicated Egress IPs now available.** Enterprise Gateway users can now use Bring Your Own IP (BYOIP) for dedicated egress IPs. Admins can now onboard and use their own IPv4 or IPv6 prefixes to egress traffic from Cloudflare, delivering greater control, flexibility, and compliance for network traffic. Get started by following the [BYOIP onboarding process](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/#bring-your-own-ip-address-byoip). Once your IPs are onboarded, go to **Gateway** > **Egress policies** and select or create an egress policy. In **Select an egress IP**, choose *Use dedicated egress IPs (Cloudflare or BYOIP)*, then select your BYOIP address from the dropdown menu. ![Screenshot of a dropdown menu adding a BYOIP IPv4 address as a dedicated egress IP in a Gateway egress policy](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=933,height=459,format=webp/_astro/Gateway-byoip-dedicated-egress-ips.D0pzLAbV.png) For more information, refer to [BYOIP for dedicated egress IPs](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/#bring-your-own-ip-address-byoip). ## 2025-08-15 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **SFTP support for SSH with Cloudflare Access for Infrastructure** [SSH with Cloudflare Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) now supports SFTP. It is compatible with SFTP clients, such as Cyberduck. ## 2025-08-14 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Cloudflare Access Logging supports the Customer Metadata Boundary (CMB)** Cloudflare Access logs now support the [Customer Metadata Boundary (CMB)](https://developers.cloudflare.com/data-localization/metadata-boundary/). If you have configured the CMB for your account, all Access logging will respect that configuration. Note For EU CMB customers, the logs will not be stored by Access and will appear as empty in the dashboard. EU CMB customers should utilize [Logpush](https://developers.cloudflare.com/logs/logpush/) to retain their Access logging, if desired. ## 2025-08-07 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Expanded Email Link Isolation** When you deploy MX or Inline, not only can you apply email link isolation to suspicious links in all emails (including benign), you can now also apply email link isolation to all links of a specified disposition. This provides more flexibility in controlling user actions within emails. For example, you may want to deliver suspicious messages but isolate the links found within them so that users who choose to interact with the links will not accidentally expose your organization to threats. This means your end users are more secure than ever before. ![Expanded Email Link Isolation Configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1600,height=497,format=webp/_astro/expanded-link-actions.DziIg6E8.jpg) To isolate all links within a message based on the disposition, select **Settings** > **Link Actions** > **View** and select **Configure**. As with other other links you isolate, an interstitial will be provided to warn users that this site has been isolated and the link will be recrawled live to evaluate if there are any changes in our threat intel. Learn more about this feature on [Configure link actions ↗︎](https://developers.cloudflare.com/cloudflare-one/email-security/settings/detection-settings/configure-link-actions/). This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-07-31 [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Terraform V5 support for tunnels and routes** The Cloudflare Terraform provider resources for Cloudflare WAN tunnels and routes now support Terraform provider version 5. Customers using infrastructure-as-code workflows can manage their tunnel and route configuration with the latest provider version. For more information, refer to the [Cloudflare Terraform provider documentation ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs). ## 2025-07-30 [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Magic Transit and Magic WAN health check data is fully compatible with the CMB EU setting.** Today, we are excited to announce that all Magic Transit and Magic WAN customers with CMB EU ([Customer Metadata Boundary - Europe](https://developers.cloudflare.com/data-localization/metadata-boundary/)) enabled in their account will be able to access GRE, IPsec, and CNI health check and traffic volume data in the Cloudflare dashboard and via API. This ensures that all Magic Transit and Magic WAN customers with CMB EU enabled will be able to access all Magic Transit and Magic WAN features. Specifically, these two GraphQL endpoints are now compatible with CMB EU: - `magicTransitTunnelHealthChecksAdaptiveGroups` - `magicTransitTunnelTrafficAdaptiveGroups` ## 2025-07-28 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Scam domain category introduced under Security Threats** We have introduced a new Security Threat category called **Scam**. Relevant domains are marked with the Scam category. Scam typically refers to fraudulent websites and schemes designed to trick victims into giving away money or personal information. **New category added** | Parent ID | Parent Name | Category ID | Category Name | | --- | --- | --- | --- | | 21 | Security Threats | 191 | Scam | Refer to [Gateway domain categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) to learn more. ## 2025-07-24 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway HTTP Filtering on all ports available in open BETA** [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) can now apply [HTTP filtering](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) to all proxied HTTP requests, not just traffic on standard HTTP (`80`) and HTTPS (`443`) ports. This means all requests can now be filtered by [A/V scanning](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/antivirus-scanning/), [file sandboxing](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/file-sandboxing/), [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/#data-in-transit), and more. You can turn this [setting](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/#inspect-on-all-ports) on by going to **Settings** > **Network** > **Firewall** and choosing *Inspect on all ports*. ![HTTP Inspection on all ports setting](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1096,height=535,format=webp/_astro/Gateway-Inspection-all-ports.CCmwX6D0.png) To learn more, refer to [Inspect on all ports (Beta)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/#inspect-on-all-ports). ## 2025-07-22 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Google Bard Application replaced by Gemini** The **Google Bard** application (ID: 1198) has been deprecated and fully removed from the system. It has been replaced by the **Gemini** application (ID: 1340). Any existing Gateway policies that reference the old Google Bard application will no longer function. To ensure your policies continue to work as intended, you should update them to use the new Gemini application. We recommend replacing all instances of the deprecated Bard application with the new Gemini application in your Gateway policies. For more information about application policies, refer to [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2025-07-21 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Virtual Cloudflare One Appliance with KVM support (open beta)** The KVM-based virtual Cloudflare One Appliance is now in open beta with official support for Proxmox VE. Customers can deploy the virtual appliance on KVM hypervisors to connect branch or data center networks to Cloudflare WAN without dedicated hardware. For setup instructions, refer to [Configure a virtual Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-virtual-appliance/). ## 2025-07-17 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **New detection entry type: Document Matching for DLP** You can now create [document-based](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#document-entries) detection entries in DLP by uploading example documents. Cloudflare will encrypt your documents and create a unique fingerprint of the file. This fingerprint is then used to identify similar documents or snippets within your organization's traffic and stored files. ![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1356,height=839,format=webp/_astro/document-match.CcN8pGgR.png) **Key features and benefits:** - **Upload documents, forms, or templates:** Easily upload .docx and .txt files (up to 10 MB) that contain sensitive information you want to protect. - **Granular control with similarity percentage:** Define a minimum similarity percentage (0-100%) that a document must meet to trigger a detection, reducing false positives. - **Comprehensive coverage:** Apply these document-based detection entries in: - **Gateway policies:** To inspect network traffic for sensitive documents as they are uploaded or shared. - **CASB (Cloud Access Security Broker):** To scan files stored in cloud applications for sensitive documents at rest. - **Identify sensitive data:** This new detection entry type is ideal for identifying sensitive data within completed forms, templates, or even small snippets of a larger document, helping you prevent data exfiltration and ensure compliance. Once uploaded and processed, you can add this new document entry into a DLP profile and policies to enhance your data protection strategy. ## 2025-07-15 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Faster, more reliable UDP traffic for Cloudflare Tunnel** Your real-time applications running over [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) are now faster and more reliable. We've completely re-architected the way `cloudflared` proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel. This is a foundational improvement to Cloudflare Tunnel, delivered automatically to all customers. There are no settings to configure — your UDP traffic is already flowing faster and more reliably. **What’s new:** - **Faster UDP performance**: We've significantly reduced the latency for establishing new UDP sessions, making applications like private DNS much more responsive. - **Greater reliability for mixed traffic**: UDP packets are no longer affected by heavy TCP traffic, preventing timeouts and connection drops for your real-time services. Learn more about running [TCP or UDP applications](https://developers.cloudflare.com/reference-architecture/architectures/sase/#connecting-applications) and [private networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) through [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/). ## 2025-07-10 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New onboarding guides for Zero Trust** Use our brand new onboarding experience for Cloudflare Zero Trust. New and returning users can now engage with a **Get Started** tab with walkthroughs for setting up common use cases end-to-end. ![Zero Trust onboarding guides](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2048,height=966,format=webp/_astro/zt-onboarding-guides._18EfPbe.png) There are eight brand new onboarding guides in total: - Securely access a private network (sets up device client and Tunnel) - Device-to-device / mesh networking (sets up and connects multiple device clients) - Network to network connectivity (sets up and connects multiple WARP Connectors, makes reference to Magic WAN availability for Enterprise) - Secure web traffic (sets up device client, Gateway, pre-reqs, and initial policies) - Secure DNS for networks (sets up a new DNS location and Gateway policies) - Clientless web access (sets up Access to a web app, Tunnel, and public hostname) - Clientless SSH access (all the same + the web SSH experience) - Clientless RDP access (all the same + RDP-in-browser) Each flow walks the user through the steps to configure the essential elements, and provides a “more details” panel with additional contextual information about what the user will accomplish at the end, along with why the steps they take are important. Try them out now in the [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/?to=/:account/home)! ## 2025-07-07 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Cloudy summaries for Access and Gateway Logs** Cloudy, Cloudflare's AI Agent, will now automatically summarize your [Access](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) block logs. In the log itself, Cloudy will summarize what occurred and why. This will be helpful for quick troubleshooting and issue correlation. ![Cloudy AI summarizes a log](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=512,height=472,format=webp/_astro/cloudy-explanation.oFZR6cXa.png) If you have feedback about the Cloudy summary - good or bad - you can provide that right from the summary itself. ## 2025-07-07 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New App Library for Zero Trust Dashboard** Cloudflare Zero Trust customers can use the App Library to get full visibility over the SaaS applications that they use in their Gateway policies, CASB integrations, and Access for SaaS applications. **App Library**, found under **My Team**, makes information available about all Applications that can be used across the Zero Trust product suite. ![Zero Trust App Library](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1089,height=548,format=webp/_astro/app-library.D403GJ9j.png) You can use the App Library to see: - How Applications are defined - Where they are referenced in policies - Whether they have Access for SaaS configured - Review their CASB findings and integration status. Within individual Applications, you can also track their usage across your organization, and better understand user behavior. ## 2025-07-01 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Access RDP securely from your browser — now in open beta** [Browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is now available in open beta for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. With browser-based RDP, you can: - **Control how users authenticate to internal RDP resources** with single sign-on (SSO), multi-factor authentication (MFA), and granular access policies. - **Record who is accessing which servers and when** to support regulatory compliance requirements and to gain greater visibility in the event of a security event. - **Eliminate the need to install and manage software on user devices**. You will only need a web browser. - **Reduce your attack surface** by keeping your RDP servers off the public Internet and protecting them from common threats like credential stuffing or brute-force attacks. ![Example of a browsed-based RDP Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2132,height=1814,format=webp/_astro/browser-based-rdp-access-app.BNXce1JL.png) To get started, see [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). ## 2025-06-30 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Agent for Android (version 2.4.2)** A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store ↗︎](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release contains improvements and new exciting features, including [post-quantum cryptography](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate [protection of post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) without needing to upgrade any of your individual corporate applications or systems. **Changes and improvements** - QLogs are now disabled by default and can be enabled in the app by turning on **Enable qlogs** under **Settings** > **Advanced** > **Diagnostics** > **Debug Logs**. The QLog setting from previous releases will no longer be respected. - DNS over HTTPS traffic is now included in the WARP tunnel by default. - The WARP client now applies [post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). - Fixed an issue that caused WARP connection failures on ChromeOS devices. ## 2025-06-30 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Agent for iOS (version 1.11)** A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store ↗︎](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release contains improvements and new exciting features, including [post-quantum cryptography](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate [protection of post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) without needing to upgrade any of your individual corporate applications or systems. **Changes and improvements** - QLogs are now disabled by default and can be enabled in the app by turning on **Enable qlogs** under **Settings** > **Advanced** > **Diagnostics** > **Debug Logs**. The QLog setting from previous releases will no longer be respected. - DNS over HTTPS traffic is now included in the WARP tunnel by default. - The WARP client now applies [post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). ## 2025-06-23 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Data Security Analytics in the Zero Trust dashboard** Zero Trust now includes **Data security analytics**, providing you with unprecedented visibility into your organization sensitive data. The new dashboard includes: - **Sensitive Data Movement Over Time:** - See patterns and trends in how sensitive data moves across your environment. This helps understand where data is flowing and identify common paths. - **Sensitive Data at Rest in SaaS & Cloud:** - View an inventory of sensitive data stored within your corporate SaaS applications (for example, Google Drive, Microsoft 365) and cloud accounts (such as AWS S3). - **DLP Policy Activity:** - Identify which of your Data Loss Prevention (DLP) policies are being triggered most often. - See which specific users are responsible for triggering DLP policies. ![Data Security Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3254,height=1580,format=webp/_astro/cf1-data-security-analytics-v1.BGl6fYXl.png) To access the new dashboard, log in to [Cloudflare One ↗︎](https://one.dash.cloudflare.com/) and go to **Insights** on the sidebar. ## 2025-06-18 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway will now evaluate Network policies before HTTP policies from July 14th, 2025** [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) will now evaluate [Network (Layer 4) policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) **before** [HTTP (Layer 7) policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). This change preserves your existing security posture and does not affect which traffic is filtered — but it may impact how notifications are displayed to end users. This change will roll out progressively between **July 14–18, 2025**. If you use HTTP policies, we recommend reviewing your configuration ahead of rollout to ensure the user experience remains consistent. #### Updated order of enforcement **Previous order:** 1. DNS policies 2. HTTP policies 3. Network policies **New order:** 1. DNS policies 2. **Network policies** 3. **HTTP policies** #### Action required: Review your Gateway HTTP policies This change may affect block notifications. For example: - You have an **HTTP policy** to block `example.com` and display a block page. - You also have a **Network policy** to block `example.com` silently (no client notification). With the new order, the Network policy will trigger first — and the user will no longer see the HTTP block page. To ensure users still receive a block notification, you can: - Add a client notification to your Network policy, or - Use only the HTTP policy for that domain. --- #### Why we’re making this change This update is based on user feedback and aims to: - Create a more intuitive model by evaluating network-level policies before application-level policies. - Minimize [526 connection errors](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-526/#error-526-in-the-zero-trust-context) by verifying the network path to an origin before attempting to establish a decrypted TLS connection. --- To learn more, visit the [Gateway order of enforcement documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/order-of-enforcement/). ## 2025-06-05 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Cloudflare One Analytics Dashboards and Exportable Access Report** Cloudflare One now offers powerful new analytics dashboards to help customers easily discover available insights into their application access and network activity. These dashboards provide a centralized, intuitive view for understanding user behavior, application usage, and security posture. !\[Cloudflare One Analytics Dashboards](\~/assets/images/changelog/cloudflare-one/Analytics Dashboards.png) Additionally, a new exportable access report is available, allowing customers to quickly view high-level metrics and trends in their application access. A **preview** of the report is shown below, with more to be found in the report: ![Cloudflare One Analytics Dashboards](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2406,height=950,format=webp/_astro/access-report.C744W7JR.png) Both features are accessible in the Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control. ## 2025-05-29 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New Gateway Analytics in the Cloudflare One Dashboard** Users can now access significant enhancements to Cloudflare Gateway analytics, providing you with unprecedented visibility into your organization's DNS queries, HTTP requests, and Network sessions. These powerful new dashboards enable you to go beyond raw logs and gain actionable insights into how your users are interacting with the Internet and your protected resources. You can now visualize and explore: - Patterns Over Time: Understand trends in traffic volume and blocked requests, helping you identify anomalies and plan for future capacity. - Top Users & Destinations: Quickly pinpoint the most active users, enabling better policy enforcement and resource allocation. - Actions Taken: See a clear breakdown of security actions applied by Gateway policies, such as blocks and allows, offering a comprehensive view of your security posture. - Geographic Regions: Gain insight into the global distribution of your traffic. ![Gateway Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2740,height=1166,format=webp/_astro/gateway-analytics.BdSwbIBb.png) To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) and go to Analytics in the side navigation bar. ## 2025-05-27 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Gateway Protocol Detection Now Available for Pay-as-you-go and Free Plans** All Cloudflare One Gateway users can now use Protocol detection logging and filtering, including those on Pay-as-you-go and Free plans. With Protocol Detection, admins can identify and enforce policies on traffic proxied through Gateway based on the underlying network protocol (for example, HTTP, TLS, or SSH), enabling more granular traffic control and security visibility no matter your plan tier. This feature is available to enable in your account network settings for all accounts. For more information on using Protocol Detection, refer to the [Protocol detection documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/). ## 2025-05-18 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New Applications Added to Zero Trust** 42 new applications have been added for Zero Trust support within the Application Library and Gateway policy enforcement, giving you the ability to investigate or apply inline policies to these applications. 33 of the 42 applications are Artificial Intelligence applications. The others are Human Resources (2 applications), Development (2 applications), Productivity (2 applications), Sales & Marketing, Public Cloud, and Security. To view all available applications, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), navigate to the **App Library** under **My Team**. For more information on creating Gateway policies, see our [Gateway policy documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2025-05-16 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **New Access Analytics in the Cloudflare One Dashboard** A new Access Analytics dashboard is now available to all Cloudflare One customers. Customers can apply and combine multiple filters to dive into specific slices of their Access metrics. These filters include: - Logins granted and denied - Access events by type (SSO, Login, Logout) - Application name (Salesforce, Jira, Slack, etc.) - Identity provider (Okta, Google, Microsoft, onetimepin, etc.) - Users ( `chris@cloudflare.com`, `sally@cloudflare.com`, `rachel@cloudflare.com`, etc.) - Countries (US, CA, UK, FR, BR, CN, etc.) - Source IP address - App type (self-hosted, Infrastructure, RDP, etc.) ![Access Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2030,height=1720,format=webp/_astro/accessanalytics.DYXgwZCl.png) To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) and find Analytics in the side navigation bar. ## 2025-05-15 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Open email attachments with Browser Isolation** You can now safely open email attachments to view and investigate them. What this means is that messages now have a **Attachments** section. Here, you can view processed attachments and their classifications (for example, *Malicious*, *Suspicious*, *Encrypted*). Next to each attachment, a **Browser Isolation** icon allows your team to safely open the file in a **clientless, isolated browser** with no risk to the analyst or your environment. ![Attachment-RBI](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=517,height=155,format=webp/_astro/Attachment-RBI.U9Dp8dJO.png) To use this feature, you must: - Turn on **Allow users to open a remote browser without the device client** in your Zero Trust settings. - Have **Browser Isolation (BISO)** seats assigned. For more details, refer to our [setup guide](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/). Some attachment types may not render in Browser Isolation. If there is a file type that you would like to be opened with Browser Isolation, reach out to your Cloudflare contact. This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-05-14 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Domain Categories improvements** **New categories added** | Parent ID | Parent Name | Category ID | Category Name | | --- | --- | --- | --- | | 1 | Ads | 66 | Advertisements | | 3 | Business & Economy | 185 | Personal Finance | | 3 | Business & Economy | 186 | Brokerage & Investing | | 21 | Security Threats | 187 | Compromised Domain | | 21 | Security Threats | 188 | Potentially Unwanted Software | | 6 | Education | 189 | Reference | | 9 | Government & Politics | 190 | Charity and Non-profit | **Changes to existing categories** | Original Name | New Name | | --- | --- | | Religion | Religion & Spirituality | | Government | Government/Legal | | Redirect | URL Alias/Redirect | Refer to [Gateway domain categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) to learn more. ## 2025-05-13 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) **SAML HTTP-POST bindings support for RBI** Remote Browser Isolation (RBI) now supports SAML HTTP-POST bindings, enabling seamless authentication for SSO-enabled applications that rely on POST-based SAML responses from Identity Providers (IdPs) within a Remote Browser Isolation session. This update resolves a previous limitation that caused `405` errors during login and improves compatibility with multi-factor authentication (MFA) flows. With expanded support for major IdPs like Okta and Azure AD, this enhancement delivers a more consistent and user-friendly experience across authentication workflows. Learn how to [set up Remote Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/). ## 2025-05-13 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **New Applications Added for DNS Filtering** You can now create DNS policies to manage outbound traffic for an expanded list of applications. This update adds support for 273 new applications, giving you more control over your organization's outbound traffic. With this update, you can: - Create DNS policies for a wider range of applications - Manage outbound traffic more effectively - Improve your organization's security and compliance posture For more information on creating DNS policies, see our [DNS policy documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/). ## 2025-05-12 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Case Sensitive Custom Word Lists** You can now configure [custom word lists](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#custom-wordlist-datasets) to enforce case sensitivity. This setting supports flexibility where needed and aims to reduce false positives where letter casing is critical. ![dlp](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1289,height=910,format=webp/_astro/case-sesitive-cwl.MPuOc_3r.png) ## 2025-05-08 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Open email links with Browser Isolation** You can now safely open links in emails to view and investigate them. ![Open links with Browser Isolation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=558,height=204,format=webp/_astro/investigate-links.pYbpGkt5.jpg) From **Investigation**, go to **View details**, and look for the **Links identified** section. Next to each link, the Cloudflare dashboard will display an **Open in Browser Isolation** icon which allows your team to safely open the link in a clientless, isolated browser with no risk to the analyst or your environment. Refer to [Open links](https://developers.cloudflare.com/cloudflare-one/email-security/investigation/search-email/#open-links) to learn more about this feature. To use this feature, you must: - Turn on **Allow users to open a remote browser without the device client** in your Zero Trust settings. - Have **Browser Isolation (RBI)** seats assigned. For more details, refer to our [setup guide](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-05-07 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Send forensic copies to storage without DLP profiles** You can now [send DLP forensic copies](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#send-dlp-forensic-copies-to-logpush-destination) to third-party storage for any HTTP policy with an `Allow` or `Block` action, without needing to include a DLP profile. This change increases flexibility for data handling and forensic investigation use cases. By default, Gateway will send all matched HTTP requests to your configured DLP Forensic Copy jobs. ![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1324,height=636,format=webp/_astro/forensic-copies-for-all.fxeFrCY4.png) ## 2025-05-01 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) **Browser Isolation Overview page for Zero Trust** A new **Browser Isolation Overview** page is now available in the Cloudflare Zero Trust dashboard. This centralized view simplifies the management of [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) deployments, providing: - **Streamlined Onboarding:** Easily set up and manage isolation policies from one location. - **Quick Testing:** Validate [clientless web application isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) with ease. - **Simplified Configuration:** Configure [isolated access applications](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/isolate-application/) and policies efficiently. - **Centralized Monitoring:** Track aggregate usage and blocked actions. This update consolidates previously disparate settings, accelerating deployment, improving visibility into isolation activity, and making it easier to ensure your protections are working effectively. ![Browser Isolation Overview](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1717,height=1286,format=webp/_astro/browser-isolation-overview.Ljd5ax_O.png) To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) and find Browser Isolation in the side navigation bar. ## 2025-04-30 [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) **Dark Mode for Zero Trust Dashboard** The [Cloudflare Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) now supports Cloudflare's native dark mode for all accounts and plan types. Zero Trust Dashboard will automatically accept your user-level preferences for system settings, so if your Dashboard appearance is set to 'system' or 'dark', the Zero Trust dashboard will enter dark mode whenever the rest of your Cloudflare account does. ![Zero Trust dashboard supports dark mode](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3456,height=1596,format=webp/_astro/dark-mode.DfLeS20d.png) To update your view preference in the Zero Trust dashboard: 1. Log into the [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/). 2. Select your user icon. 3. Select **Dark Mode**. To update your view preference in the Core dashboard: 1. Log into the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com). 2. Go to **My Profile** 3. For **Appearance**, choose **Dark**. ## 2025-04-30 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Cloudflare One Appliance supports multiple DNS server IPs** Cloudflare One Appliance DHCP server settings now support specifying multiple DNS server IP addresses in the DHCP pool. Previously, customers could only configure a single DNS server per DHCP pool. With this update, you can specify multiple DNS servers to provide redundancy for clients at branch locations. For configuration details, refer to [DHCP server](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/network-options/dhcp/dhcp-server/). ## 2025-04-28 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **FQDN Filtering For Gateway Egress Policies** Cloudflare One administrators can now control which egress IP is used based on a destination's fully qualified domain name (FDQN) within Gateway Egress policies. - Host, Domain, Content Categories, and Application selectors are now available in the Gateway Egress policy builder in beta. - During the beta period, you can use these selectors with traffic on-ramped to Gateway with the WARP client, proxy endpoints (commonly deployed with PAC files), or Cloudflare Browser Isolation. - For WARP client support, additional configuration is required. For more information, refer to the [WARP client configuration documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/#limitations). ![Egress by FQDN and Hostname](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=841,height=1045,format=webp/_astro/Gateway-Egress-FQDN-Policy-preview.Civon5p8.png) This will help apply egress IPs to your users' traffic when an upstream application or network requires it, while the rest of their traffic can take the most performant egress path. ## 2025-04-21 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Access bulk policy tester** The [Access bulk policy tester](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/#test-all-policies-in-an-application) is now available in the Cloudflare Zero Trust dashboard. The bulk policy tester allows you to simulate Access policies against your entire user base before and after deploying any changes. The policy tester will simulate the configured policy against each user's last seen identity and device posture (if applicable). ![Example policy tester](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1531,height=693,format=webp/_astro/example-policy-tester.DCY8hQvx.png) ## 2025-04-14 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **New predefined detection entry for ICD-11** You now have access to the World Health Organization (WHO) 2025 edition of the [International Classification of Diseases 11th Revision (ICD-11) ↗︎](https://www.who.int/news/item/14-02-2025-who-releases-2025-update-to-the-international-classification-of-diseases-%28icd-11%29) as a predefined detection entry. The new dataset can be found in the [Health Information](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#health-information) predefined profile. ICD-10 dataset remains available for use. ## 2025-04-11 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **HTTP redirect and custom block page redirect** You can now use more flexible redirect capabilities in Cloudflare One with Gateway. - A new **Redirect** action is available in the HTTP policy builder, allowing admins to redirect users to any URL when their request matches a policy. You can choose to preserve the original URL and query string, and optionally include policy context via query parameters. - For **Block** actions, admins can now configure a custom URL to display when access is denied. This block page redirect is set at the account level and can be overridden in DNS or HTTP policies. Policy context can also be passed along in the URL. Learn more in our documentation for [HTTP Redirect](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#redirect) and [Block page redirect](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page). ## 2025-04-09 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Cloudflare Zero Trust SCIM User and Group Provisioning Logs** [Cloudflare Zero Trust SCIM provisioning](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim) now has a full audit log of all create, update and delete event from any SCIM Enabled IdP. The [SCIM logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/scim-logs/) support filtering by IdP, Event type, Result and many more fields. This will help with debugging user and group update issues and questions. SCIM logs can be found on the Zero Trust Dashboard under **Logs** -> **SCIM provisioning**. ![Example SCIM Logs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2318,height=1060,format=webp/_astro/example-scim-log.Bv5Zqckh.png) ## 2025-04-01 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **CASB and Email security** With Email security, you get two free CASB integrations. Use one SaaS integration for Email security to sync with your directory of users, take actions on delivered emails, automatically provide EMLs for reclassification requests for clean emails, discover CASB findings and more. With the other integration, you can have a separate SaaS integration for CASB findings for another SaaS provider. Refer to [Add an integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) to learn more about this feature. ![CASB-EmailSecurity](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=727,height=502,format=webp/_astro/CASB-EmailSecurity.B1wd9be2.png) This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-03-21 [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Secure DNS Locations Management User Role** We're excited to introduce the [**Cloudflare Zero Trust Secure DNS Locations Write role**](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/#secure-dns-locations), designed to provide DNS filtering customers with granular control over third-party access when configuring their Protective DNS (PDNS) solutions. Many DNS filtering customers rely on external service partners to manage their DNS location endpoints. This role allows you to grant access to external parties to administer DNS locations without overprovisioning their permissions. **Secure DNS Location Requirements:** - Mandate usage of [Bring your own DNS resolver IP addresses](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-resolver-ips/#bring-your-own-dns-resolver-ip) if available on the account. - Require source network filtering for IPv4/IPv6/DoT endpoints; token authentication or source network filtering for the DoH endpoint. You can assign the new role via Cloudflare Dashboard (`Manage Accounts > Members`) or via API. For more information, refer to the [Secure DNS Locations documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/#secure-dns-locations). ## 2025-03-17 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Agent for Android (version 2.4)** A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store ↗︎](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release includes a new feature allowing [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. **Changes and improvements** - Improved in-app error messages. - Improved mobile client login with support for [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url). - Fixed an issue preventing admin split tunnel settings taking priority for traffic from certain applications. ## 2025-03-17 [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Cloudflare One Agent for iOS (version 1.10)** A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store ↗︎](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release includes a new feature allowing [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. **Changes and improvements** - Improved in-app error messages. - Improved mobile client login with support for [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url). - Bug fixes and performance improvements. ## 2025-03-13 [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) **Cloudflare IP Ranges List** Magic Firewall now supports a new managed list of Cloudflare IP ranges. This list is available as an option when creating a Magic Firewall policy based on IP source/destination addresses. When selecting "is in list" or "is not in list", the option "**Cloudflare IP Ranges**" will appear in the dropdown menu. This list is based on the IPs listed in the Cloudflare [IP ranges ↗︎](https://www.cloudflare.com/en-gb/ips/). Updates to this managed list are applied automatically. ![Cloudflare IPs Managed List](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1102,height=677,format=webp/_astro/cloudflare-ips.DetyOndL.png) Note: IP Lists require a Cloudflare Advanced Network Firewall subscription. For more details about Cloudflare Network Firewall plans, refer to [Plans](https://developers.cloudflare.com/cloudflare-network-firewall/plans). ## 2025-03-07 [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) **Cloudflare One Agent now supports Endpoint Monitoring** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into device, network, and application performance across your Cloudflare SASE deployment. The latest release of the Cloudflare One agent (v2025.1.861) now includes device endpoint monitoring capabilities to provide deeper visibility into end-user device performance which can be analyzed directly from the dashboard. Device health metrics are now automatically collected, allowing administrators to: - View the last network a user was connected to - Monitor CPU and RAM utilization on devices - Identify resource-intensive processes running on endpoints ![Device endpoint monitoring dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1226,height=675,format=webp/_astro/cloudflare-one-agent-health-monitoring.XXtiRuOp.gif) This feature complements existing DEX features like [synthetic application monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/) and [network path visualization](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/traceroute/), creating a comprehensive troubleshooting workflow that connects application performance with device state. For more details refer to our [DEX](https://developers.cloudflare.com/cloudflare-one/insights/dex/) documentation. ## 2025-03-04 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) **Gain visibility into user actions in Zero Trust Browser Isolation sessions** We're excited to announce that new logging capabilities for [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) through [Logpush](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/) are available in Beta starting today! With these enhanced logs, administrators can gain visibility into end user behavior in the remote browser and track blocked data extraction attempts, along with the websites that triggered them, in an isolated session. ```json { "AccountID": "$ACCOUNT_ID", "Decision": "block", "DomainName": "www.example.com", "Timestamp": "2025-02-27T23:15:06Z", "Type": "copy", "UserID": "$USER_ID" } ``` User Actions available: - **Copy & Paste** - **Downloads & Uploads** - **Printing** Learn more about how to get started with Logpush in our [documentation](https://developers.cloudflare.com/logs/logpush/). ## 2025-03-03 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **New SAML and OIDC Fields and SAML transforms for Access for SaaS** [Access for SaaS applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/) now include more configuration options to support a wider array of SaaS applications. **SAML and OIDC Field Additions** OIDC apps now include: - Group Filtering via RegEx - OIDC Claim mapping from an IdP - OIDC token lifetime control - Advanced OIDC auth flows including hybrid and implicit flows ![OIDC field additions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1021,height=192,format=webp/_astro/oidc-claims.2di8l9Lv.png) SAML apps now include improved SAML attribute mapping from an IdP. ![SAML field additions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1051,height=202,format=webp/_astro/saml-attribute-statements.CW45j5Qi.png) **SAML transformations** SAML identities sent to Access applications can be fully customized using JSONata expressions. This allows admins to configure the precise identity SAML statement sent to a SaaS application. ![Configured SAML statement sent to application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1030,height=254,format=webp/_astro/transformation-box.DyKn-DdN.png) ## 2025-03-01 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Use Logpush for Email security detections** You can now send detection logs to an endpoint of your choice with Cloudflare Logpush. Filter logs matching specific criteria you have set and select from over 25 fields you want to send. When creating a new Logpush job, remember to select **Email security alerts** as the dataset. ![logpush-detections](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=927,height=688,format=webp/_astro/Logpush-Detections.Dc5tHta3.png) For more information, refer to [Enable detection logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/email-security-logs/#enable-detection-logs). This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-27 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Check status of Email security or Area 1** Concerns about performance for Email security or Area 1? You can now check the operational status of both on the [Cloudflare Status page ↗︎](https://www.cloudflarestatus.com/). For Email security, look under **Cloudflare Sites and Services**. - **Dashboard** is the dashboard for Cloudflare, including Email security - **Email security (Zero Trust)** is the processing of email - **API** are the Cloudflare endpoints, including the ones for Email security For Area 1, under **Cloudflare Sites and Services**: - **Area 1 - Dash** is the dashboard for Cloudflare, including Email security - **Email security (Area1)** is the processing of email - **Area 1 - API** are the Area 1 endpoints ![Status-page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=792,height=348,format=webp/_astro/Status-Page.DcFJ1286.png) This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-25 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Use DLP Assist for M365** Cloudflare Email security customers who have Microsoft 365 environments can quickly deploy an Email DLP (Data Loss Prevention) solution for free. Simply deploy our add-in, create a DLP policy in Cloudflare, and configure Outlook to trigger behaviors like displaying a banner, alerting end users before sending, or preventing delivery entirely. Refer to [Outbound Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/email-security/policies/outbound/outbound-dlp/) to learn more about this feature. In GUI alert: ![DLP-Alert](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1357,height=212,format=webp/_astro/DLP-Alert.5s-fbKn3.png) Alert before sending: ![DLP-Pop-up](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1362,height=479,format=webp/_astro/DLP-Pop-up.0gkYy7o5.png) Prevent delivery: ![DLP-Blocked](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1353,height=329,format=webp/_astro/DLP-Blocked.CmQkGrnM.png) This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-14 [Cloudflare One Appliance](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) **Configure your Magic WAN Connector to connect via static IP assignment** You can now locally configure your [Magic WAN Connector](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/) to work in a static IP configuration. This local method does not require having access to a DHCP Internet connection. However, it does require being comfortable with using tools to access the serial port on Magic WAN Connector as well as using a serial terminal client to access the Connector's environment. For more details, refer to [WAN with a static IP address](https://developers.cloudflare.com/cloudflare-wan/configuration/appliance/configure-hardware-appliance/#bootstrap-via-serial-console). ## 2025-02-07 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Open email links with Security Center** You can now investigate links in emails with Cloudflare Security Center to generate a report containing a myriad of technical details: a phishing scan, SSL certificate data, HTTP request and response data, page performance data, DNS records, what technologies and libraries the page uses, and more. ![Open links in Security Center](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1118,height=402,format=webp/_astro/Open-Links-Security-Center.b-LJU4YB.png) From **Investigation**, go to **View details**, and look for the **Links identified** section. Select **Open in Security Center** next to each link. **Open in Security Center** allows your team to quickly generate a detailed report about the link with no risk to the analyst or your environment. For more details, refer to [Open links](https://developers.cloudflare.com/cloudflare-one/email-security/investigation/search-email/#open-links). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-03 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) **Block files that are password-protected, compressed, or otherwise unscannable.** Gateway HTTP policies can now block files that are password-protected, compressed, or otherwise unscannable. These unscannable files are now matched with the [Download and Upload File Types traffic selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-types) for HTTP policies: - Password-protected Microsoft Office document - Password-protected PDF - Password-protected ZIP archive - Unscannable ZIP archive To get started inspecting and modifying behavior based on these and other rules, refer to [HTTP filtering](https://developers.cloudflare.com/cloudflare-one/traffic-controls/get-started/http/). ## 2025-01-20 [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) **Detect source code leaks with Data Loss Prevention** You can now detect source code leaks with Data Loss Prevention (DLP) with predefined checks against common programming languages. The following programming languages are validated with natural language processing (NLP). - C - C++ - C# - Go - Haskell - Java - JavaScript - Lua - Python - R - Rust - Swift DLP also supports confidence level for [source code profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#source-code). For more details, refer to [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/). ## 2025-01-15 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Export SSH command logs with Access for Infrastructure using Logpush** Availability Only available on Enterprise plans. Cloudflare now allows you to send SSH command logs to storage destinations configured in [Logpush](https://developers.cloudflare.com/logs/logpush/), including third-party destinations. Once exported, analyze and audit the data as best fits your organization! For a list of available data fields, refer to the [SSH logs dataset](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/ssh_logs/). To set up a Logpush job, refer to [Logpush integration](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). ## 2024-12-19 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Escalate user submissions** After you triage your users' submissions (that are machine reviewed), you can now escalate them to our team for reclassification (which are instead human reviewed). User submissions from the submission alias, PhishNet, and our API can all be escalated. ![Escalate](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=897,height=434,format=webp/_astro/Escalate.CwXPIyM3.png) From **Reclassifications**, go to **User submissions**. Select the three dots next to any of the user submissions, then select **Escalate** to create a team request for reclassification. The Cloudflare dashboard will then show you the submissions on the **Team Submissions** tab. Refer to [User submissions](https://developers.cloudflare.com/cloudflare-one/email-security/submissions/user-submissions/) to learn more about this feature. This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2024-12-19 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Increased transparency for phishing email submissions** You now have more transparency about team and user submissions for phishing emails through a **Reclassification** tab in the Zero Trust dashboard. Reclassifications happen when users or admins [submit a phish](https://developers.cloudflare.com/cloudflare-one/email-security/settings/submission-settings/) to Email security. Cloudflare reviews and - in some cases - reclassifies these emails based on improvements to our machine learning models. This new tab increases your visibility into this process, allowing you to view what submissions you have made and what the outcomes of those submissions are. ![Use the Reclassification area to review submitted phishing emails](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1645,height=758,format=webp/_astro/reclassifications-tab.yDgtjG51.png) ## 2024-12-19 [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) **Troubleshoot tunnels with diagnostic logs** The latest `cloudflared` build [2024.12.2 ↗︎](https://github.com/cloudflare/cloudflared/releases/tag/2024.12.2) introduces the ability to collect all the diagnostic logs needed to troubleshoot a `cloudflared` instance. A diagnostic report collects data from a single instance of `cloudflared` running on the local machine and outputs it to a `cloudflared-diag` file. For more information, refer to [Diagnostic logs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs/). ## 2024-12-17 [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Network Interconnect](https://developers.cloudflare.com/network-interconnect/) **Establish BGP peering over Direct CNI circuits** Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using a Direct CNI on-ramp. Using BGP peering allows customers to: - Automate the process of adding or removing networks and subnets. - Take advantage of failure detection and session recovery features. With this functionality, customers can: - Establish an eBGP session between their devices and the Magic WAN / Magic Transit service when connected via CNI. - Secure the session by MD5 authentication to prevent misconfigurations. - Exchange routes dynamically between their devices and their Magic routing table. Refer to [Magic WAN BGP peering](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-routes/#configure-bgp-routes) or [Magic Transit BGP peering](https://developers.cloudflare.com/magic-transit/how-to/configure-routes/#configure-bgp-routes) to learn more about this feature and how to set it up. ## 2024-12-05 [Multi-Cloud Networking](https://developers.cloudflare.com/multi-cloud-networking/) **Generate customized terraform files for building cloud network on-ramps** You can now generate customized terraform files for building cloud network on-ramps to [Magic WAN](https://developers.cloudflare.com/cloudflare-wan/). [Magic Cloud](https://developers.cloudflare.com/multi-cloud-networking/) can scan and discover existing network resources and generate the required terraform files to automate cloud resource deployment using their existing infrastructure-as-code workflows for cloud automation. You might want to do this to: - Review the proposed configuration for an on-ramp before deploying it with Cloudflare. - Deploy the on-ramp using your own infrastructure-as-code pipeline instead of deploying it with Cloudflare. For more details, refer to [Set up with Terraform](https://developers.cloudflare.com/multi-cloud-networking/cloud-on-ramps/#set-up-with-terraform). ## 2024-11-22 [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) **Find security misconfigurations in your AWS cloud environment** You can now use CASB to find security misconfigurations in your AWS cloud environment using [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/). You can also [connect your AWS compute account](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/aws-s3/#compute-account) to extract and scan your S3 buckets for sensitive data while avoiding egress fees. CASB will scan any objects that exist in the bucket at the time of configuration. To connect a compute account to your AWS integration: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Integrations**. 2. Find and select your AWS integration. 3. Select **Open connection instructions**. 4. Follow the instructions provided to connect a new compute account. 5. Select **Refresh**. ## 2024-11-21 [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) **Improved non-English keyboard support** You can now type in languages that use diacritics (like á or ç) and character-based scripts (such as Chinese, Japanese, and Korean) directly within the remote browser. The isolated browser now properly recognizes non-English keyboard input, eliminating the need to copy and paste content from a local browser or device. ## 2024-11-07 [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) **Use Logpush for Email security user actions** You can now send user action logs for Email security to an endpoint of your choice with Cloudflare Logpush. Filter logs matching specific criteria you have set or select from multiple fields you want to send. For all users, we will log the date and time, user ID, IP address, details about the message they accessed, and what actions they took. When creating a new Logpush job, remember to select **Audit logs** as the dataset and filter by: - **Field**: `"ResourceType"` - **Operator**: `"starts with"` - **Value**: `"email_security"`. ![Logpush-user-actions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=829,height=454,format=webp/_astro/Logpush-User-Actions.D14fWgmq.png) For more information, refer to [Enable user action logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/email-security-logs/#enable-user-action-logs). This feature is available across all Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2024-10-02 [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) **Search for custom rules using rule name and/or ID** The Magic Firewall dashboard now allows you to search custom rules using the rule name and/or ID. 1. Log into the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com) and select your account. 2. Go to **Analytics & Logs** > **Network Analytics**. 3. Select **Magic Firewall**. 4. Add a filter for **Rule ID**. ![Search for firewall rules with rule IDs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1032,height=801,format=webp/_astro/search-with-rule-id.DJgzqgKk.png) Additionally, the rule ID URL link has been added to Network Analytics. ## 2024-10-01 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) **Eliminate long-lived credentials and enhance SSH security with Cloudflare Access for Infrastructure** Organizations can now eliminate long-lived credentials from their SSH setup and enable strong multi-factor authentication for SSH access, similar to other Access applications, all while generating access and command logs. SSH with [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) uses short-lived SSH certificates from Cloudflare, eliminating SSH key management and reducing the security risks associated with lost or stolen keys. It also leverages a common deployment model for Cloudflare One customers: [WARP-to-Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-device-client/). SSH with Access for Infrastructure enables you to: - **Author fine-grained policy** to control who may access your SSH servers, including specific ports, protocols, and SSH users. - **Monitor infrastructure access** with Access and SSH command logs, supporting regulatory compliance and providing visibility in case of security breach. - **Preserve your end users' workflows.** SSH with Access for Infrastructure supports native SSH clients and does not require any modifications to users’ SSH configs. ![Example of an infrastructure Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1916,height=1714,format=webp/_astro/infrastructure-app.BhpJOgxs.png) To get started, refer to [SSH with Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/). ## 2024-06-17 [Risk Score](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) **Exchange user risk scores with Okta** Beyond the controls in [Zero Trust](https://developers.cloudflare.com/cloudflare-one/), you can now [exchange user risk scores](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/#send-risk-score-to-okta) with Okta to inform SSO-level policies. First, configure Cloudflare One to send user risk scores to Okta. 1. Set up the [Okta SSO integration](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/okta/). 2. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Integrations** > **Identity providers**. 3. In **Your identity providers**, locate your Okta integration and select **Edit**. 4. Turn on **Send risk score to Okta**. 5. Select **Save**. 6. Upon saving, Cloudflare One will display the well-known URL for your organization. Copy the value. Next, configure Okta to receive your risk scores. 1. On your Okta admin dashboard, go to **Security** > **Device Integrations**. 2. Go to **Receive shared signals**, then select **Create stream**. 3. Name your integration. In **Set up integration with**, choose *Well-known URL*. 4. In **Well-known URL**, enter the well-known URL value provided by Cloudflare One. 5. Select **Create**. ## 2024-06-16 [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) [CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) [Cloudflare Tunnel for SASE](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) [Digital Experience Monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/) [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) [Email security](https://developers.cloudflare.com/cloudflare-one/email-security/) [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) [Multi-Cloud Networking](https://developers.cloudflare.com/multi-cloud-networking/) [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) [Network Flow](https://developers.cloudflare.com/network-flow/) [Magic Transit](https://developers.cloudflare.com/magic-transit/) [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) [Network Interconnect](https://developers.cloudflare.com/network-interconnect/) [Risk Score](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) **Explore product updates for Cloudflare One** Welcome to your new home for product updates on [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/). Our [new changelog](https://developers.cloudflare.com/changelog/) lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs. If you are looking for older product updates, refer to the following locations.
Older product updates - Access - Browser Isolation - CASB - Cloudflare Tunnel - Data Loss Prevention - Digital Experience Monitoring - Email security - Gateway - Multi-Cloud Networking - Cloudflare Network Firewall - Magic Network Monitoring - Magic Transit - Magic WAN - Network Interconnect - Risk score - Cloudflare One Client
Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/#page","headline":"Changelog","description":"Review recent changes to Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/og.png?v=dd4319fb842ef5a5","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare Access. title: Access image: https://developers.cloudflare.com/cloudflare-one/changelog/access/og.png?v=9bffd60be15eac96 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Access Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/access/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/access.xml) ## 2026-10-14 **Account context in Access deny redirects** App-aware Cloudflare Access deny redirects include an `account_id` query parameter when account context is available. Custom block pages can use it to identify the account that owns the application represented by `kid`. For example, a custom redirect can include: ```txt https://denied.example.com/?kid=&account_id=&original_url=app.example.com%2Fadmin ``` The account ID helps block-page integrations look up applications through account-scoped APIs. It is context, not proof of authentication or authorization. For parameter descriptions and an example, refer to [Custom redirect URL parameters](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-block-page/#custom-redirect-url-parameters). ## 2026-10-14 **Infrastructure applications support a configurable session duration** [Infrastructure applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now have a configurable session duration with a default value of 24 hours. You can set the session duration when creating or editing an infrastructure application in the dashboard or via the API. ![Session duration setting in infrastructure application configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2824,height=522,format=webp/_astro/infrastructure-ssh-session-duration.DI7ApX89.png) When the session duration elapses, any active SSH connections through that application will be closed, and users will need to reconnect. Previously, infrastructure applications did not enforce a session duration limit. Sessions could persist beyond 24 hours in some cases, but were never guaranteed beyond 10 hours due to [Gateway connection limits](https://developers.cloudflare.com/cloudflare-one/access-controls/troubleshooting/#long-lived-ssh-sessions-disconnect). When a target matches multiple infrastructure applications, the shortest session duration applies. For more information, refer to [Session duration](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#session-duration). ## 2026-10-02 **New strict service token authentication setting for Access** The strict service token authentication setting applies consistent behavior to requests made with service tokens. When the setting is on for a Zero Trust organization, Access handles requests with service token headers as follows: - If authentication or authorization fails, Access always returns `401` or `403` instead of redirecting the client to the login page with `302`. - Only Service Auth policies can authorize the request. Access ignores Allow policies and any `CF_Authorization` cookie sent with the request. - Access does not return a `CF_Authorization` cookie to the client after successful authentication. Subsequent requests should continue to use service token headers. - Failed requests for recognized service tokens appear in [Access authentication logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/#non-identity-authentication). Zero Trust organizations created on or after October 5, 2026 have strict service token authentication turned on by default and cannot turn it off. Cloudflare recommends that existing organizations turn it on as well. Organizations created before October 5, 2026 can configure the setting in the dashboard or through the API. 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**. [Go to **Access settings** ↗](https://one.dash.cloudflare.com/?to=/:account/access-controls/settings) 2. Under **Manage service tokens**, turn on **Strict service token authentication**. 3. In the confirmation dialog, select **Enable**. To turn off strict service token authentication, turn off the setting and select **Disable**. ```bash curl "https://api.cloudflare.com/client/v4/accounts/%7Baccount_id%7D/access/organizations" \ --request PATCH \ --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ --json '{ "strict_service_token_auth": true }' ``` To turn off strict service token authentication, set `strict_service_token_auth` to `false`. For behavior and configuration details, refer to [Strict service token authentication](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#strict-service-token-authentication). ## 2026-10-01 **Simplified permissions for tagging targets with Access for Infrastructure** You can now tag [targets](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets) using only the `Zero Trust Write` API token permission. Previously, tagging targets through the API required both `Zero Trust Write` and `Tag Write` permissions on the API token. This change applies to inline target tagging through the [Infrastructure Access Targets API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/infrastructure/subresources/targets/). Tagging resources through the general [Resource Tagging API](https://developers.cloudflare.com/resource-tagging/) still requires the `Tag Admin`, `Tag Write`, or equivalent role. For more information, refer to [Tag targets](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#tag-targets). ## 2026-09-24 **MCP server portals are now generally available** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) are now generally available to all Cloudflare customers. A portal gives users one endpoint for approved Model Context Protocol (MCP) servers. Cloudflare Access logs tool, prompt, and resource activity. Since the open beta, MCP server portals have added: - [Gateway routing](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#route-portal-traffic-through-gateway) for HTTP logging and data loss prevention (DLP) scanning - [Code Mode policies](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode-policies) that control how portals reduce tool definitions and token use - [Static OAuth client credentials](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#configure-manual-oauth-credentials) for providers that do not support Dynamic Client Registration - [Session management](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#manage-portal-sessions) for reconnecting servers and changing authorizations from the portal - [Service token authentication](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token) for autonomous agents and machine-to-machine access - [Logpush support](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/) for exporting portal activity to external storage or a security information and event management (SIEM) system To create a portal and connect an MCP client, refer to [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/). ## 2026-09-22 **Automatically manage inactive Access service tokens** Cloudflare Access administrators can now automatically disable or delete inactive service tokens. Administrators can set an inactivity period from 30 to 365 days and choose what Access does when a token reaches that limit. To be eligible for cleanup, a token must be older than the configured period, must not have successfully authenticated during that period, and must not be directly referenced by an Access policy rule. Cleanup runs gradually in the background, so eligible tokens may not be disabled or deleted immediately. For configuration instructions, refer to [Manage inactive service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#manage-inactive-service-tokens). ## 2026-09-22 **Private MCP server support for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now connect to MCP servers available only on your private network. The portal uses [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) to reach [private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) and IP addresses without exposing the MCP server to the public Internet. Connect the server network to Cloudflare with [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/), [Cloudflare Mesh](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/), or another [Cloudflare One connector](https://developers.cloudflare.com/cloudflare-one/networks/connectors/). Configure a private hostname or CIDR route, then turn on **Route traffic through Cloudflare Gateway** when you add the server. OAuth authorization server endpoints, such as the authorization and token endpoints, must be accessible on the public Internet. If Cloudflare automatically registers the OAuth client through Dynamic Client Registration (DCR), the registration endpoint must also be accessible on the public Internet. For setup instructions, refer to [Connect a private MCP server](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-a-private-mcp-server). ## 2026-09-15 **Access for Infrastructure now supports tagged targets and tag-based target criteria** [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now integrates with [Resource Tagging](https://developers.cloudflare.com/resource-tagging/). You can attach key-value tags to [infrastructure targets](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#1-add-a-target) and use them in access policies. You can manage tags on targets inline when you create or edit a target or through the central [Resource Tagging API](https://developers.cloudflare.com/resource-tagging/how-to/manage-tags/). Cloudflare keeps tags in sync across both methods. Infrastructure applications also support a target criteria model with `include`, `require`, and `exclude` operators. Each operator can match targets by hostname, tag, or both. - **Include** matches targets that have any of the specified values. - **Require** matches targets that have all of the specified values. - **Exclude** rejects targets that have any of the specified values. ![Infrastructure application builder showing target criteria with an included tag, port 22, and SSH as the selected protocol](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2372,height=1616,format=webp/_astro/tags-in-infra-app.ja2Tp-Gq.png) For more information, refer to [Add an infrastructure application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/). ## 2026-09-14 **Require fresh authentication for SAML identity providers** Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on **Require reauthentication** in the Cloudflare dashboard, or set `force_authn` to `true` through the API. Access will then set `ForceAuthn` to `true` in signed and unsigned SAML authentication requests. This option is useful when an application requires users to reauthenticate at the identity provider instead of relying on an existing identity provider session. The default value is `false`. For configuration details, refer to [Require fresh authentication at the identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-saml/#require-fresh-authentication-at-the-identity-provider). ## 2026-08-26 **Access service token secrets use a scannable format** Cloudflare Access service token Client Secrets created on or after August 26, 2026, use the format `cfast_[40 alphanumeric characters][8-character checksum]`. The prefix and checksum make these credentials easier for secret scanning tools to identify with fewer false positives. Existing service token secrets continue to work and do not require rotation. Both formats use the same Client ID and the same `CF-Access-Client-Id` and `CF-Access-Client-Secret` authentication headers. For more information, refer to [Service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). ## 2026-08-25 **Grace periods for service token rotation** Cloudflare Access administrators can now choose a grace period when rotating a service token secret. Both secrets remain valid during the grace period, giving administrators time to update services without interrupting authentication. The dashboard offers grace periods from one hour to 30 days. Administrators can also revoke the previous secret immediately. The API accepts an RFC 3339 expiration time for custom rotation schedules. For configuration instructions, refer to [Rotate service token secrets](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#rotate-service-token-secrets). ## 2026-08-25 **Temporarily turn off Access service tokens** Cloudflare Access administrators can now temporarily turn off service tokens without deleting them. A disabled token cannot authenticate, but its configuration remains available so administrators can turn it on again later. Turning off a token also stops any previous secret in an active rotation grace period. Use this control to contain suspected credential exposure or pause an automated service. For configuration instructions, refer to [Turn a service token on or off](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/#turn-a-service-token-on-or-off). ## 2026-08-25 **MCP server portals support MCP 2026-07-28 specification** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support the stateless MCP `2026-07-28` specification for client and upstream server connections. The portal's `/mcp` endpoint automatically accepts stateless MCP `2026-07-28` requests and earlier 2025 Streamable HTTP clients. When the portal connects to an upstream Streamable HTTP server, it checks for MCP `2026-07-28` support and falls back to the 2025 handshake when needed. Client and upstream protocol selection are independent, so clients and servers can upgrade separately without portal configuration changes. SSE connections continue to use the legacy protocol. For details, refer to [MCP server portal transport and protocol compatibility](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#transport). ## 2026-08-19 **Access resource lists now support resource-scoped roles** Members with only resource-scoped Access roles can now open Access resource list pages in the Cloudflare dashboard and call list endpoints in the API. They no longer need an additional account-scoped read-only role to list resources. The dashboard and API return only resources included in the member's permission policy scopes. Filtering applies to Access applications, policies, service tokens, and identity providers. This allows administrators to delegate specific Access resources without granting account-wide visibility. Previously, the dashboard blocked these list pages and API list requests returned `403` responses. For members with the Cloudflare Access App Admin role, policy lists include policies attached directly to the selected application. Reusable policies appear only when the member has the Cloudflare Access Policy Admin role for those policies. For role definitions and assignment details, refer to [Resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) and [Role scopes](https://developers.cloudflare.com/fundamentals/manage-members/scope/). ## 2026-08-14 **You can now enable Access on a Worker or all Workers at once** You now have two new ways to protect your [Workers](https://developers.cloudflare.com/workers/) with [Cloudflare Access](https://developers.cloudflare.com/workers/configuration/cloudflare-access/). **Protect an application across all its domains at once** Until now, if a Worker was reachable on a route, a Custom Domain, and a `workers.dev` URL, you had to manually add each one to an Access application and keep the list in sync whenever routes or domains changed. Now, Access attaches the policy to the Worker itself, so every associated domain and preview URL stays protected even when its routes or domains change. ![Access setting for protecting a single Worker](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1476,height=689,format=webp/_astro/protect-one-worker.BSpeeOry.png) **Protect all new and existing Workers by default** Make all Workers private by default, so every existing and newly created Worker requires sign-in before anyone can reach it. ![Account-wide Access setting that protects all Workers](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2436,height=1432,format=webp/_astro/protect-all-workers._AWy-S-E.png) If a specific Worker should remain publicly accessible, add a Worker-level bypass to exempt it. ![Make a Worker public when all Workers are protected](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1228,height=756,format=webp/_astro/make-worker-public.D3yjPjtf.png) Whether you protect a single application or all Workers at once, you can choose whether to protect preview deployments only or both previews and production, and control who can sign in by Cloudflare account membership, email address, or email domain. For more advanced policy options, edit the policy in [Zero Trust ↗︎](https://dash.cloudflare.com/?to=/:account/one/access/apps). ![Access policy configuration for controlling who can sign in](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1276,height=1220,format=webp/_astro/choose-who-can-sign-in.DKf3kWAK.png) **View all of your Worker Access policies** You can view and manage all of your Access policies in the **Access** tab of the Workers & Pages section in the dashboard. ![Access tab showing all configured Access policies](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1646,height=1366,format=webp/_astro/access-policies.DN7yCwHX.png) **See who is accessing your Worker** When Access is enabled on your Worker, every authenticated request includes `ctx.access`. Call [`ctx.access.getIdentity()`](https://developers.cloudflare.com/workers/runtime-apis/context/#access) to get the user's email, name, and groups — no manual JWT validation required. ```js export default { async fetch(request, env, ctx) { if (!ctx.access) { return new Response("Access did not run", { status: 401 }); } const identity = await ctx.access.getIdentity(); return Response.json({ aud: ctx.access.aud, email: identity?.email }); }, }; ``` **Test Access locally** You can now test Cloudflare Access locally with `wrangler dev`. Add a `dev` block to your `wrangler.jsonc`: ```json { "access": { "dev": { "aud": "my-app", "identity": { "email": "admin@example.com" } } } } ``` Your Worker will receive this identity through `ctx.access` and `ctx.access.getIdentity()`, letting you test authenticated and unauthenticated flows without deploying. Remove the `dev` block to simulate unauthenticated requests. **API and programmatic access** You can also set up these policies through the [Workers API](https://developers.cloudflare.com/workers/configuration/cloudflare-access/) instead of the dashboard. ## 2026-08-12 **Independent MFA supports FIDO2 for infrastructure applications** [Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) applications support independent multi-factor authentication (MFA) with FIDO2 keys. You can allow `ssh_fido2_key`, `piv_key`, or both in application-level and policy-level MFA settings. Users enroll FIDO2 keys through the App Launcher and connect with the generated SSH identity. FIDO2 keys for SSH are separate from browser-based WebAuthn security keys and Personal Identity Verification (PIV) keys. For setup instructions, refer to [Enroll a FIDO2 key for infrastructure apps](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-fido2-key-for-infrastructure-apps) and [Configure MFA for infrastructure applications](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications). ## 2026-08-05 **Identity-aware controls are now available in AI Gateway** AI Gateway now integrates with Cloudflare Access, giving you two new capabilities: - **Protect your gateway endpoint.** Put your AI Gateway behind Access so you can set policies that control who is allowed to call a specific gateway's endpoint. - **Identity-aware controls.** When traffic reaches AI Gateway through an Access-protected custom domain, AI Gateway can use the authenticated user's Access identity in logs, analytics, routing, and spend controls. With identity-aware controls, you can set spend limits by authenticated user, control which gateways different users can access, filter logs by user, and build policies without passing user IDs from the client application. AI Gateway adds the verified Access user ID to request metadata as `cf.user_id`. For setup instructions, refer to [Cloudflare Access](https://developers.cloudflare.com/ai-gateway/configuration/cloudflare-access/). ## 2026-08-03 **Control authorization cookies for multi-domain Access applications** Cloudflare Access administrators can now control whether a self-hosted application preemptively sets authorization cookies across its public hostnames. Previously, Access automatically used eager redirects for applications with five or fewer hostnames. Applications with more than five hostnames received cookies as users visited each hostname. Administrators can now choose either behavior, regardless of the number of hostnames. The new **Eager redirect cookie** setting is turned on by default for new applications. After a user signs in, Access redirects the browser through each hostname and sets a `CF_Authorization` cookie. This supports applications that need to make requests across hostnames before the user visits each one. For applications with many hostnames, the redirect chain can cause sign-in loops in some browsers. Turn off the setting to issue the cookie only when a user visits each hostname. To configure the setting, refer to [Authorization cookie](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#eager-redirect-cookie). ## 2026-07-31 **Static OAuth client credentials for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now connect to upstream MCP servers that require a pre-registered OAuth client. This supports OAuth providers that do not offer Dynamic Client Registration or have disabled it. This unlocks portal connections to major SaaS providers such as Slack and GitHub, whose MCP servers do not yet support DCR. When adding an MCP server, administrators can enter the client ID and client secret from an OAuth application registered with the upstream provider. The configuration also supports custom OAuth endpoints, scopes, and the `client_secret_post` and `client_secret_basic` token endpoint authentication methods. Cloudflare stores the client secret encrypted. Users still authenticate to the upstream server with their own accounts when they connect through a portal. For setup instructions, refer to [Configure manual OAuth credentials](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#configure-manual-oauth-credentials). ## 2026-07-30 **Admins can turn on Code Mode by default for MCP portal users** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) now support four Code Mode policies: *Off*, *Opt-in*, *On by default*, and *Enforced*. Admins can choose whether Code Mode is unavailable, optional, enabled by default, or required for every session. Existing portals retain their current behavior. Portals that previously allowed Code Mode use *Opt-in*, while portals that did not allow Code Mode use *Off*. New portals also use *Opt-in* by default. Clients turn on Code Mode for an *Opt-in* portal with `?codemode=search_and_execute`. The *On by default* policy lets clients opt out with `?codemode=off`, which avoids nested code execution when a client runs its own Code Mode implementation. The *Off* and *Enforced* policies ignore client overrides. The Cloudflare API exposes these policies through the `code_mode` field: ```json { "code_mode": "default_on" } ``` The supported values are `off`, `opt_in`, `default_on`, and `enforced`. The previous `allow_code_mode` boolean is deprecated. For configuration details and client behavior, refer to [Code Mode policies](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode-policies). ## 2026-07-20 **Browser-based login for plaintext HTTP private applications** Cloudflare Access now uses the standard browser-based login flow for [private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) served over plaintext HTTP on port `80`. Previously, plaintext HTTP private apps fell back to the same session flow used for SSH, RDP, and other non-HTTP protocols: users got an `Authentication required` pop-up from the Cloudflare One Client, then had to select the notification to open a browser and log in. Now, users hitting an HTTP private app see the Access login page directly in the browser and receive a standard Access [application token](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/) on success. This brings the HTTP experience in line with HTTPS apps (with [Gateway TLS decryption](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/) turned on). No configuration change is required. The Cloudflare One Client is still required to route traffic to the private network, but it no longer manages the Access session for HTTP apps. Other non-HTTP protocols (SSH, RDP, arbitrary TCP/UDP) continue to use the Cloudflare One Client notification flow. ## 2026-07-16 **Bulk print PDFs for browser-based RDP** Users in browser-based RDP sessions can now print multiple PDF files as a single print job. Copy the files to your clipboard on the remote machine, then select **Print all PDFs** in the clipboard panel. The files are combined into one PDF and sent to your local printer. ![The clipboard panel showing the Print all PDFs option for multiple selected PDF files.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=768,height=432,format=webp/_astro/rdp-bulk-print.DT4sCcI-.png) Bulk print is available in Chromium-based browsers and Firefox. For more information, refer to [Print PDFs for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#print-pdfs). ## 2026-07-07 **File transfer controls for browser-based RDP (beta)** You can now configure file transfer controls for browser-based RDP with Cloudflare Access, allowing you to restrict whether users can upload or download files between their local machine and the remote Windows server. ![File transfer connection settings in the Access policy configuration.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1356,height=692,format=webp/_astro/file-transfer-policy-control.CiSEa5rr.png) This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting file transfers, you can prevent sensitive data from being moved out of the remote session to a user's personal device. #### Configuration options File transfer controls are configured per policy within your Access application, alongside existing [text clipboard controls](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#connection-settings). For each policy, you can select one of the following options: - **Client to remote RDP session allowed** — Users can upload files from their local machine into the browser-based RDP session. - **Remote RDP session to client allowed** — Users can download files from the browser-based RDP session to their local machine. - **Both directions allowed** — Users can upload and download files between their local machine and the browser-based RDP session. - **Disable copying/pasting** — Users are not allowed to transfer files between their local machine and the browser-based RDP session. By default, file transfer is denied for new policies. For existing Access applications created before this feature was available, file transfer remains denied. #### How it works To upload, drag files into the browser window or select the settings gear icon on the left side of the RDP session. To download, copy a file in the remote session and select the settings gear to download it, download multiple files as a zip, or print PDFs to a local printer. ![The clipboard side panel showing files available for transfer.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=812,height=532,format=webp/_astro/clipboard-side-panel.Us2RfXfs.png) ![A remote document ready for download or local printing.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=770,height=442,format=webp/_astro/remote-doc-ready-for-download-or-print-local.Dcm5hrGD.png) This feature is in beta and available on all Zero Trust plans. For more information, refer to [File transfer for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#transfer-files). ## 2026-07-01 **Fix redirect URL fragment encoding for single-page applications** Access now correctly preserves URL fragment characters (`/`, `?`, `=`, `&`, `;`) when redirecting users back to an application after login. Previously, these characters were encoded with `encodeURIComponent`, which mangled fragment-based routes used by single-page applications (SPAs). For example, an SPA URL like `https://app.example.com/#/dashboard?tab=settings&view=advanced` would previously redirect to a broken URL after login. This is now handled correctly. If your SPA users were experiencing broken navigation after authenticating through Access, this fix resolves the issue without any configuration changes. ## 2026-07-01 **Independent MFA for infrastructure applications** [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) now supports independent multi-factor authentication (MFA) for SSH connections using YubiKey PIV keys. This adds a hardware-backed second factor to SSH access, ensuring that a compromised device session alone is not sufficient to reach your servers. With per-application and per-policy configuration, you can enforce PIV key authentication for sensitive usernames (for example, `root`) while applying different requirements for other usernames. You can also set an MFA session duration to control how often users must re-authenticate. #### Enrollment Users enroll their YubiKey PIV key through the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/). For enrollment instructions and SSH client setup, refer to [Enroll a PIV key for infrastructure apps](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#enroll-a-piv-key-for-infrastructure-apps). #### Configuration For setup instructions, refer to [Enforce MFA for infrastructure applications](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/#infrastructure-applications). ## 2026-06-26 **Service token support for MCP server portals** You can now connect autonomous agents and bots to an [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) using an [Access service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/). Service token sessions can reach upstream MCP servers through the portal without a browser-based OAuth flow. To set this up: - Add a [Service Auth policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#service-auth) that matches your service token to the portal's Access application. - Add a Service Auth policy that matches the same token to each linked MCP server's Access application. - Turn **Require user auth** off ( `on_behalf: false`) for each linked server so the portal uses the admin credential instead of a per-user OAuth grant. The bot connects with `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers and sees the tools from every linked server it is authorized for. Servers that still require per-user OAuth are excluded from service token sessions because a service token cannot complete a per-user OAuth grant. For step-by-step setup, refer to [Connect with a service token](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#connect-with-a-service-token). ## 2026-06-18 **Cloudflare identity provider is now the default for new accounts** When you create a new Zero Trust organization, Cloudflare now adds the [Cloudflare identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/) as your default login method. Previously, new organizations started with [one-time PIN (OTP)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/). With the Cloudflare identity provider, your users authenticate using their existing Cloudflare account credentials, and authentication is restricted to members of your account. You can still add OTP or connect any [third-party identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/) whenever you need to. This change only applies to newly created accounts. Existing organizations keep the login methods they already have configured. If you would like to use the Cloudflare Identity Provider in an existing account, you must enable it. ## 2026-06-04 **Share identity providers across accounts with IdP federation** Cloudflare Access now supports [IdP federation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/idp-federation/), which allows organizations to share a single identity provider across multiple Cloudflare accounts. Instead of configuring the same IdP (for example, Okta or Entra ID) separately in every account, you configure it once in a source account and share it with the other accounts in your organization. Each recipient account gets a read-only IdP connection that routes authentication back to the source account through a bridge — a hidden application in the source account that brokers the cross-account login. End users sign in with their existing IdP credentials, and each account's Access policies evaluate the resulting identity just like any other IdP login. Key capabilities: - **One IdP, many accounts** — Configure your IdP once and share it with all accounts in your organization. - **Lifecycle management** — As accounts join or leave your Cloudflare organization, their IdP connections are provisioned and removed automatically — no manual cleanup required. - **Immutable recipient connections** — IdP connections in recipient accounts cannot be accidentally modified or deleted. To get started, refer to [IdP federation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/idp-federation/). ## 2026-06-03 **SAML assertion encryption for identity providers** Cloudflare Access now supports SAML assertion encryption for identity provider integrations. When turned on, your identity provider encrypts SAML assertions using a Cloudflare-managed certificate before sending them through the user's browser. Only Access can decrypt these assertions, protecting sensitive identity data even after TLS termination. Without encryption, SAML assertions are transmitted in plaintext and could be visible to browser extensions or client-side malware. ![SAML encryption toggle in the identity provider configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1698,height=344,format=webp/_astro/saml-encryption.J5jmiYv8.png) SAML encryption includes built-in certificate lifecycle management: - **Automatic certificate generation**: Access generates an encryption certificate when you turn on SAML encryption for an identity provider. - **Certificate rotation**: Rotate certificates without downtime. The previous certificate remains valid until expiration, giving you time to update your IdP. - **PEM export**: Copy the certificate in PEM format for manual upload to your IdP, or point your IdP to the SAML metadata endpoint for automatic retrieval. To get started, refer to [Encrypt SAML assertions](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-saml/#encrypt-saml-assertions). ## 2026-05-28 **Tool and prompt aliases for MCP server portals** When you connect third-party MCP servers through [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/), you have no control over how the server author named tools or wrote descriptions. Unclear names make it harder for AI agents to select the right tool and harder for users to understand what is available. You can now [rename tools and prompts](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases) and rewrite their descriptions directly on the portal, without modifying the upstream server. For example, a tool named `super_cool_tool` can become `search_customer_records` with a description tailored to your organization. ![Edit tool modal showing name and description fields for an MCP server tool](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1640,height=1144,format=webp/_astro/portal-edit-tool-modal.DrxORhBl.png) Modified tools display a **Modified** label in the tools list so administrators can see which tools have been customized at a glance. ![Tools authorized list showing a modified label on a renamed tool](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1862,height=700,format=webp/_astro/portal-tools-authorized-modified.B674Xvip.png) Aliases override the metadata that MCP clients receive. You can set them at two levels: - **Per portal**: Applies only within a specific portal. Takes precedence over server-level aliases. - **Per server**: Applies across all portals that use the server. You can reset an alias at any time to restore the original upstream name. For more information, refer to [Tool and prompt aliases](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#rename-tools-and-prompts-with-aliases). ## 2026-05-19 **Cloudflare as identity provider and account membership selector** Cloudflare Access now supports using Cloudflare itself as an [identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/). If you publish an Access application and select Cloudflare as the login method, users can sign in with their existing Cloudflare account — no one-time PINs, no third-party IdP configuration, and no shared email inboxes. Authentication is backed by Cloudflare's own account security (including multi-factor authentication), making it both simpler to set up and more secure than OTP-based login for most use cases. Cloudflare is now the **default identity provider for all newly created Zero Trust accounts**, replacing One-time PIN. This also enables two new capabilities: - **Cloudflare Account Member selector** — A new [policy selector](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#selectors) that matches users based on their membership in a Cloudflare account. You can target the current account or specify a different account ID for cross-account access scenarios. - **Restrict to account members** — An identity provider configuration option that limits authentication to users who are members of your Cloudflare account. To get started, add Cloudflare as an [identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/) in your Zero Trust settings. ## 2026-05-12 **Refreshed Access login page** The [Access login page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/) and [one-time password (OTP)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/) page now feature a refreshed design that improves visual consistency, user trust, and mobile responsiveness. **Before:** ![Screenshot of the previous Access login page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=532,height=906,format=webp/_astro/access-login-old.CwNVkCQH.png) **After:** ![Screenshot of the updated Access login page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=541,height=722,format=webp/_astro/access-login-new.Y7WUfg9G.png) The updated login experience includes: - **Unified authentication card** - All sign-in options (identity provider buttons, email input, OTP) now appear in a single card with consistent styling, replacing the previous multi-section layout. - **Consistent button styling** - Identity provider buttons use a uniform size and layout for easier scanning and selection. - **Better mobile experience** - Responsive layout improvements ensure the login page renders correctly on phones and tablets. - **Dark mode support** - The login page now supports dark mode. ## 2026-04-23 **AAGUID restrictions and AMR matching for Access independent MFA** [Independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/) in Cloudflare Access now supports two additional organization-level controls: - **[Restrict authenticators by AAGUID](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#restrict-authenticators-by-aaguid)** — Limit enrollment to a specific set of WebAuthn authenticators using their [AAGUID ↗︎](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-registry-v2.0-id-20180227.html#authenticator-attestation-guid). This is useful for organizations that require FIPS-validated security keys or company-issued hardware. AAGUIDs are managed through a new [List](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/) type. - **[AMR matching](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/#use-identity-provider-mfa)** — Skip the independent MFA prompt when the identity provider has already performed an equivalent MFA. Access reads the `amr` claim defined in [RFC 8176 ↗︎](https://datatracker.ietf.org/doc/html/rfc8176) and matches supported values such as `hwk`, `otp`, and `fpt` to the authenticator types allowed on the application or policy. This prevents users from having to complete MFA twice when their identity provider already enforces it. To get started, refer to [Independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/). ## 2026-04-17 **Homepage and sign-out for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) display a homepage when users visit the portal domain in a browser. ![MCP server portal homepage showing connection status and setup instructions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1037,height=631,format=webp/_astro/portals-homepage-disconnected.BHbOwayQ.png) The homepage shows: - The portal name and organization branding - The MCP endpoint URL with a copy button - Per-client connection instructions for Claude Desktop, Workers AI Playground, OpenCode, Windsurf, and other MCP clients Authenticated users see their email address and a **Sign out** button. Selecting **Sign out** revokes all portal-level OAuth grants, deletes upstream server OAuth states, and redirects through Cloudflare Access logout. A confirmation page shows a summary of the revoked sessions. For more information, refer to [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#portal-homepage). ## 2026-04-15 **Independent MFA for Access applications** Cloudflare Access now supports independent multi-factor authentication (MFA), allowing you to enforce MFA requirements without relying on your identity provider (IdP). With per-application and per-policy configuration, you can enforce stricter authentication methods like hardware security keys on sensitive applications without requiring them across your entire organization. This reduces the risk of MFA fatigue for your broader user population while adding additional security where it matters most. This feature also addresses common gaps in IdP-based MFA, such as inconsistent MFA policies across different identity providers or the need for additional security layers beyond what the IdP provides. Independent MFA supports the following authenticator types: - **Authenticator application** — Time-based one-time passwords (TOTP) using apps like Google Authenticator, Microsoft Authenticator, or Authy. - **Security key** — Hardware security keys such as YubiKeys. - **Biometrics** — Built-in device authenticators including Apple Touch ID, Apple Face ID, and Windows Hello. Note Infrastructure applications do not yet support independent MFA. #### Configuration levels You can configure MFA requirements at three levels: | Level | Description | | --- | --- | | **Organization** | Enforce MFA by default for all applications in your account. | | **Application** | Require or turn off MFA for a specific application. | | **Policy** | Require or turn off MFA for users who match a specific policy. | Settings at lower levels (policy) override settings at higher levels (organization), giving you granular control over MFA enforcement. #### User enrollment Users enroll their authenticators through the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/). To help with onboarding, administrators can share a direct enrollment link: `.cloudflareaccess.com/AddMfaDevice`. To get started with Independent MFA, refer to [Independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/independent-mfa/). ## 2026-04-02 **Session management for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support in-session management of upstream MCP server connections. Users can return to the server selection page at any time to enable or disable servers, reauthenticate, or change which data a server has access to — all without leaving their MCP client. To return to the server selection page, ask your AI agent with a prompt like "take me back to the server selection page." The portal responds with an authorization URL via [MCP elicitation ↗︎](https://modelcontextprotocol.io/specification/2025-03-26/server/elicitation) that you open in your browser: ```txt https://./authorize?elicitationId= ``` From the server selection page you can: - **Enable or disable servers** — Toggle individual upstream MCP servers on or off. Disabling a server removes its tools from the active session, which reduces context window usage. - **Log out and reauthenticate** — Log out of a server and log back in to change which data the server has access to, or to reauthenticate with different permissions. Users can also enable or disable a server inline by asking their AI agent directly, for example "enable the wiki server" or "disable my Jira server." The portal also automatically prompts connected users to authorize new servers when an admin adds them to the portal. This requires the use of [managed OAuth](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/#enable-managed-oauth-on-an-mcp-server-portal). For more information, refer to [Manage portal sessions](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#manage-portal-sessions). ## 2026-04-01 **Logs UI refresh** Access authentication logs and Gateway activity logs (DNS, Network, and HTTP) now feature a refreshed user interface that gives you more flexibility when viewing and analyzing your logs. ![Screenshot of the new logs UI showing DNS query logs with customizable columns and filtering options](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2984,height=842,format=webp/_astro/cf1-new-logs-ui.DxF4x0l-.png) The updated UI includes: - **Filter by field** - Select any field value to add it as a filter and narrow down your results. - **Customizable fields** - Choose which fields to display in the log table. Querying for fewer fields improves log loading performance. - **View details** - Select a timestamp to view the full details of a log entry. - **Switch to classic view** - Return to the previous log viewer interface if needed. For more information, refer to [Access authentication logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). ## 2026-03-26 **Code Mode for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support [Code Mode MCP server patterns](https://developers.cloudflare.com/agents/model-context-protocol/codemode/), a technique that reduces context window usage by replacing individual tool definitions with a single code execution tool. Code Mode is turned on by default on all portals. To turn it off, edit the portal in **Access controls** > **AI controls** and turn off **Code Mode** under **Basic information**. When Code Mode is active, the portal exposes a single `code` tool instead of listing every tool from every upstream MCP server. The connected AI agent writes JavaScript that calls typed `codemode.*` methods for each upstream tool. The generated code runs in an isolated [Dynamic Worker](https://developers.cloudflare.com/dynamic-workers/) environment, keeping authentication credentials and environment variables out of the model context. To use Code Mode, append `?codemode=search_and_execute` to your portal URL when connecting from an MCP client: ```txt https://./mcp?codemode=search_and_execute ``` For more information, refer to [Code Mode](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode). ## 2026-03-26 **Context optimization for MCP server portals** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) support two context optimization options that reduce how many tokens tool definitions consume in the model's context window. Both options are activated by appending the `optimize_context` query parameter to the portal URL. #### `minimize_tools` Strips tool descriptions and input schemas from all upstream tools, leaving only their names. The portal exposes a special `query` tool that agents use to retrieve full definitions on demand. This provides up to 5x savings in token usage. ```txt https://./mcp?optimize_context=minimize_tools ``` #### `search_and_execute` Hides all upstream tools and exposes only two tools: `query` and `execute`. The `query` tool searches and retrieves tool definitions. The `execute` tool runs the upstream tools in an isolated [Dynamic Worker](https://developers.cloudflare.com/dynamic-workers/) environment. This reduces the initial token cost to a small constant, regardless of how many tools are available through the portal. ```txt https://./mcp?optimize_context=search_and_execute ``` For more information, refer to [Optimize context](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#optimize-context). ## 2026-03-20 **Managed OAuth for Cloudflare Access** Cloudflare Access supports managed OAuth, which allows non-browser clients — such as CLIs, AI agents, SDKs, and scripts — to authenticate with Access-protected applications using a standard OAuth 2.0 authorization code flow. Previously, non-browser clients that attempted to access a protected application received a `302` redirect to a login page they could not complete. The established workaround was `cloudflared access curl`, which required installing additional tooling. With managed OAuth, clients instead receive a `401` response with a `WWW-Authenticate` header that points to Access's OAuth discovery endpoints ([RFC 8414 ↗︎](https://datatracker.ietf.org/doc/html/rfc8414) and [RFC 9728 ↗︎](https://datatracker.ietf.org/doc/html/rfc9728)). The client opens the end user's browser to the Access login page. The end user authenticates with their identity provider, and the client receives an OAuth access token for subsequent requests. Access enforces the same policies as a browser login; the OAuth layer is a new transport mechanism, not a separate authentication path. Managed OAuth can be enabled on any self-hosted Access application or [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/). It is opt-in for existing applications to avoid interfering with those that run their own OAuth servers and rely on their own `WWW-Authenticate` headers. Note For MCP server portals, managed OAuth is enabled by default on new portals. It remains opt-in for self-hosted applications. To enable managed OAuth, go to **Zero Trust** > **Access controls** > **Applications**, edit the application, and turn on **Managed OAuth** under **Advanced settings**. You can also enable it via the API by setting `oauth_configuration.enabled` to `true` on the [Access applications endpoint](https://developers.cloudflare.com/api/resources/zero_trust/subresources/access/subresources/applications/methods/update/). ![Managed OAuth settings in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2914,height=1042,format=webp/_astro/managed-oauth.BirLnBpy.png) For setup instructions, refer to [Enable managed OAuth](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/). ## 2026-03-20 **Route MCP server portal traffic through Cloudflare Gateway** [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now route traffic through [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) for richer HTTP request logging and data loss prevention (DLP) scanning. When Gateway routing is turned on, portal traffic appears in your [Gateway HTTP logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). You can create [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) with [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/) to detect and block sensitive data sent to upstream MCP servers. Note DLP [AI prompt profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#ai-prompt) do not apply to MCP server portal traffic. To enable Gateway routing, go to **Access controls** > **AI controls**, edit the portal, and turn on **Route traffic through Cloudflare Gateway** under **Basic information**. ![Route MCP server portal traffic through Cloudflare Gateway](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1568,height=158,format=webp/_astro/portal-route-through-gateway.0KMUAXBm.png) For more details, refer to [Route traffic through Gateway](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#route-portal-traffic-through-gateway). ## 2026-03-04 **User risk score selector in Access policies** You can now use [user risk scores](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) in your [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). The new **User Risk Score** selector allows you to create Access policies that respond to user behavior patterns detected by Cloudflare's risk scoring system, including impossible travel, high DLP policy matches, and more. For more information, refer to [Use risk scores in Access policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/#use-risk-scores-in-access-policies). ## 2026-03-01 **Clipboard controls for browser-based RDP** You can now configure clipboard controls for browser-based RDP with Cloudflare Access. Clipboard controls allow administrators to restrict whether users can copy or paste text between their local machine and the remote Windows server. ![Enable users to copy and paste content from their local machine to remote RDP sessions in the Cloudflare One dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2000,height=546,format=webp/_astro/rdp-clipboard-controls.B0ZmliDb.png) This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting clipboard access, you can prevent sensitive data from being transferred out of the remote session to a user's personal device. #### Configuration options Clipboard controls are configured per policy within your Access application. For each policy, you can independently allow or deny: - **Copy from local client to remote RDP session** — Users can copy/paste text from their local machine into the browser-based RDP session. - **Copy from remote RDP session to local client** — Users can copy/paste text from the browser-based RDP session to their local machine. By default, both directions are denied for new policies. For existing Access applications created before this feature was available, clipboard access remains enabled to preserve backwards compatibility. When a user attempts a restricted clipboard action, the clipboard content is replaced with an error message informing them that the action is not allowed. For more information, refer to [Clipboard controls for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#clipboard-controls). ## 2026-02-27 **Export MCP server portal logs with Logpush** Availability Only available on Enterprise plans. [MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) now supports [Logpush](https://developers.cloudflare.com/logs/logpush/) integration. You can automatically export MCP server portal activity logs to third-party storage destinations or security information and event management (SIEM) tools for analysis and auditing. #### Available log fields The MCP server portal logs dataset includes fields such as: - `Datetime` — Timestamp of the request - `PortalID` / `PortalAUD` — Portal identifiers - `ServerID` / `ServerURL` — Upstream MCP server details - `Method` — JSON-RPC method (for example, `tools/call`, `prompts/get`, `resources/read`) - `ToolCallName` / `PromptGetName` / `ResourceReadURI` — Method-specific identifiers - `UserID` / `UserEmail` — Authenticated user information - `Success` / `Error` — Request outcome - `ServerResponseDurationMs` — Response time from upstream server For the complete field reference, refer to [MCP portal logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/mcp_portal_logs/). #### Set up Logpush To configure Logpush for MCP server portal logs, refer to [Logpush integration](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). Note MCP server portals is currently in beta. ## 2026-02-17 **Streamlined clientless browser isolation for private applications** A new **Allow clientless access** setting makes it easier to connect users without a device client to internal applications, without using public DNS. ![Allow clientless access setting in the Cloudflare One dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1117,height=206,format=webp/_astro/allow-clientless-access.BHKwQuVt.png) Previously, to provide clientless access to a private hostname or IP without a [published application](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/#add-a-published-application-route), you had to create a separate [bookmark application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/) pointing to a prefixed [Clientless Web Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) URL (for example, `https://.cloudflareaccess.com/browser/https://10.0.0.1/`). This bookmark was visible to all users in the App Launcher, regardless of whether they had access to the underlying application. Now, you can manage clientless access directly within your [private self-hosted application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). When **Allow clientless access** is turned on, users who pass your Access application policies will see a tile in their App Launcher pointing to the prefixed URL. Users must have [remote browser permissions](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) to open the link. ## 2026-02-17 **Policies for bookmark applications** You can now assign [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) to [bookmark applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/). This lets you control which users see a bookmark in the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/) based on identity, device posture, and other policy rules. Previously, bookmark applications were visible to all users in your organization. With policy support, you can now: - **Tailor the App Launcher to each user** — Users only see the applications they have access to, reducing clutter and preventing accidental clicks on irrelevant resources. - **Restrict visibility of sensitive bookmarks** — Limit who can view bookmarks to internal tools or partner resources based on group membership, identity provider, or device posture. Bookmarks support all [Access policy configurations](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) except purpose justification, temporary authentication, and application isolation. If no policy is assigned, the bookmark remains visible to all users (maintaining backwards compatibility). For more information, refer to [Add bookmarks](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/). ## 2026-02-13 **Fine-grained permissions for Access policies and service tokens** Fine-grained permissions for **Access policies** and **Access service tokens** are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources. #### New roles - **Cloudflare Access policy admin**: Can edit a specific [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) in an account. - **Cloudflare Access service token admin**: Can edit a specific [Access service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) in an account. These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets. For more information: - [Resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) - [Role scopes](https://developers.cloudflare.com/fundamentals/manage-members/scope/) Note Resource-scoped roles is currently in beta. ## 2026-01-22 **Require Access protection for zones** You can now require Cloudflare Access protection for all hostnames in your account. When enabled, traffic to any hostname that does not have a matching Access application is automatically blocked. This deny-by-default approach prevents accidental exposure of internal resources to the public Internet. If a developer deploys a new application or creates a DNS record without configuring an Access application, the traffic is blocked rather than exposed. ![Require Cloudflare Access protection in the dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2160,height=738,format=webp/_astro/require-cloudflare-access-protection.BAUmTYOs.png) #### How it works - **Blocked by default**: Traffic to all hostnames in the account is blocked unless an Access application exists for that hostname. - **Explicit access required**: To allow traffic, create an Access application with an Allow or Bypass policy. - **Hostname exemptions**: You can exempt specific hostnames from this requirement. To turn on this feature, refer to [Require Access protection](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/require-access-protection/). ## 2026-01-22 **New granular API token permissions for Cloudflare Access** Three new API token permissions are available for Cloudflare Access, giving you finer-grained control when building automations and integrations: - **Access: Organizations Revoke** — Grants the ability to [revoke user sessions](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/#revoke-user-sessions) in a Zero Trust organization. Use this permission when you need a token that can terminate active sessions without broader write access to organization settings. - **Access: Population Read** — Grants read access to the [SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that only need to read synced user and group data. - **Access: Population Write** — Grants write access to the [SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that need to create or modify synced user and group data. These permissions are scoped at the account level and can be combined with existing Access permissions. For a full list of available permissions, refer to [API token permissions](https://developers.cloudflare.com/fundamentals/api/reference/permissions/). ## 2026-01-08 **Cloudflare admin activity logs capture creation of DNS over HTTP (DoH) users** Cloudflare [admin activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/) now capture each time a [DNS over HTTP (DoH) user](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-over-https/) is created. These logs can be viewed from the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com/), pulled via the [Cloudflare API](https://developers.cloudflare.com/api/), and exported through [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). ## 2025-11-14 **Generate Cloudflare Access SSH certificate authority (CA) directly from the Cloudflare dashboard** SSH with [Cloudflare Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) allows you to use short-lived SSH certificates to eliminate SSH key management and reduce security risks associated with lost or stolen keys. Previously, users had to generate this certificate by using the [Cloudflare API ↗︎](https://developers.cloudflare.com/api/) directly. With this update, you can now create and manage this certificate in the [Cloudflare One dashboard ↗︎](https://one.dash.cloudflare.com) from the **Access controls** > **Service credentials** page. ![Navigate to Access controls and then Service credentials to see where you can generate an SSH CA](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2710,height=1180,format=webp/_astro/SSH-CA-generation.DYa9RnX1.png) For more details, refer to [Generate a Cloudflare SSH CA](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#generate-a-cloudflare-ssh-ca). ## 2025-10-28 **Access private hostname applications support all ports/protocols** [Cloudflare Access for private hostname applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) can now secure traffic on all ports and protocols. Previously, applying Zero Trust policies to private applications required the application to use HTTPS on port `443` and support Server Name Indicator (SNI). This update removes that limitation. As long as the application is reachable via a Cloudflare off-ramp, you can now enforce your critical security controls — like single sign-on (SSO), MFA, device posture, and variable session lengths — to any private application. This allows you to extend Zero Trust security to services like SSH, RDP, internal databases, and other non-HTTPS applications. ![Example private application on non-443 port](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1283,height=496,format=webp/_astro/internal_private_app_any_port.DNXnEy0u.png) For example, you can now create a self-hosted application in Access for `ssh.testapp.local` running on port `22`. You can then build a policy that only allows engineers in your organization to connect after they pass an SSO/MFA check and are using a corporate device. This feature is generally available across all plans. ## 2025-10-02 **Fine-grained Permissioning for Access for Apps, IdPs, & Targets now in Public Beta** Fine-grained permissions for **Access Applications, Identity Providers (IdPs), and Targets** is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources. #### What's New - **[Access Applications ↗︎](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/)**: Grant admin permissions to specific Access Applications. - **[Identity Providers ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/)**: Grant admin permissions to individual Identity Providers. - **[Targets ↗︎](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#1-add-a-target)**: Grant admin rights to specific Targets ![Updated Permissions Policy UX](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3004,height=1410,format=webp/_astro/2025-10-01-fine-grained-permissioning-ux.BWVmQsVF.png) Note During the public beta, members must also be assigned an account-scoped, read only role to view resources in the dashboard. This restriction will be lifted in a future release. - **Account Read Only** plus a fine-grained permission for a specific App, IdP, or Target - **Cloudflare Zero Trust Read Only** plus fine-grained permission for a specific App, IdP, or Target For more info: - [Get started with Cloudflare Permissioning](https://developers.cloudflare.com/fundamentals/manage-members/roles/) - [Manage Member Permissioning via the UI & API](https://developers.cloudflare.com/fundamentals/manage-members/manage) ## 2025-09-22 **Access Remote Desktop Protocol (RDP) destinations securely from your browser — now generally available!** [Browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is now generally available for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. Since we announced our [open beta](https://developers.cloudflare.com/changelog/post/2025-07-01-browser-based-rdp-open-beta/), we've made a few improvements: - Support for targets with IPv6. - Support for [Magic WAN](https://developers.cloudflare.com/cloudflare-wan/) and [WARP Connector](https://developers.cloudflare.com/mesh/) as on-ramps. - More robust error messaging on the login page to help you if you encounter an issue. - Worldwide keyboard support. Whether your day-to-day is in Portuguese, Chinese, or something in between, your browser-based RDP experience will look and feel exactly like you are using a desktop RDP client. - Cleaned up some other miscellaneous issues, including but not limited to enhanced support for Entra ID accounts and support for usernames with spaces, quotes, and special characters. As a refresher, here are some benefits browser-based RDP provides: - **Control how users authenticate to internal RDP resources** with single sign-on (SSO), multi-factor authentication (MFA), and granular access policies. - **Record who is accessing which servers and when** to support regulatory compliance requirements and to gain greater visibility in the event of a security event. - **Eliminate the need to install and manage software on user devices**. You will only need a web browser. - **Reduce your attack surface** by keeping your RDP servers off the public Internet and protecting them from common threats like credential stuffing or brute-force attacks. ![Example of a browser-based RDP Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2132,height=1814,format=webp/_astro/browser-based-rdp-access-app.BNXce1JL.png) To get started, refer to [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). ## 2025-08-26 **Manage and restrict access to internal MCP servers with Cloudflare Access** You can now control who within your organization has access to internal MCP servers, by putting internal MCP servers behind [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). [Self-hosted applications](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/linked-apps/) in Cloudflare Access now support OAuth for MCP server authentication. This allows Cloudflare to delegate access from any self-hosted application to an MCP server via OAuth. The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the authorized user, using that user's specific permissions and scopes. For example, if you have an MCP server designed for internal use within your organization, you can configure Access policies to ensure that only authorized users can access it, regardless of which MCP client they use. Support for internal, self-hosted MCP servers also works with MCP server portals, allowing you to provide a single MCP endpoint for multiple MCP servers. For more on MCP server portals, read the [blog post ↗︎](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) on the Cloudflare Blog. ## 2025-08-26 **MCP server portals** ![MCP server portal](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1557,height=420,format=webp/_astro/mcp-server-portal.BOKqTCoI.png) An [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint. Key benefits include: - **Streamlined access to multiple MCP servers**: MCP server portals support both unauthenticated MCP servers as well as MCP servers secured using any third-party or custom OAuth provider. Users log in to the portal URL through Cloudflare Access and are prompted to authenticate separately to each server that requires OAuth. - **Customized tools per portal**: Admins can tailor an MCP portal to a particular use case by choosing the specific tools and prompt templates that they want to make available to users through the portal. This allows users to access a curated set of tools and prompts — the less external context exposed to the AI model, the better the AI responses tend to be. - **Observability**: Once the user's AI agent is connected to the portal, Cloudflare Access logs the individual requests made using the tools in the portal. This is available in an open beta for all customers across all plans! For more information check out our [blog ↗︎](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) for this release. ## 2025-08-15 **SFTP support for SSH with Cloudflare Access for Infrastructure** [SSH with Cloudflare Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) now supports SFTP. It is compatible with SFTP clients, such as Cyberduck. ## 2025-08-14 **Cloudflare Access Logging supports the Customer Metadata Boundary (CMB)** Cloudflare Access logs now support the [Customer Metadata Boundary (CMB)](https://developers.cloudflare.com/data-localization/metadata-boundary/). If you have configured the CMB for your account, all Access logging will respect that configuration. Note For EU CMB customers, the logs will not be stored by Access and will appear as empty in the dashboard. EU CMB customers should utilize [Logpush](https://developers.cloudflare.com/logs/logpush/) to retain their Access logging, if desired. ## 2025-07-01 **Access RDP securely from your browser — now in open beta** [Browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is now available in open beta for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients. With browser-based RDP, you can: - **Control how users authenticate to internal RDP resources** with single sign-on (SSO), multi-factor authentication (MFA), and granular access policies. - **Record who is accessing which servers and when** to support regulatory compliance requirements and to gain greater visibility in the event of a security event. - **Eliminate the need to install and manage software on user devices**. You will only need a web browser. - **Reduce your attack surface** by keeping your RDP servers off the public Internet and protecting them from common threats like credential stuffing or brute-force attacks. ![Example of a browsed-based RDP Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2132,height=1814,format=webp/_astro/browser-based-rdp-access-app.BNXce1JL.png) To get started, see [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/). ## 2025-06-05 **Cloudflare One Analytics Dashboards and Exportable Access Report** Cloudflare One now offers powerful new analytics dashboards to help customers easily discover available insights into their application access and network activity. These dashboards provide a centralized, intuitive view for understanding user behavior, application usage, and security posture. !\[Cloudflare One Analytics Dashboards](\~/assets/images/changelog/cloudflare-one/Analytics Dashboards.png) Additionally, a new exportable access report is available, allowing customers to quickly view high-level metrics and trends in their application access. A **preview** of the report is shown below, with more to be found in the report: ![Cloudflare One Analytics Dashboards](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2406,height=950,format=webp/_astro/access-report.C744W7JR.png) Both features are accessible in the Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control. ## 2025-05-16 **New Access Analytics in the Cloudflare One Dashboard** A new Access Analytics dashboard is now available to all Cloudflare One customers. Customers can apply and combine multiple filters to dive into specific slices of their Access metrics. These filters include: - Logins granted and denied - Access events by type (SSO, Login, Logout) - Application name (Salesforce, Jira, Slack, etc.) - Identity provider (Okta, Google, Microsoft, onetimepin, etc.) - Users ( `chris@cloudflare.com`, `sally@cloudflare.com`, `rachel@cloudflare.com`, etc.) - Countries (US, CA, UK, FR, BR, CN, etc.) - Source IP address - App type (self-hosted, Infrastructure, RDP, etc.) ![Access Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2030,height=1720,format=webp/_astro/accessanalytics.DYXgwZCl.png) To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) and find Analytics in the side navigation bar. ## 2025-04-21 **Access bulk policy tester** The [Access bulk policy tester](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/#test-all-policies-in-an-application) is now available in the Cloudflare Zero Trust dashboard. The bulk policy tester allows you to simulate Access policies against your entire user base before and after deploying any changes. The policy tester will simulate the configured policy against each user's last seen identity and device posture (if applicable). ![Example policy tester](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1531,height=693,format=webp/_astro/example-policy-tester.DCY8hQvx.png) ## 2025-04-09 **Cloudflare Zero Trust SCIM User and Group Provisioning Logs** [Cloudflare Zero Trust SCIM provisioning](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim) now has a full audit log of all create, update and delete event from any SCIM Enabled IdP. The [SCIM logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/scim-logs/) support filtering by IdP, Event type, Result and many more fields. This will help with debugging user and group update issues and questions. SCIM logs can be found on the Zero Trust Dashboard under **Logs** -> **SCIM provisioning**. ![Example SCIM Logs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2318,height=1060,format=webp/_astro/example-scim-log.Bv5Zqckh.png) ## 2025-03-03 **New SAML and OIDC Fields and SAML transforms for Access for SaaS** [Access for SaaS applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/) now include more configuration options to support a wider array of SaaS applications. **SAML and OIDC Field Additions** OIDC apps now include: - Group Filtering via RegEx - OIDC Claim mapping from an IdP - OIDC token lifetime control - Advanced OIDC auth flows including hybrid and implicit flows ![OIDC field additions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1021,height=192,format=webp/_astro/oidc-claims.2di8l9Lv.png) SAML apps now include improved SAML attribute mapping from an IdP. ![SAML field additions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1051,height=202,format=webp/_astro/saml-attribute-statements.CW45j5Qi.png) **SAML transformations** SAML identities sent to Access applications can be fully customized using JSONata expressions. This allows admins to configure the precise identity SAML statement sent to a SaaS application. ![Configured SAML statement sent to application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1030,height=254,format=webp/_astro/transformation-box.DyKn-DdN.png) ## 2025-01-15 **Export SSH command logs with Access for Infrastructure using Logpush** Availability Only available on Enterprise plans. Cloudflare now allows you to send SSH command logs to storage destinations configured in [Logpush](https://developers.cloudflare.com/logs/logpush/), including third-party destinations. Once exported, analyze and audit the data as best fits your organization! For a list of available data fields, refer to the [SSH logs dataset](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/ssh_logs/). To set up a Logpush job, refer to [Logpush integration](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). ## 2024-10-01 **Eliminate long-lived credentials and enhance SSH security with Cloudflare Access for Infrastructure** Organizations can now eliminate long-lived credentials from their SSH setup and enable strong multi-factor authentication for SSH access, similar to other Access applications, all while generating access and command logs. SSH with [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/) uses short-lived SSH certificates from Cloudflare, eliminating SSH key management and reducing the security risks associated with lost or stolen keys. It also leverages a common deployment model for Cloudflare One customers: [WARP-to-Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-device-client/). SSH with Access for Infrastructure enables you to: - **Author fine-grained policy** to control who may access your SSH servers, including specific ports, protocols, and SSH users. - **Monitor infrastructure access** with Access and SSH command logs, supporting regulatory compliance and providing visibility in case of security breach. - **Preserve your end users' workflows.** SSH with Access for Infrastructure supports native SSH clients and does not require any modifications to users’ SSH configs. ![Example of an infrastructure Access application](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1916,height=1714,format=webp/_astro/infrastructure-app.BhpJOgxs.png) To get started, refer to [SSH with Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/). ## 2025-02-12 **Access policies support filtering** You can now filter Access policies by their action, selectors, rule groups, and assigned applications. ## 2025-02-11 **Private self-hosted applications and reusable policies GA** [Private self-hosted applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) and [reusable Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/) are now generally available (GA) for all customers. ## 2025-01-21 **Access Applications support private hostnames/IPs and reusable Access policies.** Cloudflare Access self-hosted applications can now be defined by [private IPs](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/), [private hostnames](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) (on port 443) and [public hostnames](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/). Additionally, we made Access policies into their own object which can be reused across multiple applications. These updates involved significant updates to the overall Access dashboard experience. The updates will be slowly rolled out to different customer cohorts. If you are an Enterprise customer and would like early access, reach out to your account team. ## 2025-01-15 **Logpush for SSH command logs** Enterprise customers can now use Logpush to export SSH command logs for Access for Infrastructure targets. ## 2024-12-04 **SCIM GA for Okta and Microsoft Entra ID** Cloudflare's SCIM integrations with [Okta](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/okta/#synchronize-users-and-groups) and [Microsoft Entra ID](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/entra-id/#synchronize-users-and-groups) (formerly AzureAD) are now out of beta and generally available (GA) for all customers. These integrations can be used for Access and Gateway policies and Zero Trust user management. Note: This GA release does not include [Dashboard SSO SCIM](https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/) support. ## 2024-10-23 **SSH with Access for Infrastructure** Admins can now use [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) to manage privileged access to SSH servers. Access for Infrastructure provides improved control and visibility over who accessed what service and what they did during their SSH session. Access for Infrastructure also eliminates the risk and overhead associated with managing SSH keys by using short-lived SSH certificates to access SSH servers. ## 2024-08-26 **Reduce automatic seat deprovisioning minimum to 1 month, down from 2 months.** Admins can now configure Zero Trust seats to [automatically expire](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/seat-management/#enable-seat-expiration) after 1 month of user inactivity. The previous minimum was 2 months. ## 2024-06-06 **Scalability improvements to the App Launcher** Applications now load more quickly for customers with a large number of applications or complex policies. ## 2024-04-28 **Add option to bypass CORS to origin server** Access admins can [defer all CORS enforcement to their origin server](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/cors/#bypass-options-requests-to-origin) for specific Access applications. ## 2024-04-15 **Zero Trust User identity audit logs** All user identity changes via SCIM or Authentication events are logged against a user's registry identity. ## 2024-02-22 **Access for SaaS OIDC Support** Access for SaaS applications can be setup with OIDC as an authentication method. OIDC and SAML 2.0 are now both fully supported. ## 2024-02-22 **WARP as an identity source for Access** Allow users to log in to Access applications with their WARP session identity. Users need to reauthenticate based on default session durations. WARP authentication identity must be turned on in your device enrollment permissions and can be enabled on a per application basis. ## 2023-12-20 **Unique Entity IDs in Access for SaaS** All new Access for SaaS applications have unique Entity IDs. This allows for multiple integrations with the same SaaS provider if required. The unique Entity ID has the application audience tag appended. Existing apps are unchanged. ## 2023-12-15 **Default relay state support in Access for SaaS** Allows Access admins to set a default relay state on Access for SaaS apps. ## 2023-09-15 **App launcher supports tags and filters** Access admins can now tag applications and allow users to filter by those tags in the App Launcher. ## 2023-09-15 **App launcher customization** Allow Access admins to configure the App Launcher page within Zero Trust. ## 2023-09-15 **View active Access user identities in the dashboard and API** Access admins can now view the full contents of a user's identity and device information for all active application sessions. ## 2023-09-08 **Custom OIDC claims for named IdPs** Access admins can now add custom claims to the existing named IdP providers. Previously this was locked to the generic OIDC provider. ## 2023-08-02 **Azure AD authentication contexts** Support Azure AD authentication contexts directly in Access policies. ## 2023-06-23 **Custom block pages for Access applications** Allow Access admins to customize the block pages presented by Access to end users. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/access/#page","headline":"Access","description":"Review recent changes to Cloudflare Access.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/access/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/access/og.png?v=9bffd60be15eac96","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare Browser Isolation. title: Browser Isolation image: https://developers.cloudflare.com/cloudflare-one/changelog/browser-isolation/og.png?v=b581aff02abb1602 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Browser Isolation Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/browser-isolation/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/browser-isolation.xml) ## 2026-09-30 **Role-based access control for Browser Isolation policies** [Isolation policies](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/) support role-based access control (RBAC). Because isolation policies are Gateway HTTP policies with the *Isolate* action, Gateway's account-level and resource-scoped roles apply to them directly. Use the `Zero Trust HTTP Policies Admin` account-level role to grant access to all HTTP policies in the account. You can also assign a [resource-scoped role](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/) to let a team member manage a specific isolation policy without exposing other Gateway resources. [Policy settings](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/#policy-settings) such as copy/paste, file download/upload, keyboard, and printing are part of the policy object and follow the same permissions. For setup instructions, refer to [Granular permissions for Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/). ## 2026-09-09 **Improved iOS tap-to-type experience for Browser Isolation** [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) has improved the tap-to-type experience for users on iOS devices. Previously, Browser Isolation displayed a full-screen overlay with the message `tap to type` when users focused a text field. The prompt now appears inline over the focused text field, reducing disruption when users enter text in isolated sessions. If the focused text field is too small to display the full prompt, Browser Isolation displays a keyboard icon in the center of the text field instead. ![Inline tap-to-type prompt over a focused text field in Browser Isolation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1320,height=605,format=webp/_astro/tap-to-type.UmUg_KNp.jpg) iOS users should tap twice to begin entering text. This update applies automatically to Browser Isolation sessions on iOS. For more information on why this interaction is required, refer to [iOS limitations](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/known-limitations/#ios). ## 2026-07-07 **Browser Isolation support for authorization proxy endpoints** [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) now supports Gateway [authorization proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint). You can apply [HTTP Isolate policies](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/) to traffic routed through authorization proxy endpoints, the same way you can for traffic from the Cloudflare One Client. Previously, only [source IP proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#source-ip-endpoint) supported Browser Isolation, and only with non-identity policies. Because authorization proxy endpoints authenticate users through an identity provider, you can now apply identity-based Isolate policies to PAC file-proxied traffic without requiring the Cloudflare One Client. To get started, [create an authorization proxy endpoint](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and [build an Isolate policy](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/). ## 2026-04-10 **Canvas Remoting optimizes performance for productivity applications** Remote Browser Isolation now supports **Canvas Remoting**, improving performance for HTML5 Canvas applications by sending vector draw commands instead of rasterized bitmaps. #### Key improvements - **10x bandwidth reduction:** Microsoft Word and other Office apps use 90% less bandwidth - **Smooth performance:** Google Sheets maintains consistent 30fps rendering - **Responsive terminals:** Web-based development environments and AI notebooks work in real-time - **Zero configuration:** Enabled by default for all Browser Isolation customers #### How it works Instead of sending rasterized bitmaps for every Canvas update, Browser Isolation now: 1. Captures Canvas draw commands at the source 2. Converts them to lightweight vector instructions 3. Renders Canvas content on the client This reduces bandwidth from hundreds of kilobytes per second to tens of kilobytes per second. #### Managing Canvas Remoting To temporarily disable for troubleshooting: - Right-click the isolated webpage background - Select **Disable Canvas Remoting** - Re-enable the same way by selecting **Enable Canvas Remoting** #### Limitations Currently supports 2D Canvas contexts only. WebGL and 3D graphics applications continue using bitmap rendering. For more information, refer to [Canvas Remoting](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/canvas-remoting/). ## 2025-05-13 **SAML HTTP-POST bindings support for RBI** Remote Browser Isolation (RBI) now supports SAML HTTP-POST bindings, enabling seamless authentication for SSO-enabled applications that rely on POST-based SAML responses from Identity Providers (IdPs) within a Remote Browser Isolation session. This update resolves a previous limitation that caused `405` errors during login and improves compatibility with multi-factor authentication (MFA) flows. With expanded support for major IdPs like Okta and Azure AD, this enhancement delivers a more consistent and user-friendly experience across authentication workflows. Learn how to [set up Remote Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/). ## 2025-05-01 **Browser Isolation Overview page for Zero Trust** A new **Browser Isolation Overview** page is now available in the Cloudflare Zero Trust dashboard. This centralized view simplifies the management of [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) deployments, providing: - **Streamlined Onboarding:** Easily set up and manage isolation policies from one location. - **Quick Testing:** Validate [clientless web application isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) with ease. - **Simplified Configuration:** Configure [isolated access applications](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/isolate-application/) and policies efficiently. - **Centralized Monitoring:** Track aggregate usage and blocked actions. This update consolidates previously disparate settings, accelerating deployment, improving visibility into isolation activity, and making it easier to ensure your protections are working effectively. ![Browser Isolation Overview](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1717,height=1286,format=webp/_astro/browser-isolation-overview.Ljd5ax_O.png) To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) and find Browser Isolation in the side navigation bar. ## 2025-03-04 **Gain visibility into user actions in Zero Trust Browser Isolation sessions** We're excited to announce that new logging capabilities for [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) through [Logpush](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/) are available in Beta starting today! With these enhanced logs, administrators can gain visibility into end user behavior in the remote browser and track blocked data extraction attempts, along with the websites that triggered them, in an isolated session. ```json { "AccountID": "$ACCOUNT_ID", "Decision": "block", "DomainName": "www.example.com", "Timestamp": "2025-02-27T23:15:06Z", "Type": "copy", "UserID": "$USER_ID" } ``` User Actions available: - **Copy & Paste** - **Downloads & Uploads** - **Printing** Learn more about how to get started with Logpush in our [documentation](https://developers.cloudflare.com/logs/logpush/). ## 2024-11-21 **Improved non-English keyboard support** You can now type in languages that use diacritics (like á or ç) and character-based scripts (such as Chinese, Japanese, and Korean) directly within the remote browser. The isolated browser now properly recognizes non-English keyboard input, eliminating the need to copy and paste content from a local browser or device. ## 2024-03-21 **Removed third-party cookie dependencies** Removed dependency on third-party cookies in the isolated browser, fixing an issue that previously caused intermittent disruptions for users maintaining multi-site, cross-tab sessions in the isolated browser. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/browser-isolation/#page","headline":"Browser Isolation","description":"Review recent changes to Cloudflare Browser Isolation.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/browser-isolation/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/browser-isolation/og.png?v=b581aff02abb1602","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare CASB. title: CASB image: https://developers.cloudflare.com/cloudflare-one/changelog/casb/og.png?v=53701f47e3083dda --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # CASB Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/casb/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/casb.xml) ## 2026-10-05 **Detect organization-specific risks with CASB custom finding types** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) now supports [**custom finding types**](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/), giving security teams full control over the security conditions CASB detects across their SaaS and cloud integrations. In addition to CASB's library of standard finding types, you can now write your own detection logic using [Rego ↗︎](https://www.openpolicyagent.org/docs/policy-language), the open-source policy language from Open Policy Agent (OPA). Use custom finding types to match your organization's own thresholds and exceptions, such as flagging admin accounts without two-factor authentication, and get higher-confidence findings to act on. ![Create a custom finding type with a name, severity, scope, and Rego detection logic](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1194,height=1194,format=webp/_astro/create-custom-finding-type.CF3GXoPZ.png) #### Key capabilities - **Write your own detection logic** — Define exactly what CASB flags using Rego expressions evaluated against asset data from your connected integrations. - **Target any supported provider and asset class** — Scope a custom finding type to a provider (such as Google Workspace or Microsoft 365) and asset class (such as users, files, or groups), and apply it to all integrations for that provider or a selected subset. - **Built-in validation** — Select **Validate** to check your expression for syntax errors and schema issues before you create the finding type. - **Inspect and duplicate standard finding types** — Open any standard finding type to view its detection logic, then duplicate it as the starting point for a custom finding type. - **Works with CASB policies** — Use custom finding types in [CASB remediation policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) to send matching findings to Slack, ServiceNow, or any other webhook destination. #### Get started 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Findings library**. 2. Select **Create finding**. 3. Enter a name, description, and severity. 4. Select a provider and asset class, then set the integration scope. 5. Write your Rego expression and select **Validate**. 6. Select **Create finding**. CASB evaluates the custom finding type against assets as they are created or updated within the selected scope. Matching assets appear as posture finding instances under **Posture Findings**. #### Learn more - Learn how to [create and manage custom finding types](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/custom-finding-types/) in Cloudflare One. - Learn how to [manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare One. - Learn how to [create and manage CASB remediation policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) in Cloudflare One. CASB custom finding types are now available in Cloudflare One. ## 2026-09-09 **New CASB integration for Zoom** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) now integrates with Zoom. The integration connects through Cloudflare's pre-built OAuth application — no manual app setup in Zoom is required. After an initial scan, CASB continuously scans your Zoom account to surface new findings as your environment changes. Zoom is widely used for meetings, webinars, and collaboration. Misconfigurations in account settings, meeting security controls, and recording access can expose organizations to data leakage, unauthorized access, and compliance risk. Cloudflare CASB ingests Zoom account data via API to surface security findings across these areas. #### Key capabilities Starting today, security teams can scan for security findings across the following assets: - **Account settings** — Detect weak password policies, unlocked security controls, and two-factor authentication gaps across your Zoom account - **User accounts** — Identify users not enforcing SSO, accounts with insecure host keys, unverified or inactive users, and unsafe overrides of account-level security settings - **Meetings** — Surface meetings without passwords or waiting rooms, meetings using Personal Meeting IDs (PMIs), and meetings with external domain hosts - **Recordings** — Detect publicly accessible cloud recordings, recordings without passcodes, and weak recording password configurations - **Content** — Identify sensitive information in meeting and recording content via DLP Profile matching #### Learn more This integration is available to all Cloudflare Zero Trust customers today. New customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the Cloudflare One dashboard under **Cloud & SaaS findings** > **Integrations**. The integration begins scanning immediately and surfaces findings in the dashboard within minutes. ## 2026-08-21 **Automatically remediate Microsoft 365 and Google Workspace findings with API-based CASB remediation policies** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) is an API-based (agentless) tool that continuously scans your SaaS and cloud applications for security misconfigurations and data exposure. You can now use **CASB remediation policies** to automatically fix a finding or send a webhook the moment CASB detects it, without manual triage. #### Remediate Microsoft 365 and Google Workspace findings A policy can perform a first-party remediation action directly against the SaaS integration API. When a policy triggers, Cloudflare revokes the external sharing configuration without human intervention. Remediation is currently supported for file-sharing findings in Microsoft 365 and Google Workspace. Support for additional finding types and integrations is coming soon. For the full list of supported finding types, refer to [Run remediations](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/#run-remediations) in the CASB remediation policies documentation. #### Send webhooks A policy can send posture finding data to Slack, ServiceNow, or any other webhook destination. Webhook actions are supported for all posture finding types across CASB integrations. A single policy can perform both actions: remediate a finding and send a webhook. #### Get started 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Policies**. 2. Select **Create a policy**. 3. Under **Basic information**, enter a **Policy name** and, optionally, a **Description**. 4. Under **Choose how you want to trigger the policy**, select a **Vendor**, **Integration**, and **Finding type**. 5. Under **Define what to do with findings that match your trigger**, choose **Run Remediation**, **Send webhooks**, or both. 6. Under **Status**, turn on **Enable policy**. 7. Select **Create policy**. #### Learn more - Learn how to [create and manage CASB remediation policies](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/policies/) in Cloudflare One. - Configure [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/) as a policy destination. - Learn how to [manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare One. CASB remediation policies are now available in Cloudflare One. ## 2026-05-19 **CASB adds support for Claude Compliance API** [Cloudflare CASB](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) now integrates with the [Claude Compliance API ↗︎](https://support.claude.com/en/articles/13015708-access-the-compliance-api). This enhancement gives security teams visibility into Claude usage patterns, admin activity, and compliance-relevant events across their organization. The Claude Compliance API provides structured access to audit logs and administrative actions within Claude Enterprise and Claude Platform. Cloudflare CASB ingests this data to surface security findings that help organizations enhance their security posture and enforce AI governance. #### Key capabilities Starting today, security teams can scan for security findings across the following assets: - **Public projects** — Projects set to public visibility - **Project attachment** — Files and documents added to projects that violate DLP policies - **Chat files** — User-uploaded and provider-generated files that violate DLP policies - **Chat messages** — User prompts and provider responses that violate DLP policies - **Artifacts** — Provider-generated documents and files that violate DLP policies #### Learn more This [integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) is available to all Cloudflare One customers. New Cloudflare customers can sign up and start with their first two integrations for free. Existing customers can enable the integration directly in the dashboard. The integration begins scanning immediately and surfaces findings in the dashboard within minutes. ## 2026-04-09 **Send CASB posture finding instances with webhooks** You can now use **CASB webhooks** in Cloudflare One to send posture finding instances to external systems such as chat platforms, ticketing systems, SIEMs, SOAR tools, and custom automation services. This gives security teams a simple way to route CASB posture findings into the tools and workflows they already use for triage and response. To get started, go to **Integrations** > **Webhooks** in the Cloudflare One dashboard to create a webhook destination. After you configure a webhook, open a posture finding instance and select **Send webhook** to send it. #### Key capabilities - **Flexible authentication** — Configure destinations using **None**, **Basic Auth**, **Bearer Auth**, **Static Headers**, or **HMAC-Signing**. - **Built-in testing** — Use **Test delivery** to send a test request before sending a live finding instance. - **Posture finding workflows** — Send posture finding instances directly from the finding details workflow in **Cloud & SaaS findings**. - **HTTPS destinations** — Configure webhook destinations with public `https://` URLs. #### Learn more - Configure [CASB webhooks](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/webhooks/) in Cloudflare. - Learn how to [manage findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare. CASB webhooks are now available in Cloudflare One. ## 2026-02-20 **Understand CASB findings instantly with Cloudy Summaries** You can now easily understand your SaaS security posture findings and why they were detected with **Cloudy Summaries in CASB**. This feature integrates Cloudflare's Cloudy AI directly into your CASB Posture Findings to automatically generate clear, plain-language summaries of complex security misconfigurations, third-party app risks, and data exposures. This allows security teams and IT administrators to drastically reduce triage time by immediately understanding the context, potential impact, and necessary remediation steps for any given finding—without needing to be an expert in every connected SaaS application. To view a summary, simply navigate to your Posture Findings in the Cloudflare One dashboard (under **Cloud and SaaS findings**) and open the finding details of a specific instance of a Finding. Cloudy Summaries are supported on all available integrations, including Microsoft 365, Google Workspace, Salesforce, GitHub, AWS, Slack, and Dropbox. See the full list of supported integrations [here](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/). #### Key capabilities - **Contextual explanations** — Quickly understand the specifics of a finding with plain-language summaries detailing exactly what was detected, from publicly shared sensitive files to risky third-party app scopes. - **Clear risk assessment** — Instantly grasp the potential security impact of the finding, such as data breach risks, unauthorized account access, or email spoofing vulnerabilities. - **Actionable guidance** — Get clear recommendations and next steps on how to effectively remediate the issue and secure your environment. - **Built-in feedback** — Help improve future AI summarization accuracy by submitting feedback directly using the thumbs-up and thumbs-down buttons. #### Learn more - Learn more about managing [CASB Posture Findings](https://developers.cloudflare.com/cloudflare-one/cloud-and-saas-findings/) in Cloudflare. Cloudy Summaries in CASB are available to all Cloudflare CASB users today. ## 2025-11-14 **New SaaS Security weekly digests with API CASB** You can now stay on top of your SaaS security posture with the new **CASB Weekly Digest** notification. This opt-in email digest is delivered to your inbox every Monday morning and provides a high-level summary of your organization's Cloudflare API CASB findings from the previous week. This allows security teams and IT administrators to get proactive, at-a-glance visibility into new risks and integration health without having to log in to the dashboard. To opt in, navigate to **Manage Account** > **Notifications** in the Cloudflare dashboard to configure the **CASB Weekly Digest** alert type. #### Key capabilities - **At-a-glance summary** — Review new high/critical findings, most frequent finding types, and new content exposures from the past 7 days. - **Integration health** — Instantly see the status of all your connected SaaS integrations (Healthy, Unhealthy, or Paused) to spot API connection issues. - **Proactive alerting** — The digest is sent automatically to all subscribed users every Monday morning. - **Easy to configure** — Users can opt in by enabling the notification in the Cloudflare dashboard under **Manage Account** > **Notifications**. #### Learn more - Configure [notification preferences](https://developers.cloudflare.com/notifications/) in Cloudflare. The CASB Weekly Digest notification is available to all Cloudflare users today. ## 2025-10-28 **CASB introduces new granular roles** Cloudflare CASB (Cloud Access Security Broker) now supports two new granular roles to provide more precise access control for your security teams: - **Cloudflare CASB Read:** Provides read-only access to view CASB findings and dashboards. This role is ideal for security analysts, compliance auditors, or team members who need visibility without modification rights. - **Cloudflare CASB:** Provides full administrative access to configure and manage all aspects of the CASB product. These new roles help you better enforce the principle of least privilege. You can now grant specific members access to CASB security findings without assigning them broader permissions, such as the **Super Administrator** or **Administrator** roles. To enable [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/), scans in CASB, account members will need the **Cloudflare Zero Trust** role. You can find these new roles when inviting members or creating API tokens in the Cloudflare dashboard under **Manage Account** > **Members**. To learn more about managing roles and permissions, refer to the [Manage account members and roles documentation](https://developers.cloudflare.com/fundamentals/manage-members/roles/). ## 2025-08-26 **New CASB integrations for ChatGPT, Claude, and Gemini** [Cloudflare CASB ↗︎](https://www.cloudflare.com/zero-trust/products/casb/) now supports three of the most widely used GenAI platforms — **OpenAI ChatGPT**, **Anthropic Claude**, and **Google Gemini**. These API-based integrations give security teams agentless visibility into posture, data, and compliance risks across their organization’s use of generative AI. ![Cloudflare CASB showing selection of new findings for ChatGPT, Claude, and Gemini integrations.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2335,height=1776,format=webp/_astro/casb-ai-integrations-preview.B-zsSA1P.png) #### Key capabilities - **Agentless connections** — connect ChatGPT, Claude, and Gemini tenants via API; no endpoint software required - **Posture management** — detect insecure settings and misconfigurations that could lead to data exposure - **DLP detection** — identify sensitive data in uploaded chat attachments or files - **GenAI-specific insights** — surface risks unique to each provider’s capabilities #### Learn more - [ChatGPT integration docs ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/openai/) - [Claude integration docs ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/anthropic/) - [Gemini integration docs ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/google-workspace/gemini/) These integrations are available to all Cloudflare One customers today. ## 2025-06-23 **Data Security Analytics in the Zero Trust dashboard** Zero Trust now includes **Data security analytics**, providing you with unprecedented visibility into your organization sensitive data. The new dashboard includes: - **Sensitive Data Movement Over Time:** - See patterns and trends in how sensitive data moves across your environment. This helps understand where data is flowing and identify common paths. - **Sensitive Data at Rest in SaaS & Cloud:** - View an inventory of sensitive data stored within your corporate SaaS applications (for example, Google Drive, Microsoft 365) and cloud accounts (such as AWS S3). - **DLP Policy Activity:** - Identify which of your Data Loss Prevention (DLP) policies are being triggered most often. - See which specific users are responsible for triggering DLP policies. ![Data Security Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3254,height=1580,format=webp/_astro/cf1-data-security-analytics-v1.BGl6fYXl.png) To access the new dashboard, log in to [Cloudflare One ↗︎](https://one.dash.cloudflare.com/) and go to **Insights** on the sidebar. ## 2024-11-22 **Find security misconfigurations in your AWS cloud environment** You can now use CASB to find security misconfigurations in your AWS cloud environment using [Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/). You can also [connect your AWS compute account](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/aws-s3/#compute-account) to extract and scan your S3 buckets for sensitive data while avoiding egress fees. CASB will scan any objects that exist in the bucket at the time of configuration. To connect a compute account to your AWS integration: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com), go to **Cloud & SaaS findings** > **Integrations**. 2. Find and select your AWS integration. 3. Select **Open connection instructions**. 4. Follow the instructions provided to connect a new compute account. 5. Select **Refresh**. ## 2024-06-03 **Atlassian Bitbucket integration** You can now scan your Bitbucket Cloud workspaces for a variety of contextualized security issues such as source code exposure, admin misconfigurations, and more. ## 2024-05-23 **Data-at-rest DLP for Box and Dropbox** You can now scan your [Box](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/box/#data-loss-prevention-optional) and [Dropbox](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/dropbox/#data-loss-prevention-optional) files for DLP matches. ## 2024-04-16 **Export CASB findings to CSV** You can now export all top-level CASB findings or every instance of your findings to CSV. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/casb/#page","headline":"CASB","description":"Review recent changes to Cloudflare CASB.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/casb/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/casb/og.png?v=53701f47e3083dda","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Track updates and changes to Cloudflare One features. title: Cloudflare Network Firewall image: https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-network-firewall/og.png?v=e28aa8876fee825a --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare Network Firewall Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-network-firewall/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/cloudflare-network-firewall.xml) ## 2026-09-25 **Managed Rulesets supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Managed Rulesets are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. For the full list of feature availability, refer to [Check feature availability before upgrading](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-08-19 **Threat Intel Lists supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Threat Intel Lists are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. This feature requires a Cloudflare Advanced Network Firewall subscription. Support for additional features - Rate Limiting and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-07-08 **IP lists, IDS, and SIP rules supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) IP lists, IDS, and SIP rules are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. These features require a Cloudflare Advanced Network Firewall subscription. Support for additional features - Threat Intel Lists, Rate Limiting, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-04-21 **Country rules supported in Unified Routing** [Cloudflare Advanced Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/) Country rules are now supported for accounts using [Unified Routing](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#unified-routing) mode. This feature requires a Cloudflare Advanced Network Firewall subscription. You can create firewall rules that match traffic based on source or destination country to enforce geographic access policies across your network. This is the first of the Cloudflare Advanced Network Firewall features to become available in Unified Routing. Support for additional features - IP Lists, ASN Lists, Threat Intel Lists, IDS, Rate Limiting, SIP, and Managed Rulesets - is planned. For the full list of current beta limitations, refer to [Traffic steering beta limitations](https://developers.cloudflare.com/cloudflare-wan/reference/traffic-steering/#check-feature-availability-before-upgrading). ## 2026-02-17 **Cloudflare One Product Name Updates** We are updating naming related to some of our Networking products to better clarify their place in the Zero Trust and Secure Access Service Edge (SASE) journey. We are retiring some older brand names in favor of names that describe exactly what the products do within your network. We are doing this to help customers build better, clearer mental models for comprehensive SASE architecture delivered on Cloudflare. #### What's changing - **Magic WAN** → **Cloudflare WAN** - **Magic WAN IPsec** → **Cloudflare IPsec** - **Magic WAN GRE** → **Cloudflare GRE** - **Magic WAN Connector** → **Cloudflare One Appliance** - **Magic Firewall** → **Cloudflare Network Firewall** - **Magic Network Monitoring** → **Network Flow** - **Magic Cloud Networking** → **Cloudflare One Multi-cloud Networking** **No action is required by you** — all functionality, existing configurations, and billing will remain exactly the same. For more information, visit the [Cloudflare One documentation](https://developers.cloudflare.com/cloudflare-one/). ## 2026-01-15 **Network Services navigation update** The Network Services menu structure in Cloudflare's dashboard has been updated to reflect solutions and capabilities instead of product names. This will make it easier for you to find what you need and better reflects how our services work together. Your existing configurations will remain the same, and you will have access to all of the same features and functionality. The changes visible in your dashboard may vary based on the products you use. Overall, changes relate to [Magic Transit ↗︎](https://developers.cloudflare.com/magic-transit/), [Magic WAN ↗︎](https://developers.cloudflare.com/magic-wan/), and [Magic Firewall ↗︎](https://developers.cloudflare.com/cloudflare-network-firewall/). **Summary of changes:** - A new **Overview** page provides access to the most common tasks across Magic Transit and Magic WAN. - Product names have been removed from top-level navigation. - Magic Transit and Magic WAN configuration is now organized under **Routes** and **Connectors**. For example, you will find IP Prefixes under **Routes**, and your GRE/IPsec Tunnels under **Connectors.** - Magic Firewall policies are now called **Firewall Policies.** - Magic WAN Connectors and Connector On-Ramps are now referenced in the dashboard as **Appliances** and **Appliance profiles.** They can be found under **Connectors > Appliances.** - Network analytics, network health, and real-time analytics are now available under **Insights.** - Packet Captures are found under **Insights > Diagnostics.** - You can manage your Sites from **Insights > Network health.** - You can find Magic Network Monitoring under **Insights > Network flow**. If you would like to provide feedback, complete [this form ↗︎](https://forms.gle/htWyjRsTjw1usdis5). You can also find these details in the January 7, 2026 email titled **\[FYI] Upcoming Network Services Dashboard Navigation Update**. Preview: ![Networking Navigation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3000,height=1052,format=webp/_astro/networking-overview-and-navigation.CeMgEFaZ.png) ## 2025-03-13 **Cloudflare IP Ranges List** Magic Firewall now supports a new managed list of Cloudflare IP ranges. This list is available as an option when creating a Magic Firewall policy based on IP source/destination addresses. When selecting "is in list" or "is not in list", the option "**Cloudflare IP Ranges**" will appear in the dropdown menu. This list is based on the IPs listed in the Cloudflare [IP ranges ↗︎](https://www.cloudflare.com/en-gb/ips/). Updates to this managed list are applied automatically. ![Cloudflare IPs Managed List](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1102,height=677,format=webp/_astro/cloudflare-ips.DetyOndL.png) Note: IP Lists require a Cloudflare Advanced Network Firewall subscription. For more details about Cloudflare Network Firewall plans, refer to [Plans](https://developers.cloudflare.com/cloudflare-network-firewall/plans). ## 2024-10-02 **Search for custom rules using rule name and/or ID** The Magic Firewall dashboard now allows you to search custom rules using the rule name and/or ID. 1. Log into the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com) and select your account. 2. Go to **Analytics & Logs** > **Network Analytics**. 3. Select **Magic Firewall**. 4. Add a filter for **Rule ID**. ![Search for firewall rules with rule IDs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1032,height=801,format=webp/_astro/search-with-rule-id.DJgzqgKk.png) Additionally, the rule ID URL link has been added to Network Analytics. ## 2024-09-12 **New UI improvements** The dashboard now displays the order number of custom rules, and improved drag and drop functionality. You can also preview rules on a side panel without leaving the current page. ## 2024-08-16 **Cloudflare Network Firewall Analytics Rule Log Enhancement** Customers who create a rule in a disabled mode will see the rule as **Log (rule disabled)**. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-network-firewall/#page","headline":"Cloudflare Network Firewall","description":"Track updates and changes to Cloudflare One features.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-network-firewall/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-network-firewall/og.png?v=e28aa8876fee825a","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to the Cloudflare One Client. title: Cloudflare One Client image: https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-one-client/og.png?v=ac442acb788a02de --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare One Client Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-one-client/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Review recent changes to the Cloudflare One Client (formerly WARP). [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/cloudflare-one-client.xml) ## 2026-10-12 **Cloudflare One Client for Windows (version 2026.8.2110.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply. ## 2026-10-12 **Cloudflare One Client for macOS (version 2026.8.2110.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply. ## 2026-10-12 **Cloudflare One Client for Linux (version 2026.8.2110.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where the client could repeatedly disconnect and reconnect when a split tunnel configuration with hostname-based entries failed to apply. ## 2026-10-07 **Cloudflare One Client for macOS (version 2026.8.2100.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Faster connects and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. **Additional changes and improvements** - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default. - Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering. - Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration. - Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report “No network” after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-10-07 **Cloudflare One Client for Windows (version 2026.8.2100.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across tunnel reconnections. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved connection reliability on devices with very large hosts files. The client now detects a large hosts file, allows more time for its initial DNS check, and shows a banner letting the user know that connecting may take longer. - Faster tunnel reconnections and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. - A service recovery mechanism, backed by a Windows scheduled task, now starts the client service on system unlock if it is not already running. This is enabled by default. **Additional changes and improvements** - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering. - Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration. - Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep. - Fixed the client service failing to restart after an unexpected termination. - Fixed the client UI getting stuck in a connecting state after sleep and wake even though the tunnel was connected. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report “No network” after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - A Windows DNS client regression may cause connectivity check failures on systems containing large hosts files. While this release includes a fix to mitigate this issue, users may still experience reduced DNS performance and connectivity check failures. ## 2026-10-07 **Cloudflare One Client for Linux (version 2026.8.2100.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release includes the following highlights: - Traffic to split tunnel excluded resources is no longer briefly blocked while the client is connecting or reconnecting. The client now keeps its learned split tunnel configuration across reconnects. - Support for routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Faster tunnel reconnections and lower memory use. The hosts file is now read once and shared across the client’s DNS resolvers instead of being reloaded by each one. - Added an MDM setting to prefer IPv4 when resolving hostnames in proxy mode. The setting is off by default. **Additional changes and improvements** - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Individual DNS-over-HTTPS queries now time out instead of hanging when the upstream server stops responding. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed the client reconnecting while Emergency Disconnect was active after switching organizations or re-registering. - Fixed the client being unable to connect after an upgrade when its stored registration credentials no longer matched its configuration. - Fixed the client service restarting unexpectedly when it was slow to respond, such as after waking from sleep. - Fixed the client window not appearing on first launch after a fresh install on RHEL 10. - Fixed duplicate WARP routing policy rules accumulating on reconnect. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report “No network” after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - When in DNS Only mode, the client may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration. Local Domain Fallback works as expected in other client modes. ## 2026-09-30 **Cloudflare One Client for Windows (version 2026.8.2033.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None For Zero Trust documentation, see: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/ For Consumer documentation, see: https://developers.cloudflare.com/warp-client/ ## 2026-09-29 **Cloudflare One Client for Windows (version 2026.8.2028.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-29 **Cloudflare One Client for macOS (version 2026.8.2028.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-21 **Cloudflare One Client for macOS (version 2026.8.1755.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-21 **Cloudflare One Client for Windows (version 2026.8.1755.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Fixed an issue that could briefly block traffic to split tunnel excluded resources while the client was connecting or reconnecting. - Improved reauthentication reliability and fixed an issue where a reauthentication could force a new registration. - Improved client reaction to the current network lowering its MTU. - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-09 **Cloudflare One Client for macOS (version 2026.8.1290.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - Fixed Extra Logging failing to capture packets across all interfaces. - Fixed an issue that could prevent remote diagnostics from completing. - Fixed DNS connectivity checks failing on IPv6-only networks. - Fixed the client service exiting when its route-monitoring socket was closed after sleep or wake. - Fixed DNS enforcement checks making the client service unresponsive on systems with large routing tables. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-09-09 **Cloudflare One Client for Windows (version 2026.8.1290.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Added support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel when unrestricted LAN inclusion is enabled by policy or MDM. - Improved DNS reliability on networks with lower MTUs by clamping the TCP maximum segment size (MSS) for DNS-over-HTTPS connections sent through the tunnel. - Improved API reliability by retrying requests dropped when reusing pooled connections. - The client no longer requires the Windows WLAN AutoConfig service to be running. - Implemented a service recovery mechanism backed by Windows scheduler task to start WARP service on system unlock if not already started. - Fixed slow captive portal checks causing the client service to become unresponsive or restart while connecting. - Fixed a race when switching tunnel protocols during key rotation that could prevent WireGuard from connecting. - Fixed the client continuing to report 'No network' after a successful manual disconnect. - Fixed Digital Experience Monitoring (DEX) HTTP tests failing TLS validation on Windows. - Fixed the client UI crashing at startup when it could not write to the Windows registry. - Fixed latency spikes and traffic interruptions during TPM-backed API authentication when hardware-backed registration is enabled. - Fixed trailing whitespace in BIOS serial numbers causing serial-number and client-certificate device posture checks to fail. - Fixed a client UI crash that could occur when the daemon connection was reset during an IPC request. - Fixed a startup crash when date formatting data for the system locale had not yet loaded. **Known issues** - None ## 2026-08-28 **Cloudflare One Client for macOS (version 2026.7.1376.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms. ## 2026-08-28 **Cloudflare One Client for Windows (version 2026.7.1376.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). Fixed a rare but critical issue where the client could fail to connect or switch organizations due to an invalid registration after switching installed client versions. Additionally, this hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms. ## 2026-08-28 **Cloudflare One Client for Linux (version 2026.7.1377.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves an issue where a small but noticeable percentage of DNS queries fail across platforms. ## 2026-08-19 **Cloudflare One Client for Windows (version 2026.7.1343.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. - When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. **Additional changes and improvements** - Fixed a process leak in the Windows GUI that could exhaust system resources during IPC client-creation failures. - Fixed being unable to switch organizations when the client was stuck in the "Device not in organization" state. - Fixed an issue where Microsoft Defender would falsely flag the Cloudflare One Client installation as malicious when installing with Intune. - Made the Windows domain-joined posture check more reliable. - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. **Known issues** - If a user upgrades to version 2026.7.1343.0, downgrades to an earlier version, re-registers, and then upgrades back to 2026.7.1343.0, the client might fail to connect or switch organizations. To resolve this issue, run `warp-cli registration delete` or `warp-cli registration delete-all`. ## 2026-08-19 **Cloudflare One Client for macOS (version 2026.7.1343.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. - When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. **Additional changes and improvements** - Fixed the client not allowing login to another organization when currently showing "Device not in organization." - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed crash when trying to connect to captive portal on Wi-Fi. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. **Known issues** - None ## 2026-08-19 **Cloudflare One Client for Linux (version 2026.7.1343.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - When reauthentication is needed for any reason, the notifications are clearer and reduce the actions needed to get you back to work by redirecting to the browser for authentication instead of the app window when necessary. - When a network is blocking or otherwise not supportive of HTTP/3, the client will learn and adapt by switching the order of fallback for that network by starting with HTTP/2 first and then trying HTTP/3 if needed. This reduces delays in time to connectivity when joining older or heavily filtered networks. **Additional changes and improvements** - Fixed the client not allowing login to another organization when currently showing "Device not in organization." - A DNS search domain parsing failure no longer prevents connection. - Cloud icon now correctly reflects actual connection status instead of showing disconnected while fully connected. - Fixed missing certificate error display due to a race condition. - Fixed empty black window after transitioning from docked dual displays to undocked/internal display. - Fixed hostname routes not working for Cloudflare Mesh when the IP addresses of the hostnames are local addresses. **Known issues** - When in DNS Only mode, the client may send DNS queries for names that are configured for Local Domain Fallback to the encrypted DNS server instead of falling back to the system configuration. Local Domain Fallback works as expected in other client modes. ## 2026-08-10 **Cloudflare One Client for Windows (version 2026.6.905.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix addresses an uncommon and intermittent case on Windows devices where the device is unable to reconnect after the device is woken from sleep. ## 2026-07-31 **Cloudflare One Client for Windows (version 2026.7.1210.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Improved connection reliability: the client now swaps protocol order after repeated connectivity-check failures, which helps when HTTP/3 is blocked after the QUIC handshake. - Fixed issue where a certificate error could be incorrectly displayed right after the connection is established. - A [DNS search domain](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) parsing failure no longer prevents connection. - Fixed a [MASQUE](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#device-tunnel-protocol) issue where the tunnel could stall while uploading at a high rate. - Fixed being unable to [switch organizations](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/switch-organizations/) when the client was stuck in the "Device not in organization" state. - Fixed the Home Screen dropdown popup not anchoring correctly. - Fixed a crash during dialog dismissal. - Increased tolerance for configurations with a large number of [local domain fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) resolver IPs, so DNS resolution behaves correctly even when more fallback resolvers are configured than recommended. - Fixed a networking issue where IPv6 multicast routes were being assigned to the WARP tunnel interface. - Fixed fatal errors on UI load on Windows 10. - Fixed a crash during Windows notification initialization. - Made the Windows [domain-joined posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/domain-joined/) more reliable. - Fixed orphaned credentials left behind on multi-user uninstall. - A successful re-authentication will cause the [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) to be re-evaluated. - Improved [dashboard-managed client updates](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) by running the updater only when needed. ## 2026-07-31 **Cloudflare One Client for macOS (version 2026.7.1210.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release includes the following changes and improvements: - Improved connection reliability: the client now swaps protocol order after repeated connectivity-check failures, which helps when HTTP/3 is blocked after the QUIC handshake. - Fixed issue where a certificate error could be incorrectly displayed right after the connection is established. - A [DNS search domain](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) parsing failure no longer prevents connection. - Fixed a [MASQUE](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#device-tunnel-protocol) issue where the tunnel could stall while uploading at a high rate. - Fixed being unable to [switch organizations](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/switch-organizations/) when the client was stuck in the "Device not in organization" state. - Fixed the Home Screen dropdown popup not anchoring correctly. - Fixed a crash during dialog dismissal. - Increased tolerance for configurations with a large number of [local domain fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) resolver IPs, so DNS resolution behaves correctly even when more fallback resolvers are configured than recommended. - Fixed the WARP client stealing window focus (for example, during reauth). - Fixed a client crash when connecting to a captive portal over Wi-Fi. - Fixed the system tray icon showing "disconnected" while the UI showed "connected". - A successful re-authentication will cause the [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/) to be re-evaluated. - Improved [dashboard-managed client updates](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) by running the updater only when needed. ## 2026-07-21 **Cloudflare One Client for Windows (version 2026.6.880.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel. ## 2026-07-21 **Cloudflare One Client for macOS (version 2026.6.880.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel. ## 2026-07-21 **Cloudflare One Client for Linux (version 2026.6.880.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix resolves a regression that caused a large increase in DNS-over-TCP queries to fallback and internal DNS servers. The client now sends fallback DNS queries over UDP first, falling back to TCP only when a response is truncated, instead of querying both protocols in parallel. ## 2026-07-07 **Cloudflare One Client for Windows (version 2026.6.850.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This hotfix addresses a Windows authentication issue in the embedded WebView2 browser. Single sign-on could fail to use the Windows primary account, causing users to be prompted for an interactive sign-in. The embedded authentication browser now allows SSO providers to use the OS primary account when available. ## 2026-07-01 **Cloudflare One Client for Linux (version 2026.6.836.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This package is the same release as 2026.6.822.0, with a fix for our RPM package. Previously the repository served a single build to every OS version, so an install could pull a dependency that isn't available on that release. The repository now serves the correct build for each operating system version, so installs automatically pull the dependencies that version requires. Debian and Ubuntu were not affected. If you installed version 2026.6.822.0 on an RPM-based distribution, we recommend refreshing your repository configuration: ```bash sudo curl -fsSL https://pkg.cloudflareclient.com/cloudflare-warp-ascii.repo | sudo tee /etc/yum.repos.d/cloudflare-warp.repo sudo dnf clean all sudo dnf install cloudflare-warp ``` ## 2026-06-29 **Cloudflare One Client for Windows (version 2026.6.822.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. **Additional Changes and improvements** - Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in Windows Accessibility settings. - Path MTU Discovery (PMTUD) is now enabled by default. - The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications. - Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Fixed a high CPU issue when the device wakes from sleep. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. **Known issues** - Single sign-on in the embedded WebView2 authentication browser may fail to use the Windows primary account, prompting for an interactive sign-in. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - In rare cases, a registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click "Ok" with the default highlighted option. ## 2026-06-29 **Cloudflare One Client for macOS (version 2026.6.822.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. **Additional Changes and improvements** - Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. - Path MTU Discovery (PMTUD) is now enabled by default. - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - When deploying with Microsoft Intune, the client may be repeatedly reinstalled because Intune adds the client's embedded framework bundles to its install-detection list, and those frameworks cannot be detected as installed on their own. See [Repeated reinstalls on macOS with Microsoft Intune](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#repeated-reinstalls-on-macos-with-microsoft-intune) for the workaround. ## 2026-06-29 **Cloudflare One Client for Linux (version 2026.6.822.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces multiple features from our previous beta release into stable release, including: - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the TPM (with TPM 2.0+) whenever it is available to provide stronger protection against device impersonation. See [Hardware-backed registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. **Additional changes and improvements** - Starting with 2026.6.822.0, the client unifies all API requests under the `api.devices.cloudflare.com` SNI, where previously both `zero-trust-client.cloudflareclient.com` and `notifications.cloudflareclient.com` were used. Review [Cloudflare One Client with firewall](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/firewall/) to ensure systems that rely on SNI inspection do not block the API traffic. The behavior of previous client versions is unaffected. - [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) functionality using the Cloudflare One Client is now supported on RHEL 9 and 10. - Cloudflare Mesh now supports [hostname-based routing](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes). - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the system display settings. - Path MTU Discovery (PMTUD) is now enabled by default. - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Fixed an issue where some Debian releases experienced inaccurate version reporting for posture checks. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. For RHEL deployments, this release introduces a dependency on the [Extra Packages for Enterprise Linux](https://docs.fedoraproject.org/en-US/epel/) repository (EPEL). The EPEL repository provides packages that support the captive portal detection’s in-app browser authentication and system tray icon. See [Getting started with EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/) for instructions on enabling EPEL. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. ## 2026-06-24 **Cloudflare One Client for macOS (version 2026.6.782.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This beta release introduces upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. **Additional changes and improvements** This release also introduces multiple fixes and improvements including: - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. - Path MTU Discovery (PMTUD) is now enabled by default. - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. - Users can now register with team names in any case format without errors. - New UI fixes - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. - Added clear error messaging when the Cloudflare certificate needs to be installed. - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. - Added ability to configure proxy mode for consumer users. - Added back the option to quit for consumer users. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. ## 2026-05-29 **Cloudflare One Client for macOS (version 2026.5.1155.1)** A new Beta release for the macOS Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks (United inflight Wi-Fi was the reported case). The browser now reliably loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-29 **Cloudflare One Client for Windows (version 2026.5.1155.1)** A new Beta release for the Windows Cloudflare One Client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - The client now applies DNS search suffixes configured in your [device profile](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. - Administrators can now control which virtual networks (VNETs) are available to which users via WARP device profile settings in the Zero Trust dashboard. Previously, every VNET in the organization was visible to every device; you can now scope the VNET picker per profile so users only see the networks relevant to them. See [VNET availability](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#vnet-availability) for details. - Added mandatory authentication. When enabled via MDM, the Cloudflare One Client blocks all Internet traffic from the moment the machine boots until the user authenticates, closing the visibility gap on newly deployed devices and during re-authentication. See the [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and [documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/) for details. - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field, matching what the documentation has always claimed. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. - The UseWebView2 registry value (HKLM\\SOFTWARE\\Cloudflare\\CloudflareWARP\\UseWebView2 = y) is once again honored by the new GUI for authentication, so administrators who prefer the embedded WebView2 browser for sign-in can opt back in. This setting was effectively ignored in the previous release; the default browser was always used. This key is now also honored for re-authentications. - Fixed a crash in the authentication browser when navigating to a site that prompts for browser permissions (microphone, camera, notifications, etc.). The same fix had previously landed for the captive-portal browser; this extends it to the auth browser. - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai\_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. **Known issues** - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. ## 2026-05-26 **Cloudflare One Client for macOS (version 2026.4.1390.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Fixed a proxy mode connection stall issue. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-26 **Cloudflare One Client for Windows (version 2026.4.1390.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Fixed a proxy mode connection stall issue. **Known issues** - Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. ## 2026-05-26 **Cloudflare One Client for Linux (version 2026.4.1390.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. - Fixed a proxy mode connection stall issue. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-11 **Cloudflare One Client for Windows (version 2026.4.1350.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Windows! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. **Known issues** - Registration authentication for devices via the integrated WebView2 browser is unavailable in this version as a temporary measure. As a result, the client will utilize the default browser on the device to complete the authentication process. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of Split Tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. - Windows ARM may prompt the user to close running applications while trying to install this version. Simply click “Ok” with the default highlighted option. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, please reconnect the client by selecting "disconnect" and then "connect" in the client user interface. ## 2026-05-11 **Cloudflare One Client for macOS (version 2026.4.1350.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for macOS! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Additional Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-05-11 **Cloudflare One Client for Linux (version 2026.4.1350.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release introduces the new Cloudflare One Client UI for Linux! You can expect a cleaner and more intuitive design as well as easier access to common actions and information. Here are some of the many things we have found our users appreciate: - Right click context menu to access the most common client actions quickly - Built-in captive portal login experience **Changes and improvements** - Added a new CLI command: warp-cli mdm refresh. This command executes an immediate refresh of the Mobile Device Management (MDM) configuration file. - Official support for RHEL 9 has been added for Cloudflare Mesh nodes. To install the RHEL 9 package, the Extra Packages for Enterprise Linux (EPEL) repository must be active, as it contains dependencies required for the tray icon and captive portal webview. **Known issues** - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. - Split tunnel list configuration is not available in the new UI. Management of split tunnel entries is currently only possible via `warp-cli tunnel ip` and `warp-cli tunnel host`. UI support will be added in a future release. ## 2026-04-07 **Cloudflare One Client for Windows (version 2026.3.851.0)** A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for Windows will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** - Fixed an issue causing Windows client tunnel interface initialization failure which prevented clients from establishing a tunnel for connection. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. - Fixed packet capture failing on tunnel interface when the tunnel interface is renamed by SCCM VPN boundary support. - Fixed unnecessary registration deletion caused by RDP connections in multi-user mode. - Fixed increased tunnel interface start-up time due to a race between duplicate address detection (DAD) and disabling NetBT. - Fixed tunnel failing to connect when the system DNS search list contains unexpected characters. - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. - Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. - Fixed an issue where degraded Windows Management Instrumentation (WMI) state could put the client in a failed connection state loop during initialization. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. This warning will be omitted from future release notes. This Windows update was released in July 2025. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. This warning will be omitted from future release notes. This Microsoft Security Intelligence update was released in May 2025. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. ## 2026-04-02 **Cloudflare One Client for macOS (version 2026.3.846.0)** A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for macOS will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. - Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. ## 2026-04-02 **Cloudflare One Client for Linux (version 2026.3.846.0)** A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for Linux will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. - Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. ## 2026-03-10 **WARP client for macOS (version 2026.3.566.1)** A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and introduces a brand new visual style for the client interface. The new Cloudflare One Client interface changes connectivity management from a toggle to a button and brings useful connectivity settings to the home screen. The redesign also introduces a collapsible navigation bar. When expanded, more client information can be accessed including connectivity, settings, and device profile information. If you have any feedback or questions, visit the [Cloudflare Community forum](https://community.cloudflare.com/t/introducing-the-new-cloudflare-one-client-interface/901362) and let us know. **Changes and improvements** - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed emergency disconnect state from a previous organization incorrectly persisting after switching organizations. - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm to Cubic for improved reliability across platforms. - Fixed initiating managed network detection checks when no network is available, which caused device profile flapping. **Known issues** - The client may become stuck in a `Connecting` state. To resolve this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Alternatively, change the client's operation mode. - The client may display an empty white screen upon the device waking from sleep. To resolve this issue, exit and then open the client to re-launch it. - Canceling login during a single MDM configuration setup results in an empty page with no way to resume authentication. To work around this issue, exit and relaunch the client. ## 2026-03-10 **WARP client for Windows (version 2026.3.566.1)** A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and introduces a brand new visual style for the client interface. The new Cloudflare One Client interface changes connectivity management from a toggle to a button and brings useful connectivity settings to the home screen. The redesign also introduces a collapsible navigation bar. When expanded, more client information can be accessed including connectivity, settings, and device profile information. If you have any feedback or questions, visit the [Cloudflare Community forum](https://community.cloudflare.com/t/introducing-the-new-cloudflare-one-client-interface/901362) and let us know. **Changes and improvements** - Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. - Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. - Added monitoring for tunnel statistics collection timeouts. - Switched tunnel congestion control algorithm to Cubic for improved reliability across platforms. - Fixed packet capture failing on tunnel interface when the tunnel interface is renamed by SCCM VPN boundary support. - Fixed unnecessary registration deletion caused by RDP connections in multi-user mode. - Fixed increased tunnel interface start-up time due to a race between duplicate address detection (DAD) and disabling NetBT. - Fixed tunnel failing to connect when the system DNS search list contains unexpected characters. - Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. - Fixed an issue in proxy mode where the client could become unresponsive due to upstream connection timeouts. - Fixed emergency disconnect state from a previous organization incorrectly persisting after switching organizations. - Fixed initiating managed network detection checks when no network is available, which caused device profile flapping. **Known issues** - The client may unexpectedly terminate during captive portal login. To work around this issue, use a web browser to authenticate with the captive portal and then re-launch the client. - An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. - The client may become stuck in a `Connecting` state. To resolve this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Alternatively, change the client's operation mode. - The client may display an empty white screen upon the device waking from sleep. To resolve this issue, exit and then open the client to re-launch it. - Canceling login during a single MDM configuration setup results in an empty page with no way to resume authentication. To work around this issue, exit and relaunch the client. - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. This warning will be omitted from future release notes. This Microsoft Security Intelligence update was released in May 2025. - DNS resolution may be broken when the following conditions are all true: - The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. ## 2026-02-24 **WARP client for Windows (version 2026.1.150.0)** A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features. **Changes and improvements** - Improvements to [multi-user mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/). Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost. - Added a new feature to [manage NetBIOS over TCP/IP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#netbios-over-tcpip) functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in [device profile settings](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for the Windows [client certificate posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) to ensure logged results are from checks that run once users log in. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. - Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. - Fixed an issue causing DNS requests to fail with clients in Traffic and DNS mode. - Improved service shutdown behavior in cases where the daemon is unresponsive. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2026-02-24 **WARP client for macOS (version 2026.1.150.0)** A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. **Changes and improvements** - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. - Fixed an issue with DNS server configuration failures that caused tunnel connection delays. - Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. - Fixed an issue causing DNS requests to fail with clients in Traffic and DNS mode. ## 2026-02-24 **WARP client for Linux (version 2026.1.150.0)** A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com). **Changes and improvements** - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. - Fixed an issue where misconfigured DEX HTTP tests prevented new registrations. - Fixed issues causing DNS requests to fail with clients in Traffic and DNS mode or DNS only mode. ## 2026-01-27 **WARP client for Windows (version 2026.1.89.1)** A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes, improvements, and new features. **Changes and improvements** - Improvements to [multi-user mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-multiuser/). Fixed an issue where when switching from a pre-login registration to a user registration, Mobile Device Management (MDM) configuration association could be lost. - Added a new feature to [manage NetBIOS over TCP/IP](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#netbios-over-tcpip) functionality on the Windows client. NetBIOS over TCP/IP on the Windows client is now disabled by default and can be enabled in [device profile settings](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles/). - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for the Windows [client certificate posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/client-certificate/) to ensure logged results are from checks that run once users log in. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2026-01-27 **WARP client for macOS (version 2026.1.89.1)** A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** - Fixed an issue causing failure of the [local network exclusion](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#allow-users-to-enable-local-network-exclusion) feature when configured with a timeout of `0`. - Improvement for more accurate reporting of device colocation information in the Cloudflare One dashboard. ## 2026-01-13 **WARP client for Windows (version 2025.10.186.0)** A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features. New features include the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect), and a new WARP client device posture check for [Antivirus](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/antivirus/). **Changes and improvements** - Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint. - Fixed an issue that caused occasional audio degradation and increased CPU usage on Windows by optimizing route configurations for large [domain-based split tunnel rules](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#domain-based-split-tunnels). - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Fixed an issue where sending large messages to the daemon by Inter-Process Communication (IPC) could cause the daemon to fail and result in service interruptions. - Added support for a new WARP client device posture check for [Antivirus](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/antivirus/). The check confirms the presence of an antivirus program on a Windows device with the option to check if the antivirus is up to date. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2026-01-13 **WARP client for macOS (version 2025.10.186.0)** A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features, including the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint. ## 2026-01-13 **WARP client for Linux (version 2025.10.186.0)** A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features, including the ability to manage WARP client connectivity for all devices in your fleet using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com). **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - Linux [disk encryption posture check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/disk-encryption/) now supports non-filesystem encryption types like `dm-crypt`. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Fixed an issue where the GUI becomes unresponsive when the **Re-Authenticate in browser** button is clicked. - Added a new feature to manage WARP client connectivity for all devices using an [external signal](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/emergency-disconnect/#set-up-external-emergency-disconnect). This feature allows administrators to send a global signal from an on-premises HTTPS endpoint that force disconnects or reconnects all WARP clients in an account based on configuration set on the endpoint. ## 2025-12-09 **WARP client for Windows (version 2025.10.118.1)** A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. - Fixed an issue where sending large messages to the WARP daemon by Inter-Process Communication (IPC) could cause WARP to crash and result in service interruptions. **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2025-12-09 **WARP client for macOS (version 2025.10.118.1)** A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and improvements. **Changes and improvements** - The [Local Domain Fallback](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) feature has been fixed for devices running WARP client version 2025.4.929.0 and newer. Previously, these devices could experience failures with Local Domain Fallback unless a fallback server was explicitly configured. This configuration is no longer a requirement for the feature to function correctly. - [Proxy mode](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) now supports transparent HTTP proxying in addition to CONNECT-based proxying. ## 2025-11-11 **WARP client for Windows (version 2025.9.558.0)** A new GA release for the Windows WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues. **Changes and improvements** - Fixed an inconsistency with [Global WARP override](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#disconnect-warp-on-all-devices) settings in multi-user environments when switching between users. - The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues. - Fixed an issue where deleting a registration was erroneously reported as having failed. - Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). - Improvements for the [OS version](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/warp-client-checks/os-version/) WARP client check. Windows Updated Build Revision (UBR) numbers can now be checked by the client to ensure devices have required security patches and features installed. - The WARP client now supports Windows 11 ARM-based machines. For information on known limitations, refer to the [Known limitations page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#cloudflare-one-client-disconnected-on-windows-arm). **Known issues** - For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. - Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server). - Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. - DNS resolution may be broken when the following conditions are all true: - WARP is in Secure Web Gateway without DNS filtering (tunnel-only) mode. - A custom DNS server address is configured on the primary network adapter. - The custom DNS server address on the primary network adapter is changed while WARP is connected. To work around this issue, reconnect the WARP client by toggling off and back on. ## 2025-11-11 **WARP client for macOS (version 2025.9.558.0)** A new GA release for the macOS WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues. **Changes and improvements** - The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues. - Fixed an issue where deleting a registration was erroneously reported as having failed. - Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). **Known issues** - Devices using WARP client 2025.4.929.0 and up may experience Local Domain Fallback failures if a fallback server has not been configured. To configure a fallback server, refer to [Route traffic to fallback server](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/cloudflare-one-client/configure/route-traffic/local-domains/#route-traffic-to-fallback-server). ## 2025-11-11 **WARP client for Linux (version 2025.9.558.0)** A new GA release for the Linux WARP client is now available on the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes, improvements, and new features including [Path Maximum Transmission Unit Discovery (PMTUD)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). When PMTUD is enabled, the client will dynamically adjust packet sizing to optimize connection performance. There is also a new connection status message in the GUI to inform users that the local network connection may be unstable. This will make it easier to diagnose connectivity issues. WARP client version 2025.8.779.0 introduced an updated public key for Linux packages. The public key must be updated if it was installed before September 12, 2025 to ensure the repository remains functional after December 4, 2025. Instructions to make this update are available at [pkg.cloudflareclient.com](https://pkg.cloudflareclient.com/). **Changes and improvements** - The GUI now displays the health of the tunnel and DNS connections by showing a connection status message when the network may be unstable. This will make it easier to diagnose connectivity issues. - Fixed an issue where deleting a registration was erroneously reported as having failed. - Path Maximum Transmission Unit Discovery (PMTUD) may now be used to discover the effective MTU of the connection. This allows the WARP client to improve connectivity optimized for each network. PMTUD is disabled by default. To enable it, refer to the [PMTUD documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/path-mtu-discovery/#enable-path-mtu-discovery). ## 2025-08-29 **Cloudflare One WARP Diagnostic AI Analyzer** We're excited to share a new AI feature, the [WARP diagnostic analyzer ↗︎](https://blog.cloudflare.com/ai-troubleshoot-warp-and-network-connectivity-issues/), to help you troubleshoot and resolve WARP connectivity issues faster. This beta feature is now available in the [Cloudflare One dashboard ↗︎](https://dash.cloudflare.com/one/) to all users. The AI analyzer makes it easier for you to identify the root cause of client connectivity issues by parsing [remote captures](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/#start-a-remote-capture) of [WARP diagnostic logs](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#warp-diag-logs). The WARP diagnostic analyzer provides a summary of impact that may be experienced on the device, lists notable events that may contribute to performance issues, and recommended troubleshooting steps and articles to help you resolve these issues. Refer to [WARP diagnostics analyzer (beta)](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/#diagnostics-analyzer-beta) to learn more about how to maximize using the WARP diagnostic analyzer to troubleshoot the WARP client. ## 2025-06-30 **Cloudflare One Agent for Android (version 2.4.2)** A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store ↗︎](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release contains improvements and new exciting features, including [post-quantum cryptography](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate [protection of post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) without needing to upgrade any of your individual corporate applications or systems. **Changes and improvements** - QLogs are now disabled by default and can be enabled in the app by turning on **Enable qlogs** under **Settings** > **Advanced** > **Diagnostics** > **Debug Logs**. The QLog setting from previous releases will no longer be respected. - DNS over HTTPS traffic is now included in the WARP tunnel by default. - The WARP client now applies [post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). - Fixed an issue that caused WARP connection failures on ChromeOS devices. ## 2025-06-30 **Cloudflare One Agent for iOS (version 1.11)** A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store ↗︎](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release contains improvements and new exciting features, including [post-quantum cryptography](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). By tunneling your corporate network traffic over Cloudflare, you can now gain the immediate [protection of post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) without needing to upgrade any of your individual corporate applications or systems. **Changes and improvements** - QLogs are now disabled by default and can be enabled in the app by turning on **Enable qlogs** under **Settings** > **Advanced** > **Diagnostics** > **Debug Logs**. The QLog setting from previous releases will no longer be respected. - DNS over HTTPS traffic is now included in the WARP tunnel by default. - The WARP client now applies [post-quantum cryptography ↗︎](https://blog.cloudflare.com/pq-2024/) end-to-end on enabled devices accessing resources behind a Cloudflare Tunnel. This feature can be enabled by [MDM](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#enable_post_quantum). ## 2025-03-17 **Cloudflare One Agent for Android (version 2.4)** A new GA release for the Android Cloudflare One Agent is now available in the [Google Play Store ↗︎](https://play.google.com/store/apps/details?id=com.cloudflare.cloudflareoneagent). This release includes a new feature allowing [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. **Changes and improvements** - Improved in-app error messages. - Improved mobile client login with support for [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url). - Fixed an issue preventing admin split tunnel settings taking priority for traffic from certain applications. ## 2025-03-17 **Cloudflare One Agent for iOS (version 1.10)** A new GA release for the iOS Cloudflare One Agent is now available in the [iOS App Store ↗︎](https://apps.apple.com/us/app/cloudflare-one-agent/id6443476492). This release includes a new feature allowing [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url) during enrollment, as well as fixes and minor improvements. **Changes and improvements** - Improved in-app error messages. - Improved mobile client login with support for [team name insertion by URL](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/manual-deployment/#enroll-using-a-url). - Bug fixes and performance improvements. ## 2024-06-16 **Explore product updates for Cloudflare One** Welcome to your new home for product updates on [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/). Our [new changelog](https://developers.cloudflare.com/changelog/) lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs. If you are looking for older product updates, refer to the following locations.
Older product updates - Access - Browser Isolation - CASB - Cloudflare Tunnel - Data Loss Prevention - Digital Experience Monitoring - Email security - Gateway - Multi-Cloud Networking - Cloudflare Network Firewall - Magic Network Monitoring - Magic Transit - Magic WAN - Network Interconnect - Risk score - Cloudflare One Client
Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-one-client/#page","headline":"Cloudflare One Client","description":"Review recent changes to the Cloudflare One Client.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-one-client/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/cloudflare-one-client/og.png?v=ac442acb788a02de","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare Tunnel. title: Cloudflare Tunnel image: https://developers.cloudflare.com/cloudflare-one/changelog/tunnel/og.png?v=cd1ba19f8454ac06 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare Tunnel Last updated Sep 16, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/tunnel/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/tunnel.xml) ## 2026-10-16 **50,000 routes per account and Tunnels for Platforms** Two changes make it easier to run Cloudflare Tunnel at scale. #### 50,000 routes per account by default The default limit for [routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) is now 50,000 per account, up from 1,000. This limit covers [CIDR routes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/) and [hostname routes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) for [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/). The new limit applies to every account automatically, with no action required. Published applications (public hostnames) are not routes and are not affected by this limit. Each tunnel supports roughly 5,000–10,000 published applications, depending on the size of its configuration. For details, refer to [Published application limits](https://developers.cloudflare.com/tunnel/concepts/routing/#published-application-limits). #### Tunnels for Platforms Every account includes 1,000 tunnels. With [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/), you can now run more than 1,000 tunnels in a single account — for example, one tunnel per device, per end customer, or per development environment. ![Buy additional tunnels from the Tunnels page in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1512,height=802,format=webp/_astro/tunnels-for-platforms.DuPYMNzo.gif) To buy additional tunnels, go to **Networking** > **Tunnels** and select **Buy more tunnels** in the **Usage** card. Additional tunnels are billed at $4.50 per tunnel per month. Enterprise customers can contact their account team for committed or usage-based pricing. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) For pricing, limits, and best practices for managing large tunnel fleets, refer to [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/). ## 2026-10-02 **Protect Quick Tunnels with email authentication** You can now restrict who can access a [Quick Tunnel](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/). Use the new `--allowed-mail` flag in `cloudflared` to require visitors to authenticate with a one-time PIN sent to their email before they reach your local service. ```sh cloudflared tunnel --url http://localhost:8080 --allowed-mail alice@example.com ``` ![Protected Quick Tunnel demo](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1512,height=854,format=webp/_astro/protected-quick-tunnels.DlA306r_.gif) Previously, anyone with a `trycloudflare.com` URL could access the service behind it. Protected Quick Tunnels let you share a local development server, webhook receiver, or demo with specific people without creating a Cloudflare account or configuring a domain. You can allow: - A single email address: `--allowed-mail alice@example.com` - Multiple email addresses, by repeating the flag or using a comma-separated list: `--allowed-mail 'alice@example.com,bob@example.com'` - Every address on a domain: `--allowed-mail '*@example.com'` Visitors do not need a Cloudflare account. Access ends for everyone when you stop the `cloudflared` process. To get started, [update `cloudflared`](https://developers.cloudflare.com/tunnel/downloads/) to the latest version and refer to [Restrict access by email](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/#restrict-access-by-email). ## 2026-09-29 **Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs** You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and `cloudflared` replica received each session. [Gateway network logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#network-logs) and [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) now identify two new kinds of traffic: - **Mesh** — Traffic sent from or delivered to a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) node. Previously, Mesh nodes were logged the same way as devices running the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/), because Mesh nodes run the client in headless mode. - **Workers VPC** — Traffic sent by a Worker through a [Workers VPC](https://developers.cloudflare.com/workers-vpc/) binding. Previously, Workers VPC sessions were not recorded in Network Session Logs. ![Viewing Mesh and Workers VPC traffic in Gateway network logs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1439,height=796,format=webp/_astro/2026-09-28-mesh-workers-vpc-network-logs.iGvLKYk7.gif) #### Gateway network logs To view these values in the dashboard, go to **Zero Trust** > **Insights & Logs** > **Logs** > **Network logs**, select **Columns**, and turn on **Traffic Source** and **Traffic Destination**. Both values also appear under **Network query details** when you open a log entry. #### Network Session Logs The `zero_trust_network_sessions` dataset, available through [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/), includes the following fields: | Field | Description | | --- | --- | | `OnrampType` | How the session entered Cloudflare One. Values: `CF1_CLIENT`, `MESH`, `WORKERS_VPC`, `MAGIC`, `OTHER`. | | `Offramp` | Where the session was routed. Sessions routed to a Mesh node report `MESH`. | | `SourceName` | Name of the Worker that started the session. Only populated for Workers VPC sessions. | | `SourceID` | Stable identifier of the Worker that started the session. Only populated for Workers VPC sessions. | | `DestinationReplicaID` | The replica that served the session, such as a specific replica of a Mesh node or a `cloudflared` replica of a Cloudflare Tunnel. | For example, `OnrampType = 'WORKERS_VPC' AND Offramp = 'MESH'` returns every session where a Worker reached a service behind a Mesh node, and `SourceName` tells you which Worker it was. Redeploy your Workers `SourceName` and `SourceID` are only populated for Workers deployed after 29 September 2026. To include them for an existing Worker, redeploy it — for example, with `npx wrangler deploy`. No code changes are required. #### See which tunnel and replica received a session With `DestinationReplicaID`, you can now confirm which [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and which `cloudflared` replica received traffic for a specific session. Combine it with the existing `DestinationTunnelID` field to trace a session to an exact tunnel replica — or Mesh node replica — when you run multiple replicas for high availability. The replica ID matches the **Connector ID** shown in the dashboard, so you can [stream that replica's logs](https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming) with `cloudflared tail --connector-id`. Sessions logged before this change are not backfilled. For all available fields, refer to [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/). ## 2026-09-18 **cloudflared to deprecate 32-bit Windows and Intel-based macOS builds in 2027** Starting in 2027, Cloudflare will deprecate 32-bit Windows and Intel-based macOS builds of `cloudflared`. After the deprecation takes effect, Cloudflare will no longer publish new `cloudflared` releases for either architecture. Windows 10, the last Windows release to support 32-bit systems, reached end of support in October 2025. Apple has also deprecated Intel-based Mac computers. macOS 26 Tahoe, released in September 2025, was the final macOS release to support Intel-based Macs. macOS 27, released in September 2026, no longer supports them. Focusing development on currently supported architectures allows `cloudflared` to align with operating system support and continue receiving updates on supported platforms. For available downloads and supported platforms, refer to the [Cloudflare Tunnel downloads](https://developers.cloudflare.com/tunnel/downloads/) documentation. ## 2026-09-02 **Create multiple Cloudflare Tunnel and Cloudflare Mesh routes at once** You can now create multiple [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) routes from the Routes page in a single action, instead of submitting one route at a time. ![Creating multiple Cloudflare Tunnel and Cloudflare Mesh routes at once from the Routes page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1034,format=webp/_astro/2026-09-01-tunnel-mesh-bulk.zu4fOWN3.gif) When creating a route, you can now: - **Add multiple destinations at once** — Enter a comma-separated list of CIDR ranges or hostnames to create several routes of the same type and connector together. - **Queue up multiple routes** — Select **Add another** to stage additional routes, including different types or connectors, before creating them all in one action. - **Retry only what failed** — If some routes in a batch fail (for example, an invalid CIDR), the routes that were created successfully are removed from the form automatically, so you only need to fix and resubmit the ones that failed. The same Routes UI already supports bulk creation for [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) static routes, so you can add multiple WAN destinations or queue up several WAN routes before creating them together as well. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) For setup steps, refer to [Add routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/). ## 2026-08-18 **Configure origin application settings for Cloudflare Tunnel in the dashboard** You can now configure origin application settings directly in the Cloudflare dashboard when adding or editing a published application route for a [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/). These settings control how `cloudflared` connects to your origin server and were previously only available in the Cloudflare One dashboard or via local configuration files. ![Configure origin application settings in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/tunnel-origin-settings-dashboard.CsC2RwFC.gif) When editing a published application, expand **Additional application settings** to configure parameters organized into three categories: - **HTTP** — Set a custom HTTP Host header or disable chunked encoding. - **TLS** — Configure origin server name, CA pool, TLS timeout, disable TLS verification, match SNI to host, or enable HTTP/2 to origin. - **Connection** — Tune connect timeout, keep-alive timeout, keep-alive connections, TCP keep-alive interval, proxy type, or disable Happy Eyeballs. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) For the full list of origin parameters, refer to [Origin parameters](https://developers.cloudflare.com/tunnel/reference/origin-parameters/). ## 2026-08-11 **Hostname routing is now generally available, with a new public IP range for initial resolved IPs** [Hostname routing ↗︎](https://blog.cloudflare.com/tunnel-hostname-routing/) is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: - **Cloudflare Tunnel**: route a [private hostname](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) (for example, `wiki.internal.local`) to a private application behind your tunnel, or a [public hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) (for example, `bank.example.com`) to egress through a specific tunnel and anchor traffic to a dedicated exit node. - **Cloudflare Mesh**: attract a [private or public hostname's traffic](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) to a Mesh node. Alongside GA, the default IPv4 range used for initial resolved IPs (also called token IPs) is changing from a Carrier-Grade NAT (CGNAT) range to a public Cloudflare-owned range: - **IPv4**: `172.64.128.0/20` - **IPv6**: `2606:4700:0cf1:4000::/64` This is the default range. You can [configure a custom initial resolved IP range](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/) for IPv4 if it conflicts with your existing network. **Why this is changing:** Starting with [Chrome 142 ↗︎](https://developer.chrome.com/release-notes/142), Local Network Access (LNA) restrictions block background requests to CGNAT addresses (`100.64.0.0/10`), which included the previous initial resolved IP default (`100.80.0.0/16`). LNA is implemented at the Chromium engine level, so it affects all Chromium-based browsers (for example, Microsoft Edge, Brave, and Opera), not only Google Chrome. This could silently break hostname-based Gateway features for users of these browsers, and required Chrome Enterprise policy workarounds. The new default range is public Cloudflare address space, so it is not affected by this restriction. **What is affected:** Initial resolved IPs are used by several features that associate a DNS query with the network connection that follows it: - [Private](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) and [public](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) hostname routing for Cloudflare Tunnel - [Hostname routes](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) for Cloudflare Mesh - [Access private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) on non-HTTPS ports - [Egress policy host selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/host-selectors/) (Domain, Host, Application, and Content Categories) You can check your account's current range, or configure a custom range, at any time from **Networking** > **IP addresses** > **Address space** > **Custom IPs**, or using the [Initial Resolved IP Subnet API](). [Go to **Custom IPs** ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space/custom-ips) For full instructions, refer to [Configure initial resolved IPs](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/). The IPv6 range (`2606:4700:0cf1:4000::/64`) is unchanged and is not affected by this restriction. The default IPv4 range, and all Cloudflare One IPv6 ranges, are automatically routed through the Cloudflare One Client and do not require any Split Tunnel configuration. Refer to [Automatically managed ranges](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) for details. If you were relying on a Chrome Enterprise policy workaround (such as `LocalNetworkAccessRestrictionsTemporaryOptOut`) while your account was still on the legacy CGNAT-based range, refer to [Google Chrome restricts access to private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#google-chrome-restricts-access-to-private-hostnames) for next steps. ## 2026-08-10 **Stream live logs from Cloudflare Tunnel in the dashboard** Real-time Tunnel log streaming is now available in the Cloudflare dashboard under **Networking** > **Tunnels**. This brings the same live debugging capability previously only available in the Cloudflare One dashboard, including multi-connector aggregated streaming for high-availability deployments. ![Stream live logs from a tunnel in the Cloudflare dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/tunnel-live-logs-core-dashboard.Dtm7Jg51.gif) In the tunnel detail view, a new **Live logs** tab lets you: - **Stream logs from single or multiple connectors** — In [highly available](https://developers.cloudflare.com/tunnel/configuration/#replicas-and-high-availability) deployments with multiple `cloudflared` replicas, logs from all connectors are merged into a single stream grouped by hostname, making it easy to identify which host machine produced each log entry. - **Filter by log level, event type, and HTTP method** — Narrow the stream to only the events you care about (HTTP, TCP, UDP, or `cloudflared` internal), at any log level. [Go to **Tunnels** ↗](https://dash.cloudflare.com/?to=/:account/tunnels) For more information, refer to [Tunnel observability](https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming) and [Tunnel log streams](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/). ## 2026-07-09 **Zero Trust Networks route endpoints and Cloudflare Tunnel connections field retiring on October 5, 2026** On **October 5, 2026**, two changes take effect across the [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/) and [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/): the CIDR-encoded route endpoints are removed, and tunnel list and get responses no longer include the `connections` field. If you manage private network routes or read tunnel connection details through the API, `cloudflared`, Terraform, or another integration, review the changes in the following sections and migrate before the removal date. #### Route endpoints The CIDR-encoded route endpoints are deprecated in favor of the standard, `route_id`-based endpoints that already exist today. Both sets of endpoints route a private network through [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) or [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) (the API still refers to Mesh nodes as `warp_connector`) — only the request shape changes. **Deprecated endpoints (removed October 5, 2026):** - Create a tunnel route (CIDR Endpoint): [`POST /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/subresources/networks/methods/create/) - Update a tunnel route (CIDR Endpoint): [`PATCH /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/subresources/networks/methods/edit/) - Delete a tunnel route (CIDR Endpoint): [`DELETE /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/subresources/networks/methods/delete/) **Replacement endpoints:** - Create a tunnel route: [`POST /accounts/{account_id}/teamnet/routes`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/create/) - Update a tunnel route: [`PATCH /accounts/{account_id}/teamnet/routes/{route_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/edit/) - Delete a tunnel route: [`DELETE /accounts/{account_id}/teamnet/routes/{route_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/delete/) #### What is changing | | Deprecated (CIDR-encoded path) | Replacement | | --- | --- | --- | | Route identifier | URL-encoded CIDR in the path (`/network/{ip_network_encoded}`) | `route_id` in the path (`network` moves to the request body on create) | | Create | `POST .../teamnet/routes/network/{ip_network_encoded}` | `POST .../teamnet/routes` with `network` and `tunnel_id` in the body | | Update | `PATCH .../teamnet/routes/network/{ip_network_encoded}` | `PATCH .../teamnet/routes/{route_id}` | | Delete | `DELETE .../teamnet/routes/network/{ip_network_encoded}` | `DELETE .../teamnet/routes/{route_id}` | #### Action required 1. Capture each route's `route_id` by calling [List tunnel routes](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/list/), or read it from the response the first time you create a route with the replacement endpoint. 2. Update any scripts, backend services, or CI/CD pipelines that call the CIDR-encoded endpoints directly. 3. If you manage routes with the `cloudflared tunnel route ip add | delete` commands, upgrade `cloudflared` to the [latest version ↗︎](https://github.com/cloudflare/cloudflared/releases). 4. If you manage routes with Terraform, make sure you are on a current version of the [`cloudflare_zero_trust_tunnel_cloudflared_route` ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_tunnel_cloudflared_route) resource and the [Cloudflare Terraform provider ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs). ```bash # Before: create a route by URL-encoding the CIDR into the path curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/network/172.16.0.0%2F16 \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{"tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}' # After: create a route with the network in the request body curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{"network": "172.16.0.0/16", "tunnel_id": "'$TUNNEL_ID'", "comment": "Example comment for this route."}' # After: update or delete a route using its route_id curl -X PATCH https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \ -d '{"comment": "Updated comment for this route."}' curl -X DELETE https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/routes/$ROUTE_ID \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` #### Cloudflare Tunnel and Cloudflare Mesh connections Starting the same day, the `connections` array is removed from list and get responses for [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes (the `cfd_tunnel` and `warp_connector` API resources). Query the dedicated connections endpoint instead of reading the field off the tunnel or node object. This affects: - [`GET /accounts/{account_id}/cfd_tunnel`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/list/) — `connections` removed from each item in `result` - [`GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/get/) — `connections` removed from `result` - [`GET /accounts/{account_id}/warp_connector`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/list/) — `connections` removed from each item in `result` - [`GET /accounts/{account_id}/warp_connector/{tunnel_id}`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/get/) — `connections` removed from `result` #### Action required Fetch connection details from the tunnel-specific connections endpoint instead of parsing it off the list or get response. For Cloudflare Tunnel, call [`GET /accounts/{account_id}/cfd_tunnel/{tunnel_id}/connections`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/subresources/connections/methods/get/). For Cloudflare Mesh, call [`GET /accounts/{account_id}/warp_connector/{tunnel_id}/connections`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/subresources/connections/methods/get/). ```bash # Before: read connections off the tunnel object curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" # After: query connections directly curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cfd_tunnel/$TUNNEL_ID/connections \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` Update any dashboards, monitoring scripts, or automation that parses `connections` from the tunnel list or get response. `cloudflared` and the Cloudflare Terraform provider do not read this field, so no changes are required on their side for this part of the update. #### Why we are making these changes - **Smaller, faster responses.** Cloudflare Tunnel and Cloudflare Mesh nodes with many connections no longer inflate every list and get call — connection detail is only fetched when you need it. - **A single way to identify a route.** Consolidating on `route_id` removes the need to URL-encode CIDR ranges into the path and matches how every other resource in the Zero Trust Networks API is addressed. - **Consistency across the API.** Both changes align these endpoints with Cloudflare's standard REST conventions for resource identifiers and nested detail endpoints. To learn more, refer to the [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/), the [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/), and [Routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) documentation. ## 2026-06-19 **Manage all your routes from one page in the dashboard** The **Routes** page in the Cloudflare dashboard now shows the routes across all of your connectors — [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) and [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) routes alongside [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/) and [Magic Transit](https://developers.cloudflare.com/magic-transit/) static routes — in a single table, instead of a separate routes view per product. ![The unified Routes page in the Cloudflare dashboard, showing routes across connectors in a single table](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=948,format=webp/_astro/2026-06-19-unified-routes.B3igBY20.gif) From the unified Routes page you can: - **Visualize your network with an interactive map** that shows how your destinations flow through to your connectors — including equal-cost multi-path (ECMP) routes where the same prefix is served by several connectors. Select a node to filter the table down to the routes behind it. - **See every route in one table**, with its destination, type, connector, priority, and source, and filter or sort to find what you need. - **Create, edit, and delete routes** of any supported type without leaving the page. When adding a Cloudflare WAN or Magic Transit static route, you now pick the next hop by **connector name** instead of typing its IP. - **Manage [virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/virtual-networks/)** from a dedicated tab. - **Test a route** to see which connector and next hop a destination resolves to before you commit a change. To find it, go to **Networking** > **Routes** in the dashboard sidebar. [Go to **Routes** ↗](https://dash.cloudflare.com/?to=/:account/magic-networks/routes) Your existing routes, APIs, and configurations are unchanged — this is a dashboard experience that brings them together in one place. Learn how to [add routes](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/) and [manage virtual networks](https://developers.cloudflare.com/cloudflare-one/networks/virtual-networks/). ## 2026-05-27 **Cloudflare Tunnel now runs connectivity pre-checks at startup** Starting with [`cloudflared` version 2026.5.2 ↗︎](https://github.com/cloudflare/cloudflared/releases), [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) automates the entire [connectivity pre-checks workflow](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/) directly inside the binary. Previously, customers had to install `dig` and `netcat` and run those commands by hand to verify their environment. Now `cloudflared` does it natively at startup — and surfaces actionable remediation when something is blocked. ![cloudflared connectivity pre-checks output](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1012,format=webp/_astro/cloudflared-connectivity-prechecks.DRwN6tGe.gif) On every `cloudflared tunnel run` (and `cloudflared tunnel diag`), the binary now natively checks: - **DNS resolution** — `region1.v2.argotunnel.com` and `region2.v2.argotunnel.com` resolve to valid Cloudflare IPs. - **Transport connectivity** — outbound `UDP (QUIC)` and `TCP (HTTP/2)` on port `7844`. - **Management API** — outbound `TCP/443` to `api.cloudflare.com` for software updates. Results are printed in a scannable CLI table with three states: - ✅ **Pass** — the check succeeded. - ⚠️ **Warn** — a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel will still come up. - ❌ **Fail** — a blocking issue, with a specific remediation hint (for example, `Allow outbound UDP on port 7844`). If DNS is unresolvable, or **both** UDP and TCP fail on port 7844, `cloudflared` exits early with the failure rather than looping on opaque `failed to dial` errors. Pre-checks now run automatically on every start, which also catches regressions like overnight firewall policy changes — no need to remember to rerun the troubleshooting guide. To get the new behavior, upgrade `cloudflared` to version `2026.5.2` or later. For more details, refer to the [Connectivity pre-checks documentation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/connectivity-prechecks/). ## 2026-05-21 **Granular permissions for Cloudflare Tunnel and Cloudflare Mesh** You can now scope Cloudflare permissions to individual [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) instances and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes. Administrators can delegate access to specific Tunnels or Mesh nodes without granting account-wide control over private networking. #### What is new When you [add a member](https://developers.cloudflare.com/fundamentals/manage-members/manage/) or create a [permission policy](https://developers.cloudflare.com/fundamentals/manage-members/policies/), the resource picker now lists [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) instances and [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) nodes as scopable resource types. You can: - Grant a read-only role on a single Cloudflare Tunnel instance to a support operator for log streaming and diagnostics — without exposing other Tunnels or destructive actions. - Grant a write role on a specific Cloudflare Mesh node to an application team — without giving them access to the rest of your private network. - Scope a single policy to one or many Tunnels and Mesh nodes at once. #### How it works Granular permissions are a parallel layer to existing account-level roles — they do not replace them. - **Existing account-level roles continue to work.** A member with `Cloudflare Access` or `Cloudflare Zero Trust` retains write access to every Tunnel and Mesh node in the account. This ensures backward compatibility for existing automation and tokens. - **Granular permissions are additive.** For any API request on a specific Tunnel or Mesh node, access is granted if the principal has **either** the account-level role **or** a granular permission for that resource. - **Resource enumeration is authorization-aware.** Listing endpoints ( `GET /accounts/{id}/cfd_tunnel`, `GET /accounts/{id}/warp_connector`) return only the resources the principal has at least read access to. #### Get started - Configure [granular permissions for Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/guides/granular-permissions/). - Configure [granular permissions for Cloudflare Tunnel and Cloudflare Mesh in Cloudflare One](https://developers.cloudflare.com/cloudflare-one/networks/connectors/granular-permissions/). - Review the [resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles) on the Cloudflare role reference. ## 2026-03-20 **Stream logs from multiple replicas of Cloudflare Tunnel simultaneously** In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all [replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) of that tunnel and supports streaming logs from multiple replicas at once. ![View replicas and stream logs from multiple connectors](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1040,format=webp/_astro/tunnel-multiconn.DEOEaLlu.gif) Previously, you could only stream logs from one replica at a time. With this update: - **Replicas on the tunnel overview** — All active replicas for the selected tunnel now appear on that tunnel's overview page under **Connectors**. Select any replica to stream its logs. - **Multi-connector log streaming** — Stream logs from multiple replicas simultaneously, making it easier to correlate events across your infrastructure during debugging or incident response. To try it out, log in to [Cloudflare One ↗︎](https://one.dash.cloudflare.com/) and go to **Networks** > **Connectors** > **Cloudflare Tunnels**. Select **View logs** next to the tunnel you want to monitor. For more information, refer to [Tunnel log streams](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) and [Deploy replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas/). ## 2026-03-19 **Manage Cloudflare Tunnels with Wrangler** You can now manage [Cloudflare Tunnels](https://developers.cloudflare.com/tunnel/) directly from [Wrangler](https://developers.cloudflare.com/workers/wrangler/), the CLI for the Cloudflare Developer Platform. The new [`wrangler tunnel`](https://developers.cloudflare.com/workers/wrangler/commands/tunnel/) commands let you create, run, and manage tunnels without leaving your terminal. ![Wrangler tunnel commands demo](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=1094,format=webp/_astro/wrangler-tunnel.DOqrtGGg.gif) Available commands: - `wrangler tunnel create` — Create a new remotely managed tunnel. - `wrangler tunnel list` — List all tunnels in your account. - `wrangler tunnel info` — Display details about a specific tunnel. - `wrangler tunnel delete` — Delete a tunnel. - `wrangler tunnel run` — Run a tunnel using the cloudflared daemon. - `wrangler tunnel quick-start` — Start a free, temporary tunnel without an account using [Quick Tunnels](https://developers.cloudflare.com/tunnel/get-started/quick-tunnels/). Wrangler handles downloading and managing the [cloudflared](https://developers.cloudflare.com/tunnel/downloads/) binary automatically. On first use, you will be prompted to download `cloudflared` to a local cache directory. These commands are currently experimental and may change without notice. To get started, refer to the [Wrangler tunnel commands documentation](https://developers.cloudflare.com/workers/wrangler/commands/tunnel/). ## 2026-02-20 **Manage Cloudflare Tunnel directly from the main Cloudflare Dashboard** [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) is now available in the main Cloudflare Dashboard at [Networking > Tunnels ↗︎](https://dash.cloudflare.com/?to=/:account/tunnels), bringing first-class Tunnel management to developers using Tunnel for securing origin servers. ![Manage Tunnels in the Core Dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=894,format=webp/_astro/tunnel-core-dashboard.BGPqaHfo.gif) This new experience provides everything you need to manage Tunnels for [public applications](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), including: - **Full Tunnel lifecycle management**: Create, configure, delete, and monitor all your Tunnels in one place. - **Native integrations**: View Tunnels by name when configuring [DNS records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/) and [Workers VPC](https://developers.cloudflare.com/workers-vpc/) — no more copy-pasting UUIDs. - **Real-time visibility**: Monitor [replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) and Tunnel [health status](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/#tunnel-status) directly in the dashboard. - **Routing map**: Manage all ingress routes for your Tunnel, including [public applications](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/), [private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/), [private CIDRs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/), and [Workers VPC services](https://developers.cloudflare.com/workers-vpc/), from a single interactive interface. #### Choose the right dashboard for your use case **Core Dashboard**: Navigate to [Networking > Tunnels ↗︎](https://dash.cloudflare.com/?to=/:account/tunnels) to manage Tunnels for: - Securing origin servers and [public applications](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) with CDN, WAF, Load Balancing, and DDoS protection - Connecting [Workers to private services](https://developers.cloudflare.com/workers-vpc/) via Workers VPC **Cloudflare One Dashboard**: Navigate to [Zero Trust > Networks > Connectors ↗︎](https://one.dash.cloudflare.com/?to=/:account/networks/connectors) to manage Tunnels for: - Securing your public applications with [Zero Trust access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) - Connecting users to [private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) - Building a [private mesh network](https://developers.cloudflare.com/reference-architecture/architectures/sase/#connecting-networks) Both dashboards provide complete Tunnel management capabilities — choose based on your primary workflow. #### Get started New to Tunnel? Learn how to [get started with Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) or explore advanced use cases like [securing SSH servers](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/) or [running Tunnels in Kubernetes](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/). ## 2026-01-15 **Verify WARP Connector connectivity with a simple ping** We have made it easier to validate connectivity when deploying [WARP Connector](https://developers.cloudflare.com/mesh/) as part of your [software-defined private network](https://developers.cloudflare.com/reference-architecture/architectures/sase/#connecting-networks). You can now `ping` the WARP Connector host directly on its LAN IP address immediately after installation. This provides a fast, familiar way to confirm that the Connector is online and reachable within your network before testing access to downstream services. Starting with [version 2025.10.186.0](https://developers.cloudflare.com/changelog/post/2026-01-13-warp-linux-ga/), WARP Connector responds to traffic addressed to its own LAN IP, giving you immediate visibility into Connector reachability. Learn more about deploying [WARP Connector](https://developers.cloudflare.com/mesh/) and building private network connectivity with [Cloudflare One](https://developers.cloudflare.com/cloudflare-one/). ## 2025-11-11 **cloudflared proxy-dns command will be removed starting February 2, 2026** Starting February 2, 2026, the `cloudflared proxy-dns` command will be removed from all new `cloudflared` [releases](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/). This change is being made to enhance security and address a potential vulnerability in an underlying DNS library. This vulnerability is specific to the `proxy-dns` command and does not affect any other `cloudflared` features, such as the core [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) service. The `proxy-dns` command, which runs a client-side [DNS-over-HTTPS (DoH)](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/) proxy, has been an officially undocumented feature for several years. This functionality is fully and securely supported by our actively developed products. Versions of `cloudflared` released before this date will not be affected and will continue to operate. However, note that our [official support policy](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/downloads/#deprecated-releases) for any `cloudflared` release is one year from its release date. #### Migration paths We strongly advise users of this undocumented feature to migrate to one of the following officially supported solutions before February 2, 2026, to continue benefiting from secure [DNS-over-HTTPS](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/). #### End-user devices The preferred method for enabling DNS-over-HTTPS on user devices is the [Cloudflare WARP client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). The WARP client automatically secures and proxies all DNS traffic from your device, integrating it with your organization's [Zero Trust policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and [posture checks](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/). #### Servers, routers, and IoT devices For scenarios where installing a client on every device is not possible (such as servers, routers, or IoT devices), we recommend using the [WARP Connector](https://developers.cloudflare.com/mesh/). Instead of running `cloudflared proxy-dns` on a machine, you can install the WARP Connector on a single Linux host within your private network. This connector will act as a gateway, securely routing all DNS and network traffic from your [entire subnet](https://developers.cloudflare.com/mesh/features/routes/) to Cloudflare for [filtering and logging](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2025-09-18 **Connect and secure any private or public app by hostname, not IP — with hostname routing for Cloudflare Tunnel** You can now route private traffic to [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) based on a hostname or domain, moving beyond the limitations of IP-based routing. This new capability is **free for all Cloudflare One customers**. Previously, Tunnel routes could only be defined by IP address or [CIDR range](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-cidr/). This created a challenge for modern applications with dynamic or ephemeral IP addresses, often forcing administrators to maintain complex and brittle IP lists. ![Hostname-based routing in Cloudflare Tunnel](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1990,height=530,format=webp/_astro/tunnel-hostname-routing.DSi8MP_7.webp) **What’s new:** - **Hostname & Domain Routing**: Create routes for individual hostnames (e.g., `payroll.acme.local`) or entire domains (e.g., `*.acme.local`) and direct their traffic to a specific Tunnel. - **Simplified Zero Trust Policies**: Build resilient policies in Cloudflare Access and Gateway using stable hostnames, making it dramatically easier to apply per-resource authorization for your private applications. - **Precise Egress Control**: Route traffic for public hostnames (e.g., `bank.example.com`) through a specific Tunnel to enforce a dedicated source IP, solving the IP allowlist problem for third-party services. - **No More IP Lists**: This feature makes the workaround of maintaining dynamic IP Lists for Tunnel connections obsolete. Get started in the Tunnels section of the Zero Trust dashboard with your first [private hostname](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) or [public hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) route. Learn more in our [blog post ↗︎](https://blog.cloudflare.com/tunnel-hostname-routing/). ## 2025-09-02 **Cloudflare Tunnel and Networks API will no longer return deleted resources by default starting December 1, 2025** Starting **December 1, 2025**, list endpoints for the [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/) and [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/) will no longer return deleted tunnels, routes, subnets and virtual networks by default. This change makes the API behavior more intuitive by only returning active resources unless otherwise specified. No action is required if you already explicitly set `is_deleted=false` or if you only need to list active resources. This change affects the following API endpoints: - List all tunnels: [`GET /accounts/{account_id}/tunnels`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/methods/list/) - List [Cloudflare Tunnels](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/): [`GET /accounts/{account_id}/cfd_tunnel`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/cloudflared/methods/list/) - List [WARP Connector](https://developers.cloudflare.com/mesh/) tunnels: [`GET /accounts/{account_id}/warp_connector`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/subresources/warp_connector/methods/list/) - List tunnel routes: [`GET /accounts/{account_id}/teamnet/routes`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/routes/methods/list/) - List subnets: [`GET /accounts/{account_id}/zerotrust/subnets`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/subnets/methods/list/) - List virtual networks: [`GET /accounts/{account_id}/teamnet/virtual_networks`](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/subresources/virtual_networks/methods/list/) #### What is changing? The default behavior of the `is_deleted` query parameter will be updated. | Scenario | Previous behavior (before December 1, 2025) | New behavior (from December 1, 2025) | | --- | --- | --- | | `is_deleted` parameter is omitted | Returns **active & deleted** tunnels, routes, subnets and virtual networks | Returns **only active** tunnels, routes, subnets and virtual networks | #### Action required If you need to retrieve deleted (or all) resources, please update your API calls to explicitly include the `is_deleted` parameter before **December 1, 2025**. To get a list of only deleted resources, you must now explicitly add the `is_deleted=true` query parameter to your request: ```bash # Example: Get ONLY deleted Tunnels curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/tunnels?is_deleted=true" \ -H "Authorization: Bearer $API_TOKEN" # Example: Get ONLY deleted Virtual Networks curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/teamnet/virtual_networks?is_deleted=true" \ -H "Authorization: Bearer $API_TOKEN" ``` Following this change, retrieving a complete list of both active and deleted resources will require two separate API calls: one to get active items (by omitting the parameter or using `is_deleted=false`) and one to get deleted items (`is_deleted=true`). #### Why we’re making this change This update is based on user feedback and aims to: - **Create a more intuitive default:** Aligning with common API design principles where list operations return only active resources by default. - **Reduce unexpected results:** Prevents users from accidentally operating on deleted resources that were returned unexpectedly. - **Improve performance:** For most users, the default query result will now be smaller and more relevant. To learn more, please visit the [Cloudflare Tunnel API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/tunnels/) and [Zero Trust Networks API](https://developers.cloudflare.com/api/resources/zero_trust/subresources/networks/) documentation. ## 2025-07-15 **Faster, more reliable UDP traffic for Cloudflare Tunnel** Your real-time applications running over [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) are now faster and more reliable. We've completely re-architected the way `cloudflared` proxies UDP traffic in order to isolate it from other traffic, ensuring latency-sensitive applications like private DNS are no longer slowed down by heavy TCP traffic (like file transfers) on the same Tunnel. This is a foundational improvement to Cloudflare Tunnel, delivered automatically to all customers. There are no settings to configure — your UDP traffic is already flowing faster and more reliably. **What’s new:** - **Faster UDP performance**: We've significantly reduced the latency for establishing new UDP sessions, making applications like private DNS much more responsive. - **Greater reliability for mixed traffic**: UDP packets are no longer affected by heavy TCP traffic, preventing timeouts and connection drops for your real-time services. Learn more about running [TCP or UDP applications](https://developers.cloudflare.com/reference-architecture/architectures/sase/#connecting-applications) and [private networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) through [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/). ## 2024-12-19 **Troubleshoot tunnels with diagnostic logs** The latest `cloudflared` build [2024.12.2 ↗︎](https://github.com/cloudflare/cloudflared/releases/tag/2024.12.2) introduces the ability to collect all the diagnostic logs needed to troubleshoot a `cloudflared` instance. A diagnostic report collects data from a single instance of `cloudflared` running on the local machine and outputs it to a `cloudflared-diag` file. For more information, refer to [Diagnostic logs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs/). ## 2024-10-17 **Simplified WARP Connector deployment** You can now deploy WARP Connector using a simplified, guided workflow similar to `cloudflared` connectors. For detailed instructions, refer to the [WARP Connector documentation](https://developers.cloudflare.com/mesh/). ## 2024-10-10 **Bugfix for --grace-period** The new `cloudflared` build [2024.10.0 ↗︎](https://github.com/cloudflare/cloudflared/releases/tag/2024.10.0) has a bugfix related to the [--grace-period](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#grace-period) tunnel run parameter. `cloudflared` connectors will now abide by the specified waiting period before forcefully closing connections to Cloudflare's network. ## 2024-08-06 **cloudflared builds available in GitHub for Apple silicon** macOS users can now download `cloudflared-arm64.pkg` directly from [GitHub ↗︎](https://github.com/cloudflare/cloudflared/releases), in addition to being available via Homebrew. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/tunnel/#page","headline":"Cloudflare Tunnel","description":"Review recent changes to Cloudflare Tunnel.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/tunnel/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/tunnel/og.png?v=cd1ba19f8454ac06","dateModified":"2026-09-16","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare DLP. title: Data Loss Prevention image: https://developers.cloudflare.com/cloudflare-one/changelog/dlp/og.png?v=1432f202fa071850 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Data Loss Prevention Last updated May 1, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/dlp/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/dlp.xml) ## 2026-09-14 **Discover where sensitive data goes before you create a Data Loss Prevention policy** **Passive Detection** for [Cloudflare Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) lets you learn from your Gateway traffic before deciding what to log or block. Discover the sensitive data types in sampled traffic, explore their destinations, and use the findings to build policies around your organization's needs. The dashboard brings together detections from sampled HTTP request and response bodies. Select an entry to follow its detections over time, review destinations, and check policy coverage. You do not need a Gateway DLP policy to get these insights, and existing Gateway policies continue to apply. ![Passive Detection dashboard showing detection totals, data type distribution, policy coverage, and detection entries](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1200,height=593,format=webp/_astro/passive-detection.B_-_POtg.gif) Passive Detection is generally available. The detection entries available to your account depend on your [Zero Trust plan](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). To get started, refer to the [Passive Detection documentation](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/passive-detection/). ## 2026-08-21 **Test Data Loss Prevention profiles without sending traffic through Gateway** **Test scan** lets you check how [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/) evaluates sample content before you apply a profile to production traffic. Paste text, upload a file, or upload a HAR file, then select the profiles you want to test. ![Test scan results showing matched profiles, detection entries, and match context](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1200,height=587,format=webp/_astro/dlp-test-scan.Dm6EgN6x.gif) Test scan sends content directly to the DLP scanner. Gateway policies are not evaluated, no traffic passes through Gateway, and no Gateway activity logs are created. Results include matched profiles, detection entries, confidence levels, match context, proximity keywords, file metadata, antivirus status, and OCR output. Test scan is available to all Cloudflare Zero Trust customers. Profile availability depends on your [Zero Trust plan](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). For more details, refer to the [Test scan documentation](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/test-scan/). ## 2026-07-10 **Source code detection improvements** Data Loss Prevention (DLP) source code detection now focuses on identifying whole source code file uploads and downloads. Previously, source code detection performed partial scans resulting in a higher rate of false positives. Since only whole source code files are evaluated, code embedded in other content — such as chat messages, documentation, or code samples — is no longer flagged as source code, removing a common source of false positives. Source code detection requires a minimum of 500 characters to evaluate a file. Files below this threshold are not flagged to reduce noise. This threshold filters out small fragments that lack enough context for reliable classification. Enable and set [confidence levels](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/#confidence-thresholds) to tune match sensitivity. A higher confidence level reduces false positives by requiring stronger signals that the content is truly source code. A lower confidence level catches more files at the cost of additional noise. Source code detection applies to standalone source code files in [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). It does not detect source code embedded within other file types or payloads, such as `.docx` files or chat messages. For more information, refer to [Source Code predefined profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#source-code). ## 2026-06-11 **Define custom topics for AI prompt protection** You can now define custom topics for AI prompt protection. Predefined [AI prompt topics](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics) cover common content and intent categories such as PII, source code, and jailbreak attempts. Custom topics let you detect unique or proprietary concepts that are not included in predefined categories. You describe a custom topic in natural language, and Cloudflare DLP detects whether a prompt matches that topic based on context rather than specific keywords. For example, a topic that describes confidential merger discussions matches a prompt that paraphrases the deal, even when the prompt never uses the word merger or names the companies involved. To detect literal values such as internal codenames or product identifiers, use a [custom wordlist or pattern entry](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#custom-wordlist-datasets) instead. Custom topics run through the same [application granular controls](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#granular-controls) path as predefined AI prompt topics. Custom topics are available for ChatGPT, Google Gemini, Perplexity, and Claude. #### Create a custom AI prompt topic 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Data loss prevention** > **Detection entries**. 2. Select **AI prompt topics**, then select **Custom Prompt Topic**. 3. Describe the topic in natural language. Be specific about the concept you want to detect. For example, describe unreleased product roadmap details or confidential customer contract terms. 4. Add this detection entry to an existing DLP profile, or [create a new DLP profile](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/#build-a-custom-profile). 5. Use the profile in a Gateway HTTP policy to log or block prompts that match the topic. Note Write the description as a concept to classify, not a list of keywords. For example, describe "internal financial forecasts and unreleased revenue figures" rather than listing specific document names. For more information, refer to [AI prompt topics](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics). ## 2026-04-30 **Classify sensitive content with Data Classification** Cloudflare DLP now includes **Data Classification**, which lets administrators organize and label sensitive content using labels, templates, and reusable data classes. With Data Classification, administrators can define labels such as sensitivity schemas and levels, and data tag groups and tags. Administrators can also build from Cloudflare-managed templates and create reusable data classes that combine detection entries, other data classes, sensitivity levels, and data tags. You can then use those classifications in custom DLP profiles to identify the severity of sensitive content, understand where it exists, and apply that logic consistently across DLP profiles. For more information, refer to [Data Classification](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/data-classification/). ## 2026-04-30 **New predefined detection entries are available** Cloudflare DLP now includes new predefined detection entries. The expanded catalog includes detections for specific credential types, webhooks, addresses, tax identifiers, national IDs, financial data, and crypto wallets. Examples include `GitHub PAT`, `OpenAI API Key`, `Slack Webhook`, `Discord Webhook`, `US Physical Address`, and `Bitcoin Wallet`. For the full list, refer to [Predefined detection entries](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/predefined-detection-entries/). ## 2026-04-28 **Create and manage DLP detection entries outside of profiles** You can now create, view, and manage DLP detection entries outside of profiles. Detection entries are no longer hidden inside individual profiles. Administrators can manage detection entries directly from the **Detection entries** section and use them in custom DLP profiles. For more information, refer to [Configure detection entries](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/). ## 2026-04-28 **Detect PII records with a new predefined DLP profile** Cloudflare DLP now includes a new predefined profile designed to detect PII records that contain multiple types of personal data: **Personally Identifiable Information (PII) Record**. Most predefined and custom DLP profiles match when any enabled detection entry matches. The **Personally Identifiable Information (PII) Record** profile is different. It only matches when at least three unique detection entries are found in close proximity, which reduces false positives from standalone values that may not represent a real PII record. Detection entries included in the profile: - AU Passport Number - American Express Card Number - Diners Club Card Number - US Driver's License Number - Email Address - Full Name - US Mailing Address - Mastercard Card Number - US Individual Tax Identification Number (ITIN) - US Passport Number - US Phone Number - Union Pay Card Number - United States SSN Numeric Detection - Visa Card Number For more information, refer to [predefined DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ## 2026-04-14 **DLP account-level settings** **Account-level DLP settings are now available** in Cloudflare One. You can now configure advanced DLP settings at the account level, including OCR, AI context analysis, and payload masking. This provides consistent enforcement across all DLP profiles and simplifies configuration management. Key changes: - **Consistent enforcement**: Settings configured at the account level apply to all DLP profiles - **Simplified migration**: Settings enabled on any profile are automatically migrated to account level - **Deprecation notice**: Profile-level advanced settings will be deprecated in a future release **Migration details:** During the migration period, if a setting is enabled on any profile, it will automatically be enabled at the account level. This means profiles that previously had a setting disabled may now have it enabled if another profile in the account had it enabled. Settings are evaluated using OR logic - a setting is enabled if it is turned on at either the account level or the profile level. However, profile-level settings cannot be enabled when the account-level setting is off. For more details, refer to the [DLP settings documentation](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-settings/). ## 2026-04-14 **Detect Cloudflare API tokens with DLP** The **Credentials and Secrets** DLP profile now includes three new predefined entries for detecting Cloudflare API credentials: | Entry name | Token prefix | Detects | | --- | --- | --- | | Cloudflare User API Key | `cfk_` | User-scoped API keys | | Cloudflare User API Token | `cfut_` | User-scoped API tokens | | Cloudflare Account Owned API Token | `cfat_` | Account-scoped API tokens | These detections target the new [Cloudflare API credential format](https://developers.cloudflare.com/fundamentals/api/get-started/token-formats/), which uses a structured prefix and a CRC32 checksum suffix. The identifiable prefix makes it possible to detect leaked credentials with high confidence and low false positive rates — no surrounding context such as `Authorization: Bearer` headers is required. Credentials generated before this format change will not be matched by these entries. #### How to enable Cloudflare API token detections 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **DLP** > **DLP Profiles**. 2. Select the **Credentials and Secrets** profile. 3. Turn on one or more of the new Cloudflare API token entries. 4. Use the profile in a Gateway HTTP policy to log or block traffic containing these credentials. Example policy: | Selector | Operator | Value | Action | | --- | --- | --- | --- | | DLP Profile | in | *Credentials and Secrets* | Block | You can also enable individual entries to scope detection to specific credential types — for example, enabling **Account Owned API Token** detection without enabling **User API Key** detection. For more information, refer to [predefined DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ## 2026-04-14 **Configure how sensitive data appears in DLP payload logs** You can now configure how sensitive data matches are displayed in your DLP payload match logs — giving your incident response team the context they need to validate alerts without compromising your security posture. To get started, go to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), select **Zero Trust** > **Data loss prevention** > **DLP settings** and find the **Payload log masking** card. Previously, all DLP payload logs used a single masking mode that obscured matched data entirely and hid the original character count, making it difficult to distinguish true positives from false positives. This update introduces three options: - **Full Mask (default):** Masks the match while preserving character count and visual formatting (for example, `***-**-****` for a Social Security Number). This is an improvement over the previous default, which did not preserve character count. - **Partial Mask:** Reveals 25% of the matched content while masking the remainder (for example, `***-**-6789`). - **Clear Text:** Stores the full, unmasked violation for deep investigation (for example, `123-45-6789`). **Important:** The masking level you select is applied at detection time, before the payload is encrypted. This means the chosen format is what your team will see after decrypting the log with your private key — the existing encryption workflow is unchanged. **Applies to all enabled detections:** When a masking level other than Full Mask is selected, it applies to all sensitive data matches found within a payload window — not just the match that triggered the policy. Any data matched by your enabled DLP detection entries will be masked at the selected level. For more information, refer to [DLP logging options](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules). ## 2026-03-26 **Streaming ZIP file scanning removes per-file size limits** DLP now processes ZIP files using a streaming handler that scans archive contents element-by-element as data arrives. This removes previous file size limitations and improves memory efficiency when scanning large archives. Microsoft Office documents (DOCX, XLSX, PPTX) also benefit from this improvement, as they use ZIP as a container format. This improvement is automatic — no configuration changes are required. ## 2026-03-25 **Detect and sanitize HAR files** HTTP Archive (HAR) files are used by engineering and support teams to capture and share web traffic logs for troubleshooting. However, these files routinely contain highly sensitive data — including session cookies, authorization headers, and other credentials — that can pose a significant risk if uploaded to third-party services without being reviewed or cleaned first. Gateway now includes a predefined DLP profile called **Unsanitized HAR** that detects HAR files in HTTP traffic. You can use this profile in a Gateway HTTP policy to either block HAR file uploads entirely or redirect users to a sanitization tool before allowing the upload to proceed. #### How to configure a HAR file policy In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Firewall Policies** > **HTTP** and create a new HTTP policy using the **DLP Profile** selector: | Selector | Operator | Value | Action | | --- | --- | --- | --- | | DLP Profile | in | *Unsanitized HAR* | | Then choose one of the following actions: - **Block**: Prevents the upload of any HAR file that has not been sanitized by Cloudflare's sanitizer. Use this for strict environments where HAR file sharing must be disallowed entirely. - **Block** with **Gateway Redirect**: Intercepts the upload and redirects the user to `https://har-sanitizer.pages.dev/`, where they can sanitize the file. Once sanitized, the user can re-upload the clean file and proceed with their workflow. #### Sanitized HAR recognition HAR files processed by the Cloudflare HAR sanitizer receive a tamper-evident sanitized marker. DLP recognizes this marker and will not re-trigger the policy on a file that has already been sanitized and has not been modified since. If a previously sanitized file is edited, it will be treated as unsanitized and flagged again. #### Visibility in Gateway logs Gateway logs will reflect whether a detected HAR file was classified as **Unsanitized** or **Sanitized**, giving your security team full visibility into HAR file activity across your organization. For more information, refer to [predefined DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). ## 2025-10-01 **Expanded File Type Controls for Executables and Disk Images** You can now enhance your security posture by blocking additional application installer and disk image file types with Cloudflare Gateway. Preventing the download of unauthorized software packages is a critical step in securing endpoints from malware and unwanted applications. We have expanded Gateway's file type controls to include: - Apple Disk Image (dmg) - Microsoft Software Installer (msix, appx) - Apple Software Package (pkg) You can find these new options within the [*Upload File Types* and *Download File Types* selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-types) when creating or editing an HTTP policy. The file types are categorized as follows: - **System**: *Apple Disk Image (dmg)* - **Executable**: *Microsoft Software Installer (msix)*, *Microsoft Software Installer (appx)*, *Apple Software Package (pkg)* To ensure these file types are blocked effectively, please note the following behaviors: - DMG: Due to their file structure, DMG files are blocked at the very end of the transfer. A user's download may appear to progress but will fail at the last moment, preventing the browser from saving the file. - MSIX: To comprehensively block Microsoft Software Installers, you should also include the file type *Unscannable*. MSIX files larger than 100 MB are identified as Unscannable ZIP files during inspection. To get started, go to your HTTP policies in Zero Trust. For a full list of file types, refer to [supported file types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#supported-file-types). ## 2025-09-25 **Refine DLP Scans with New Body Phase Selector** You can now more precisely control your HTTP DLP policies by specifying whether to scan the request or response body, helping to reduce false positives and target specific data flows. In the Gateway HTTP policy builder, you will find a new selector called *Body Phase*. This allows you to define the direction of traffic the DLP engine will inspect: - *Request Body*: Scans data sent from a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts. - *Response Body*: Scans data sent to a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data. For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to *Request Body*, the policy will only trigger if the user attempts to upload or submit an SSN, ignoring the content of the web page itself. All policies without this selector will continue to scan both request and response bodies to ensure continued protection. For more information, refer to [Gateway HTTP policy selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#body-phase). ## 2025-08-25 **New DLP topic based detection entries for AI prompt protection** You now have access to a comprehensive suite of capabilities to secure your organization's use of generative AI. AI prompt protection introduces four key features that work together to provide deep visibility and granular control. 1. **Prompt Detection for AI Applications** DLP can now natively detect and inspect user prompts submitted to popular AI applications, including **Google Gemini**, **ChatGPT**, **Claude**, and **Perplexity**. 2. **Prompt Analysis and Topic Classification** Our DLP engine performs deep analysis on each prompt, applying [topic classification](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics). These topics are grouped into two evaluation categories: - **Content:** PII, Source Code, Credentials and Secrets, Financial Information, and Customer Data. - **Intent:** Jailbreak attempts, requests for malicious code, or attempts to extract PII. To help you apply these topics quickly, we have also released five new predefined profiles (for example, AI Prompt: AI Security, AI Prompt: PII) that bundle these new topics. ![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=728,height=439,format=webp/_astro/ai-prompt-detection-entry.4QmdkAuv.png) 3. **Granular Guardrails** You can now build guardrails using Gateway HTTP policies with [application granular controls](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#granular-controls). Apply a DLP profile containing an [AI prompt topic detection](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics) to individual AI applications (for example, `ChatGPT`) and specific user actions (for example, `SendPrompt`) to block sensitive prompts.![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=731,height=511,format=webp/_astro/ai-prompt-policy.CF3H2rbK.png) 4. **Full Prompt Logging** To aid in incident investigation, an optional setting in your Gateway policy allows you to [capture prompt logs](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-generative-ai-prompt-content) to store the full interaction of prompts that trigger a policy match. To make investigations easier, logs can be filtered by `conversation_id`, allowing you to reconstruct the full context of an interaction that led to a policy violation.![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=728,height=444,format=webp/_astro/ai-prompt-log.ywQDc5qN.png) AI prompt protection is now available in open beta. To learn more about it, read the [blog ↗︎](https://blog.cloudflare.com/ai-prompt-protection/#closing-the-loop-logging) or refer to [AI prompt topics](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#ai-prompt-topics). ## 2025-07-17 **New detection entry type: Document Matching for DLP** You can now create [document-based](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#document-entries) detection entries in DLP by uploading example documents. Cloudflare will encrypt your documents and create a unique fingerprint of the file. This fingerprint is then used to identify similar documents or snippets within your organization's traffic and stored files. ![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1356,height=839,format=webp/_astro/document-match.CcN8pGgR.png) **Key features and benefits:** - **Upload documents, forms, or templates:** Easily upload .docx and .txt files (up to 10 MB) that contain sensitive information you want to protect. - **Granular control with similarity percentage:** Define a minimum similarity percentage (0-100%) that a document must meet to trigger a detection, reducing false positives. - **Comprehensive coverage:** Apply these document-based detection entries in: - **Gateway policies:** To inspect network traffic for sensitive documents as they are uploaded or shared. - **CASB (Cloud Access Security Broker):** To scan files stored in cloud applications for sensitive documents at rest. - **Identify sensitive data:** This new detection entry type is ideal for identifying sensitive data within completed forms, templates, or even small snippets of a larger document, helping you prevent data exfiltration and ensure compliance. Once uploaded and processed, you can add this new document entry into a DLP profile and policies to enhance your data protection strategy. ## 2025-06-23 **Data Security Analytics in the Zero Trust dashboard** Zero Trust now includes **Data security analytics**, providing you with unprecedented visibility into your organization sensitive data. The new dashboard includes: - **Sensitive Data Movement Over Time:** - See patterns and trends in how sensitive data moves across your environment. This helps understand where data is flowing and identify common paths. - **Sensitive Data at Rest in SaaS & Cloud:** - View an inventory of sensitive data stored within your corporate SaaS applications (for example, Google Drive, Microsoft 365) and cloud accounts (such as AWS S3). - **DLP Policy Activity:** - Identify which of your Data Loss Prevention (DLP) policies are being triggered most often. - See which specific users are responsible for triggering DLP policies. ![Data Security Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3254,height=1580,format=webp/_astro/cf1-data-security-analytics-v1.BGl6fYXl.png) To access the new dashboard, log in to [Cloudflare One ↗︎](https://one.dash.cloudflare.com/) and go to **Insights** on the sidebar. ## 2025-05-12 **Case Sensitive Custom Word Lists** You can now configure [custom word lists](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#custom-wordlist-datasets) to enforce case sensitivity. This setting supports flexibility where needed and aims to reduce false positives where letter casing is critical. ![dlp](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1289,height=910,format=webp/_astro/case-sesitive-cwl.MPuOc_3r.png) ## 2025-05-07 **Send forensic copies to storage without DLP profiles** You can now [send DLP forensic copies](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#send-dlp-forensic-copies-to-logpush-destination) to third-party storage for any HTTP policy with an `Allow` or `Block` action, without needing to include a DLP profile. This change increases flexibility for data handling and forensic investigation use cases. By default, Gateway will send all matched HTTP requests to your configured DLP Forensic Copy jobs. ![DLP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1324,height=636,format=webp/_astro/forensic-copies-for-all.fxeFrCY4.png) ## 2025-04-14 **New predefined detection entry for ICD-11** You now have access to the World Health Organization (WHO) 2025 edition of the [International Classification of Diseases 11th Revision (ICD-11) ↗︎](https://www.who.int/news/item/14-02-2025-who-releases-2025-update-to-the-international-classification-of-diseases-%28icd-11%29) as a predefined detection entry. The new dataset can be found in the [Health Information](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#health-information) predefined profile. ICD-10 dataset remains available for use. ## 2025-02-03 **Block files that are password-protected, compressed, or otherwise unscannable.** Gateway HTTP policies can now block files that are password-protected, compressed, or otherwise unscannable. These unscannable files are now matched with the [Download and Upload File Types traffic selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-types) for HTTP policies: - Password-protected Microsoft Office document - Password-protected PDF - Password-protected ZIP archive - Unscannable ZIP archive To get started inspecting and modifying behavior based on these and other rules, refer to [HTTP filtering](https://developers.cloudflare.com/cloudflare-one/traffic-controls/get-started/http/). ## 2025-01-20 **Detect source code leaks with Data Loss Prevention** You can now detect source code leaks with Data Loss Prevention (DLP) with predefined checks against common programming languages. The following programming languages are validated with natural language processing (NLP). - C - C++ - C# - Go - Haskell - Java - JavaScript - Lua - Python - R - Rust - Swift DLP also supports confidence level for [source code profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#source-code). For more details, refer to [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/). ## 2025-01-15 **Payload log match visibility** When viewing decrypted payload log matches, DLP now provides more context by listing multiple DLP matches and the matching DLP profile. ## 2024-11-25 **Profile confidence levels** DLP profiles now support setting a [confidence level](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/#confidence-levels) to choose how tolerant its detections are to false positives based on the context of the detection. The higher a profile's confidence level is, the less false positives will be allowed. Confidence levels include Low, Medium, or High. DLP profile confidence levels supersede [context analysis](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/#context-analysis). ## 2024-11-01 **Send entire HTTP requests to a Logpush destination** In addition to [logging the payload](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules) from HTTP requests that matched a DLP policy in Cloudflare Logs, Enterprise users can now configure a [Logpush job](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#send-dlp-forensic-copies-to-logpush-destination) to send the entire HTTP request that triggered a DLP match to a storage destination. This allows long-term storage of full requests for use in forensic investigation. ## 2024-09-03 **Exact Data Match multi-entry upload support** You can now upload files with [multiple columns of data](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/#upload-a-new-exact-data-match-dataset) as Exact Data Match datasets. DLP can use each column as a separate existing detection entry. ## 2024-05-23 **Data-at-rest DLP for Box and Dropbox** You can now scan your [Box](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/box/#data-loss-prevention-optional) and [Dropbox](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/dropbox/#data-loss-prevention-optional) files for DLP matches. ## 2024-04-16 **Optical character recognition** DLP can now [detect sensitive data](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/advanced-settings/#optical-character-recognition-ocr) in jpeg, jpg, and png files. This helps companies prevent the leak of sensitive data in images, such as screenshots. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/dlp/#page","headline":"Data Loss Prevention","description":"Review recent changes to Cloudflare DLP.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/dlp/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/dlp/og.png?v=1432f202fa071850","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Digital Experience Monitoring. title: Digital Experience Monitoring image: https://developers.cloudflare.com/cloudflare-one/changelog/dex/og.png?v=dffd4589129a4993 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Digital Experience Monitoring Last updated May 1, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/dex/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/dex.xml) ## 2026-07-09 **Wi-Fi signal and network performance analytics for Cloudflare One Client devices** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into device, network, and application performance across your Cloudflare SASE deployment. The **Device Monitoring** page now analyzes hardware and network data between a Cloudflare One Client device and Cloudflare's edge, so you can diagnose connectivity and performance issues. Previously, this data was only available in raw DEX Device State Event logs, which required you to build your own analytics to interpret it. ![Device Monitoring summary with connection status, connection mode, Wi-Fi signal strength, traffic performance, and device health](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1652,height=664,format=webp/_astro/dex-device-monitoring-summary.CBxeSd6b.png) A summary at the top of the page shows the health of each category at a glance, using **Good**, **Fair**, and **Poor** labels: - **Connection** — connection status, Cloudflare One Client mode, and tunnel type over time - **Wi-Fi signal strength** — signal measured in dBm over time, with thresholds that flag a weak signal - **Traffic performance** — upstream and downstream performance, including network throughput on the active interface - **Device health** — hardware metrics such as CPU, memory, and disk ![Wi-Fi signal strength and network throughput charts on the Device Monitoring page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1666,height=732,format=webp/_astro/dex-device-monitoring-wifi-network.CoEBznAm.png) You can filter by category and adjust the time range to correlate a device's metrics with a user's reported issue. These analytics are available to all Cloudflare One customers at no additional cost. To learn more, refer to the [DEX monitoring documentation](https://developers.cloudflare.com/cloudflare-one/insights/dex/monitoring/). ## 2026-04-29 **Digital experience tests to authenticated resources and enhanced configuration** [Digital experience tests](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/) now support testing applications protected by Cloudflare Access or third-party authentication. All authentication secrets are managed via [Cloudflare Secret Store](https://developers.cloudflare.com/secrets-store/). Digital experience tests also have enhanced configuration options including: - New HTTP methods (DELETE, PATCH, POST, PUT) - Secret Store headers, custom plain text headers, and custom request bodies - Advanced settings: follow redirects, response bodies, response headers, and allow untrusted certificates ![Digital experience test configuration for Cloudflare Access applications](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2840,height=1374,format=webp/_astro/dex_test_auth_config.CD3G3zb_.png)![Digital experience enhanced test configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2840,height=1496,format=webp/_astro/dex_test_enhanced_config.Nsv7Vcob.png) ## 2026-04-28 **Internet outage notifications for devices** [Digital Experience](https://developers.cloudflare.com/cloudflare-one/insights/dex/) will display a dashboard notification when an Internet outage or traffic anomaly may impact a [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) device based on its geographic location or network connection. This Internet outage and traffic anomaly data is pulled from [Cloudflare Radar ↗︎](https://radar.cloudflare.com/). All Internet outage and traffic anomaly observations can be viewed in the [Radar Outage Center ↗︎](https://radar.cloudflare.com/outage-center). ![Digital Experience Monitoring dashboard notification for Internet outage impacting Cloudflare One Client devices](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2076,height=314,format=webp/_astro/dex_radar_ux_notification.CpdrUVYA.png)![Digital Experience Monitoring dashboard analytics for Internet outage impacting Cloudflare One Client devices](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2068,height=909,format=webp/_astro/dex_radar_analytics.GaPxWM6C.png) ## 2026-04-28 **Cloudflare One Client speed tests** IT teams can now remotely run speed tests from the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) to Cloudflare's network edge. Each speed test includes the following metrics: - Internet speed: download and upload throughput - Latency: download, upload, unloaded latency, and jitter - Network quality score: video streaming, webchat/real-time communication (RTC) In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Insights** > **Digital experience** > **Diagnostics** and select **Run diagnostics** to use the feature today. ![Cloudflare One client speed test result](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2906,height=1730,format=webp/_astro/dex_speed_test.DukupcRs.png) ## 2026-04-15 **Last seen timestamp for Cloudflare One Client devices is more consistent** The last seen timestamp for [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) devices is now more consistent across the dashboard. IT teams will see more consistent information about the most recent client event between a device and Cloudflare's network. ## 2026-02-19 **DEX Supports EU Customer Metadata Boundary** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into [WARP](https://developers.cloudflare.com/warp-client/) device connectivity and performance to any internal or external application. Now, all DEX logs are fully compatible with Cloudflare's [Customer Metadata Boundary](https://developers.cloudflare.com/data-localization/metadata-boundary/) (CMB) setting for the 'EU' (European Union), which ensures that DEX logs will not be stored outside the 'EU' when the option is configured. If a Cloudflare One customer using DEX enables CMB 'EU', they will not see any DEX data in the Cloudflare One dashboard. Customers can ingest DEX data via [LogPush](https://developers.cloudflare.com/logs/logpush/), and build their own analytics and dashboards. If a customer enables CMB in their account, they will see the following message in the Digital Experience dashboard: "DEX data is unavailable because Customer Metadata Boundary configuration is on. Use Cloudflare LogPush to export DEX datasets." ![Digital Experience Monitoring message when Customer Metadata Boundary for the EU is enabled](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2143,height=1221,format=webp/_astro/dex_supports_cmb.6YOLXjHN.png) ## 2025-11-12 **DEX Logpush jobs** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into WARP device metrics, connectivity, and network performance across your Cloudflare SASE deployment. We've released four new WARP and DEX device data sets that can be exported via [Cloudflare Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/). These Logpush data sets can be exported to R2, a cloud bucket, or a SIEM to build a customized logging and analytics experience. 1. [DEX Application Tests](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dex_application_tests/) 2. [DEX Device State Events](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/dex_device_state_events/) 3. [WARP Config Changes](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/warp_config_changes/) 4. [WARP Toggle Changes](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/warp_toggle_changes/) To create a new DEX or WARP Logpush job, customers can go to the account level of the Cloudflare dashboard > Analytics & Logs > Logpush to get started. ![DEX logpush job creation dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2549,height=1283,format=webp/_astro/dex_logpush_datasets.CtCk36pX.png) ## 2025-08-29 **DEX MCP Server** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into device connectivity and performance across your Cloudflare SASE deployment. We've released an MCP server [(Model Context Protocol) ↗︎](https://cloudflare.com/learning/ai/what-is-model-context-protocol-mcp/) for DEX. The DEX MCP server is an AI tool that allows customers to ask a question like, "Show me the connectivity and performance metrics for the device used by carly‌@acme.com", and receive an answer that contains data from the DEX API. Any Cloudflare One customer using a Free, Pay-as-you-go, or Enterprise account can access the DEX MCP Server. This feature is available to everyone. Customers can test the new DEX MCP server in less than one minute. To learn more, read the [DEX MCP server documentation](https://developers.cloudflare.com/cloudflare-one/insights/dex/dex-mcp-server/). ## 2025-03-07 **Cloudflare One Agent now supports Endpoint Monitoring** [Digital Experience Monitoring (DEX)](https://developers.cloudflare.com/cloudflare-one/insights/dex/) provides visibility into device, network, and application performance across your Cloudflare SASE deployment. The latest release of the Cloudflare One agent (v2025.1.861) now includes device endpoint monitoring capabilities to provide deeper visibility into end-user device performance which can be analyzed directly from the dashboard. Device health metrics are now automatically collected, allowing administrators to: - View the last network a user was connected to - Monitor CPU and RAM utilization on devices - Identify resource-intensive processes running on endpoints ![Device endpoint monitoring dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1226,height=675,format=webp/_astro/cloudflare-one-agent-health-monitoring.XXtiRuOp.gif) This feature complements existing DEX features like [synthetic application monitoring](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/) and [network path visualization](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/traceroute/), creating a comprehensive troubleshooting workflow that connects application performance with device state. For more details refer to our [DEX](https://developers.cloudflare.com/cloudflare-one/insights/dex/) documentation. ## 2025-01-24 **IP visibility** [IP visibility](https://developers.cloudflare.com/cloudflare-one/insights/dex/ip-visibility/) enables admins to inspect the different IP addresses associated with an end-user device. IP types available for review on the Cloudflare dashboard include: the device's private IP, the public IP assigned to the device by the ISP, and the router's (that the device is connected to) private IP. ## 2024-12-19 **Remote captures** Admins can now collect packet captures (PCAPs) and WARP diagnostic logs from end-user devices. For more information, refer to [Remote captures](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/). ## 2024-05-20 **Last seen ISP** Admins can view the last ISP seen for a device by going to **My Team** > **Devices**. Requires setting up a [traceroute test](https://developers.cloudflare.com/cloudflare-one/insights/dex/tests/traceroute/). ## 2024-05-13 **DEX alerts** Admins can now set [DEX alerts](https://developers.cloudflare.com/cloudflare-one/insights/dex/notifications/) using [Cloudflare Notifications](https://developers.cloudflare.com/notifications/). Three new DEX alert types: - Device connectivity anomaly - Test latency - Test low availability Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/dex/#page","headline":"Digital Experience Monitoring","description":"Review recent changes to Digital Experience Monitoring.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/dex/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/dex/og.png?v=dffd4589129a4993","dateModified":"2026-05-01","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Track updates and changes to Cloudflare One features. title: Email security image: https://developers.cloudflare.com/cloudflare-one/changelog/email-security/og.png?v=c02f05aa99e84d8f --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Email security Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/email-security/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/email-security-cf1.xml) ## 2026-08-17 **Post-quantum key exchange for MX deployments** Cloudflare Email Security now supports post-quantum hybrid key exchange with X25519MLKEM768 on the SMTP connections we make to receive and deliver mail. Deploying Email Security in front of a provider that supports post-quantum hybrid key agreement (like Google Workspace) will create a TLS 1.3 connection using post-quantum key agreement. Inbound MX connections and outbound delivery connections now negotiate the [X25519MLKEM768](https://developers.cloudflare.com/ssl/post-quantum-cryptography/#hybrid-key-agreement) hybrid key agreement when the peer supports it, protecting SMTP traffic against [harvest-now, decrypt-later ↗︎](https://blog.cloudflare.com/pq-2024/) attacks. Support is backwards compatible and enabled automatically for all customers. Senders and receivers that do not yet advertise post-quantum key agreement continue to connect with classical key exchange. This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-08-12 **Block emails by content with blocked content rules** Cloudflare Email security now lets administrators write their own content-based blocking rules. A new **Blocked content** area under **Policies & rules** lets you define a plaintext string or a regular expression, choose whether to scan the message subject, body, or both, and automatically block any message that matches. - Create rules using either **plaintext** matches or **regular expressions** — useful for blocking targeted phishing campaigns, known-bad phrases, or content patterns unique to your organization. - Choose the **search location** for each rule: **subject**, **body**, or **subject and body**. - Use the built-in **regular expression checker** to validate your pattern against sample text before saving, so you can confirm the rule matches what you expect and avoid false positives. - Matching messages are marked with a malicious [disposition](https://developers.cloudflare.com/cloudflare-one/email-security/reference/dispositions-and-attributes/) and prevented from reaching users' inboxes. Blocked content rules currently only support the block action. This feature is available for the following Email security packages: - **Enterprise** - **Enterprise + PhishGuard** To get started, refer to [Blocked content](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/blocked-content/). ## 2026-05-06 **Cloudy Summaries in PhishNet O365** PhishNet users can now access **Cloudy summaries** directly within the email investigation experience. When reviewing a message in PhishNet, users will see an AI-generated summary that provides additional context and key details about the email. These summaries help users quickly understand the nature of a message without needing to manually parse through headers, body content, and detection signals. Cloudy surfaces the most relevant information so users can make faster, more informed decisions about suspicious emails. **These summaries are not trained on customer data.** They are generated using the outputs of our existing detection models and analysis systems. This feature is available for PhishNet with Office 365. Support for Gmail will be available by the end of the quarter. ## 2026-04-07 **User Submission Triage Status Tracking** Cloudflare Email security now supports **Triage Status Tracking for User Submissions**. This enhancement gives SOC teams a streamlined way to track, manage, and prioritize user-submitted emails directly within the Cloudflare One dashboard. - The User Submissions table now includes a **Status** column with three states: **Unreviewed** (new submissions awaiting triage), **Reviewed** (submissions assessed by the SOC team), and **Escalated** (submissions escalated to team submissions for further investigation). Analysts can quickly update statuses and filter the table to focus on what needs attention. - SOC teams can now organize their triage workflows, avoid duplicate reviews, and make sure critical threats get escalated for deeper investigation—bringing order to the chaos of high-volume submission management. Triage Status Tracking is **automatically available** for all Email security customers using the user submissions feature. No additional configuration is required; customers just need to make sure user submissions are being sent to their user submission aliases. This applies to all Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-04-06 **DANE Support for MX Deployments** Cloudflare Email Security now supports DANE (DNS-based Authentication of Named Entities) for MX deployments. This enhancement strengthens email transport security by enabling DNSSEC-backed certificate verification for our regional MX records. - Regional MX hostnames now publish DANE TLSA records backed by DNSSEC, enabling DANE-capable SMTP senders to cryptographically validate certificate identities before establishing TLS connections—moving beyond opportunistic encryption to verified encrypted delivery. - DANE support is automatically available for all customers using regional MX deployments. No additional configuration is required; DANE-capable mail infrastructure will automatically validate MX certificates using the published records. This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-03-15 **Unlimited result paging in Investigations** Investigations now support unlimited result paging in both the dashboard and the API, removing the previous 1,000-record cap. Security teams can page through complete result sets when searching across large mail volumes, giving SOC analysts and automated workflows deeper visibility for forensics and threat hunting. In the dashboard, infinite paging is now supported in the Investigations view. The 1,000-record ceiling has been removed, so you can navigate through the full result set directly in the UI. The [Investigations API](https://developers.cloudflare.com/api/resources/email_security/subresources/investigate/methods/list) now returns up to 10,000 records per page (up from 1,000), with no cap on total result volume across pages. For high-volume use cases, we recommend: - **[Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/email-security-logs/) to a SIEM** for full-fidelity datasets and long-term retention. - **SOAR playbooks** against the async bulk action API for large-scale remediation. Bulk actions initiated from the dashboard remain capped at 1,000 messages per action. - **The Investigations API** for report exports larger than 1,000 results, which is the dashboard download cap. This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-02-02 **Improved Accessibility and Search for Monitoring** We have updated the Monitoring page to provide a more streamlined and insightful experience for administrators, improving both data visualization and dashboard accessibility. - **Enhanced Visual Layout**: Optimized contrast and the introduction of stacked bar charts for clearer data visualization and trend analysis. ![visual-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3212,height=2344,format=webp/_astro/monitoring-bar-charts.Bi-4BuXC.png) - **Improved Accessibility & Usability**: - **Widget Search**: Added search functionality to multiple widgets, including Policies, Submitters, and Impersonation. - **Actionable UI**: All available actions are now accessible via dedicated buttons. - **State Indicators**: Improved UI states to clearly communicate loading, empty datasets, and error conditions. ![buttons-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3178,height=664,format=webp/_astro/monitoring-buttons.DORPJvP_.png) - **Granular Data Breakdowns**: New views for dispositions by month, malicious email details, link actions, and impersonations. ![monthly-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=3202,height=1486,format=webp/_astro/monitoring-monthly-dispositions.CYuI5d9y.png) This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2026-01-12 **Enhanced visibility for post-delivery actions** The Action Log now provides enriched data for post-delivery actions to improve troubleshooting. In addition to success confirmations, failed actions now display the targeted Destination folder and a specific failure reason within the Activity field. Note Error messages will vary depending on whether you are using Google Workspace or Microsoft 365. ![failure-log-example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2348,height=1692,format=webp/_astro/enhanced-visibility-post-delivery-actions.BNiyPtJU.png) This update allows you to see the full lifecycle of a failed action. For instance, if an administrator tries to move an email that has already been deleted or moved manually, the log will now show the multiple retry attempts and the specific destination error. This applies to all Email Security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-12-03 **Reclassifications to Submissions** We have updated the terminology “Reclassify” and “Reclassifications” to “Submit” and “Submissions” respectively. This update more accurately reflects the outcome of providing these items to Cloudflare. Submissions are leveraged to tune future variants of campaigns. To respect data sanctity, providing a submission does not change the original disposition of the emails submitted. ![nav\_example](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=756,height=628,format=webp/_astro/reclassification-submission.B6nL5Hw7.png) This applies to all Email Security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-11-18 **Adjustment to Final Disposition Column** #### Adjustment to Final Disposition column #### The **Final Disposition** column in **Submissions** > **Team Submissions** tab is changing for non-Phishguard customers. #### What's Changing - Column will be called **Status** instead of **Final Disposition** - Column status values will now be: **Submitted**, **Accepted** or **Rejected**. #### Next Steps We will listen carefully to your feedback and continue to find comprehensive ways to communicate updates on your submissions. Your submissions will continue to be addressed at an even greater rate than before, fuelling faster and more accurate email security improvement. ## 2025-10-17 **On-Demand Security Report** You can now generate on-demand security reports directly from the Cloudflare dashboard. This new feature provides a comprehensive overview of your email security posture, making it easier than ever to demonstrate the value of Cloudflare’s Email security to executives and other decision makers. These reports offer several key benefits: - **Executive Summary:** Quickly view the performance of Email security with a high-level executive summary. - **Actionable Insights:** Dive deep into trend data, breakdowns of threat types, and analysis of top targets to identify and address vulnerabilities. - **Configuration Transparency:** Gain a clear view of your policy, submission, and domain configurations to ensure optimal setup. - **Account Takeover Risks:** Get a snapshot of your M365 risky users (requires a Microsoft Entra ID P2 license and [M365 SaaS integration ↗︎](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/microsoft-365/)). To get started, refer to [Download a security report](https://developers.cloudflare.com/cloudflare-one/email-security/monitoring/download-report/#download-a-security-report). ![Report](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1009,height=571,format=webp/_astro/report.CbkPa8Jt.png) This feature is available across the following Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-09-23 **Invalid Submissions Feedback** Email security relies on your submissions to continuously improve our detection models. However, we often receive submissions in formats that cannot be ingested, such as incomplete EMLs, screenshots, or text files. To ensure all customer feedback is actionable, we have launched two new features to manage invalid submissions sent to our team and user [submission aliases](https://developers.cloudflare.com/cloudflare-one/email-security/settings/submission-settings/submission-addresses/): - **Email Notifications:** We now automatically notify users by email when they provide an invalid submission, educating them on the correct format. To disable notifications, go to **[Settings ↗︎](https://one.dash.cloudflare.com/?to=/:account/email-security/settings)** > **Invalid submission emails** and turn the feature off. ![EmailSec-Invalid-Submissions-Toggle](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1096,height=175,format=webp/_astro/EmailSec-Invalid-Submissions-Toggle.DXjbR6aX.png) - **Invalid Submission dashboard:** You can quickly identify which users need education to provide valid submissions so Cloudflare can provide continuous protection. ![EmailSec-Invalid-Submissions-Dashboard](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1132,height=511,format=webp/_astro/EmailSec-Invalid-Submissions-Dashboard.zuf1on2n.png) Learn more about this feature on [invalid submissions](https://developers.cloudflare.com/cloudflare-one/email-security/submissions/invalid-submissions/). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-09-11 **Regional Email Processing for Germany, India, or Australia** We’re excited to announce that Email security customers can now choose their preferred mail processing location directly from the UI when onboarding a domain. This feature is available for the following onboarding methods: **MX**, **BCC**, and **Journaling**. #### What’s new Customers can now select where their email is processed. The following regions are supported: - **Germany** - **India** - **Australia** Global processing remains the default option, providing flexibility to meet both compliance requirements or operational preferences. #### How to use it When onboarding a domain with MX, BCC, or Journaling: 1. Select the desired processing location (Germany, India, or Australia). 2. The UI will display updated processing addresses specific to that region. 3. For MX onboarding, if your domain is managed by Cloudflare, you can automatically update MX records directly from the UI. #### Availability This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** #### What’s next We’re expanding the list of processing locations to match our [Data Localization Suite (DLS)](https://developers.cloudflare.com/data-localization/) footprint, giving customers the broadest set of regional options in the market without the complexity of self-hosting. ## 2025-09-01 **Updated Email security roles** To provide more granular controls, we refined the [existing roles](https://developers.cloudflare.com/cloudflare-one/roles-permissions/#email-security-roles) for Email security and launched a new Email security role as well. All Email security roles no longer have read or write access to any of the other Zero Trust products: - **Email Configuration Admin** - **Email Integration Admin** - **Email security Read Only** - **Email security Analyst** - **Email security Policy Admin** - **Email security Reporting** To configure [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/email-security/policies/outbound/outbound-dlp/) or [Remote Browser Isolation (RBI)](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/#set-up-clientless-web-isolation), you now need to be an admin for the Zero Trust dashboard with the **Cloudflare Zero Trust** role. Also through customer feedback, we have created a new additive role to allow **Email security Analyst** to create, edit, and delete Email security policies, without needing to provide access via the **Email Configuration Admin** role. This role is called **Email security Policy Admin**, which can read all settings, but has write access to [allow policies](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/allow-policies/), [trusted domains](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/trusted-domains/), and [blocked senders](https://developers.cloudflare.com/cloudflare-one/email-security/policies/inbound/blocked-senders/). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-08-07 **Expanded Email Link Isolation** When you deploy MX or Inline, not only can you apply email link isolation to suspicious links in all emails (including benign), you can now also apply email link isolation to all links of a specified disposition. This provides more flexibility in controlling user actions within emails. For example, you may want to deliver suspicious messages but isolate the links found within them so that users who choose to interact with the links will not accidentally expose your organization to threats. This means your end users are more secure than ever before. ![Expanded Email Link Isolation Configuration](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1600,height=497,format=webp/_astro/expanded-link-actions.DziIg6E8.jpg) To isolate all links within a message based on the disposition, select **Settings** > **Link Actions** > **View** and select **Configure**. As with other other links you isolate, an interstitial will be provided to warn users that this site has been isolated and the link will be recrawled live to evaluate if there are any changes in our threat intel. Learn more about this feature on [Configure link actions ↗︎](https://developers.cloudflare.com/cloudflare-one/email-security/settings/detection-settings/configure-link-actions/). This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-05-15 **Open email attachments with Browser Isolation** You can now safely open email attachments to view and investigate them. What this means is that messages now have a **Attachments** section. Here, you can view processed attachments and their classifications (for example, *Malicious*, *Suspicious*, *Encrypted*). Next to each attachment, a **Browser Isolation** icon allows your team to safely open the file in a **clientless, isolated browser** with no risk to the analyst or your environment. ![Attachment-RBI](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=517,height=155,format=webp/_astro/Attachment-RBI.U9Dp8dJO.png) To use this feature, you must: - Turn on **Allow users to open a remote browser without the device client** in your Zero Trust settings. - Have **Browser Isolation (BISO)** seats assigned. For more details, refer to our [setup guide](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/). Some attachment types may not render in Browser Isolation. If there is a file type that you would like to be opened with Browser Isolation, reach out to your Cloudflare contact. This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-05-08 **Open email links with Browser Isolation** You can now safely open links in emails to view and investigate them. ![Open links with Browser Isolation](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=558,height=204,format=webp/_astro/investigate-links.pYbpGkt5.jpg) From **Investigation**, go to **View details**, and look for the **Links identified** section. Next to each link, the Cloudflare dashboard will display an **Open in Browser Isolation** icon which allows your team to safely open the link in a clientless, isolated browser with no risk to the analyst or your environment. Refer to [Open links](https://developers.cloudflare.com/cloudflare-one/email-security/investigation/search-email/#open-links) to learn more about this feature. To use this feature, you must: - Turn on **Allow users to open a remote browser without the device client** in your Zero Trust settings. - Have **Browser Isolation (RBI)** seats assigned. For more details, refer to our [setup guide](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-04-01 **CASB and Email security** With Email security, you get two free CASB integrations. Use one SaaS integration for Email security to sync with your directory of users, take actions on delivered emails, automatically provide EMLs for reclassification requests for clean emails, discover CASB findings and more. With the other integration, you can have a separate SaaS integration for CASB findings for another SaaS provider. Refer to [Add an integration](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) to learn more about this feature. ![CASB-EmailSecurity](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=727,height=502,format=webp/_astro/CASB-EmailSecurity.B1wd9be2.png) This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-03-01 **Use Logpush for Email security detections** You can now send detection logs to an endpoint of your choice with Cloudflare Logpush. Filter logs matching specific criteria you have set and select from over 25 fields you want to send. When creating a new Logpush job, remember to select **Email security alerts** as the dataset. ![logpush-detections](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=927,height=688,format=webp/_astro/Logpush-Detections.Dc5tHta3.png) For more information, refer to [Enable detection logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/email-security-logs/#enable-detection-logs). This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-27 **Check status of Email security or Area 1** Concerns about performance for Email security or Area 1? You can now check the operational status of both on the [Cloudflare Status page ↗︎](https://www.cloudflarestatus.com/). For Email security, look under **Cloudflare Sites and Services**. - **Dashboard** is the dashboard for Cloudflare, including Email security - **Email security (Zero Trust)** is the processing of email - **API** are the Cloudflare endpoints, including the ones for Email security For Area 1, under **Cloudflare Sites and Services**: - **Area 1 - Dash** is the dashboard for Cloudflare, including Email security - **Email security (Area1)** is the processing of email - **Area 1 - API** are the Area 1 endpoints ![Status-page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=792,height=348,format=webp/_astro/Status-Page.DcFJ1286.png) This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-25 **Use DLP Assist for M365** Cloudflare Email security customers who have Microsoft 365 environments can quickly deploy an Email DLP (Data Loss Prevention) solution for free. Simply deploy our add-in, create a DLP policy in Cloudflare, and configure Outlook to trigger behaviors like displaying a banner, alerting end users before sending, or preventing delivery entirely. Refer to [Outbound Data Loss Prevention](https://developers.cloudflare.com/cloudflare-one/email-security/policies/outbound/outbound-dlp/) to learn more about this feature. In GUI alert: ![DLP-Alert](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1357,height=212,format=webp/_astro/DLP-Alert.5s-fbKn3.png) Alert before sending: ![DLP-Pop-up](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1362,height=479,format=webp/_astro/DLP-Pop-up.0gkYy7o5.png) Prevent delivery: ![DLP-Blocked](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1353,height=329,format=webp/_astro/DLP-Blocked.CmQkGrnM.png) This feature is available across these Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2025-02-07 **Open email links with Security Center** You can now investigate links in emails with Cloudflare Security Center to generate a report containing a myriad of technical details: a phishing scan, SSL certificate data, HTTP request and response data, page performance data, DNS records, what technologies and libraries the page uses, and more. ![Open links in Security Center](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1118,height=402,format=webp/_astro/Open-Links-Security-Center.b-LJU4YB.png) From **Investigation**, go to **View details**, and look for the **Links identified** section. Select **Open in Security Center** next to each link. **Open in Security Center** allows your team to quickly generate a detailed report about the link with no risk to the analyst or your environment. For more details, refer to [Open links](https://developers.cloudflare.com/cloudflare-one/email-security/investigation/search-email/#open-links). This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2024-12-19 **Escalate user submissions** After you triage your users' submissions (that are machine reviewed), you can now escalate them to our team for reclassification (which are instead human reviewed). User submissions from the submission alias, PhishNet, and our API can all be escalated. ![Escalate](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=897,height=434,format=webp/_astro/Escalate.CwXPIyM3.png) From **Reclassifications**, go to **User submissions**. Select the three dots next to any of the user submissions, then select **Escalate** to create a team request for reclassification. The Cloudflare dashboard will then show you the submissions on the **Team Submissions** tab. Refer to [User submissions](https://developers.cloudflare.com/cloudflare-one/email-security/submissions/user-submissions/) to learn more about this feature. This feature is available across these Email security packages: - **Advantage** - **Enterprise** - **Enterprise + PhishGuard** ## 2024-12-19 **Increased transparency for phishing email submissions** You now have more transparency about team and user submissions for phishing emails through a **Reclassification** tab in the Zero Trust dashboard. Reclassifications happen when users or admins [submit a phish](https://developers.cloudflare.com/cloudflare-one/email-security/settings/submission-settings/) to Email security. Cloudflare reviews and - in some cases - reclassifies these emails based on improvements to our machine learning models. This new tab increases your visibility into this process, allowing you to view what submissions you have made and what the outcomes of those submissions are. ![Use the Reclassification area to review submitted phishing emails](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1645,height=758,format=webp/_astro/reclassifications-tab.yDgtjG51.png) ## 2024-11-07 **Use Logpush for Email security user actions** You can now send user action logs for Email security to an endpoint of your choice with Cloudflare Logpush. Filter logs matching specific criteria you have set or select from multiple fields you want to send. For all users, we will log the date and time, user ID, IP address, details about the message they accessed, and what actions they took. When creating a new Logpush job, remember to select **Audit logs** as the dataset and filter by: - **Field**: `"ResourceType"` - **Operator**: `"starts with"` - **Value**: `"email_security"`. ![Logpush-user-actions](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=829,height=454,format=webp/_astro/Logpush-User-Actions.D14fWgmq.png) For more information, refer to [Enable user action logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/email-security-logs/#enable-user-action-logs). This feature is available across all Email security packages: - **Enterprise** - **Enterprise + PhishGuard** ## 2024-12-19 **Email security expanded folder scanning** Microsoft 365 customers can now choose to scan all folders or just the inbox when deploying via the Graph API. ## 2024-08-06 **Email security is live** Email security is now live under Zero Trust. ## 2024-08-06 **Microsoft Graph API deployment.** Customers using Microsoft Office 365 can set up Email security via Microsoft Graph API. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/email-security/#page","headline":"Email security","description":"Track updates and changes to Cloudflare One features.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/email-security/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/email-security/og.png?v=c02f05aa99e84d8f","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare Gateway. title: Gateway image: https://developers.cloudflare.com/cloudflare-one/changelog/gateway/og.png?v=99a900cbe73b71a8 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Gateway Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/gateway/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/gateway.xml) ## 2026-10-15 **Application Library now supports custom applications** Starting today, you can create [custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) in the [Application Library](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/) and reference them in Gateway DNS, Network, and HTTP policies. You can define an application with hostnames, IP subnets, or both. Then, optionally add TCP or UDP ports or port ranges to restrict HTTP and Network matching. ![Custom application form with a name, application ID, category, two hostnames, and a TCP port 443 constraint](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1928,height=1108,format=webp/_astro/custom-application-create.hLzR_NQZ.png) This release also improves search and filtering in the Application Library, updates the interfaces, data, and metrics used to review applications, and makes it easier to select and manage applications in the Gateway policy builder. ![Gateway HTTP policy builder with a custom application selected in the Application selector under the Artificial Intelligence category](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1472,height=1324,format=webp/_astro/custom-application-gateway-policy-builder.DFnrNoHS.png) For more information, refer to [Custom applications](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) and [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2026-10-15 **Gateway and Workers integration is now in public beta** Cloudflare Gateway now integrates with Cloudflare Workers in public beta on all Zero Trust plans. You can use the **Forward** action in [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) to run your own code on matching, permitted traffic without managing a separate proxy. The **Forward** action lets you transform HTTP requests and responses, return a coaching page, or run background tasks such as Slack notifications and R2 captures. Your Worker receives the request and [Gateway context](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/available-context/), including connection metadata, user identity, and device posture when available. ![A matching Gateway Forward policy sends HTTP traffic to a Worker, which processes requests and responses for Internet or private-network upstream services.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2048,height=1053,format=webp/_astro/gateway-workers-forward.CFUFJAE0.png) Gateway handles the proxy connection, TLS decryption, and upstream routing. It evaluates HTTP request policies before Forward policies and inspects the final response before returning it to the user. Gateway inspects the original request body before delivering it to your Worker. A body-inspection Block decision can interrupt the Worker. To get started, [deploy a Worker and configure a Forward policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/forward-traffic/), or adapt one of the [Worker templates](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/worker-templates/). ## 2026-10-13 **Request Gateway DNS64 through DNS locations and EDNS** You can now request DNS64 through Cloudflare Gateway DNS location settings or Extension Mechanisms for DNS (EDNS) options. DNS64 synthesizes `AAAA` records from `A` records for IPv6-only networks. These networks require network address translation from IPv6 to IPv4 (NAT64). Turn on **Enable DNS64** for a location, or include an empty EDNS option `65051` in individual queries. Both mechanisms support UDP, TCP, DNS over TLS (DoT), and DNS over HTTPS (DoH). For example, request DNS64 through EDNS with `dig`: ```bash dig @"" ipv4only.arpa AAAA +ednsopt=65051 +short ``` The existing `cf-dns-options: dns64` DoH header remains supported independently. DNS64 is off by default. Each mechanism independently requests synthesis. For configuration, API update behavior, and request examples, refer to [DNS64](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns64/). ## 2026-10-07 **Cloudflare Organizations is generally available** Cloudflare Organizations is now generally available for Enterprise customers and MSSP/Distributor partners. Organizations provides a top-level container for centrally managing accounts, members, analytics, and shared policies. Organization Super Administrators receive implicit access to every account in their Organization without requiring separate account memberships. Enterprise customers can manage accounts in a single-tier Organization. MSSP/Distributor partners can use nested sub-organizations to manage customer accounts. Organization Roles remains in beta, and current product limitations still apply. For more information, refer to [Cloudflare Organizations](https://developers.cloudflare.com/fundamentals/organizations/) and [current limitations](https://developers.cloudflare.com/fundamentals/organizations/limitations/). ## 2026-09-30 **Role-based access control for Browser Isolation policies** [Isolation policies](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/) support role-based access control (RBAC). Because isolation policies are Gateway HTTP policies with the *Isolate* action, Gateway's account-level and resource-scoped roles apply to them directly. Use the `Zero Trust HTTP Policies Admin` account-level role to grant access to all HTTP policies in the account. You can also assign a [resource-scoped role](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/) to let a team member manage a specific isolation policy without exposing other Gateway resources. [Policy settings](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/isolation-policies/#policy-settings) such as copy/paste, file download/upload, keyboard, and printing are part of the policy object and follow the same permissions. For setup instructions, refer to [Granular permissions for Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/). ## 2026-09-29 **Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs** You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and `cloudflared` replica received each session. [Gateway network logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#network-logs) and [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) now identify two new kinds of traffic: - **Mesh** — Traffic sent from or delivered to a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) node. Previously, Mesh nodes were logged the same way as devices running the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/), because Mesh nodes run the client in headless mode. - **Workers VPC** — Traffic sent by a Worker through a [Workers VPC](https://developers.cloudflare.com/workers-vpc/) binding. Previously, Workers VPC sessions were not recorded in Network Session Logs. ![Viewing Mesh and Workers VPC traffic in Gateway network logs](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1439,height=796,format=webp/_astro/2026-09-28-mesh-workers-vpc-network-logs.iGvLKYk7.gif) #### Gateway network logs To view these values in the dashboard, go to **Zero Trust** > **Insights & Logs** > **Logs** > **Network logs**, select **Columns**, and turn on **Traffic Source** and **Traffic Destination**. Both values also appear under **Network query details** when you open a log entry. #### Network Session Logs The `zero_trust_network_sessions` dataset, available through [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/), includes the following fields: | Field | Description | | --- | --- | | `OnrampType` | How the session entered Cloudflare One. Values: `CF1_CLIENT`, `MESH`, `WORKERS_VPC`, `MAGIC`, `OTHER`. | | `Offramp` | Where the session was routed. Sessions routed to a Mesh node report `MESH`. | | `SourceName` | Name of the Worker that started the session. Only populated for Workers VPC sessions. | | `SourceID` | Stable identifier of the Worker that started the session. Only populated for Workers VPC sessions. | | `DestinationReplicaID` | The replica that served the session, such as a specific replica of a Mesh node or a `cloudflared` replica of a Cloudflare Tunnel. | For example, `OnrampType = 'WORKERS_VPC' AND Offramp = 'MESH'` returns every session where a Worker reached a service behind a Mesh node, and `SourceName` tells you which Worker it was. Redeploy your Workers `SourceName` and `SourceID` are only populated for Workers deployed after 29 September 2026. To include them for an existing Worker, redeploy it — for example, with `npx wrangler deploy`. No code changes are required. #### See which tunnel and replica received a session With `DestinationReplicaID`, you can now confirm which [Cloudflare Tunnel](https://developers.cloudflare.com/tunnel/) and which `cloudflared` replica received traffic for a specific session. Combine it with the existing `DestinationTunnelID` field to trace a session to an exact tunnel replica — or Mesh node replica — when you run multiple replicas for high availability. The replica ID matches the **Connector ID** shown in the dashboard, so you can [stream that replica's logs](https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming) with `cloudflared tail --connector-id`. Sessions logged before this change are not backfilled. For all available fields, refer to [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/). ## 2026-09-23 **Traffic Destination selector in Gateway policies** Gateway [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) policies now include a **Traffic Destination** selector that identifies how traffic exits Cloudflare. This allows administrators to write policies that target specific off-ramp methods - for example, applying different rules to traffic destined for the public Internet compared to traffic routed through Cloudflare Tunnel or Cloudflare WAN. #### Available traffic destination values | UI name | API value | Description | | --- | --- | --- | | Internet | `internet` | Traffic to the public Internet | | Cloudflare WAN | `cloudflare_wan` | Traffic through a [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/) connection | | Cloudflare Tunnel | `cloudflare_tunnel` | Traffic to a private origin through [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) | | Cloudflare One Client | `device_client` | Traffic to another device running the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) | | Mesh | `mesh` | Traffic through a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) node | The selector uses the `net.offramp.type` API field in both HTTP and Network policies. | UI name | API example | | --- | --- | | Traffic Destination | `net.offramp.type == "internet"` | For more information, refer to [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/). ## 2026-08-13 **Detect and control software package downloads with package registry security** Cloudflare Gateway can now detect software package downloads and give you policy control over supply chain traffic. When a developer or CI/CD pipeline downloads a package through Gateway, the proxy identifies the registry protocol from the request URL and extracts the package ecosystem, name, version, and namespace. You can then write [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) using `pkg.*` selectors to allow or block package downloads. #### Supported ecosystems Gateway detects package downloads for the following ecosystems: | Ecosystem | Namespace | | --- | --- | | npm | Scope (for example, `@babel`) | | PyPI | -- | | RubyGems | -- | | Cargo | -- | | Go | Module path | | Maven | Group ID | | NuGet | -- | #### Selectors In the dashboard, select **Package Ecosystem** to access the package registry selectors. After selecting a single ecosystem, nested fields for package name, version, and namespace become available. Five `pkg.*` selectors are available for HTTP policies with the Allow and Block actions: | Selector | Description | | --- | --- | | `pkg.ecosystem` | The package ecosystem detected from the request URL. | | `pkg.name` | The package name extracted from the download URL. | | `pkg.version` | The package version, with support for ecosystem-aware comparison operators. | | `pkg.namespace` | The package namespace, when the ecosystem supports one. | | `pkg.purl` | The [Package URL (PURL) ↗︎](https://github.com/package-url/purl-spec) derived from the detected coordinates. Available in the API only. | Detection is based on the registry protocol rather than the hostname, so it works the same way whether traffic goes to a public registry, a corporate proxy such as Artifactory or Nexus, or a self-hosted mirror. Package registry security requires [TLS decryption](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/) to be turned on. For more information, refer to [Package registry security](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/package-registry-security/). ## 2026-08-12 **MCP protocol detection and AI Security dashboard** Cloudflare Gateway now automatically detects [Model Context Protocol (MCP) ↗︎](https://www.cloudflare.com/learning/ai/what-is-model-context-protocol-mcp/) traffic flowing through your network. MCP is the standard protocol used by AI agents to connect to external tools and data sources. Gateway identifies MCP requests by inspecting protocol-specific headers and payload characteristics. #### MCP policy selector A new **Is MCP** selector (`experimental.is_mcp`) is available in [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#is-mcp). Use this selector to build Gateway rules that allow, block, or isolate MCP traffic. This selector is currently in beta and may change before general availability. For example, the following policy blocks MCP traffic that does not arrive through an approved [MCP portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/): | Selector | Operator | Value | Logic | Action | | --- | --- | --- | --- | --- | | Is MCP | is | *True* | And | Block | | Traffic Source | is not | *MCP portal* | | | ![Example Gateway policy that blocks MCP traffic not arriving through an MCP portal](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1104,height=664,format=webp/_astro/gateway-block-unknown-mcp.B2Ainj8x.png) #### AI security report A new **AI security report** dashboard under **Insights & Logs > Dashboards** provides visibility into MCP usage across your organization. The dashboard includes: - Total MCP request volume, unique users, and unique MCP servers - A timeseries chart of unique MCP servers observed over time - A summary of Gateway policies that target MCP traffic ![AI security report dashboard showing MCP detection data including total MCP requests, users, servers, and Gateway policies for MCP](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2406,height=928,format=webp/_astro/gateway-mcp-dashboard.C9jPahkp.png) For more information, refer to [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). ## 2026-08-12 **Traffic Source selector in Gateway policies** Gateway [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) policies now include a **Traffic Source** selector that identifies how traffic reaches Cloudflare. This allows administrators to write policies that target specific on-ramp methods - for example, applying different rules to traffic arriving via the Cloudflare One Client compared to traffic routed through an MCP portal or a proxy endpoint. #### Available traffic source values | UI name | API value | Description | | --- | --- | --- | | Device client | `device_client` | Traffic from the [Cloudflare One Client (WARP)](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) | | Mesh | `mesh` | Traffic from a [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) connector | | Cloudflare WAN | `cloudflare_wan` | Traffic from [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-wan/zero-trust/cloudflare-gateway/) (Magic WAN) | | Clientless RDP | `clientless_rdp` | Traffic from a clientless RDP session | | Proxy endpoint | `proxy_endpoint` | Traffic from a [proxy endpoint](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) (PAC file) | | Clientless Browser Isolation | `agentless_biso` | Traffic from [clientless Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) | | MCP portal | `mcp_portal` | Traffic from an [MCP portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) | The selector uses the `net.onramp.type` API field in both HTTP and Network policies. | UI name | API example | | --- | --- | | Traffic Source | `net.onramp.type == "device_client"` | #### Browser Isolation selector A **Browser Isolation** selector is also available in Network and HTTP policies. This selector identifies whether the current session is running inside [Remote Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/), allowing administrators to apply different policy behavior to isolated traffic. | UI name | API example | | --- | --- | | Browser Isolation | `net.is_isolated == true` | For more information, refer to [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) and [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/). ## 2026-08-11 **Hostname routing is now generally available, with a new public IP range for initial resolved IPs** [Hostname routing ↗︎](https://blog.cloudflare.com/tunnel-hostname-routing/) is now generally available. Instead of managing static IP lists and routes, you can route traffic by hostname across multiple Cloudflare One connectors: - **Cloudflare Tunnel**: route a [private hostname](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) (for example, `wiki.internal.local`) to a private application behind your tunnel, or a [public hostname](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) (for example, `bank.example.com`) to egress through a specific tunnel and anchor traffic to a dedicated exit node. - **Cloudflare Mesh**: attract a [private or public hostname's traffic](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) to a Mesh node. Alongside GA, the default IPv4 range used for initial resolved IPs (also called token IPs) is changing from a Carrier-Grade NAT (CGNAT) range to a public Cloudflare-owned range: - **IPv4**: `172.64.128.0/20` - **IPv6**: `2606:4700:0cf1:4000::/64` This is the default range. You can [configure a custom initial resolved IP range](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/) for IPv4 if it conflicts with your existing network. **Why this is changing:** Starting with [Chrome 142 ↗︎](https://developer.chrome.com/release-notes/142), Local Network Access (LNA) restrictions block background requests to CGNAT addresses (`100.64.0.0/10`), which included the previous initial resolved IP default (`100.80.0.0/16`). LNA is implemented at the Chromium engine level, so it affects all Chromium-based browsers (for example, Microsoft Edge, Brave, and Opera), not only Google Chrome. This could silently break hostname-based Gateway features for users of these browsers, and required Chrome Enterprise policy workarounds. The new default range is public Cloudflare address space, so it is not affected by this restriction. **What is affected:** Initial resolved IPs are used by several features that associate a DNS query with the network connection that follows it: - [Private](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/) and [public](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/egress-cloudflared/) hostname routing for Cloudflare Tunnel - [Hostname routes](https://developers.cloudflare.com/mesh/features/routes/#hostname-routes) for Cloudflare Mesh - [Access private applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) on non-HTTPS ports - [Egress policy host selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/host-selectors/) (Domain, Host, Application, and Content Categories) You can check your account's current range, or configure a custom range, at any time from **Networking** > **IP addresses** > **Address space** > **Custom IPs**, or using the [Initial Resolved IP Subnet API](). [Go to **Custom IPs** ↗](https://dash.cloudflare.com/?to=/:account/ip-addresses/address-space/custom-ips) For full instructions, refer to [Configure initial resolved IPs](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/). The IPv6 range (`2606:4700:0cf1:4000::/64`) is unchanged and is not affected by this restriction. The default IPv4 range, and all Cloudflare One IPv6 ranges, are automatically routed through the Cloudflare One Client and do not require any Split Tunnel configuration. Refer to [Automatically managed ranges](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/#automatically-managed-ranges) for details. If you were relying on a Chrome Enterprise policy workaround (such as `LocalNetworkAccessRestrictionsTemporaryOptOut`) while your account was still on the legacy CGNAT-based range, refer to [Google Chrome restricts access to private hostnames](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/connect-private-hostname/#google-chrome-restricts-access-to-private-hostnames) for next steps. ## 2026-07-28 **Control Cloudflare Gateway DNS caching with a maximum TTL setting** You can now set a maximum time-to-live (TTL) for DNS responses returned by Gateway. When an upstream DNS record has a TTL that exceeds the configured maximum, Gateway caps it to your specified value. This ensures that DNS policy changes - such as blocking a newly identified malicious domain - take effect faster across all clients. ![The maximum DNS TTL setting in Traffic policies > Traffic settings, showing a numeric input field that accepts values between 60 and 36,000 seconds](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2170,height=294,format=webp/_astro/gateway-max-ttl-traffic-settings.BRF3NUMp.png) The setting is available at two levels: - **Account level** - In **Traffic Policies** > **Traffic Settings**, under **Proxy and inspection**. This sets the default cap for all DNS locations. - **Per-location** - Each [DNS location](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/) can inherit the account setting, disable the cap, or override it with a custom value. Two new fields are also available in DNS logs: `upstream_record_ttls` (the original TTL from the upstream response) and `applied_max_ttl` (the cap Gateway applied). These appear in the DNS logs column picker and in Logpush datasets. For more information, refer to [Maximum DNS TTL](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/maximum-dns-ttl/). ## 2026-07-17 **New header control options for Gateway HTTP policies** Cloudflare Gateway now supports advanced header control on [Allow policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#allow). Administrators can add, overwrite, or delete headers on matching requests using static values or dynamic variables. #### Header operations Gateway HTTP policies using the Allow action support three operations in `rule_settings`: | Operation | API field | Behavior | | --- | --- | --- | | Add | `add_headers` | Appends a value to the header. Existing values are preserved. | | Overwrite | `set_headers` | Replaces the header value. Creates the header if it does not exist. | | Delete | `delete_headers` | Removes the header from the request. | Gateway applies operations in order: delete, then overwrite, then add. #### Dynamic variables Header values can include dynamic variables using the `@{...}` syntax. Gateway resolves variables at request time from identity, device, and network context. | Variable | Description | | --- | --- | | `@{identity.email}` | User email from the identity provider | | `@{identity.name}` | User display name from the identity provider | | `@{identity.id}` | Cloudflare identity UUID | | `@{identity.groups}` | Identity provider group memberships | | `@{identity.SAML}` | SAML attributes (if configured) | | `@{identity.OIDC}` | OIDC claims (if configured) | | `@{source.ip}` | Source IP of the connection | | `@{destination.ip}` | Destination IP of the request | | `@{device.id}` | Cloudflare One Client device UUID | | `@{device.posture}` | Device posture check results (JSON string) | You can mix static text and dynamic variables in a single header value. For example, `user-@{identity.email}` resolves to `user-jdoe@example.com`. For more information, refer to [Custom headers](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tenant-control/). ## 2026-07-15 **Internal DNS is now generally available** [Internal DNS](https://developers.cloudflare.com/dns/internal-dns/) is now generally available. Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane you already use for public DNS, Zero Trust, and application services. #### Why it matters - **Consolidate DNS operations.** Public and private DNS run on one platform, with one API, one audit trail, and one place to set policy. - **Simplify split-horizon DNS.** Internal and external resolution are defined as separate [views](https://developers.cloudflare.com/dns/internal-dns/dns-views/) over shared zones, managed from a single control plane — so there is no drift to chase down. - **Extend Zero Trust to DNS.** Resolver policies decide which users and devices resolve against which view, enforced by the same [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) that already governs the rest of your traffic. Setting up Internal DNS takes three steps: create a zone, create a view, and define a resolver policy. ```json POST /zones { "account": { "id": "" }, "name": "corp.internal", "type": "internal" } ``` Internal DNS is included with [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) for Enterprise customers. To get started, refer to the [Internal DNS documentation](https://developers.cloudflare.com/dns/internal-dns/). ## 2026-06-30 **New permissions and roles for Gateway policies and lists** You can now assign granular, resource-scoped roles for [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) firewall policies and [Zero Trust lists](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/). Administrators can delegate access to specific policy types or list management without granting account-wide or product-wide control. #### What is new When you [add a member](https://developers.cloudflare.com/fundamentals/manage-members/manage/) or create a [permission policy](https://developers.cloudflare.com/fundamentals/manage-members/policies/), the following resource-scoped roles are now available: | Role | Description | | --- | --- | | Zero Trust Gateway Firewall Policies Admin | Can view and edit all Gateway firewall policies, including DNS, HTTP, and Network policies. | | Zero Trust Gateway DNS Policies Admin | Can view and edit Gateway DNS policies. | | Zero Trust Gateway HTTP Policies Admin | Can view and edit Gateway HTTP policies. | | Zero Trust Gateway Network Policies Admin | Can view and edit Gateway Network policies. | | Zero Trust Gateway Egress Policies Admin | Can view and edit Gateway Egress policies. | | Zero Trust Gateway Resolver Policies Admin | Can view and edit Gateway Resolver policies. | | Zero Trust Gateway Policies Admin | Can view and edit all Gateway policies. | | Zero Trust Gateway Policies Read | Can view all Gateway policies. | | Zero Trust Gateway Read Only | Can view all Gateway resources. | | Zero Trust DNS Locations Admin | Can view and edit DNS locations. | | Zero Trust Proxy Endpoints Admin | Can view and edit Gateway Proxy Endpoints. | | Zero Trust Account Lists Admin | Can view and edit all Gateway and Access lists. | | Zero Trust Account Lists Read | Can view all Gateway and Access lists. | These roles allow you to: - Grant a network engineer write access to Network policies only, without exposing DNS or HTTP policy configuration. - Allow a security analyst to view all Gateway policies in read-only mode for auditing purposes. - Delegate list management to a team that maintains block and allow lists without giving them access to policy configuration. You can also now assign *Resource-scoped roles*. These roles are complementary to existing account-level roles, and allow you to grant access to a specific resource, like an individual Gateway policy or Cloudflare One list. **Existing account-level roles continue to work.** A member with the `Cloudflare Gateway` or `Cloudflare Zero Trust` role retains full access to all Gateway resources. This ensures backward compatibility for existing automation and API tokens. #### Get started - Refer to [Granular permissions for Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/granular-permissions/) for setup instructions and supported resources. - Learn how to [create permission policies](https://developers.cloudflare.com/fundamentals/manage-members/policies/) that use these roles. ## 2026-06-05 **Filter Workers' public Internet traffic using Gateway policies** Workers using a [VPC Network](https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/) binding with `network_id: "cf1:network"` now egress to public Internet destinations through [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). This means your existing Zero Trust traffic policies — DNS, HTTP, Network, and egress — extend to traffic that originates from your Workers, the same way they do for WARP users today. 1. [Worker](https://developers.cloudflare.com/workers/) Calls `env.EGRESS.fetch()` 2. [VPC binding](https://developers.cloudflare.com/workers-vpc/)↓ 3. [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) Bind via [`cf1:network`](https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/) 4. ↓ 5. [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) Policies applied: [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/) [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) 6. ↓ 7. ↗Public Internet Any public hostname or IP [Gateway logsDNSHTTPNetwork](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) What you get by default: - **Visibility.** Worker egress shows up in Gateway [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) logs alongside your other traffic, so you can audit what your Workers are calling and when. - **Enforcement.** Any existing Gateway policy whose selectors match a Worker request will apply — including allow / block lists, DNS category filtering, and HTTP destination rules. If you have already blocked a category for your workforce, your Workers inherit that block. ```jsonc { "vpc_networks": [ { "binding": "EGRESS", "network_id": "cf1:network", "remote": true, }, ], } ``` ```toml [[vpc_networks]] binding = "EGRESS" network_id = "cf1:network" remote = true ``` ```js // Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://developers.cloudflare.com/service/https://api.example.com/data"); ``` ```ts // Egress to a public destination — subject to your Gateway policies and logged const response = await env.EGRESS.fetch("https://developers.cloudflare.com/service/https://api.example.com/data"); ``` For configuration options, refer to [VPC Networks](https://developers.cloudflare.com/workers-vpc/configuration/vpc-networks/). For policy authoring, refer to [Cloudflare Gateway traffic policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2026-05-27 **Write regex using natural language in Cloudflare One** [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) policy selectors which support regular expressions can now be authored in the dashboard using natural language. When building a [policy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/expression-syntax/) with a regex-based selector (like `matches regex`), you can describe what you want to match in plain English and the Cloudflare Agent will generate and validate a corresponding regular expression. ![Write policy regex using natural language](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1000,height=638,format=webp/_astro/gateway-regex-ai-generation.CtJ0S6FS.png) To get started, select a regex-compatible selector in the [Gateway policy builder](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and select the icon. You'll see an input field for natural language, such as "any URL starting with /api/v1" or ".com, .net, and .app hosts which contain `gooogle` in the host." You can also use the tool to explain existing regular expressions. If a policy already contains a regex pattern, you can instantly generate a plain-language description. A built-in feedback mechanism allows you to rate each interaction to help improve output quality over time. For more information, refer to [Cloudflare One firewall policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) and expect to see the same functionality supported soon in [Data loss prevention profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/). ## 2026-05-12 **Create Gateway firewall policies with natural language** Cloudflare Gateway now supports natural language policy creation for [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) firewall policies. Administrators can describe the outcome they want in plain language, and Cloudflare will generate a complete policy rule that populates the policy builder form. ![Create with AI button on the Gateway firewall policies page](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2360,height=1088,format=webp/_astro/gateway-create-with-ai.BYG07coh.png) To create a policy with natural language, select **Create with AI** on any Gateway firewall policy tab. Choose a policy type, describe what the policy should do, and a fully configured rule will appear in the policy builder for review. You can edit any field before saving, or re-generate with a different prompt. The generated policy incorporates your account context - including lists, DLP profiles, applications, and device posture checks - so that references to your existing resources resolve automatically. A built-in feedback mechanism allows you to rate each generated policy and provide optional comments, which Cloudflare uses to improve output quality over time. For more information, refer to [Gateway firewall policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/). ## 2026-04-29 **Gateway Authorization Proxy and hosted PAC files are now generally available** The [Gateway Authorization Proxy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and [hosted PAC files](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) are now generally available for all plan types. Authorization proxy endpoints add an identity-aware option alongside the existing [source IP proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#source-ip-endpoint), using [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) authentication to verify who a user is before applying Gateway filtering — without installing the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/). Cloudflare-hosted PAC files let you create and distribute PAC files directly from Cloudflare One on Cloudflare's global network. These features are ideal for environments where deploying a device client is not an option, such as virtual desktops (VDI) or compliance-restricted endpoints. To get started, refer to the [proxy endpoints documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/). ## 2026-04-24 **Network Session Logs now available for all on-ramps** [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/) are now generated for all traffic proxied through Cloudflare Gateway, regardless of on-ramp type. This includes traffic from [proxy endpoints (PAC files)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) and [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) egress — on-ramps that previously did not generate session logs. Customers who already consume the `zero_trust_network_sessions` dataset via [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/) or [Log Explorer](https://developers.cloudflare.com/observability/logs/log-explorer/) may see increased log volume if they use these on-ramps. For field definitions, refer to [Zero Trust Network Session Logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/). For traffic analysis, refer to [Network session analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/network-sessions/). ## 2026-04-20 **Network session analytics dashboard** The new [Network session analytics](https://developers.cloudflare.com/cloudflare-one/insights/analytics/network-sessions/) dashboard is now available in Cloudflare One. This dashboard provides visibility into your network traffic patterns, helping you understand how traffic flows through your Cloudflare One infrastructure. ![Cloudflare One Network Session Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2926,height=1574,format=webp/_astro/cf1-network-session-analytics.Gl90hEcp.png) #### What you can do with Network session analytics - **Analyze geographic distribution**: View a world map showing where your network traffic originates, with a list of top locations by session count. - **Monitor key metrics**: Track session count, total bytes transferred, and unique users. - **Identify connection issues**: Analyze connection close reasons to troubleshoot network problems. - **Review protocol usage**: See which network protocols (TCP, UDP, ICMP) are most used. #### Dashboard features - **Summary metrics**: Session count, bytes total, and unique users - **Traffic by location**: World map visualization and location list with top traffic sources - **Top protocols**: Breakdown of TCP, UDP, ICMP, and ICMPv6 traffic - **Connection close reasons**: Insights into why sessions terminated (client closed, origin closed, timeouts, errors) #### How to access 1. Log in to [Cloudflare One ↗︎](https://dash.cloudflare.com). 2. Go to **Zero Trust** > **Insights** > **Dashboards**. 3. Select **Network session analytics**. For more information, refer to the [Network session analytics documentation](https://developers.cloudflare.com/cloudflare-one/insights/analytics/network-sessions/). ## 2026-04-14 **Configure how sensitive data appears in DLP payload logs** You can now configure how sensitive data matches are displayed in your DLP payload match logs — giving your incident response team the context they need to validate alerts without compromising your security posture. To get started, go to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), select **Zero Trust** > **Data loss prevention** > **DLP settings** and find the **Payload log masking** card. Previously, all DLP payload logs used a single masking mode that obscured matched data entirely and hid the original character count, making it difficult to distinguish true positives from false positives. This update introduces three options: - **Full Mask (default):** Masks the match while preserving character count and visual formatting (for example, `***-**-****` for a Social Security Number). This is an improvement over the previous default, which did not preserve character count. - **Partial Mask:** Reveals 25% of the matched content while masking the remainder (for example, `***-**-6789`). - **Clear Text:** Stores the full, unmasked violation for deep investigation (for example, `123-45-6789`). **Important:** The masking level you select is applied at detection time, before the payload is encrypted. This means the chosen format is what your team will see after decrypting the log with your private key — the existing encryption workflow is unchanged. **Applies to all enabled detections:** When a masking level other than Full Mask is selected, it applies to all sensitive data matches found within a payload window — not just the match that triggered the policy. Any data matched by your enabled DLP detection entries will be masked at the selected level. For more information, refer to [DLP logging options](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules). ## 2026-04-06 **Organizations is now in public beta for enterprises** We're announcing the public beta of **Organizations** for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location. **What's New** **Organizations \[BETA]**: [Organizations](https://developers.cloudflare.com/fundamentals/organizations/) are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 accounts and 5000 zones, giving larger teams a single place to administer resources at scale. **Self-serve onboarding**: Enterprise customers can [create an Organization](https://developers.cloudflare.com/fundamentals/organizations/setup/) in the dashboard and assign accounts where they are already Super Administrators. **Centralized Account Management**: At launch, every Organization member has the Organization Super Admin role. Organization Super Admins can invite other users and manage any child account under the Organization implicitly. **Shared policies**: Share [WAF](https://developers.cloudflare.com/waf/custom-rules/) or [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/tiered-policies/organizations/) policies across multiple accounts within your Organization to simplify centralized policy management. **Implicit access**: Members of an Organization automatically receive Super Administrator permissions across child accounts, removing the need for explicit membership on each account. Additional Org-level roles will be available over the course of the year. **Unified analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts from a single dashboard for centralized visibility into traffic patterns and security events. **Terraform provider support**: Manage Organizations with infrastructure as code from day one. Provision organizations, assign accounts, and configure settings programmatically with the [Cloudflare Terraform provider ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/organization). **Shared policies**: Share [WAF](https://developers.cloudflare.com/waf/custom-rules/) or [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) policies across multiple accounts within your Organization to simplify centralized policy management. Note Organizations is in Public Beta. You must have an Enterprise account to create an organization, but once created, you can add accounts of any plan type where you are a Super Administrator. For more info: - [Get started with Organizations](https://developers.cloudflare.com/fundamentals/organizations/) - [Set up your Organization](https://developers.cloudflare.com/fundamentals/organizations/setup/) - [Review limitations](https://developers.cloudflare.com/fundamentals/organizations/limitations/) ## 2026-04-01 **Logs UI refresh** Access authentication logs and Gateway activity logs (DNS, Network, and HTTP) now feature a refreshed user interface that gives you more flexibility when viewing and analyzing your logs. ![Screenshot of the new logs UI showing DNS query logs with customizable columns and filtering options](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2984,height=842,format=webp/_astro/cf1-new-logs-ui.DxF4x0l-.png) The updated UI includes: - **Filter by field** - Select any field value to add it as a filter and narrow down your results. - **Customizable fields** - Choose which fields to display in the log table. Querying for fewer fields improves log loading performance. - **View details** - Select a timestamp to view the full details of a log entry. - **Switch to classic view** - Return to the previous log viewer interface if needed. For more information, refer to [Access authentication logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). ## 2026-03-24 **OIDC Claims filtering now available in Gateway Firewall, Resolver, and Egress policies** Cloudflare Gateway now supports [OIDC Claims](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/#oidc-claims) as a selector in Firewall, Resolver, and Egress policies. Administrators can use custom OIDC claims from their identity provider to build fine-grained, identity-based traffic policies across all Gateway policy types. With this update, you can: - Filter traffic in [DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/), [HTTP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/), and [Network](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) firewall policies based on OIDC claim values. - Apply custom [resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) to route DNS queries to specific resolvers depending on a user's OIDC claims. - Control [egress policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/) to assign dedicated egress IPs based on OIDC claim attributes. For example, you can create a policy that routes traffic differently for users with `department=engineering` in their OIDC claims, or restrict access to certain destinations based on a user's role claim. To get started, configure [custom OIDC claims](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/#custom-oidc-claims) on your identity provider and use the **OIDC Claims** selector in the Gateway policy builder. For more information, refer to [Identity-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/). ## 2026-03-04 **Gateway Authorization Proxy and hosted PAC files (open beta)** The [Gateway Authorization Proxy](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and [PAC file hosting](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) are now in open beta for all plan types. Previously, [proxy endpoints](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#source-ip-endpoint) relied on static source IP addresses to authorize traffic, providing no user-level identity in logs or policies. The new authorization proxy replaces IP-based authorization with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) authentication, verifying who a user is before applying Gateway filtering without installing the WARP client. This is ideal for environments where you cannot deploy a device client, such as virtual desktops (VDI), mergers and acquisitions, or compliance-restricted endpoints. #### Key capabilities - **Identity-aware proxy traffic** — Users authenticate through your identity provider (Okta, Microsoft Entra ID, Google Workspace, and others) via Cloudflare Access. Logs now show exactly which user accessed which site, and you can write [identity-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/identity-selectors/) like "only the Finance team can access this accounting tool." - **Multiple identity providers** — Display one or multiple login methods simultaneously, giving flexibility for organizations managing users across different identity systems. - **Cloudflare-hosted PAC files** — Create and host [PAC files](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) directly in Cloudflare One with pre-configured templates for Okta and Azure, hosted at `https://pac.cloudflare-gateway.com//` on Cloudflare's global network. - **Simplified billing** — Each user occupies a seat, exactly like they do with the Cloudflare One Client. No new metrics to track. #### Get started 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Traffic controls** > **Proxy endpoints**. 2. [Create an authorization proxy endpoint](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#authorization-endpoint) and configure Access policies. 3. [Create a hosted PAC file](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#create-a-hosted-pac-file) or write your own. 4. [Configure browsers](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/#3b-configure-browser-to-use-pac-file) to use the PAC file URL. 5. [Install the Cloudflare certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) for HTTPS inspection. For more details, refer to the [proxy endpoints documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) and the [announcement blog post ↗︎](https://blog.cloudflare.com/gateway-authorization-proxy-identity-aware-policies/). ## 2026-02-27 **New protocols added for Gateway Protocol Detection (Beta)** Gateway [Protocol Detection](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/) now supports seven additional protocols in beta: | Protocol | Notes | | --- | --- | | IMAP | Internet Message Access Protocol — email retrieval | | POP3 | Post Office Protocol v3 — email retrieval | | SMTP | Simple Mail Transfer Protocol — email sending | | MYSQL | MySQL database wire protocol | | RSYNC-DAEMON | rsync daemon protocol | | LDAP | Lightweight Directory Access Protocol | | NTP | Network Time Protocol | These protocols join the existing set of detected protocols (HTTP, HTTP2, SSH, TLS, DCERPC, MQTT, and TPKT) and can be used with the *Detected Protocol* selector in [Network policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) to identify and filter traffic based on the application-layer protocol, without relying on port-based identification. If protocol detection is enabled on your account, these protocols will automatically be logged when detected in your Gateway network traffic. For more information on using Protocol Detection, refer to the [Protocol detection documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/). ## 2025-12-17 **Shadow IT - domain level SaaS analytics** Zero Trust has again upgraded its **Shadow IT analytics**, providing you with unprecedented visibility into your organizations use of SaaS tools. With this dashboard, you can review who is using an application and volumes of data transfer to the application. With this update, you can review data transfer metrics at the domain level, rather than just the application level, providing more granular insight into your data transfer patterns. ![New Domain Level Metrics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1800,height=452,format=webp/_astro/shadow-it-domain.DoZnGAtf.png) These metrics can be filtered by all available filters on the dashboard, including user, application, or content category. Both the analytics and policies are accessible in the Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control. ## 2025-11-06 **Applications to be remapped to the new categories** We have previously added new application categories to better reflect their content and improve HTTP traffic management: refer to [Changelog](https://developers.cloudflare.com/cloudflare-one/changelog/gateway/#2025-10-28). While the new categories are live now, we want to ensure you have ample time to review and adjust any existing rules you have configured against old categories. The remapping of existing applications into these new categories will be completed by January 30, 2026. This timeline allows you a dedicated period to: - Review the new category structure. - Identify any policies you have that target the older categories. - Adjust your rules to reference the new, more precise categories before the old mappings change. Once the applications have been fully remapped by January 30, 2026, you might observe some changes in the traffic being mitigated or allowed by your existing policies. We encourage you to use the intervening time to prepare for a smooth transition. **Applications being remappedd** | Application Name | Existing Category | New Category | | --- | --- | --- | | Google Photos | File Sharing | Photography & Graphic Design | | Flickr | File Sharing | Photography & Graphic Design | | ADP | Human Resources | Business | | Greenhouse | Human Resources | Business | | myCigna | Human Resources | Health & Fitness | | UnitedHealthcare | Human Resources | Health & Fitness | | ZipRecruiter | Human Resources | Business | | Amazon Business | Human Resources | Business | | Jobcenter | Human Resources | Business | | Jobsuche | Human Resources | Business | | Zenjob | Human Resources | Business | | DocuSign | Legal | Business | | Postident | Legal | Business | | Adobe Creative Cloud | Productivity | Photography & Graphic Design | | Airtable | Productivity | Development | | Autodesk Fusion360 | Productivity | IT Management | | Coursera | Productivity | Education | | Microsoft Power BI | Productivity | Business | | Tableau | Productivity | Business | | Duolingo | Productivity | Education | | Adobe Reader | Productivity | Business | | AnpiReport | Productivity | Travel | | ビズリーチ | Productivity | Business | | doda (デューダ) | Productivity | Business | | 求人ボックス | Productivity | Business | | マイナビ2026 | Productivity | Business | | Power Apps | Productivity | Business | | RECRUIT AGENT | Productivity | Business | | シフトボード | Productivity | Business | | スタンバイ | Productivity | Business | | Doctolib | Productivity | Health & Fitness | | Miro | Productivity | Photography & Graphic Design | | MyFitnessPal | Productivity | Health & Fitness | | Sentry Mobile | Productivity | Travel | | Slido | Productivity | Photography & Graphic Design | | Arista Networks | Productivity | IT Management | | Atlassian | Productivity | Business | | CoderPad | Productivity | Business | | eAgreements | Productivity | Business | | Vmware | Productivity | IT Management | | Vmware Vcenter | Productivity | IT Management | | AWS Skill Builder | Productivity | Education | | Microsoft Office 365 (GCC) | Productivity | Business | | Microsoft Exchange Online (GCC) | Productivity | Business | | Canva | Sales & Marketing | Photography & Graphic Design | | Instacart | Shopping | Food & Drink | | Wawa | Shopping | Food & Drink | | McDonald's | Shopping | Food & Drink | | Vrbo | Shopping | Travel | | American Airlines | Shopping | Travel | | Booking.com | Shopping | Travel | | Ticketmaster | Shopping | Entertainment & Events | | Airbnb | Shopping | Travel | | DoorDash | Shopping | Food & Drink | | Expedia | Shopping | Travel | | EasyPark | Shopping | Travel | | UEFA Tickets | Shopping | Entertainment & Events | | DHL Express | Shopping | Business | | UPS | Shopping | Business | For more information on creating HTTP policies, refer to [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2025-10-28 **New Application Categories added for HTTP Traffic Management** To give you precision and flexibility while creating policies to block unwanted traffic, we are introducing new, more granular application categories in the Gateway product. We have added the following categories to provide more precise organization and allow for finer-grained policy creation, designed around how users interact with different types of applications: - Business - Education - Entertainment & Events - Food & Drink - Health & Fitness - Lifestyle - Navigation - Photography & Graphic Design - Travel The new categories are live now, but we are providing a transition period for existing applications to be fully remapped to these new categories. The full remapping will be completed by January 30, 2026. We encourage you to use this time to: - Review the new category structure. - Identify and adjust any existing HTTP policies that reference older categories to ensure a smooth transition. For more information on creating HTTP policies, refer to [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2025-10-20 **Schedule DNS policies from the UI** Admins can now create [scheduled DNS policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/timed-policies/) directly from the Zero Trust dashboard, without using the API. You can configure policies to be active during specific, recurring times, such as blocking social media during business hours or gaming sites on school nights. - **Preset Schedules**: Use built-in templates for common scenarios like Business Hours, School Days, Weekends, and more. - **Custom Schedules**: Define your own schedule with specific days and up to three non-overlapping time ranges per day. - **Timezone Control**: Choose to enforce a schedule in a specific timezone (for example, US Eastern) or based on the local time of each user. - **Combined with Duration**: Policies can have both a schedule and a duration. If both are set, the duration's expiration takes precedence. You can see the flow in the demo GIF: ![Schedule DNS policies demo](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1053,height=879,format=webp/_astro/gateway-dns-scheduled-policies-ui.Cf4l1OTE.gif) This update makes time-based DNS policies accessible to all Gateway customers, removing the technical barrier of the API. ## 2025-10-10 **New domain categories added** We have added three new domain categories under the Technology parent category, to better reflect online content and improve DNS filtering. **New categories added** | Parent ID | Parent Name | Category ID | Category Name | | --- | --- | --- | --- | | 26 | Technology | 194 | Keep Awake Software | | 26 | Technology | 192 | Remote Access | | 26 | Technology | 193 | Shareware/Freeware | Refer to [Gateway domain categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) to learn more. ## 2025-09-30 **Application granular controls for operations in SaaS applications** Gateway users can now apply granular controls to their file sharing and AI chat applications through [HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies). The new feature offers two methods of controlling SaaS applications: - **Application Controls** are curated groupings of Operations which provide an easy way for users to achieve a specific outcome. Application Controls may include *Upload*, *Download*, *Prompt*, *Voice*, and *Share* depending on the application. - **Operations** are controls aligned to the most granular action a user can take. This provides a fine-grained approach to enforcing policy and generally aligns to the SaaS providers API specifications in naming and function. Get started using [Application Granular Controls](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/granular-controls) and refer to the list of [supported applications](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/granular-controls/#compatible-applications). ## 2025-09-25 **Refine DLP Scans with New Body Phase Selector** You can now more precisely control your HTTP DLP policies by specifying whether to scan the request or response body, helping to reduce false positives and target specific data flows. In the Gateway HTTP policy builder, you will find a new selector called *Body Phase*. This allows you to define the direction of traffic the DLP engine will inspect: - *Request Body*: Scans data sent from a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts. - *Response Body*: Scans data sent to a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data. For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to *Request Body*, the policy will only trigger if the user attempts to upload or submit an SSN, ignoring the content of the web page itself. All policies without this selector will continue to scan both request and response bodies to ensure continued protection. For more information, refer to [Gateway HTTP policy selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#body-phase). ## 2025-09-11 **DNS filtering for private network onramps** [Magic WAN](https://developers.cloudflare.com/cloudflare-wan/zero-trust/cloudflare-gateway/#dns-filtering) and [WARP Connector](https://developers.cloudflare.com/mesh/features/routes/#dns-filtering) users can now securely route their DNS traffic to the Gateway resolver without exposing traffic to the public Internet. Routing DNS traffic to the Gateway resolver allows DNS resolution and filtering for traffic coming from private networks while preserving source internal IP visibility. This ensures Magic WAN users have full integration with our Cloudflare One features, including [Internal DNS](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/#internal-dns) and [hostname-based policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/#selector-prerequisites). To configure DNS filtering, change your Magic WAN or WARP Connector DNS settings to use Cloudflare's shared resolver IPs, `172.64.36.1` and `172.64.36.2`. Once you configure DNS resolution and filtering, you can use *Source Internal IP* as a traffic selector in your [resolver policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-policies/) for routing private DNS traffic to your [Internal DNS](https://developers.cloudflare.com/dns/internal-dns/). ## 2025-08-27 **Shadow IT - SaaS analytics dashboard** Zero Trust has significantly upgraded its **Shadow IT analytics**, providing you with unprecedented visibility into your organizations use of SaaS tools. With this dashboard, you can review who is using an application and volumes of data transfer to the application. You can review these metrics against application type, such as Artificial Intelligence or Social Media. You can also mark applications with an approval status, including **Unreviewed**, **In Review**, **Approved**, and **Unapproved** designating how they can be used in your organization. ![Cloudflare One Analytics Dashboards](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2814,height=1486,format=webp/_astro/shadow-it-analytics.BLNnG72w.png) These application statuses can also be used in Gateway HTTP policies, so you can block, isolate, limit uploads and downloads, and more based on the application status. Both the analytics and policies are accessible in the Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control. ## 2025-08-21 **Gateway BYOIP Dedicated Egress IPs now available.** Enterprise Gateway users can now use Bring Your Own IP (BYOIP) for dedicated egress IPs. Admins can now onboard and use their own IPv4 or IPv6 prefixes to egress traffic from Cloudflare, delivering greater control, flexibility, and compliance for network traffic. Get started by following the [BYOIP onboarding process](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/#bring-your-own-ip-address-byoip). Once your IPs are onboarded, go to **Gateway** > **Egress policies** and select or create an egress policy. In **Select an egress IP**, choose *Use dedicated egress IPs (Cloudflare or BYOIP)*, then select your BYOIP address from the dropdown menu. ![Screenshot of a dropdown menu adding a BYOIP IPv4 address as a dedicated egress IP in a Gateway egress policy](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=933,height=459,format=webp/_astro/Gateway-byoip-dedicated-egress-ips.D0pzLAbV.png) For more information, refer to [BYOIP for dedicated egress IPs](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/#bring-your-own-ip-address-byoip). ## 2025-07-28 **Scam domain category introduced under Security Threats** We have introduced a new Security Threat category called **Scam**. Relevant domains are marked with the Scam category. Scam typically refers to fraudulent websites and schemes designed to trick victims into giving away money or personal information. **New category added** | Parent ID | Parent Name | Category ID | Category Name | | --- | --- | --- | --- | | 21 | Security Threats | 191 | Scam | Refer to [Gateway domain categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) to learn more. ## 2025-07-24 **Gateway HTTP Filtering on all ports available in open BETA** [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) can now apply [HTTP filtering](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/) to all proxied HTTP requests, not just traffic on standard HTTP (`80`) and HTTPS (`443`) ports. This means all requests can now be filtered by [A/V scanning](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/antivirus-scanning/), [file sandboxing](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/file-sandboxing/), [Data Loss Prevention (DLP)](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/#data-in-transit), and more. You can turn this [setting](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/#inspect-on-all-ports) on by going to **Settings** > **Network** > **Firewall** and choosing *Inspect on all ports*. ![HTTP Inspection on all ports setting](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1096,height=535,format=webp/_astro/Gateway-Inspection-all-ports.CCmwX6D0.png) To learn more, refer to [Inspect on all ports (Beta)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/#inspect-on-all-ports). ## 2025-07-22 **Google Bard Application replaced by Gemini** The **Google Bard** application (ID: 1198) has been deprecated and fully removed from the system. It has been replaced by the **Gemini** application (ID: 1340). Any existing Gateway policies that reference the old Google Bard application will no longer function. To ensure your policies continue to work as intended, you should update them to use the new Gemini application. We recommend replacing all instances of the deprecated Bard application with the new Gemini application in your Gateway policies. For more information about application policies, refer to [Applications and app types](https://developers.cloudflare.com/cloudflare-one/traffic-controls/application-app-types/). ## 2025-06-18 **Gateway will now evaluate Network policies before HTTP policies from July 14th, 2025** [Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) will now evaluate [Network (Layer 4) policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/) **before** [HTTP (Layer 7) policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/). This change preserves your existing security posture and does not affect which traffic is filtered — but it may impact how notifications are displayed to end users. This change will roll out progressively between **July 14–18, 2025**. If you use HTTP policies, we recommend reviewing your configuration ahead of rollout to ensure the user experience remains consistent. #### Updated order of enforcement **Previous order:** 1. DNS policies 2. HTTP policies 3. Network policies **New order:** 1. DNS policies 2. **Network policies** 3. **HTTP policies** #### Action required: Review your Gateway HTTP policies This change may affect block notifications. For example: - You have an **HTTP policy** to block `example.com` and display a block page. - You also have a **Network policy** to block `example.com` silently (no client notification). With the new order, the Network policy will trigger first — and the user will no longer see the HTTP block page. To ensure users still receive a block notification, you can: - Add a client notification to your Network policy, or - Use only the HTTP policy for that domain. --- #### Why we’re making this change This update is based on user feedback and aims to: - Create a more intuitive model by evaluating network-level policies before application-level policies. - Minimize [526 connection errors](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-526/#error-526-in-the-zero-trust-context) by verifying the network path to an origin before attempting to establish a decrypted TLS connection. --- To learn more, visit the [Gateway order of enforcement documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/order-of-enforcement/). ## 2025-05-29 **New Gateway Analytics in the Cloudflare One Dashboard** Users can now access significant enhancements to Cloudflare Gateway analytics, providing you with unprecedented visibility into your organization's DNS queries, HTTP requests, and Network sessions. These powerful new dashboards enable you to go beyond raw logs and gain actionable insights into how your users are interacting with the Internet and your protected resources. You can now visualize and explore: - Patterns Over Time: Understand trends in traffic volume and blocked requests, helping you identify anomalies and plan for future capacity. - Top Users & Destinations: Quickly pinpoint the most active users, enabling better policy enforcement and resource allocation. - Actions Taken: See a clear breakdown of security actions applied by Gateway policies, such as blocks and allows, offering a comprehensive view of your security posture. - Geographic Regions: Gain insight into the global distribution of your traffic. ![Gateway Analytics](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=2740,height=1166,format=webp/_astro/gateway-analytics.BdSwbIBb.png) To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗︎](https://one.dash.cloudflare.com/) and go to Analytics in the side navigation bar. ## 2025-05-27 **Gateway Protocol Detection Now Available for Pay-as-you-go and Free Plans** All Cloudflare One Gateway users can now use Protocol detection logging and filtering, including those on Pay-as-you-go and Free plans. With Protocol Detection, admins can identify and enforce policies on traffic proxied through Gateway based on the underlying network protocol (for example, HTTP, TLS, or SSH), enabling more granular traffic control and security visibility no matter your plan tier. This feature is available to enable in your account network settings for all accounts. For more information on using Protocol Detection, refer to the [Protocol detection documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/protocol-detection/). ## 2025-05-14 **Domain Categories improvements** **New categories added** | Parent ID | Parent Name | Category ID | Category Name | | --- | --- | --- | --- | | 1 | Ads | 66 | Advertisements | | 3 | Business & Economy | 185 | Personal Finance | | 3 | Business & Economy | 186 | Brokerage & Investing | | 21 | Security Threats | 187 | Compromised Domain | | 21 | Security Threats | 188 | Potentially Unwanted Software | | 6 | Education | 189 | Reference | | 9 | Government & Politics | 190 | Charity and Non-profit | **Changes to existing categories** | Original Name | New Name | | --- | --- | | Religion | Religion & Spirituality | | Government | Government/Legal | | Redirect | URL Alias/Redirect | Refer to [Gateway domain categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) to learn more. ## 2025-05-13 **New Applications Added for DNS Filtering** You can now create DNS policies to manage outbound traffic for an expanded list of applications. This update adds support for 273 new applications, giving you more control over your organization's outbound traffic. With this update, you can: - Create DNS policies for a wider range of applications - Manage outbound traffic more effectively - Improve your organization's security and compliance posture For more information on creating DNS policies, see our [DNS policy documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/). ## 2025-04-28 **FQDN Filtering For Gateway Egress Policies** Cloudflare One administrators can now control which egress IP is used based on a destination's fully qualified domain name (FDQN) within Gateway Egress policies. - Host, Domain, Content Categories, and Application selectors are now available in the Gateway Egress policy builder in beta. - During the beta period, you can use these selectors with traffic on-ramped to Gateway with the WARP client, proxy endpoints (commonly deployed with PAC files), or Cloudflare Browser Isolation. - For WARP client support, additional configuration is required. For more information, refer to the [WARP client configuration documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/#limitations). ![Egress by FQDN and Hostname](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=841,height=1045,format=webp/_astro/Gateway-Egress-FQDN-Policy-preview.Civon5p8.png) This will help apply egress IPs to your users' traffic when an upstream application or network requires it, while the rest of their traffic can take the most performant egress path. ## 2025-04-11 **HTTP redirect and custom block page redirect** You can now use more flexible redirect capabilities in Cloudflare One with Gateway. - A new **Redirect** action is available in the HTTP policy builder, allowing admins to redirect users to any URL when their request matches a policy. You can choose to preserve the original URL and query string, and optionally include policy context via query parameters. - For **Block** actions, admins can now configure a custom URL to display when access is denied. This block page redirect is set at the account level and can be overridden in DNS or HTTP policies. Policy context can also be passed along in the URL. Learn more in our documentation for [HTTP Redirect](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#redirect) and [Block page redirect](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/gateway-block-page/#redirect-to-a-block-page). ## 2025-03-21 **Secure DNS Locations Management User Role** We're excited to introduce the [**Cloudflare Zero Trust Secure DNS Locations Write role**](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/#secure-dns-locations), designed to provide DNS filtering customers with granular control over third-party access when configuring their Protective DNS (PDNS) solutions. Many DNS filtering customers rely on external service partners to manage their DNS location endpoints. This role allows you to grant access to external parties to administer DNS locations without overprovisioning their permissions. **Secure DNS Location Requirements:** - Mandate usage of [Bring your own DNS resolver IP addresses](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-resolver-ips/#bring-your-own-dns-resolver-ip) if available on the account. - Require source network filtering for IPv4/IPv6/DoT endpoints; token authentication or source network filtering for the DoH endpoint. You can assign the new role via Cloudflare Dashboard (`Manage Accounts > Members`) or via API. For more information, refer to the [Secure DNS Locations documentation](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/#secure-dns-locations). ## 2025-02-03 **Block files that are password-protected, compressed, or otherwise unscannable.** Gateway HTTP policies can now block files that are password-protected, compressed, or otherwise unscannable. These unscannable files are now matched with the [Download and Upload File Types traffic selectors](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-types) for HTTP policies: - Password-protected Microsoft Office document - Password-protected PDF - Password-protected ZIP archive - Unscannable ZIP archive To get started inspecting and modifying behavior based on these and other rules, refer to [HTTP filtering](https://developers.cloudflare.com/cloudflare-one/traffic-controls/get-started/http/). ## 2025-02-12 **Upload/Download File Size selectors for HTTP policies** Gateway and DLP users can now create HTTP policies with the [Download and Upload File Size (MiB)](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-size) traffic selectors. This update allows users to block uploads or downloads based on file size. ## 2025-02-02 **The default global Cloudflare root certificate expired on 2025-02-02 at 16:05 UTC** If you installed the default Cloudflare certificate before 2024-10-17, you must generate a new certificate and activate it for your Zero Trust organization to avoid inspection errors. Refer to [Troubleshooting](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/common-issues/#browser-and-certificate-issues) for instructions and troubleshooting steps. ## 2025-01-08 **Bring your own resolver IP (BYOIP) for DNS locations** Enterprise users can now [provide an IP address](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-resolver-ips/#bring-your-own-dns-resolver-ip) for a private DNS resolver to use with [DNS locations](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/). Gateway supports bringing your own IPv4 and IPv6 addresses. ## 2024-11-20 **Category filtering in the network policy builder** Gateway users can now create network policies with the [Content Categories](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/#content-categories) and [Security Risks](https://developers.cloudflare.com/cloudflare-one/traffic-controls/network-policies/#security-risks) traffic selectors. This update simplifies malicious traffic blocking and streamlines network monitoring for improved security management. ## 2024-10-17 **Per-account Cloudflare root certificate** Gateway users can now generate [unique root CAs](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) for their Zero Trust account. Both generated certificate and custom certificate users must [activate a root certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/#activate-a-root-certificate) to use it for inspection. Per-account certificates replace the default Cloudflare certificate, which is set to expire on 2025-02-02. ## 2024-10-10 **Time-based policy duration** Gateway now offers [time-based DNS policy duration](https://developers.cloudflare.com/cloudflare-one/traffic-controls/dns-policies/timed-policies/#time-based-policy-duration). With policy duration, you can configure a duration of time for a policy to turn on or set an exact date and time to turn a policy off. ## 2024-10-04 **Expanded Gateway log fields** Gateway now offers new fields in [activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/) for DNS, network, and HTTP policies to provide greater insight into your users' traffic routed through Gateway. ## 2024-09-30 **File sandboxing** Gateway users on Enterprise plans can create HTTP policies with [file sandboxing](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/file-sandboxing/) to quarantine previously unseen files downloaded by your users and scan them for malware. ## 2024-07-30 **UK NCSC indicator feed publicly available in Gateway** Gateway users on any plan can now use the [PDNS threat intelligence feed](https://developers.cloudflare.com/security-center/indicator-feeds/#publicly-available-feeds) provided by the UK National Cyber Security Centre (NCSC) in DNS policies. ## 2024-07-14 **Gateway DNS filter non-authenticated queries** Gateway users can now select which endpoints to use for a given DNS location. Available endpoints include IPv4, IPv6, DNS over HTTPS (DoH), and DNS over TLS (DoT). Users can protect each configured endpoint by specifying allowed source networks. Additionally, for the DoH endpoint, users can filter traffic based on source networks and/or authenticate user identity tokens. ## 2024-06-25 **Gateway DNS policy setting to ignore CNAME category matches** Gateway now offers the ability to selectively ignore CNAME domain categories in DNS policies via the [**Ignore CNAME domain categories** setting](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/#ignore-cname-domain-categories) in the policy builder and the [`ignore_cname_category_matches` setting](https://developers.cloudflare.com/api/resources/zero_trust/subresources/gateway/subresources/rules/methods/create/) in the API. ## 2024-04-05 **Gateway file type control improvements** Gateway now offers a more extensive, categorized [list of files](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#download-and-upload-file-types) to control uploads and downloads. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/gateway/#page","headline":"Gateway","description":"Review recent changes to Cloudflare Gateway.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/gateway/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/gateway/og.png?v=99a900cbe73b71a8","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review recent changes to Cloudflare Zero Trust user risk scoring. title: Risk score image: https://developers.cloudflare.com/cloudflare-one/changelog/risk-score/og.png?v=5ce941479089b6d8 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Risk score Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/changelog/risk-score/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/risk-score.xml) ## 2026-04-08 **User risk scoring for high risk browsing activity** Cloudflare One's **User Risk Scoring** now incorporates direct signals from **Gateway DNS traffic patterns**. This update allows security teams to automatically elevate a user's risk score when they visit high-risk or malicious domains, providing a more holistic view of internal threats. #### Why this matters Browsing activity is a primary indicator of potential compromise. By tying Gateway DNS logs to specific users, administrators can now flag individuals interacting with: - **Security threats**: Domains associated with malware, phishing, or command-and-control (C2) centers. - **High-risk content**: Categories such as questionable content or violence that may violate corporate compliance. Even if a Gateway policy is set to **Block** the traffic, the interaction is still captured as a "hit" to ensure the user's risk profile reflects the attempted activity. #### New risk behaviors Two new behaviors are now available in the dashboard: - **Suspicious Security Domain Visited**: Triggers when a user visits a domain in the security threats or security risk categories. - **High risk domain visited**: Triggers when a user visits domains categorized as questionable content, violence, or CIPA. To learn more and get started, refer to the [User Risk Scoring documentation](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/). ## 2026-01-15 **Support for CrowdStrike device scores in User Risk Scoring** Cloudflare One has expanded its \[User Risk Scoring] (/cloudflare-one/insights/risk-score/) capabilities by introducing two new behaviors for organizations using the \[CrowdStrike integration] (/cloudflare-one/integrations/service-providers/crowdstrike/). Administrators can now automatically escalate the risk score of a user if their device matches specific CrowdStrike Zero Trust Assessment (ZTA) score ranges. This allows for more granular security policies that respond dynamically to the health of the endpoint. New risk behaviors The following risk scoring behaviors are now available: - CrowdStrike low device score: Automatically increases a user's risk score when the connected device reports a "Low" score from CrowdStrike. - CrowdStrike medium device score: Automatically increases a user's risk score when the connected device reports a "Medium" score from CrowdStrike. These scores are derived from \[CrowdStrike device posture attributes] (/cloudflare-one/integrations/service-providers/crowdstrike/#device-posture-attributes), including OS signals and sensor configurations. ## 2024-06-17 **Exchange user risk scores with Okta** Beyond the controls in [Zero Trust](https://developers.cloudflare.com/cloudflare-one/), you can now [exchange user risk scores](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/#send-risk-score-to-okta) with Okta to inform SSO-level policies. First, configure Cloudflare One to send user risk scores to Okta. 1. Set up the [Okta SSO integration](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/okta/). 2. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Integrations** > **Identity providers**. 3. In **Your identity providers**, locate your Okta integration and select **Edit**. 4. Turn on **Send risk score to Okta**. 5. Select **Save**. 6. Upon saving, Cloudflare One will display the well-known URL for your organization. Copy the value. Next, configure Okta to receive your risk scores. 1. On your Okta admin dashboard, go to **Security** > **Device Integrations**. 2. Go to **Receive shared signals**, then select **Create stream**. 3. Name your integration. In **Set up integration with**, choose *Well-known URL*. 4. In **Well-known URL**, enter the well-known URL value provided by Cloudflare One. 5. Select **Create**. ## 2024-06-14 **SentinelOne signal ingestion** You can now configure a [predefined risk behavior](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/#predefined-risk-behaviors) to evaluate user risk score using device posture attributes from the [SentinelOne integration](https://developers.cloudflare.com/cloudflare-one/integrations/service-providers/sentinelone/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"BlogPosting","@id":"https://developers.cloudflare.com/cloudflare-one/changelog/risk-score/#page","headline":"Risk score","description":"Review recent changes to Cloudflare Zero Trust user risk scoring.","url":"https://developers.cloudflare.com/cloudflare-one/changelog/risk-score/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/changelog/risk-score/og.png?v=5ce941479089b6d8","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: This reference architecture explains how organizations can work towards a SASE architecture using Cloudflare. title: Evolving to a SASE architecture with Cloudflare image: https://developers.cloudflare.com/reference-architecture/architectures/sase/og.png?v=9e3afe8757770ff9 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/reference-architecture/llms.txt > Use this file to discover all available pages before exploring further. # Evolving to a SASE architecture with Cloudflare Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/reference-architecture/architectures/sase/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Download a [PDF version](https://developers.cloudflare.com/reference-architecture/static/cloudflare-evolving-to-a-sase-architecture.pdf) of this reference architecture. ## Introduction Cloudflare One is a secure access service edge (SASE) platform that protects enterprise applications, users, devices, and networks. By progressively adopting Cloudflare One, organizations can move away from their patchwork of hardware appliances and other point solutions and instead consolidate security and networking capabilities on one unified control plane. Such network and security transformation helps address key challenges modern businesses face, including: - Securing access for any user to any resource with Zero Trust practices - Defending against cyber threats, including multi-channel phishing and ransomware attacks - Protecting data in order to comply with regulations and prevent leaks - Simplifying connectivity across offices, data centers, and cloud environments Cloudflare One is built on Cloudflare's [connectivity cloud ↗︎](https://www.cloudflare.com/connectivity-cloud/), ​​a unified, intelligent platform of programmable cloud-native services that enable any-to-any connectivity between all networks (enterprise and Internet), cloud environments, applications, and users. It is one of the [largest global networks ↗︎](https://www.cloudflare.com/network/), with data centers spanning [hundreds of cities worldwide ↗︎](https://www.cloudflare.com/network/) and interconnection with over 13,000 network peers. It also has a greater presence in [core Internet exchanges ↗︎](https://bgp.he.net/report/exchanges#_participants) than many other large technology companies. As a result, Cloudflare operates within \~50 ms of \~95% of the world's Internet-connected population. And since all Cloudflare services are designed to run across every network location, all traffic is connected, inspected, and filtered close to the source for the best performance and consistent user experience. This document describes a reference architecture for organizations working towards a SASE architecture, and shows how Cloudflare One enables such security and networking transformation. ### Who is this document for and what will you learn? This reference architecture is designed for IT or security professionals with some responsibility over or familiarity with their organization's existing infrastructure. It is useful to have some experience with technologies important to securing hybrid work, including identity providers (IdPs), user directories, single sign on (SSO), endpoint security or management (EPP, XDR, UEM, MDM), firewalls, routers, and point solutions like packet or content inspection hardware, threat prevention, and data loss prevention technologies. To build a stronger baseline understanding of Cloudflare, we recommend the following resources: - What is Cloudflare? | [Website ↗︎](https://www.cloudflare.com/what-is-cloudflare/) (5 minute read) or [video ↗︎](https://youtu.be/XHvmX3FhTwU?feature=shared) (2 minutes) - Solution Brief: [Cloudflare One ↗︎](https://cfl.re/SASE-SSE-platform-brief) (3 minute read) - Whitepaper: [Overview of Internet-Native SASE Architecture ↗︎](https://cfl.re/internet-native-sase-architecture-whitepaper) (10 minute read) - Blog: [Zero Trust, SASE, and SSE: foundational concepts for your next-generation network ↗︎](https://blog.cloudflare.com/zero-trust-sase-and-sse-foundational-concepts-for-your-next-generation-network/) (14 minute read) Those who read this reference architecture will learn: - How Cloudflare One protects an organization's employees, devices, applications, data, and networks - How Cloudflare One fits into your existing infrastructure, and how to approach migration to a SASE architecture - How to plan for deploying Cloudflare One While this document examines Cloudflare One at a technical level, it does not offer fine detail about every product in the platform. Instead, it looks at how all the services in Cloudflare One enable networking and network security to be consolidated on one architecture. Visit the [developer documentation ↗︎](https://developers.cloudflare.com/) for further information specific to a product area or use case. ## Disintegration of the traditional network perimeter Traditionally, most employees worked in an office and connected locally to the company network via Ethernet or Wi-Fi. Most business systems (e.g. file servers, printers, applications) were located on and accessible only from this internal network. Once connected, users would typically have broad access to local resources. A security perimeter was created around the network to protect against outsider threats, most of which came from the public Internet. The majority of business workloads were hosted on-premises and only accessible inside the network, with very little or no company data or applications existing on the Internet. However, three important trends created problems for this "castle and moat" approach to IT security: 1. **Employees became more mobile**. Organizations increasingly embrace remote / hybrid work and support the use of personal (i.e. not company-owned) devices. 2. **Cloud migration accelerated**. Organizations are moving applications, data, and infrastructure from expensive on-premises data centers to public or private cloud environments in order to improve flexibility, scalability, and cost-effectiveness. 3. **Cyber threats evolved**. The above trends expand an organization's attack surface. For example, attack campaigns have become more sophisticated and persistent in exploiting multiple channels to infiltrate organizations, and cybercriminals face lower barriers to entry with the popularity of the "cybercrime-as-a-service" black market. Traditional perimeter-based security has struggled to adapt to these changes. In particular, extending the "moat" outwards has introduced operational complexity for administrators, poor experiences for users, and inconsistency in how security controls are applied across users and applications. ![With many different methods to connect networks and filter/block traffic, managing access to company applications is costly and time consuming.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1025,height=649,format=svg/_astro/cf1-ref-arch-1.AANYC4WZ.svg) The diagram above shows an example of this adapted perimeter-based approach, in which a mix of firewalls, WAN routers, and VPN concentrators are connected with dedicated WAN on-ramps consisting of MPLS circuits and/or leased lines. The diagram also demonstrates common problem areas. In an effort to centralize policy, organizations sometimes force all employee Internet traffic through their VPN infrastructure, which results in slow browsing and user complaints. Employees then seek workarounds — such as using non-approved devices — which increases their exposure to Internet-borne attacks when they work from home or on public Wi-Fi. In addition, IT teams are unable to respond quickly to changing business needs due to the complexity of their network infrastructure. Such challenges are driving many organizations to prioritize goals like: - Accelerating business agility by supporting remote / hybrid work with secure any-to-any access - Improving productivity by simplifying policy management and by streamlining user experiences - Reducing cyber risk by protecting users and data from phishing, ransomware, and other threats across all channels - Consolidating visibility and controls across networking and security - Reducing costs by replacing expensive appliances and infrastructure (e.g. VPNs, hardware firewalls, and MPLS connections) ## Understanding a SASE architecture In recent years, [secure access service edge ↗︎](https://www.cloudflare.com/learning/access-management/security-service-edge-sse/), or SASE, has emerged as an aspirational architecture to help achieve these goals. In a SASE architecture, network connectivity and security are unified on a single cloud platform and control plane for consistent visibility, control, and experiences from any user to any application. SASE platforms consist of networking and security services, all underpinned by supporting operational services and a policy engine: - Network services forward traffic from a variety of networks into a single global corporate network. These services provide capabilities like firewalling, routing, and load balancing. - Security services apply to traffic flowing over the network, allowing for filtering of certain types of traffic and control over who can access what. - Operational services provide platform-wide capabilities like logging, API access, and comprehensive Infrastructure-as-Code support through providers like Terraform. - A policy engine integrates across all services, allowing admins to define policies which are then applied across all the connected services. ![Cloudflare's SASE cloud platform offers network, security, and operational services, as well as policy engine features, to provide zero trust connectivity between a variety of user identities, devices and access locations to customer applications, infrastructure and networks.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1253,height=920,format=svg/_astro/cf1-ref-arch-2.BMHjAM9W.svg) ## Cloudflare One: single-vendor, single-network SASE Most organizations move towards a SASE architecture progressively rather than all at once, prioritizing key security and connectivity use cases and adopting services like [Zero Trust Network Access ↗︎](https://www.cloudflare.com/learning/access-management/what-is-ztna/) (ZTNA) or [Secure Web Gateway ↗︎](https://www.cloudflare.com/learning/access-management/what-is-a-secure-web-gateway/) (SWG). Some organizations choose to use SASE services from multiple vendors. For most organizations, however, the aspiration is to consolidate security with a single vendor, in order to achieve simplified management, comprehensive visibility, and consistent experiences. [Cloudflare One ↗︎](https://www.cloudflare.com/cloudflare-one/) is a single-vendor SASE platform where all services are designed to run across all locations. All traffic is inspected closest to its source, which delivers consistent speed and scale everywhere. And thanks to composable and flexible on-ramps, traffic can be routed from any source to reach any destination. Cloudflare's connectivity cloud also offers many other services that improve application performance and security, such as [API Gateway ↗︎](https://www.cloudflare.com/learning/security/api/what-is-an-api-gateway/), [Web Application Firewall ↗︎](https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/), [Content Delivery ↗︎](https://www.cloudflare.com/learning/cdn/what-is-a-cdn/), or [DDoS mitigation ↗︎](https://www.cloudflare.com/learning/ddos/ddos-mitigation/), all of which can complement an organization's SASE architecture. For example, our Content Delivery Network (CDN) features can be used to improve the performance of a self hosted company intranet. Cloudflare's full range of services are illustrated below. ![Cloudflare's anycast network allows provides services on all connected servers to enable secure connections on public and home networks and at corporate offices.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1394,height=746,format=svg/_astro/cf1-ref-arch-4.CQafzpFq.svg) ### Cloudflare's anycast network Cloudflare's SASE platform benefits from our use of [anycast ↗︎](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) technology. Anycast allows Cloudflare to announce the IP addresses of our services from every data center worldwide, so traffic is always routed to the Cloudflare data center closest to the source. This means traffic inspection, authentication, and policy enforcement take place close to the end user, leading to consistently high-quality experiences. Using anycast ensures the Cloudflare network is well balanced. If there is a sudden increase in traffic on the network, the load can be distributed across multiple data centers – which in turn, helps maintain consistent and reliable connectivity for users. Further, Cloudflare's large [network capacity ↗︎](https://www.cloudflare.com/network/) and [AI/ML-optimized smart routing ↗︎](https://blog.cloudflare.com/meet-traffic-manager/) also help ensure that performance is constantly optimized. By contrast, many other SASE providers use Unicast routing in which a single IP address is associated with a single server and/or data center. In many such architectures, a single IP address is then associated with a specific application, which means requests to access that application may have very different network routing experiences depending on how far that traffic needs to travel. For example, performance may be excellent for employees working in the office next to the application's servers, but poor for remote employees or those working overseas. Unicast also complicates scaling traffic loads — that single service location must ramp up resources when load increases, whereas anycast networks can share traffic across many data centers and geographies. ![Cloudflare's anycast network ensures fast and reliable connectivity, whereas Unicast routing often sends all traffic to a single IP address, resulting in slower and failure prone connections.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1460,height=423,format=svg/_astro/cf1-ref-arch-5.DVAtCA4Y.svg) ## Deploying a SASE architecture with Cloudflare To understand how SASE fits into an organization's IT infrastructure, see the diagram below, which maps out all the common components of said infrastructure. Subsequent sections of this guide will add to the diagram, showing where each part of Cloudflare's SASE platform fits in. ![Typical enterprise IT infrastructure may consist of different physical locations, devices and data centers that require connectivity to multiple cloud and on-premises applications.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1212,height=821,format=svg/_astro/cf1-ref-arch-6.CZw0spTE.svg) In the diagram's top half there are a variety of Internet resources (e.g. Facebook), SaaS applications (e.g. ServiceNow), and applications running in an [infrastructure-as-a-service (IaaS) ↗︎](https://www.cloudflare.com/learning/cloud/what-is-iaas/) platform (e.g. AWS). This example organization has already deployed cloud based [identity providers ↗︎](https://www.cloudflare.com/learning/access-management/what-is-an-identity-provider/) (IdP), [unified endpoint management ↗︎](https://www.cloudflare.com/learning/security/glossary/what-is-endpoint/) (UEM) and endpoint protection platforms (EPP) as part of a Zero Trust initiative. In the bottom half are a variety of users, devices, networks, and locations. Users work from a variety of locations: homes, headquarters and branch offices, airports, and others. The devices they use might be managed by the organization or may be personal devices. In addition to the cloud, applications run in a data center in the organization's headquarters and in a data center operators' colo facility ([Equinix ↗︎](https://www.equinix.com/), in this example). A SASE architecture will define, secure, and streamline how each user and device will connect to the various resources in the diagram. Over the following sections, this guide will show ways to integrate Cloudflare One into the above infrastructure: - **Applications and services**: Placing access to private applications and services behind Cloudflare - **Networks**: Connecting entire networks to Cloudflare - **Forwarding device traffic**: Facilitating access to Cloudflare-protected resources from any device - **Verifying users and devices**: Identifying which users access requests come from, and which devices those users have ### Connecting applications This journey to a SASE architecture starts with an organization needing to provide remote access to non-Internet facing, internal-only web applications and services (e.g. SSH or RDP). Organizations typically deploy VPN appliances to connect users to the company network where the applications are hosted. However, many applications now live in cloud Infrastructure-as-a-Service platforms, where traditional VPN solutions are hard to configure. This often results in poor application and connectivity performance for users. #### Tunnels to self-hosted applications [Zero Trust Network Access ↗︎](https://www.cloudflare.com/learning/access-management/what-is-ztna/) (ZTNA) is a SASE service that secures access to self-hosted applications and services. ZTNA functionality can be divided broadly into two categories: 1) establishing connectivity between Cloudflare's network and the environments where the applications are running, and 2) setting policies to define how users are able to access these applications. In this section, we first examine the former — how to connect apps to Cloudflare. Connectivity to self-hosted applications is facilitated through tunnels that are created and maintained by a software connector, [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/). `cloudflared` is a lightweight daemon installed in an organizations' infrastructure that creates a tunnel via an outbound connection to Cloudflare's global network. The connector can be installed in a variety of ways: - In the OS installed on the bare metal server - In the OS that is running in a virtualized environment - In a [container ↗︎](https://hub.docker.com/r/cloudflare/cloudflared) running in a Docker or Kubernetes environment `cloudflared` runs on Windows, Linux, or macOS operating systems and creates an encrypted tunnel using QUIC, a modern protocol that uses UDP (instead of TCP) for fast tunnel performance and modern encryption standards. Generally speaking, there are two approaches for how users can deploy `cloudflared` in their environment: 1. **On the same server and operating system where the application or service is running**. This is typically in high-risk or compliance deployments where organizations require independent tunnels per application. `cloudflared` consumes a small amount of CPU and RAM, so impact to server performance is marginal. 2. **On a dedicated server(s) in the same network where the applications run**. This often takes the form of multiple containers in a Docker or Kubernetes environment. `cloudflared` manages multiple outbound connections back to Cloudflare and usually requires no changes to network firewalls. Those connections are spread across servers in more than one Cloudflare data center for reliability and failover. Traffic destined for a tunnel is forwarded to the connection that is geographically closest to the request, and if a `cloudflared` connection isn't responding, the tunnel will automatically failover to the next available. For more control over the traffic routed through each tunnel connection, users can integrate with the Cloudflare [load balancing](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/public-load-balancers/) service. To ensure reliable local connectivity, organizations should deploy more than one instance of `cloudflared` across their application infrastructure. For example, with ten front-end web servers running in a Kubernetes cluster, you might deploy three kubernetes services [running `cloudflared` replicas](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/deployment-guides/kubernetes/). ![Using cloudflared, multiple outbound connections are created back to Cloudflare across multiple data centers to improve overall performance and reliability.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1485,height=734,format=svg/_astro/cf1-ref-arch-7.B8tc4zlE.svg) Once tunnels have been established, there are two methods for how user traffic is forwarded to your application or service. Each method below is protected by policies managed by the ZTNA service that enforces authentication and access (which will be explored in further depth [later in this document](#secure-access-to-self-hosted-apps-and-services)). ##### Public hostname Each public hostname is specific to an address, protocol, and port associated with a private application, allowing for narrow access to a specific service when there might be multiple applications running on the same host. For example, organizations can define a public hostname (`mywebapp.domain.com`) to provide access to a web server running on `https://localhost:8080`, while ensuring no access to local Kubernetes services. Key capabilities: - A hostname is created in a public DNS zone and all requests to that hostname are first routed to the Cloudflare network, inspected against configured security and access policies, before being routed through the tunnel to the secured private resource - Multiple hostnames can be defined per tunnel, with each hostname mapping to a single application (service address and port) - Support for HTTP/HTTPS protocols - Access to resources only requires a browser - When Cloudflare's device client is deployed on a user device, policies can leverage additional contextual signals (e.g. determining whether the device is managed or running the latest OS) in policy enforcement - For access to SSH/VNC services, Cloudflare renders an SSH/VNC terminal using webassembly in the browser Applications exposed this way receive all of the benefits of Cloudflare's leading DNS, CDN, and DDoS services as well as our web application firewall (WAF), API, and bot services, all without exposing application servers directly to the Internet. ##### Private network In some cases, users may want to leverage ZTNA policies to provide access to many applications on an entire private network. This allows for greater flexibility over the ways clients connect and how services are exposed. It also enables communication to resources over protocols other than HTTP. In this scenario, users specify the subnet for the private network they wish to be accessible via Cloudflare. Key capabilities: - `cloudflared`, combined with Cloudflare device agent, provides access to private networks, allowing for any arbitrary L4 TCP, UDP or ICMP connections - One or many networks can be configured using CIDR notation (e.g. 172.21.0.16/28) - Access to resources on the private network requires the Cloudflare device agent to be installed on clients, and at least one Cloudflare Tunnel server on the connecting network For both methods, it is important to note that `cloudflared` only proxies inbound traffic to a private application or network. It does not become a gateway or "on-ramp" back to Cloudflare for the network that it proxies inbound connections to. This means that if the web server starts its own connection to another Internet-based API, that connection will not be routed via Cloudflare Tunnel and will instead be routed via the host server's default route and gateway. This is the desirable outcome in most network topologies, but there are some instances in which network services need to communicate directly with a remotely-connected user, or with services on other segmented networks. If users require connections that originate from the server or network to be routed through Cloudflare, there are multiple on-ramps through which to achieve this, which will be explained further in the "Connecting Networks" section. #### SaaS applications SaaS applications are inherently always connected to and accessed via the public Internet. As a result, the aforementioned tunnel-and-app-connector approach does not apply. Instead, organizations with a SASE architecture inspect and enforce policies on Internet-bound SaaS traffic via a [secure web gateway ↗︎](https://www.cloudflare.com/learning/access-management/what-is-a-secure-web-gateway/) (SWG), which serves as a cloud-native forward proxy. The SWG includes policies that examine outbound traffic requests and inbound content responses to determine if the user, device, or network location has access to resources on the Internet. Organizations can use these policies to control access to approved SaaS applications, as well as detect and block the use of unapproved applications (also known as [shadow IT ↗︎](https://www.cloudflare.com/learning/access-management/what-is-shadow-it/)). Some SaaS applications allow organizations to configure an IP address allowlist, which limits access to the application based on the source IP address of the request. With Cloudflare, organizations can obtain dedicated [egress IP](https://developers.cloudflare.com/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) addresses, which can be used as the source address for all traffic leaving their network. When combined with an allowlist in a SaaS application, organizations can ensure that users are only able to access applications if they are first connected to Cloudflare. (More detail on this approach is outlined in a later section about connecting user devices.) Another method to secure access to SaaS applications is to configure single sign-on (SSO) so that Cloudflare becomes an identity proxy — acting as the identity provider (IDP) — as part of the authentication and authorization process. Key capabilities: - Apply consistent access policies across both self-hosted and SaaS applications - Layer device security posture into the authentication process (e.g. users can ensure that only managed devices, running the latest operating system and passing all endpoint security checks, are able to access SaaS applications) - Ensure that certain network routes are used for access (e.g. users can require that devices are connected to Cloudflare using the device agent, which allows them to filter traffic to the SaaS application and prevent downloads of protected data) - Centralize SSO applications to Cloudflare and create one SSO integration from Cloudflare to their IdP — making both infrastructure and access policies SSO-agnostic (e.g. users can allow access to critical applications only when MFA is used, no matter which IdP is used to authenticate) When Cloudflare acts as the SSO service to an application, user authentication is still handled by an organization's existing identity provider, but is proxied via Cloudflare, where additional access restrictions can be applied. The diagram below is a high-level example of a typical request flow: ![The flow of SSO requests is proxied through Cloudflare, where the IdP is still used to authenticate, but Cloudflare provides additional access controls.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=839,height=1035,format=svg/_astro/cf1-ref-arch-8.B5wnNeFj.svg) The last method of connecting SaaS applications to Cloudflare's SASE architecture is with an API-based [cloud access security broker ↗︎](https://www.cloudflare.com/learning/access-management/what-is-a-casb/) (CASB). The Cloudflare CASB integrates via API to [popular SaaS suites](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) — including Google Workspace, Microsoft 365, Salesforce, and more — and continuously scans these applications for misconfigurations, unauthorized user activity, and other security risks. Native integration with the Cloudflare [data loss prevention ↗︎](https://www.cloudflare.com/learning/access-management/what-is-dlp/) (DLP) service enables CASB to scan for sensitive or regulated data that may be stored in files with incorrect permissions — further risking leaks or unauthorized access. CASB reports findings that alert IT teams to items such as: - Administrative accounts without adequate MFA - Company-sensitive data in files stored with public access permissions - Missing application configurations (e.g. domains missing SPF/DMARC records) #### Checkpoint: Connecting applications to Cloudflare Now, this is what the architecture of a typical organization might look like once they have integrated with Cloudflare services. It is important to note that Cloudflare is designed to secure organizations' existing applications and services in the following ways: - All self-hosted applications and services are only accessible through Cloudflare and controlled by policies defined by the Cloudflare ZTNA - SaaS application traffic is filtered and secured via the Cloudflare SWG - SaaS services are scanned via the Cloudflare CASB to check for configuration and permissions of data at rest ![Access to all applications is now only available via Cloudflare.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1212,height=1011,format=svg/_astro/cf1-ref-arch-9.DbbzPtNJ.svg) ### Connecting networks Once an organization's applications and services have been integrated, it is time to connect Cloudflare to their existing networks. Regional offices, corporate headquarters, retail locations, data centers, and cloud-hosted infrastructure all need to forward traffic to the new corporate SASE network. When all traffic flows through Cloudflare, SASE services perform the following actions: - Granting application access - Filtering general Internet-bound traffic (e.g. blocking access to sites that host malware) - Isolating web sites to protect users from day-zero or unknown harmful Internet content - Filtering traffic to identify data defined by DLP policies — then blocking the download/upload of that data to insecure devices or applications - Providing visibility into the use of non-approved applications and allowing admins to either block or apply policies around their use There are several approaches for connecting networks to Cloudflare, which can provide further flexibility in how an organization provides access to SASE-protected resources: 1. **Use software agents to create tunnels from host machines back to Cloudflare**. This is typically the method favored by users who own their own servers and applications. 2. **Set up IPsec or GRE tunnels from network routers and firewalls to connect them to the Cloudflare WAN service**. This is the approach that network administrators use when they want to forward traffic to and from entire networks. 3. **Connect a network directly to Cloudflare**. This method works best when an organization's network resides in a supported data center, usually one that is colocated with a Cloudflare data center. These methods will be explained further in the next sections. #### Using software agents There are two software-based methods of connecting networks to Cloudflare, depending on the type of applications that currently exist on the network. ##### Client-to-server connectivity As described in the previous section, [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/) proxies requests to applications and services on private networks. It installs on servers in the private network and creates secure tunnels to Cloudflare over the Internet. These connections are balanced across multiple Cloudflare data centers for reliability and can be made via multiple connectors, which helps increase the capacity of the tunnels. Using `cloudflared`, Cloudflare Tunnel supports client to server connections over the Tunnel. Any service or application running behind the Tunnel will use the default routing table when initiating outbound connectivity. This model is appropriate for a majority of scenarios, in which external users need to access resources within a private network that does not require bidirectionally-initiated communication. ![Requests initiated from a client are securely tunneled to Cloudflare via a device agent, while requests from inside the private network follow the default route.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=921,height=503,format=svg/_astro/cf1-ref-arch-10.PVIlTF5F.svg) For bidirectional, or meshed connectivity, organizations should use Cloudflare Mesh. ##### Mesh connectivity [Cloudflare Mesh](https://developers.cloudflare.com/mesh/) (formerly WARP Connector) is a lightweight solution for site-to-site, bidirectional, and mesh networking connectivity that does not require changes to underlying network routing infrastructure. Cloudflare Mesh is installed on a Linux server within an organization's network, which then becomes a gateway for other local networks that need to on-ramp traffic to Cloudflare. This provides a lightweight solution to support services such as Microsoft's System Center Configuration Manager (SCCM), Active Directory server updates, VOIP and SIP traffic, and developer workflows with complex CI/CD pipeline interaction. It can either be run supplementally to `cloudflared` and Cloudflare WAN (formerly Magic WAN), or can be a standalone remote access and site-to-site connector to the Cloudflare network. Cloudflare Mesh can proxy both user-to-network and network-to-network connectivity, or can be used to establish an overlay network of Carrier Grade NAT ([CGNAT ↗︎](https://en.wikipedia.org/wiki/Carrier-grade_NAT)) addressed endpoints to provide secure, direct connectivity to established resources using CGNAT IP ranges. This helps address overlapping network IP range challenges, point-solution access problems, or the process of shifting network design without impacting a greater underlying system. ![In an example scenario, a developer might push code to a git repository, which ends up in a Kubernetes cluster in a staging network. From staging, it is accessed by a QA tester. All of this traffic is routed and protected via a Cloudflare Mesh node.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=921,height=513,format=svg/_astro/cf1-ref-arch-11.CZ1ltr0Y.svg) *Note: Labels in this image may reflect a previous product name.* Cloudflare Tunnel via `cloudflared` is the primary method for connecting users to applications and services on private networks because it is a simpler, more granular and agile solution for many application owners (vs. IP tunnel based connectivity technology, like [IPsec ↗︎](https://www.cloudflare.com/learning/network-layer/what-is-ipsec/) and [GRE ↗︎](https://www.cloudflare.com/learning/network-layer/what-is-gre-tunneling/)). Cloudflare Mesh is the preferred method for mesh or other software-defined networking — most of which require bidirectional connectivity — when organizations do not want to make changes to the underlying network routing or edge infrastructure. #### Using network equipment Where it is not optimal or possible to install software agents, networks can also be connected to Cloudflare using existing network equipment, such as routers and network firewalls. To do this, organizations create IPsec or GRE tunnels that connect to Cloudflare's cloud-native [Cloudflare WAN ↗︎](https://www.cloudflare.com/network-services/products/magic-wan/) service. With Cloudflare WAN, existing network hardware can connect and route traffic from their respective network locations to Cloudflare through a) secure, IPsec-based tunnels over the Internet or, b) across [Cloudflare Network Interconnect ↗︎](https://www.cloudflare.com/network-services/products/network-interconnect/) (CNI) — private, direct connections that link existing network locations to the nearest Cloudflare data center. Cloudflare's WAN service uses a "light-branch, heavy-cloud" architecture that represents the evolution of software-defined WAN (SD-WAN) connectivity. With Cloudflare WAN, as depicted in the network architecture diagram below, the Cloudflare global network functions as a centrally-managed connectivity hub that securely and efficiently routes traffic between all existing network locations: ![Cloudflare's Connectivity Cloud securely links a variety of network locations to the Internet through products such as Firewall, ZTNA, CASB and Load Balancer.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=942,height=507,format=svg/_astro/cf1-ref-arch-12.D-EXKLBe.svg) As previously described, Cloudflare uses a routing technique called [anycast ↗︎](https://www.cloudflare.com/learning/cdn/glossary/anycast-network/) to globally advertise all of the services and endpoints on the Cloudflare network, including the endpoints for WAN IP tunnels. With [anycast IPsec ↗︎](https://blog.cloudflare.com/anycast-ipsec/) or anycast GRE tunnels, each tunnel configured from an organization's network device (e.g. edge router, firewall appliance, etc.) connects to hundreds of global Cloudflare data centers. Traffic sourced from an organization's network location is sent directly over these tunnels and always routes to the closest active Cloudflare data center. If the closest Cloudflare data center is unavailable, the traffic is automatically rerouted to the next-closest data center. ![In an example scenario, IPsec traffic from an office network's router would be sent to the closest Cloudflare data center.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=720,height=311,format=svg/_astro/cf1-ref-arch-13.5dK35i5D.svg) To further network resiliency, Cloudflare WAN also supports Equal Cost Multi-Path (ECMP) routing between the Cloudflare network and an organization's network location(s). With ECMP, traffic can be load-balanced across multiple anycast IP tunnels, which helps increase throughput and maximize network reliability. In the event of network path failure of one or more tunnels, traffic can be automatically failed over to the remaining healthy tunnels. The simplest and easiest way to on-ramp existing network locations to the Cloudflare WAN service is to deploy Cloudflare One Appliance, a lightweight appliance you can install in corporate network locations to automatically connect, steer, and shape any IP traffic through secure IPsec tunnels. When the WAN Connector is installed into a network, it will automatically establish communication with the Cloudflare network, download and provision relevant configurations, establish resilient IPsec tunnels, and route connected site network traffic to Cloudflare. The WAN Connector can be deployed as either a hardware or virtual appliance, making it versatile for a variety of user network environments — on-premises, virtual, or public cloud. Management, configuration, observability, and software updates for WAN Connectors is centrally managed from Cloudflare via either the dashboard or the Cloudflare API. As of 2023, the WAN Connector is currently best-suited for connecting small and medium-sized networks to Cloudflare (for example, small offices and retail stores). In situations where deploying the Cloudflare One Appliance is not feasible or desirable, organizations can securely connect their site networks to Cloudflare by configuring IPsec tunnels from their existing IPsec-capable network devices, including WAN or SD-WAN routers, firewalls, and cloud VPN gateways. Please refer to the Cloudflare [documentation](https://developers.cloudflare.com/cloudflare-wan/configuration/third-party/) for up-to-date examples of validated IPsec devices. There may also be situations where network-layer encryption is not necessary — for example, when a site's WAN-bound traffic is already encrypted at the application layer (via TLS), or when an IPsec network device offers very limited throughput performance as it encrypts and decrypts IPsec traffic. Under these circumstances, organizations can connect to the Cloudflare network using [GRE tunnels](https://developers.cloudflare.com/cloudflare-wan/configuration/how-to/configure-tunnel-endpoints/). Organizations may also connect their network locations directly to the Cloudflare network via [Cloudflare Network Interconnect ↗︎](https://www.cloudflare.com/network-services/products/network-interconnect/) (CNI). Cloudflare [supports a variety of options](https://developers.cloudflare.com/network-interconnect/) to connect your network to Cloudflare: - Direct CNI for Cloudflare WAN and Magic Transit - Classic CNI for Magic Transit - Cloud CNI for Cloudflare WAN and Magic Transit - Peering via either an internet exchange, or a private network interconnect (PNI). The following table summarizes the different methods of connecting networks to Cloudflare: | **Use case** | **Recommended** | **Alternative solution** | | --- | --- | --- | | Remote users connecting to applications on private networks in a Zero Trust model (e.g. most VPN replacement scenarios) | **Cloudflare Tunnel (with `cloudflared`)** | **Cloudflare WAN** Alternative option if `cloudflared` not suitable for environment | | Site-to-site connectivity between branches, headquarters, and data centers | **Cloudflare WAN** | **Cloudflare Mesh** Alternative option if routing changes cannot be made at perimeter | | Egress traffic from physical sites or cloud environments to cloud security inspection (e.g. most common SWG and branch firewall replacement scenarios) | **Cloudflare WAN** | **N/A** | | Service-initiated communication with remote users (e.g. AD or SCCM updates, DevOps workflows, VOIP) | **Cloudflare Mesh** | **Cloudflare WAN** Alternative option if inbound source IP fidelity not required | | Mesh networking and device-to-device connectivity | **Cloudflare Mesh** | **N/A** | Each of these methods of connecting and routing traffic can be deployed concurrently from any location. The following diagram highlights how different connectivity methods can be used in a single architecture. Note the following traffic flows: - All traffic connected via a Cloudflare Mesh node or device agent can communicate with each other over the mesh network - Developers working from home can communicate with the production and staging servers in the cloud - The employee in the retail location, as well as the developer at home, can receive VOIP calls on their laptop - A HPC Cluster in AWS represents a proprietary solution in which no third-party software agents can be installed; as a result, it uses an IPsec connection to Cloudflare WAN - In the retail location, the Cloudflare One Appliance routes all traffic to Cloudflare via an IPsec tunnel - An employee's laptop running the device agent creates its own secure connection to Cloudflare that is routed over the IPsec tunnel - The application owner of the reporting system maintains a connection to Cloudflare using `cloudflared` and doesn't require any networking help to expose their application to employees ![Connecting and routing traffic can be created using various methods such as Cloudflare Network Interconnect, IPSEC tunnels, Cloudflare Mesh and cloudflared.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1343,height=1022,format=svg/_astro/cf1-ref-arch-14.BMsYJBWD.svg) *Note: Labels in this image may reflect a previous product name.* *Note: All of the endpoints connected via Cloudflare Mesh or device agent are automatically assigned IP addresses from the 100.96.0.0/12 address range, while endpoints connected to Cloudflare WAN retain their assigned RFC1918 private IP addresses. `cloudflared` can be deployed in any of the locations by an application owner to provide hostname-based connectivity to the application.* Once the networks, applications, and user devices are connected to Cloudflare — regardless of the connection methods and devices used — all traffic can be inspected, authenticated, and filtered by the Cloudflare SASE services, then securely routed to their intended destinations. Additionally, consistent policies can be applied across all traffic, no matter how it arrives at Cloudflare. #### Checkpoint: Connecting networks to Cloudflare Now this is what a SASE architecture looks like where corporate network traffic from everywhere is forwarded to and processed by Cloudflare. In this architecture, it is possible to make a network connection from any remote location, office location or data center and connect to applications and services living in SaaS infrastructure, cloud-hosted infrastructure or an organization's own on-premise data centers. ![Traffic from all networks, North and South, as well as East and West, is now flowing through and secured by Cloudflare.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1225,height=1027,format=svg/_astro/cf1-ref-arch-15.BL6UWZPA.svg) *Note: Labels in this image may reflect a previous product name.* ### Forwarding device traffic The previous sections explain using ZTNA to secure access to self-hosted applications and using an SWG to inspect and filter traffic destined for the Internet. When a user is working on a device in any of the company networks that is connected to Cloudflare's connectivity cloud, all that traffic is inspected and policies applied without disrupting the user's workflow. Yet, users are not always (or ever) in the office; they work from home, on the road, or from other public networks. How do you ensure they have reliable access to your internal applications? How do you ensure their Internet browsing is secure no matter their work location? There are several approaches to ensure that traffic from a user device which isn't connected to an existing Cloudflare protected network, are also forwarding traffic through Cloudflare and be protected. - [Install an agent on the device](#connecting-with-a-device-agent) - [Modify browser proxy configuration](#browser-proxy-configuration) - [Direct the user to a remote browser instance](#using-remote-browser-instances) - [Modify DNS configuration](#agentless-dns-filtering) #### Connecting with a device agent The preferred method of ensuring device traffic is forwarded to Cloudflare is to install the device agent (also referred to as [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/)). The agent runs on Windows, macOS, Linux, iOS, and Android/ChromeOS, and creates a secure connection to Cloudflare where all non-local traffic is sent. Because of Cloudflare's use of anycast networking, the device agent always connects to the nearest Cloudflare server to ensure the best performance for the user. The device agent also collects local machine and network information, which is sent in the request to enrich the policy in Cloudflare. To allow for flexibility in how different devices and users connect, there are multiple [deployment modes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/): - A full L4 traffic proxy - L7 DNS proxy - L7 HTTP proxy - The ability to just collect device posture information For example, organizations might have an office that continues to use an existing [DNS filtering ↗︎](https://www.cloudflare.com/learning/access-management/what-is-dns-filtering/) service, so they can configure the agent to just proxy network and HTTP traffic. The agent can also be configured with flexible routing controls that allow for scenarios in which traffic destined for office printers is not sent to the Cloudflare network but, instead, routed to the local network. These [split tunnel configurations](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) can be made specific to groups of users, types of device operating system, or networks and by default, traffic destined to all private [IPv4 and IPv6 ranges ↗︎](https://datatracker.ietf.org/doc/html/rfc1918) is sent to the device's default gateway. If the application the user is attempting to reach is not in public DNS, you can configure the hostname and domain to be resolved with [local DNS services](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/private-dns/), so that the device agent does not attempt to resolve these using Cloudflare DNS. ![Using the device agent allows Internet and company application bound traffic to be secured by Cloudflare's SWG and ZTNA services.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1235,height=585,format=svg/_astro/cf1-ref-arch-16.DBOEvI3k.svg) The agent is more than just a network proxy; it is able to examine the device's security posture, such as if the operating system is fully up-to-date or if the hard disk is encrypted. Cloudflare's integrations with [CrowdStrike ↗︎](https://www.cloudflare.com/partners/technology-partners/crowdstrike/endpoint-partners/), [SentinelOne ↗︎](https://www.cloudflare.com/partners/technology-partners/sentinelone/), and other third-party services also provide additional data about the security posture of the device. All of this information is associated with each request and, therefore, available for use in company policies — as explained in the "Unified Management" section. The agent can be [deployed](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/) to a device either manually or using existing endpoint management (UEM) technologies. Using the agent, users register and authenticate their device to Cloudflare with the integrated identity providers. Identity information — combined with information about the local device — is then used in your SWG and ZTNA policies (including inline CASB capabilities shared across these Cloudflare services). #### Browser proxy configuration When it is not possible to install software on the device, there are agentless approaches. One option is to configure the browser to forward HTTP requests to Cloudflare by configuring proxy server details in the browser or OS. Although this can be done manually, it is more common for organizations to automate the configuration of browser proxy settings using Internet-hosted [Proxy Auto-Configuration](https://developers.cloudflare.com/cloudflare-one/traffic-controls/proxy-endpoints/) (PAC) files. The browser identifies the PAC file location in several ways: - MDM software configuring the setting in the browser - In Windows domains, Group Policy Objects (GPO) can configure the browser's PAC file - Browsers can use [Web Proxy Auto-Discovery ↗︎](https://datatracker.ietf.org/doc/html/draft-ietf-wrec-wpad-01) (WPAD) From there, configure a proxy endpoint where the browser will send all HTTP requests to. If using this method, please note that: - Filtering HTTPS traffic will also require [installing and trusting Cloudflare root certificates](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) on the devices. - A proxy endpoint will only proxy traffic sourced from a set of known IP addresses, such as the pool of public IP addresses used by a site's NAT gateway, that the administrator must specify. #### Using remote browser instances Another option to ensure device traffic is sent to Cloudflare is to use [remote browser isolation ↗︎](https://www.cloudflare.com/learning/access-management/what-is-browser-isolation/) (RBI). When a remote user attempts to visit a website, the corresponding requests and responses are handled by a headless remote browser running in the Cloudflare network that functions as a "clone" of the user device's local browser. This shields the user's device from potential harmful content and code execution that may be downloaded from the website it visits. RBI renders the received content in an isolated and secure cloud environment. Instead of executing the web content locally, the user device receives commands for how to "draw" the final rendered web page over a highly optimized protocol supported by all HTML5-compliant browsers on all operating systems. Because the remote browser runs on Cloudflare's servers, SWG policies are automatically applied to all browser requests. Ensuring access to sites is protected with RBI does not require any local software installation or reconfiguring the user's browser. Below are [several ways](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/) to accomplish this: - Typically, a remote browser session is started as the result of an SWG policy — the user just requests websites without being notified that the content is loading in a remote browser. - Organizations can also provide users with a link that automatically ensures RBI always processes each request. - Organizations can also opt to use the ZTNA service to redirect all traffic from self-hosted applications via RBI instances. All requests via a remote browser pass through the Cloudflare SWG; therefore, policies can enforce certain website access limitations. For instance, browser isolation policies can be established to: - Disable copy/paste between a remote web page and the user's local machine; this can prevent the employee from pasting proprietary code into third-party chatbots. - Disable printing of remote web content to prevent contractors from printing confidential information - Disable file uploads/downloads to ensure sensitive company data is not sent to — or downloaded from — certain websites. - Disable keyboard input (in combination with other policies) to limit data being exposed, such as someone typing in passwords to a phishing site. Isolating web applications and applying policies to risky websites helps organizations limit data loss from cyber threats or user error. And, like many Cloudflare One capabilities, RBI can be leveraged across other areas of the SASE architecture. Cloudflare's [email security ↗︎](https://www.cloudflare.com/learning/email-security/what-is-email-security/) service, for example, can automatically rewrite and isolate suspicious links in emails. This "email link isolation" capability helps protect the user from potential malicious activity such as credential harvesting phishing. #### Agentless DNS Filtering Another option for securing traffic via the Cloudflare network is to configure the device to forward DNS traffic to Cloudflare to be inspected and filtered. First [DNS locations](https://developers.cloudflare.com/cloudflare-one/traffic-controls/get-started/dns/#connect-dns-locations) are created which allow policies to be applied based on different network locations. They can be determined either by the source IP address for the request or you can use " [DNS over TLS ↗︎](https://www.cloudflare.com/learning/dns/dns-over-tls/)" or " [DNS over HTTPS ↗︎](https://www.cloudflare.com/learning/dns/dns-over-tls/)". When using source IP addresses, either the device will need to be told which DNS servers to use, or the local DNS server on the network the device is connected to needs to forward all DNS queries to Cloudflare. For DNS over TLS or HTTPS support, the devices need to be configured and support varies. Our recommendation is to use DNS over HTTPS which has wider operating system support. All of the above methods result in only the DNS requests — not all traffic — being sent to Cloudflare. SWG DNS policies are then implemented at this level to manage access to corporate network resources. #### Summary of SWG capabilities for each traffic forwarding method The following table summarizes SWG capabilities for the various methods of forwarding traffic to Cloudflare (as of Oct 2023): | | IP tunnel or Interconnect (Cloudflare WAN) | Device Agent (WARP)\*1 | Remote Browser | Browser proxy | DNS proxy | | --- | --- | --- | --- | --- | --- | | Types of traffic forwarded | TCP/UDP | TPC/UDP | HTTP | HTTP | DNS | | **Policy types** | | | | | | | DNS | Yes | Yes | Yes | Yes | Yes | | HTTP/S\*2 | Yes | Yes | Yes | Yes | N/A | | Network (L3/L4 parameter) | Yes | Yes | Yes | Yes | No | | **Data available in policies** | | | | | | | Identity information | No | Yes | Yes | No | No\*3 | | Device posture | No | Yes | No | No | No | | **Capabilities** | | | | | | | Remote browser isolation | Yes | Yes | Yes | Yes | N/A | | Enforce egress IP | Yes | Yes | Yes | Yes | N/A | Notes: 1. Running the device agent in DNS over HTTP mode provides user identity information, in addition to the same capabilities as connecting via DNS. 2. To filter HTTPS traffic, the Cloudflare [certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) needs to be installed on each device. This can be automated when using the device agent. 3. If configuring DNS over HTTPS, it is possible to inject a [service token](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/dns-over-https/#filter-doh-requests-by-user) into the request, which associates the query with an authenticated user. #### Checkpoint: Forwarding device traffic to Cloudflare By connecting entire networks or individual devices, organizations can now route user traffic to Cloudflare for secure access to privately-hosted applications and secure public Internet access. Once traffic from all user devices is forwarded to the Cloudflare network, it is time for organizations to revisit their high-level SASE architecture: ![With all devices and networks connected, any traffic destined for company applications and services all flows through Cloudflare, where policies are applied to determine access.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1227,height=1020,format=svg/_astro/cf1-ref-arch-17.Cv4XcukK.svg) *Note: Labels in this image may reflect a previous product name.* ### Verifying users and devices At this point in implementing SASE architecture, organizations have the ability to route and secure traffic beginning from the point a request is made from a browser on a user's device, all the way through Cloudflare's network to either a company-hosted private application/service or to the public Internet. But, before organizations define policies to manage that access, they need to know who is making the request and determine the security posture of the device. #### Integrating identity providers The first step in any access decision is to determine who is making the request – i.e., to authenticate the user. Cloudflare integrates with identity providers that manage secure access to resources for organizations' employees, contractors, partners, and other users. This includes support for integrations with any [SAML](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-saml/) - or OpenID Connect ([OIDC](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/)) - compliant service; Cloudflare One also includes pre-built integrations with [Okta](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/okta/), [Microsoft Entra ID (formerly Azure Active Directory)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/entra-id/), [Google Workspace](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/google-workspace/), as well as consumer IdPs such as [Facebook](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/facebook-login/), [GitHub](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/github/) and [LinkedIn](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/linkedin/). Multiple IdPs can be integrated, allowing organizations to apply policies to a wide range of both internal and external users. When a user attempts to access a Cloudflare secured application or service, they are redirected to authenticate via one of the integrated IdPs. When using the device agent, users must also authenticate to one of their organization's configured IdPs. ![Users are presented with a list of integrated identity providers before accessing protected applications.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=909,height=525,format=svg/_astro/cf1-ref-arch-18.dg0Dmn3U.svg) Once a user is authenticated, Cloudflare receives that user's information, such as username, group membership, authentication method (password, whether MFA was involved and what type), and other associated attributes (i.e., the user's role, department, or office location). This information from the IdP is then made available to the policy engine. In addition to user identities, most corporate directories also contain groups to which those identities are members. Cloudflare supports the importing of group information, which is then used as part of the policy. Group membership is a critical part of aggregating single identities so that policies can be less complex. It is far easier — for example — to set a policy allowing all employees in the sales department to access Salesforce, than to identify each user in the sales organization. Cloudflare also supports authentication of devices that are not typically associated with a human user – such as an IoT device monitoring weather conditions at a factory. For those secure connections, organizations can generate [service tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) or create [Mutual TLS ↗︎](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) (mTLS) certificates that can be deployed to such devices or machine applications. #### Trusting devices Not only does the user identity need to be verified, but the security posture of the user's device needs to be assessed. The device agent is able to provide a range of device information, which Cloudflare uses to build comprehensive security policies. The following built-in posture checks are available: - [Application check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/application-check/): Checks that a specific application process is running - [File check](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/file-check/): Checks for the presence of a file - [Firewall](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/firewall/): Checks if a firewall is running - [Disk encryption](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/disk-encryption/): Checks if/how many disks are encrypted - [Domain joined](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/domain-joined/): Checks if the device is joined to a Microsoft Active Directory domain - [OS version](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/os-version/): Checks what version of the OS is running - [Unique Client ID](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/device-uuid/): When using an MDM too, organizations can assign a verifiable UUID to a mobile, desktop, or laptop device - [Device serial number](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/corp-device/): Checks to see if the device serial matches a list of company desktop/laptop computers Cloudflare One can also integrate with any deployed endpoint security solution, such as [Microsoft Endpoint Manager](https://developers.cloudflare.com/cloudflare-one/integrations/service-providers/microsoft/), [Tanium](https://developers.cloudflare.com/cloudflare-one/integrations/service-providers/taniums2s/), [Carbon Black](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/carbon-black/), [CrowdStrike](https://developers.cloudflare.com/cloudflare-one/integrations/service-providers/crowdstrike/), [SentinelOne](https://developers.cloudflare.com/cloudflare-one/integrations/service-providers/sentinelone/), and more. Any data from those products can be passed to Cloudflare for use in access decisions. All of the above device information, combined with data on the user identity and also the network the device is on, is available in Cloudflare to be used as part of the company policy. For example, organizations could choose to only allow administrators to SSH into servers when all of the following conditions are met: their device is free from threats, running the latest operating system, and joined to the company domain. Because this information is available for every network request, any time a device posture changes, its ability to connect to an organization's resources is immediately impacted. #### Integrating email services Email — the #1 communication tool for many organizations and the most common channel by which phishing attacks occur — is another important corporate resource that should be secured via a SASE architecture. Phishing is the root cause of upwards of 90% of breaches that lead to financial loss and brand damage. Cloudflare's email security service scans for signs of malicious content or attachments before they can reach the inbox, and also proactively scans the Internet for attacker infrastructure and attack delivery mechanisms, looking for programmatically-created domains that are used to host content as part of a planned attack. Our service uses all this data to also protect against business and vendor email compromises ([BEC ↗︎](https://www.cloudflare.com/learning/email-security/business-email-compromise-bec/) / [VEC ↗︎](https://www.cloudflare.com/learning/email-security/what-is-vendor-email-compromise/)), which are notoriously hard to detect due to their lack of payloads and ability to look like legitimate email traffic. Instead of deploying tunnels to manage and control traffic to email servers, Cloudflare provides two methods of email security [setup](https://developers.cloudflare.com/email-security/deployment/): - [Inline](https://developers.cloudflare.com/email-security/deployment/inline/): Redirect all inbound email traffic through Cloudflare before they reach a user's inbox by modifying MX records - [API](https://developers.cloudflare.com/email-security/deployment/api/): Integrate Cloudflare directly with an email provider such as Microsoft 365 or Gmail Modifying MX records (inline deployment) forces all inbound email traffic through our cloud email security service where it is scanned, and — if found to be malicious — blocked from reaching a user's inbox. Because the service works at the MX record level, it is possible to use the email security service with any [SMTP-compliant ↗︎](https://www.cloudflare.com/learning/email-security/what-is-smtp/) email service. ![Protecting email with Cloudflare using MX records ensures all emails are scanned and categorized.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=996,height=235,format=svg/_astro/cf1-ref-arch-19.B4iJKLu2.svg) Organizations can also opt to integrate email security directly with their email service via APIs. Note that this approach has two drawbacks: there are fewer integrations Cloudflare supports and there is always a small delay between the email being delivered to the service and Cloudflare detecting it via the API. ![Protecting email with Cloudflare using APIs avoids the need to change DNS policy, but introduces delays into email detection and limits the types of email services that can be protected.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=859,height=212,format=svg/_astro/cf1-ref-arch-20.CpqyyvgC.svg) #### Checkpoint: A complete SASE architecture with Cloudflare The steps above provide a complete view of evolving to SASE architecture using Cloudflare One. As the diagram below shows, secure access to all private applications, services, and networks — as well as ensuring the security of users' general Internet access — is now applied to all users in the organization, internal or external. ![A fully deployed SASE solution with Cloudflare protects every aspect of your business. Ensuring all access to applications is secured and all threats from the Internet mitigated.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1226,height=1080,format=svg/_astro/cf1-ref-arch-21.B4dzMu9Q.svg) *Note: Labels in this image may reflect a previous product name.* For ease of use, the entire Cloudflare One platform can be configured via [API](https://developers.cloudflare.com/api/); and with Cloudflare's [Terraform provider ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs), organizations can manage the Cloudflare global network using the same tools they use to automate the rest of their infrastructure. This allows IT teams to fully manage their Cloudflare One infrastructure, including all the policies detailed in the next section, using code. There are also (as of Oct 2023) more than 500 [GitHub ↗︎](https://github.com/cloudflare) repositories, many of which allow IT teams to use and build tools to manage their Cloudflare deployment. ## Unified management Now that all users, devices, applications, networks, and other components are seamlessly integrated within a SASE architecture, Cloudflare One provides a centralized platform for comprehensive management. Because of the visibility Cloudflare has across the entire IT infrastructure, Cloudflare can aggregate signals from various sources, including devices, users, and networks. These signals can inform the creation of policies that govern access to organization resources. Before we go into the details of how policies can be written to manage access to applications, services, and networks connected to Cloudflare, it's worth taking a look at the two main enforcement points in Cloudflare's SASE platform that control access: SWG and the ZTNA services. These services are configured through a single administrative dashboard, simplifying policy management across the entire SASE deployment. The following diagram illustrates the flow of a request through these services, including the application of policies and the source of data for these policies. In the diagram below, the user request can either enter through the SWG or ZTNA depending on the type of service requested. It's also possible to combine both services, such as implementing a SWG HTTP policy that uses DLP service to inspect traffic related to a privately hosted application behind a ZTNA Cloudflare Tunnel. This configuration enables organizations to block downloads of sensitive data from internal applications that organizations have authorized for external access. ![User requests to the Internet or self hosted applications go through our SWG and/or ZTNA service. Administrators have a single dashboard to manage policies across both.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1145,height=726,format=svg/_astro/cf1-ref-arch-23.By2O_HTZ.svg) In the following sections, we introduce examples of how different policies can be configured to satisfy specific use cases. While these examples are not exhaustive, the goal is to demonstrate common ways Cloudflare One can be configured to address the challenges organizations encounter in its transition to a SASE architecture. Connecting an IdP to Cloudflare provides the ability to make access decisions based on factors such as group membership, authentication method, or specific user attributes. Cloudflare's device agent also supplies additional signals for policy considerations, such as assessing the operating system or verifying the device's serial number against company-managed devices. However, there are features that allow users to incorporate additional data into deployment for building powerful policies. ### Lists Cloudflare's vast intelligent network continually monitors billions of web assets and [categorizes them](https://developers.cloudflare.com/cloudflare-one/traffic-controls/domain-categories/) based on our threat intelligence and general knowledge of Internet content. You can use our free [Cloudflare Radar ↗︎](https://radar.cloudflare.com/) service to examine what categories might be applied to any specific domain. Policies can then include these categories to block known and potential security risks on the public Internet, as well as specific categories of content. Additionally, Cloudflare's SWG offers the flexibility to create and maintain customized [lists of data](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/). These lists can be uploaded via CSV files, manually maintained, or integrated with other processes and applications using the Cloudflare API. A list can contain the following data: - URLs - Hostnames - Serial numbers (macOS, Windows, Linux) - Emails - IP addresses - Device IDs (iOS, Android) For example, organizations can maintain a list of IP addresses of all remote office locations, of short term contractors' email addresses, or trusted company domains. These lists can be used in a policy to allow contractors access to a specific application if their traffic is coming from a known office IP address. ### DLP profiles and datasets Cloudflare looks at various aspects of a request, including the source IP, the requested domain, and the identity of the authenticated user initiating the request. Cloudflare also offers a DLP service which has the ability to detect and block requests based on the presence of sensitive content. The service has built in DLP profiles for common data types such as financial information, personally identifiable information (PII), and API keys. There is even a profile for source code, so users can detect and block the transfer of C++ or Python files. Organizations can create customized DLP profiles and use regular expressions to define the patterns of data they are looking for. For data that is hard to define a pattern for, datasets can be used which match exact data values. These datasets allow for the bulk upload of any data to be matched, such as lists of customer account IDs or sensitive project names. These profiles and data sets can be incorporated into policies to prevent users from downloading large files containing confidential customer data. To reduce the risk of false positives, internal users have the option to establish a match count on the profile. This means that a specific number of matches within the data are required before profile triggers. This approach prevents scenarios where a random string resembling PII or a credit card number would trigger the profile unnecessarily. By implementing a match count, the policy demands that multiple data elements align with the profile, significantly increasing its accuracy. Organizations can further increase the accuracy of the DLP profile by enabling context analysis. This feature requires certain proximity keywords to exist within approximately 1000 characters of a match. For example, the string "123-45-6789" will only count as a detection if it is in proximity to keywords such as "ssn". This contextual requirement bolsters the accuracy of the detection process. The DLP service seamlessly integrates with both Cloudflare's SWG and API-driven CASB services. In the case of the API CASB, DLP profiles are selected for scanning each integration with each SaaS application. This customization allows tailored detection criteria based on the type of data you wish to secure within each application. For the SWG service, DLP profiles can be included into any policy to detect the existence of sensitive data in any request passing through the gateway. The most common action associated with this detection is to block the request, providing a robust layer of security. ### Access Groups Access Groups are a powerful tool in the ZTNA service for aggregating users or devices into a unified entity that can be referenced within a policy. Within Cloudflare, multiple pieces of information can be combined into a single Access Group, efficiently reusing data across multiple policies while maintaining it in one centralized location. Consider an Access Group designed to manage access to critical server infrastructure. The same Access Group can be used in a device agent policy that prevents administrators from disabling their connection to Cloudflare. This approach streamlines policy management and ensures consistency across various policy implementations. Below is a diagram featuring an Access Group named "Secure Administrators," which uses a range of attributes to define the characteristics of secure administrators. The diagram shows the addition of two other Access Groups within "Secure Administrators". The groups include devices running on either the latest Windows or macOS, along with the requirement that the device must have either File Vault or Bitlocker enabled. ![An example of using Access Groups can be for grouping up many device, network or user attributes into a single policy that can be reused across applications.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1132,height=360,format=svg/_astro/cf1-ref-arch-24.aWooHqll.svg) Consistent with Cloudflare's overarching flexibility, Access Groups can be created, updated, and applied to policies through Cloudflare API or using Terraform. This allows a seamless integration with existing IT systems and processes, ensuring a cohesive approach to access management. Now that we have a solid understanding of all the components available, let's zoom in and take a look at some common use cases and how they are configured. Keep in mind that Cloudflare's policy engines are incredibly powerful and flexible, so these examples are just a glimpse into the capabilities of Cloudflare's SASE platform. ### Example use cases #### Secure access to self hosted apps and services One common driver for moving to a SASE architecture is replacing existing VPN connectivity with a more flexible and secure solution. Cloudflare One SASE architecture enables high performance and secure access to self hosted applications from anywhere in the world. However, the next step entails defining the policies that control access to resources. In this example, consider two services: a database administration application ([pgadmin ↗︎](https://www.pgadmin.org/) for example) and an SSH daemon running on the database server. The diagram below illustrates the flow of traffic and highlights the ZTNA service. It's important to note that all other services still retain the ability to inspect the request. For instance, the contractor using their personal cell phone in Germany should only have access to the db admin tool, while the employee on a managed device can access both the db admin tool and SSH into the database server. ![An employee working on a managed device at home can access both the db admin tool as well as the SSH service. However a contractor in Germany only has access to the db admin tool.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1327,height=696,format=svg/_astro/cf1-ref-arch-25.DbM82XF7.svg) The policies that enable access rely on two Access Groups. - Contractors - Users who authenticate through Okta and are part of the Okta group labeled "Contractors" - Authentication requires the use of a hardware token - Database and IT administrators - Users who authenticate through Okta and are in the Okta groups "IT administrators" or "Database administrators" - Authentication requires the use of a hardware token - Users should be on a device with a serial number in the "Managed Devices" list Both of these groups are then used in two different access policies. - Database administration tool access - Database and IT admins are allowed access - Members of the "Contractor" access group are allowed access, but each authenticated session requires the user to complete a justification request - The admin tool is rendered in an isolated browser on Cloudflare's Edge network and file downloads are disabled - Database server SSH access - "Database and IT administrators" group is allowed access - Their device must pass a Crowdstrike risk score of at least 80 - Access must come from a device that is running our device agent and is connected to Cloudflare These policies show that contractors are only allowed access to the database administration tool and do not have SSH access to the server. IT and database administrators can access the SSH service only when their devices are securely connected to Cloudflare via the device agent. Every element of the access groups and policies is evaluated for every login, so an IT administrator using a compromised laptop or a contractor unable to authenticate with a hardware token will be denied access. Both user groups will connect to Cloudflare through the closest and fastest access point of Cloudflare's globally distributed network, resulting in a high quality experience for all users no matter where they are. #### Threat defense for distributed offices and remote workers Another reason for using a SASE solution is to apply company security policies consistently across all users (whether they are employees or contractors) in the organization, regardless of where they work. The Cloudflare One SASE architecture shows that all user traffic, whether routed directly on the device or through the connected network, will go through Cloudflare. Cloudflare's SWG then handles inspection of this traffic. Depending on the connection method, policies can be applied either to the HTTP or DNS request. For example: ![Blocking high risk websites can be done by selecting a few options in the SWG policy](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=555,height=400,format=svg/_astro/cf1-ref-arch-26.CctZYYxb.svg) This can then be applied to secure and protect all users in one policy. Cloudflare can write another policy allowing access to social media websites while isolating all sessions in a remote browser hosted on Cloudflare's network. ![Isolating all social media websites can be done by identifying the application or website name and selecting what actions the user can take, such as stopping them from copy and pasting or printing.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=555,height=350,format=svg/_astro/cf1-ref-arch-27.BlDxrRwj.svg) With this setup, every request to a social media website ensures the following security measures: - Any content on the social media website that contains harmful code is prevented from executing on the local device - External users are restricted from downloading content from the site that could potentially be infected with malware or spyware #### Data protection for regulatory compliance Because Cloudflare One has visibility over every network request, Cloudflare can create policies that apply to the data in the request. This means that the DLP services can be used to detect the download of content from an application and block it for specific user demographics. Let's look at the following policy. ![Our DLP policies allow for the inspection of content in a request and blocking it.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=555,height=350,format=svg/_astro/cf1-ref-arch-28.DKy2S5nx.svg) This policy would prevent contractors from downloading a file containing customer accounts information. Furthermore, Cloudflare can configure an additional policy to block the same download if the user's device does not meet specific security posture requirements. This ensures the consistent enforcement of a common rule: no sensitive customer data can be downloaded onto a device that does not meet the required security standards. DLP policies can also be applied in the other direction, ensuring that company sensitive documents are not uploaded to non approved cloud storage or social media. ![A DLP policy can also examine if a HTTP PUT, i.e. a file upload, is taking place to a non approved application where the request contains sensitive data.](https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=555,height=350,format=svg/_astro/cf1-ref-arch-29.BGL4hCeF.svg) ### Visibility across the deployment At this point in the SASE journey, users have re-architected the IT network and security infrastructure to fully leverage all the capabilities of the Cloudflare One SASE platform. A critical element in long term deployment involves establishing complete visibility into the organization and the ability to diagnose and quickly resolve issues. For quick analysis, Cloudflare provides built-in dashboards and analytics that offers a daily overview of the deployment's operational status. As traffic flows through Cloudflare, the dashboard will alert internal users to the most frequently used SaaS applications, enabling quick actions if any unauthorized applications are accessed by external users. Moreover, all logging information from all Cloudflare One services is accessible and searchable from the administrator's dashboard. This makes it efficient to filter for specific blocked requests, with each log containing useful information such as the user's identity, device information, and the specific rule that triggered the block. This can be very handy in the early stages of deployment where rules can often need tweaking. However, many organizations rely on existing dedicated tools to manage long term visibility over the performance of their infrastructure. To support this, Cloudflare allows the export of all logging information into such tools. Every aspect of Cloudflare One is logged and can be exported. Cloudflare offers built in integrations for continuous transmission of small data batches to a variety of platforms, including AWS, Google Cloud Storage, SumoLogic, Azure, Splunk, Datadog, and any S3 compatible service. This flexibility allows organizations to selectively choose which fields to control the type and volume of data to incorporate into existing tools. On top of logs which are related to traffic and policies, Cloudflare also audits management activity. All administrative actions and changes to Cloudflare Tunnels are logged. This allows for change management auditing and, like all other logs, can be exported into other tools as part of a wider change management monitoring solution. #### Digital Experience Monitoring Cloudflare has [deep insight ↗︎](https://radar.cloudflare.com/) into the performance of the Internet and connected networks and devices. This knowledge empowers IT administrators with visibility into minute-by-minute experiences of their end-users, enabling swift resolution of issues that impact productivity. The Digital Experience Monitoring (DEM) service enables IT to run constant tests against user devices to determine the quality of the connection to company resources. The results of these tests are available on the Cloudflare One dashboard, enabling IT administrators to review and identify root causes when a specific user encounters difficulties accessing an application. These issues could stem from the user's local ISP or a specific underperforming SaaS service provider. This data is invaluable in helping administrators in diagnosing and addressing poor user experiences, leading to faster issue resolution. The dashboard shows a comprehensive summary of the entire device fleet, displaying real-time and historical connectivity metrics for all organization devices. IT admins can then drill down into specific devices for further analysis. ## Summary Having acquired a comprehensive understanding of Cloudflare's SASE platform, you are now well-equipped to integrate it with existing infrastructure. This system efficiently secures access to applications for both employees and external users, starting from the initial request on the device and extending across every network to the application, regardless of its location. This powerful new model for securing networks, applications, devices, and users is built on the massive Cloudflare network and managed through an intuitive management interface. It's worth noting that many of the capabilities described in this document can be used for free, without any time constraints, for up to 50 users. [Sign up ↗︎](https://dash.cloudflare.com/sign-up) for an account and head to the [Cloudflare One ↗︎](https://one.dash.cloudflare.com/) section. While this document has provided an overview of the platform as a whole, for those interested in delving deeper into specific areas, we recommend exploring the following resources. | Topic | Content | | --- | --- | | Cloudflare Tunnels | [Understanding Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) - [Open source repository for `cloudflared` ↗︎](https://github.com/cloudflare/cloudflared) | | WAN as a Service | [Cloudflare WAN documentation](https://developers.cloudflare.com/cloudflare-wan/) - [WAN transformation](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/wan-transformation/) | | Secure Web Gateway | [How to build Gateway policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/) | | Zero Trust Network Access | [How to build Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) | | Remote Browser Isolation | [Understanding browser isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/) | | API-Driven CASB | [Scanning SaaS applications](https://developers.cloudflare.com/cloudflare-one/integrations/cloud-and-saas/) | | Email security | [Understanding Cloudflare Email security](https://developers.cloudflare.com/email-security/) | | Replacing your VPN | [Using Cloudflare to replace your VPN](https://developers.cloudflare.com/learning-paths/replace-vpn/concepts/) | If you would like to discuss your SASE requirements in greater detail and connect with one of our architects, please visit [https://www.cloudflare.com/cloudflare-one/ ↗︎](https://www.cloudflare.com/cloudflare-one/) and request a consultation. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/reference-architecture/architectures/sase/#page","headline":"Evolving to a SASE architecture with Cloudflare","description":"This reference architecture explains how organizations can work towards a SASE architecture using Cloudflare.","url":"https://developers.cloudflare.com/reference-architecture/architectures/sase/","inLanguage":"en","image":"https://developers.cloudflare.com/reference-architecture/architectures/sase/og.png?v=9e3afe8757770ff9","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Reference information for Account limits in Cloudflare One. title: Account limits image: https://developers.cloudflare.com/cloudflare-one/account-limits/og.png?v=4b7cfe0f2c26aa59 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Account limits Last updated Oct 16, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/account-limits/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This page lists the default account limits for rules, applications, fields, and other features. These limits may be increased on Enterprise accounts. To request a limit increase, contact your account team. ## Access | Feature | Limit | | --- | --- | | Applications | 500 | | Audit Logpush jobs | 5 | | Email addresses per rule | 1,000 | | Rule groups | 300 | | Rules per rule group | 1,000 | | IP addresses per rule | 1,000 | | mTLS root certificates | 50 | | Service tokens | 50 | | Identity providers | 50 | | Reusable policies | 500 | | Rules per application | 1,000 | | Domains per application | 50 | | Infrastructure targets | 5,000 | | MCP portals | 20 | | MCP servers per portal | 80 | | Custom domains per MCP portal | 5 | | MCP portal session inactivity timeout | 24 hours | ## Application Library | Feature | Zero Trust Free | Zero Trust Pay-as-you-go | Zero Trust Enterprise | | --- | --- | --- | --- | | [Custom applications per account](https://developers.cloudflare.com/cloudflare-one/team-and-resources/app-library/custom-applications/) | 50 | 50 | 100 | ## Gateway | Feature | Limit | | --- | --- | | DNS policies per account | 500 | | Network policies per account | 500 | | HTTP policies per account | 500 | | Egress policies per account | 500 | | Resolver policies per account | 500 | | DNS locations | 250 | | Source IP CIDRs per DNS location | 1,500 | | Concurrent streams for HTTP/2 connections | 256 | | PAC files (Standard users) | 50 | | PAC files (Enterprise users) | 1,000 | | Proxy endpoints (Standard users) | 50 | | Proxy endpoints (Enterprise users) | 500 | | Source IP CIDRs per proxy endpoint | 2,000 | | Lists | 100 | | Entries per list (Standard users) | 1,000 | | Entries per list (Enterprise users) | 5,000 | | List API requests per minute | 600 | | DNS Logpush jobs | 5 | | HTTP Logpush jobs | 5 | HTTP policies using [Forward](https://developers.cloudflare.com/cloudflare-one/traffic-controls/integrate-workers/forward-traffic/) (beta) count toward the HTTP policy limit. Invoked Workers are subject to [Workers limits](https://developers.cloudflare.com/workers/platform/limits/), including memory, CPU, subrequest, and background execution limits. ## Data Loss Prevention (DLP) | Feature | Limit | | --- | --- | | Custom entries | 25 | | Exact Data Match cells per spreadsheet | 100,000 | | Custom Wordlist keywords per spreadsheet | 200 | | Custom Wordlist keywords per account | 1,000 | | Dataset cells per account | 1,000,000 | ## Cloudflare Tunnel | Feature | Limit | | --- | --- | | `cloudflared` tunnels per account | 1,000 | | Routes (CIDR routes + Hostname routes) per account | 50,000 (shared with Cloudflare Mesh) | | Published applications per tunnel | Limited by 1 MB configuration size | | Active `cloudflared` replicas per tunnel | 25 | | Virtual networks per account | 1,000 | To run more than 1,000 tunnels in a single account, refer to [Tunnels for Platforms](https://developers.cloudflare.com/tunnel/features/tunnels-for-platforms/). Published applications (public hostnames) do not count toward the routes limit. For details, refer to [Published application limits](https://developers.cloudflare.com/tunnel/concepts/routing/#published-application-limits). ## Cloudflare Mesh | Feature | Limit | | --- | --- | | Mesh nodes per account | 50 | | Routes (CIDR routes + Hostname routes) per account | 50,000 (shared with Cloudflare Tunnel) | ## Digital Experience Monitoring (DEX) | Feature | Limit | | --- | --- | | DEX Tests per account | Zero Trust Free: 10
Zero Trust Standard: 30
Zero Trust Enterprise: 50
| | Remote captures per day | Zero Trust Free: 100
Zero Trust Standard: 200
Zero Trust Enterprise: 800
| ## Certificates | Feature | Limit | | --- | --- | | Active certificates | 10 | | Certificates generated per day | 3 | | Custom certificates | 5 | ## Maximum number of characters | Feature | Character limit | | --- | --- | | Application name | 350 | | Group name | 350 | | mTLS certificates name | 350 | | Service token name | 350 | | IdP name | 350 | | Target name | 255 | | Application URL | 63 | | Team domain | 63 | | MCP portal name | 350 | | MCP server name | 350 | | MCP server description | 512 | | MCP tool alias | 40 | | MCP portal/server ID | 32 | | Gateway API policy expression | 140,000 | ## Cloudflare One Client | Feature | Limit | | --- | --- | | Characters per device profile expression | 10,000 | | Combined Split Tunnel and Local Domain Fallback entries per device profile | 1,000 | | Device IP profiles per account | 30 | Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/account-limits/#page","headline":"Account limits","description":"Reference information for Account limits in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/account-limits/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/account-limits/og.png?v=4b7cfe0f2c26aa59","dateModified":"2026-10-16","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: FAQ resources and guides for Cloudflare One. title: FAQ image: https://developers.cloudflare.com/cloudflare-one/faq/og.png?v=26d60369f607daa5 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # FAQ Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Review answers to the most commonly asked questions on Cloudflare Zero Trust, as well as a troubleshooting section to help you solve common issues and errors you may come across. If you cannot find the answer you are looking for, go to our [community page ↗︎](https://community.cloudflare.com/) and post your question there. --- ## Getting started with Cloudflare Zero Trust For extra guidance on experiencing Cloudflare Zero Trust for the first time. [Getting started ❯](https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/) ## General For general questions on Cloudflare Zero Trust and how it works. [General ❯](https://developers.cloudflare.com/cloudflare-one/faq/general-faq/) ## Identity For questions on identity providers and accessing applications behind Cloudflare Zero Trust. [Identity ❯](https://developers.cloudflare.com/cloudflare-one/faq/authentication-faq/) ## Policies For questions on how policies work, and how to create and test them. [Policies ❯](https://developers.cloudflare.com/cloudflare-one/faq/policies-faq/) ## Devices For questions on device connectivity and the Cloudflare One Client. [Devices ❯](https://developers.cloudflare.com/cloudflare-one/faq/devices-faq/) ## Tunnels For questions on connecting applications with Tunnels. [Tunnels ❯](https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/faq/#page","headline":"FAQ","description":"FAQ resources and guides for Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/og.png?v=26d60369f607daa5","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review FAQs about getting started with Cloudflare Zero Trust. title: Getting started with Cloudflare Zero Trust FAQ image: https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/og.png?v=e5b1db81663ebca0 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Getting started with Cloudflare Zero Trust FAQ Last updated Apr 30, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [❮ Back to FAQ](https://developers.cloudflare.com/cloudflare-one/faq/) ## How do I sign up for Cloudflare Zero Trust? You can sign up today on the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/). Go to **Zero Trust**, choose a team name and a payment plan, and start protecting your network in just a few minutes. ## What is a team domain/team name? Your team domain is a unique subdomain assigned to your Cloudflare account, for example, `.cloudflareaccess.com`. [Setting up a team domain](https://developers.cloudflare.com/cloudflare-one/setup/#2-create-a-zero-trust-organization) is an essential step in your Zero Trust configuration. This is where your users will find the apps you have secured behind Cloudflare Zero Trust — displayed in the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/) — and will be able to make login requests to them. The customizable portion of your team domain is called **team name**. You can view your team name and team domain in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) under **Zero Trust** > **Settings**. | team name | team domain | | --- | --- | | `your-team-name` | `.cloudflareaccess.com` | You can change your team name at any time, unless you have the Cloudflare dashboard SSO feature enabled on your account. If Cloudflare dashboard SSO is enabled, you must [turn off SSO](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/#change-your-zero-trust-team-name) before changing your team name. When you change your team name, the old name becomes available for other accounts to claim. However, if you delete your entire Zero Trust organization, any team name it used is permanently reserved and cannot be reused by any account — including your own. Warning If you change your team name, you need to update your organization's identity providers (IdPs) and the Cloudflare One Client to reflect the new team name in order to avoid any mismatch errors. ### How do I transfer a team name to another account? If you want to move a team name from one Cloudflare account to another (for example, migrating from a personal account to a company account), you can do so as long as the source Zero Trust organization still exists: 1. In the source account, go to **Settings** and change the team name to a temporary value (for example, `mycompany-old`). 2. In the destination account, go to **Settings** and set the team name to the desired value. Caution Do not delete the Zero Trust organization on the source account before changing the team name. If the organization is deleted, the team name is permanently locked and no account will be able to claim it. ### Why is my old team name is still showing up on the Login page and App Launcher? After changing your team name, you will need to check your Block page, Login page, and App Launcher settings to make sure the new team name is reflected. To verify that your team name change is successfully rendering on the Block page, Login page and App Launcher: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Custom pages** > **Team name and domain**. 2. Find the **Account Gateway block page** and **Access login page** sections, then select **Manage** next to the page you would like to review first. 3. Review that the value in **Your Organization's name** matches your new team name. 4. If the desired name is not already displayed, change the value to your desired team name and select **Save**. 5. Check both pages (**Account Gateway block page** and **Access login page** to set **Your Organization's name** as your desired team name. The App Launcher will display the same team name set on the Access login page, so you do not need to update the **Your Organization's name** field in the App Launcher page. ## How do I change my subscription plan? To make changes to your subscription, visit the Billing section under **Zero Trust** > **Settings** in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/). You can change or cancel your subscription at any time. Just remember - if you downgrade your plan during a billing cycle, your downgraded pricing will apply in the next billing cycle. If you upgrade during a billing cycle, you will be billed for the upgraded plan at the moment you select it. ## How are active seats measured? Cloudflare Zero Trust subscriptions consist of seats that users in your account consume. When users authenticate to an application or enroll their agent into the Cloudflare One Client, they count against one of your active seats. Seats can be added, removed, or revoked at **Settings** > **Cloudflare One plan**. If all seats are currently consumed, you must first remove users before decreasing your purchased seat count. ### Removing users User seats can be removed for Access and Gateway at **Team & Resources** > **Users** > **Your users**. Removing a user will have consequences both on Access and on Gateway: - **Access**: All active sessions for that user will be invalidated. A user will be able to log back into an application unless you create an [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) to block future logins from that user. - **Gateway**: All active devices for that user will be logged out of your Zero Trust organization, which stops all filtering and routing via the Cloudflare One Client. A user will be able to re-enroll their device unless you create a [device enrollment policy](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/device-enrollment/) to block them. Caution The Remove action will remove a user's seat, but it will not permanently revoke their ability to authenticate. To permanently disable a user's ability to authenticate, you must modify the policies that allow them to reach a given application or enroll a device in the Cloudflare One Client. ### Revoking users The Revoke action will terminate active sessions and log out active devices, but will not remove the user's consumption of an active seat. ## How do I know if my network is protected behind Cloudflare Zero Trust? You can visit the [Zero Trust help page ↗︎](https://help.one.cloudflare.com/). This page will give you an overview of your network details, as well as an overview of the categories that are being blocked and/or allowed. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/#page","headline":"Getting started with Cloudflare Zero Trust FAQ","description":"Review FAQs about getting started with Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/getting-started-faq/og.png?v=e5b1db81663ebca0","dateModified":"2026-04-30","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Review frequently asked questions about Cloudflare Zero Trust. title: General image: https://developers.cloudflare.com/cloudflare-one/faq/general-faq/og.png?v=990676f0b1915eee --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # General Last updated Jun 5, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/general-faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [❮ Back to FAQ](https://developers.cloudflare.com/cloudflare-one/faq/) ## What is the difference between Cloudflare Gateway and 1.1.1.1? 1.1.1.1 does not block any DNS query. When a browser requests for example.com, 1.1.1.1 simply looks up the answer either in cache or by performing a full recursive DNS query. Cloudflare Gateway's DNS resolver introduces security into this flow. Instead of allowing all DNS queries, Gateway first checks the hostname being queried against the intelligence Cloudflare has about threats on the Internet. If that query matches a known threat, or is requesting a blocked domain configured by an administrator as part of a Gateway policy, Gateway stops it before the site could load for the user - and potentially execute code or phish that team member. ## Is multi-factor authentication supported? Access supports two methods of enforcing MFA: - **Independent MFA** — Access prompts users for a second factor directly, without relying on your identity provider. You can configure MFA requirements per organization, application, or policy. For more information, refer to [Enforce independent MFA](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/#independent-mfa). - **Identity provider-based MFA** — Access respects the [MFA policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/#identity-provider-based-mfa) set in your identity provider. For example, if your users are logging into an Access protected app through Okta, Okta would enforce an MFA check before sending the valid authentication confirmation back to Cloudflare Access. ## Which browsers are supported? These browsers are supported: - Internet Explorer 11 - Edge (current release, last release) - Firefox (current release, last release) - Chrome (current release, last release) - Safari (current release, last release) ## What languages does the Cloudflare dashboard support? The Cloudflare dashboard is available in the following languages: - Deutsch (German) - English - Español (Spanish) - Français (French) - Italiano (Italian) - 日本語 (Japanese) - 한국어 (Korean) - Português (Portuguese) - 简体中文 (Mandarin Chinese, Simplified) - 繁體中文 (Mandarin Chinese, Traditional) To change your dashboard language, refer to [Profile settings](https://developers.cloudflare.com/fundamentals/user-profiles/customize-account/#language). ## What data localization services are supported? Cloudflare Zero Trust can be used with the Data Localization Suite to ensure that traffic is only inspected in the regions you choose. For more information refer to [Use Zero Trust with Data Localization Suite](https://developers.cloudflare.com/data-localization/how-to/zero-trust/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/faq/general-faq/#page","headline":"General","description":"Review frequently asked questions about Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/faq/general-faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/general-faq/og.png?v=990676f0b1915eee","dateModified":"2026-06-05","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["DNS"]} ``` --- --- description: Review frequently asked questions about identity and identity providers in Cloudflare Zero Trust. title: Identity FAQ image: https://developers.cloudflare.com/cloudflare-one/faq/authentication-faq/og.png?v=65fc61226e586c46 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Identity FAQ Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/authentication-faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [❮ Back to FAQ](https://developers.cloudflare.com/cloudflare-one/faq/) ## Can Access work with multiple identity providers at the same time? Yes. Your team can simultaneously use multiple providers, reducing friction when working with partners or contractors. Get started by adding your preferred identity providers as login methods in Zero Trust. Then, when securing a new application behind Access, you'll be able to choose which providers you want your users to log in with to reach that application. ## What if the identity provider my team uses is not listed? You can add your preferred identity providers to Cloudflare Access even if you do not see them listed in Zero Trust, as long as these providers support SAML 2.0 or [OpenID Connect (OIDC)](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/). ## How do end users log out of an application protected by Access? Access provides a URL that will end a user's current session. To force log out of an Access application, go to: `/cdn-cgi/access/logout` To log out of an App Launcher session, go to: `.cloudflareaccess.com/cdn-cgi/access/logout` For more information, refer to our [session management page](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/#log-out-as-a-user). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/faq/authentication-faq/#page","headline":"Identity FAQ","description":"Review frequently asked questions about identity and identity providers in Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/faq/authentication-faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/authentication-faq/og.png?v=65fc61226e586c46","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["SAML","SSO"]} ``` --- --- description: Review frequently asked questions about tunnels in Cloudflare Zero Trust. title: Tunnels FAQ image: https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/og.png?v=3fe49a31feec9a5b --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Tunnels FAQ Last updated Sep 16, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [❮ Back to FAQ](https://developers.cloudflare.com/cloudflare-one/faq/) ## ​Can I create a Tunnel for an apex domain? Yes. With [Named Tunnels ↗︎](https://blog.cloudflare.com/argo-tunnels-that-live-forever/) you can create a CNAME at the apex that points to the named tunnel. ## ​Does Cloudflare Tunnel support Websockets? Yes. Cloudflare Tunnel has full support for Websockets. ## ​Does Cloudflare Tunnel support gRPC? Yes. Cloudflare Tunnel supports gRPC traffic via [private subnet routing](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/). Public hostname deployments are not currently supported. ## How can Tunnel be used with Partial DNS (CNAME Setup)? Cloudflare offers two modes of setup: [Full Setup](https://developers.cloudflare.com/dns/zone-setups/full-setup/), in which the domain uses Cloudflare DNS nameservers, and [Partial Setup](https://developers.cloudflare.com/dns/zone-setups/partial-setup/) (also known as CNAME setup) in which the domain uses non-Cloudflare DNS servers. The best experience with Cloudflare Tunnel is using Full Setup because Cloudflare manages DNS for the domain and can automatically configure DNS records for newly started Tunnels. You can still use Tunnel with Partial Setup. You will need to create a new DNS record with your current DNS provider for each new hostname connected through Cloudflare Tunnel. The DNS record should be of type CNAME or ALIAS if it is on the root of the domain. The name of the record should be the subdomain it corresponds to (e.g. `example.com` or `tunnel.example.com`) and the value of the record should be `subdomain.domain.tld.cdn.cloudflare.net`. (e.g. `example.com.cdn.cloudflare.net` or `tunnel.example.com.cdn.cloudflare.net`) For a complete walkthrough of using Access with a partial CNAME setup, refer to [Publish a self-hosted application to the Internet](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/#partial-cname-setup). ## How can origin servers be secured when using Tunnel? Tunnel can expose web applications to the Internet that sit behind a NAT or firewall. Thus, you can keep your web server otherwise completely locked down. To double check that your origin web server is not responding to requests outside Cloudflare while Tunnel is running you can run netcat in the command line: ```sh netcat -zv [your-server's-ip-address] 80 netcat -zv [your-server's-ip-address] 443 ``` If your server is still responding on those ports, you will see: ```txt [ip-address] 80 (http) open ``` If your server is correctly locked down, you will see: ```txt [ip-address] 443 (https): Connection refused ``` ## Large-file and streaming traffic through Tunnel It depends on how you route the traffic. Public hostname routes make applications available on the Internet through Cloudflare's reverse proxy. On Free, Pro, and Business plans, the [service-specific terms ↗︎](https://www.cloudflare.com/service-specific-terms-application-services/#content-delivery-network-free-pro-or-business) require you to use a specific paid service to serve video and other large files. Refer to [Delivering videos with Cloudflare](https://developers.cloudflare.com/fundamentals/reference/policies-compliances/delivering-videos-with-cloudflare/) for available options, such as [Stream](https://developers.cloudflare.com/stream/). Private network routes do not publish applications to the Internet, and this restriction does not apply. Users and networks can reach these routes through the [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/), [Cloudflare Mesh](https://developers.cloudflare.com/mesh/), or [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/). For more information, refer to [Private networks](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/). ## What records are created for routing to a Named Tunnel's hostname? Named Tunnels can be routed via DNS records, in which case we use CNAME records to point to the `.cfargotunnel.com`; Or as Load Balancing endpoints, which also point to `.cfargotunnel.com`. ## Does Cloudflare Tunnel send visitor IPs to my origin? No. When using Cloudflare Tunnel, all requests to the origin are made internally between `cloudflared` and the origin. To log external visitor IPs, you will need to [configure an alternative method](https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/). ## Why does the name 'warp' and 'argo' appear in some legacy materials? Cloudflare Tunnel was previously named Warp during the beta phase. As Warp was added to the Argo product family, we changed the name to Argo Tunnel to match. Once we no longer required users to purchase Argo to create Tunnels, we renamed Argo Tunnel to Cloudflare Tunnel. ## Is it possible to restore a deleted tunnel? No. You cannot undo a tunnel deletion. If the tunnel was locally-managed, its [`config.yaml` file](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/tunnel-useful-terms/#configuration-file) will still be present and you can create a new tunnel with the same configuration. If the tunnel was remotely-managed, both the tunnel and its configuration are permanently deleted. ## How do I contact support? Before contacting the Cloudflare support team: 1. Take note of any specific error messages and/or problematic behaviors. 2. Make sure that `cloudflared` is updated to the [latest version ↗︎](https://github.com/cloudflare/cloudflared). 3. Gather any relevant error/access logs from your server. 4. If needed set [`--loglevel`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#loglevel) to `debug`, so the Cloudflare support team can get more info from the `cloudflared.log` file. 5. Include your [Cloudflare Tunnel diagnostic logs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/diag-logs/) ( `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip`). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/#page","headline":"Tunnels FAQ","description":"Review frequently asked questions about tunnels in Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/cloudflare-tunnels-faq/og.png?v=3fe49a31feec9a5b","dateModified":"2026-09-16","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["WebSockets","DNS"]} ``` --- --- description: Review frequently asked questions about policies in Cloudflare Zero Trust. title: Policies FAQ image: https://developers.cloudflare.com/cloudflare-one/faq/policies-faq/og.png?v=4cc4d0901205aa98 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Policies FAQ Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/policies-faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [❮ Back to FAQ](https://developers.cloudflare.com/cloudflare-one/faq/) ## What is the order of policy enforcement? Gateway and Access policies generally trigger from top to bottom based on their position in the policy table in the UI. Exceptions include Bypass and Service Auth policies, which Access evaluates first. Similarly, for Gateway HTTP policies, Do Not Inspect and Isolate policies take precedence over all Allow or Block policies. To learn more about order of enforcement, refer to our documentation for [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#order-of-execution) and [Gateway policies](https://developers.cloudflare.com/cloudflare-one/traffic-controls/order-of-enforcement/). ## **How can I bypass the L7 firewall for a website?** Cloudflare Gateway uses the hostname in the HTTP `CONNECT` header to identify the destination of the request. Administrators who wish to bypass a site must create a [Do Not Inspect](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/#do-not-inspect) policy in order to prevent HTTP inspection from occurring on both encrypted and plaintext traffic. Bypassing the L7 firewall results in no HTTP traffic inspection, and logging is disabled for that HTTP session. ## Can I secure applications with a second-level subdomain URL? Yes. Ensure that your SSL certificates cover the first- and second-level subdomain. Most certificates only cover the first-level subdomain and not the second. This is true for most Cloudflare certificates. To cover a second-level subdomain with a CF certificate, create an [advanced certificate](https://developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/manage-certificates/). Wildcard-based policies in Cloudflare Access only cover the level where they are applied. Add the wildcard policy to the left-most subdomain to be covered. ## How do isolation policies work together with HTTP policies? Isolation policies, like all HTTP policies, are evaluated in stages. When a user makes a request which evaluates an Isolation policy, the request will be rerouted to an isolated browser and re-evaluated for HTTP policies. This makes it possible for an isolated browser to remotely render a block page, or have malicious content within the isolated browser blocked by HTTP policies. ## Why is API or CLI traffic not isolated? Isolation policies are applied to requests that include `Accept: text/html*`. This allows Browser Isolation policies to co-exist with API and command line requests. ## Can Access enforce policies on a specific nonstandard port? No. Cloudflare Access cannot enforce a policy that would contain a port appended to the URL. However, you can use Cloudflare Tunnel to point traffic to non-standard ports. For example, if Jira is available at port `8443` on your origin, you can proxy traffic to that port via Cloudflare Tunnel. ## Why can I still reach domains blocked by a Gateway policy? If the domain is blocked by a DNS, network, or HTTP policy, it may be because: - **Your policy is still being updated.** After you edit or create a policy, Cloudflare updates the new setting across all of our data centers around the world. It takes about 60 seconds for the change to propagate. If the domain is only blocked by a DNS policy, it may be because: - **Your device is using another DNS resolver.** If you have other DNS resolvers in your DNS settings, your device could be using IP addresses for resolvers that are not part of Gateway. As a result, the domain you are trying to block is still accessible from your device. Make sure to remove all other IP addresses from your DNS settings and only include Gateway's DNS resolver IP addresses. - **Your policy is not assigned to a DNS location.** If your policy is not assigned to a DNS location and you send a DNS query from that location, Gateway will not apply that policy. Assign a policy to a DNS location to make sure the desired policy is applied when you send a DNS query from that location. - **Your DoH endpoint is not a Gateway DNS location**. Browsers can be configured to use any DoH endpoint. If you chose to configure DoH directly in your browser, make sure that the DoH endpoint is a Gateway DNS location. If the domain is only blocked by a network policy, it may be because: - **Your browser is reusing an existing connection**. Network policies only apply when a connection is opened. If a browser is connected to a domain to be blocked by a network policy, Gateway will not block requests until the connection is closed. To block the domain, close any related tabs or restart your browser. ## When does Access return a Forbidden status page versus a login page? Access returns a Forbidden page with status codes `401`/`403` when it determines there is no way a user can pass a [policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). If Cloudflare can make a full policy determination that a user will not be able to log in, Access will return a Forbidden page instead of a [login page](https://developers.cloudflare.com/cloudflare-one/reusable-components/custom-pages/access-login-page/). For example, your application has a policy that requires a user to be in a [specific geolocation](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#allow) to log in. As admin, you could define this geolocation policy by using [Include](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#include) rules, meaning the user could log in to the application from Country A or Country B. Or you could define this geolocation policy using a [Require](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#require) rule, meaning the user must be in Country A to log in. If a user from country C attempts to access the application, in both the Include and Require scenarios, the user will receive the Forbidden page. This is because Country C was not defined in either scenario. Therefore, Cloudflare has determined that this user cannot meet policy requirements and will receive the Forbidden status page. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/faq/policies-faq/#page","headline":"Policies FAQ","description":"Review frequently asked questions about policies in Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/faq/policies-faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/policies-faq/og.png?v=4cc4d0901205aa98","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["DNS"]} ``` --- --- description: Review frequently asked questions about devices in Cloudflare Zero Trust. title: Devices FAQ image: https://developers.cloudflare.com/cloudflare-one/faq/devices-faq/og.png?v=1f75a69a3bc63d51 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Devices FAQ Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/faq/devices-faq/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) [❮ Back to FAQ](https://developers.cloudflare.com/cloudflare-one/faq/) ## Why does my Windows device appear to switch from Wi-Fi to Ethernet when I enable the Cloudflare One Client? As the Cloudflare One Client has replaced WinDivert with WinTun architecture, all Windows machines using WinTun will show as being connected using a virtual adapter. Windows, by default, shows virtual adapter connections with a wired Ethernet connection icon, even if the device is connected over wireless. This is by design and should have no impact on connectivity. ## Why is my device not connecting to a closer Cloudflare data center? As our [Network Map ↗︎](https://www.cloudflare.com/en-gb/network/) shows, we have locations all over the globe. However, in the Advanced Connection stats of our application, you may notice that the data center (colo) you are connecting to isn't necessarily the one physically closest to your location. This can be due to a number of reasons: - Sometimes your nearest colo may be undergoing maintenance or having problems. Check the [Cloudflare Status page ↗︎](https://www.cloudflarestatus.com/) for system status. - Your Internet provider may choose to route traffic along an alternate path for reasons such as cost savings, reliability, or other infrastructure concerns. ## Why is my public IP address sometimes visible? The Cloudflare One Client is meant to ensure all your traffic is kept private between you and the origin (the site you are connecting to), but not from the origin itself. In a number of cases, if the origin site you are communicating with can't determine who you are and where you're from, they can't serve locale relevant content to you. Sites inside Cloudflare network are able to see this information. If a site is showing you your IP address, chances are they are in our network. Most sites outside our network (orange clouded sites) however are unable to see this information and instead see the nearest egress colo to their server. We are working to see if in the future we can't find a way to more easily share this information with a limited number of gray clouded sites where it is relevant to both parties. ## Why has my throughput dropped while using the Cloudflare One Client? The Cloudflare One Client is in part powered by 1.1.1.1. When visiting sites or going to a new location on the Internet, you should see blazing fast DNS lookups. However, the Cloudflare One Client is built to trade some throughput for enhanced privacy, because it encrypts all traffic both to and from your device. While this isn't noticeable at most mobile speeds, on desktop systems in countries where high speed broadband is available, you may notice a drop. We think the tradeoff is worth it though and continue to work on improving performance all over the system. ## Why is my device not connecting to a public Wi-Fi? The Wi-Fi network may have a captive portal that is blocking the Cloudflare One Client from establishing a secure connection. In order to access the portal, and therefore the Internet, you will need to temporarily turn off the Cloudflare One Client. After you login to the captive portal through your browser, you can turn the Cloudflare One Client back on to access corporate resources. For more information, refer to [Captive portal detection](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/captive-portals/). ## Why is my device not connecting to the Internet? A third-party service or ISP may be blocking WARP, or Zero Trust settings may be misconfigured. For a list of common issues and steps to resolve, refer to our [troubleshooting guide](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/common-issues/). ## Why is my device not connecting to the corporate Wi-Fi? An [OS firewall rule](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/client-architecture/#system-firewall) on the device may be blocking the EAP/Radius server that allows users to join the Wi-Fi network. If your corporate Wi-Fi uses a Radius server for network authentication, add the Radius server to your [Split Tunnel](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) Exclude list. ## Why is my device not connecting to my private network? If your private network is [exposed via Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/): - Verify that the Cloudflare One Client is [properly configured](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#device-configuration) on the device. - Verify that the user is allowed through by your Access and Gateway policies. - Verify that the [local LAN settings](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/cloudflared/#router-configuration) for the device do not overlap with the CIDR range of your private network. When contacting Cloudflare support, ensure that you include [Cloudflare One Client debug logs](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/) for your device. These logs will help Cloudflare support understand the overall architecture of your machine and networks. Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/faq/devices-faq/#page","headline":"Devices FAQ","description":"Review frequently asked questions about devices in Cloudflare Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/faq/devices-faq/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/faq/devices-faq/og.png?v=1f75a69a3bc63d51","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: How API and Terraform works in Cloudflare One. title: API and Terraform image: https://developers.cloudflare.com/cloudflare-one/api-terraform/og.png?v=b1adbc5636b61fad --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # API and Terraform Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/api-terraform/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) You can manage your Cloudflare Zero Trust configuration using the API or Terraform. For more information, refer to the following links: - [API reference](https://developers.cloudflare.com/api/) - [Terraform provider reference ↗︎](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs) - [Terraform how-to documentation](https://developers.cloudflare.com/terraform/) Detailed API and Terraform examples for Cloudflare Zero Trust are available in our [implementation guides](https://developers.cloudflare.com/cloudflare-one/implementation-guides/) and throughout the Cloudflare Zero Trust documentation. ## Set dashboard to read-only Super Administrators can lock all settings as read-only in the Cloudflare One dashboard. Read-only mode ensures that all updates for the account are made through the API or Terraform. To enable read-only mode: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **Settings** > **Admin controls**. 2. Enable **Set dashboard to read-only**. All users, regardless of [user permissions](https://developers.cloudflare.com/cloudflare-one/roles-permissions/), will be prevented from making configuration changes through the UI. ## Scoped API tokens The administrators managing policies and groups in Cloudflare Zero Trust might be different from those responsible for configuring WAF custom rules or other Cloudflare settings. You can configure scoped API tokens so that team members and automated systems can manage Cloudflare Zero Trust settings without having permission to modify other configurations in Cloudflare. You can create a scoped API token [via the dashboard](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/) or [via the API](https://developers.cloudflare.com/fundamentals/api/how-to/create-via-api/). For a list of available token permissions, refer to [API token permissions](https://developers.cloudflare.com/fundamentals/api/reference/permissions/). Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-one/api-terraform/#page","headline":"API and Terraform","description":"How API and Terraform works in Cloudflare One.","url":"https://developers.cloudflare.com/cloudflare-one/api-terraform/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/api-terraform/og.png?v=b1adbc5636b61fad","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Terraform","REST API"]} ``` --- --- description: Find troubleshooting guides for Cloudflare One products and learn how to collect information for Cloudflare Support. title: Troubleshooting image: https://developers.cloudflare.com/cloudflare-one/troubleshooting/og.png?v=c6fad8bb279af90e --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Troubleshooting Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/troubleshooting/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Cloudflare One provides troubleshooting guides to help you diagnose and resolve common connectivity, configuration, and security issues across your Zero Trust organization. If you cannot resolve an issue using these guides, you can collect diagnostic information and [contact Cloudflare Support](https://developers.cloudflare.com/cloudflare-one/troubleshooting/contact-support/). - [Access](https://developers.cloudflare.com/cloudflare-one/troubleshooting/access/) - [Gateway](https://developers.cloudflare.com/cloudflare-one/troubleshooting/gateway/) - [Tunnel](https://developers.cloudflare.com/cloudflare-one/troubleshooting/tunnel/) - [Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/troubleshooting/warp-client/) - [CASB](https://developers.cloudflare.com/cloudflare-one/troubleshooting/casb/) - [DLP](https://developers.cloudflare.com/cloudflare-one/troubleshooting/dlp/) - [Browser Isolation](https://developers.cloudflare.com/cloudflare-one/troubleshooting/browser-isolation/) - [DEX](https://developers.cloudflare.com/cloudflare-one/troubleshooting/dex/) - [Email Security](https://developers.cloudflare.com/cloudflare-one/troubleshooting/email-security/) - [Cloudflare WAN](https://developers.cloudflare.com/cloudflare-one/troubleshooting/wan/) - [Contact Cloudflare Support](https://developers.cloudflare.com/cloudflare-one/troubleshooting/contact-support/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/#page","headline":"Troubleshooting","description":"Find troubleshooting guides for Cloudflare One products and learn how to collect information for Cloudflare Support.","url":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/og.png?v=c6fad8bb279af90e","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Access for Zero Trust. title: Access image: https://developers.cloudflare.com/cloudflare-one/troubleshooting/access/og.png?v=9bffd60be15eac96 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Access Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/troubleshooting/access/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Review common troubleshooting scenarios for Cloudflare Access. ## Authentication and login ### AJAX/CORS errors Cloudflare Access requires that the `credentials: same-origin` parameter be added to JavaScript when using the Fetch API to include cookies. AJAX requests fail if this parameter is missing, resulting in an error such as `No Access-Control-Allow-Origin header is present on the requested resource`. For more information, refer to [CORS settings](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/cors/). ### SAML verification failure The error `SAML Verify: Invalid SAML response, SAML Verify: No certificate selected to verify` occurs when the identity provider (IdP) does not include the signing public key in the SAML response. Cloudflare Access requires the public key to match the **Signing certificate** uploaded to Zero Trust. Configure your IdP to include the public key in the response. ### Identity provider user/group info error The error `Failed to fetch user/group information from the identity provider` occurs when Cloudflare lacks the necessary API permissions to communicate with your IdP. Review the [SSO integration guide](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/) for your specific IdP and ensure the application has the correct permissions (for example, Microsoft Entra or Okta). ### Google Workspace redirect loop If you place your Google Workspace behind Access, you cannot use Google or Google Workspace as an identity provider for that application. This creates an infinite redirect cycle because both systems depend on each other to complete the login. ### Invalid session error The error `Invalid session. Please try logging in again` indicates that Access was unable to validate your `CF_Session` cookie. This can happen if software or a firewall on your device interferes with requests to Access. Ensure that the same browser instance is used to both initiate and complete the sign-in. ### Firefox Private Window Firefox's default tracking prevention in Private Windows may prevent the `CF_authorization` cookie from being sent, especially for XHR requests. To resolve this, you may need to exempt your application domain and your [team domain](https://developers.cloudflare.com/cloudflare-one/glossary/#team-name) from tracking protection. ### Workers routes on the login path If you have a Cloudflare Worker route assigned to your application's login path, the Worker may overwrite the `cf-authorization` cookie. To prevent this, ensure your Worker script does not modify or strip the `Set-Cookie` header for Access cookies. ## Identity providers ### OTP email not received If a user does not receive a one-time PIN (OTP) email: - **Policy denial**: If the user's email address does not match any **Allow** policies for the application, Cloudflare will not send an OTP email. The login page will still display a message saying the email was sent to prevent account enumeration. - **Email suppression**: The user's email may be on a suppression list due to previous delivery failures. Check your email logs or contact Support to clear suppressions. ### OTP code already used The error `This One-Time PIN has already been used` occurs when the OTP code has already been redeemed before the user enters it. OTP codes are single-use and expire 10 minutes after the initial request. This error most commonly occurs when an email security or anti-phishing tool on your network automatically follows links in emails, consuming the code before you have a chance to enter it. To resolve the issue, select **Request new code** on the login page. If the error recurs consistently, add `noreply@notify.cloudflare.com` to your email security tool's allowlist to prevent it from scanning Cloudflare authentication emails. For setup instructions, refer to [One-time PIN login](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/). ### Google Super Admin login If you use Access as the SSO provider for your Google Workspace, Google Super Admins cannot sign in via Access when accessing `admin.google.com`. Google requires Super Admins to use their original Google password to ensure they can always access the admin console. ### Missing SAML attributes If you receive a `Required attributes are missing` error during SAML authentication, verify that your IdP is sending the mandatory **email** attribute. Additionally, check for typos in attribute names (for example, `groups` vs `gropus`) in your [IdP configuration](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/). ## Applications and certificates ### SSH short-lived certificates The error `Error 0: Bad Request. Please create a ca for application` appears if a certificate has not been generated for the Access application. Refer to [SSH short-lived certificates](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/short-lived-certificates-legacy/) to generate a CA for the application. ### SSH "Origin auth failed" This error often indicates a configuration issue on the target server's SSH daemon (`sshd`): - **SSHD config**: Verify that `PubkeyAuthentication` is set to `yes` and `TrustedUserCAKeys` points to the correct Cloudflare CA file. - **Multiple auth methods**: Cloudflare Access for Infrastructure currently does not support `AuthenticationMethods` with multiple comma-separated requirements (for example, `publickey,keyboard-interactive`). ### Team domain change error The error `Access api error auth_domain_cannot_be_updated_dash_sso` occurs if you try to change your team domain while [Cloudflare dashboard SSO](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/) is enabled. Dashboard SSO does not currently support team domain changes. ### Long-lived SSH sessions disconnect All connections proxied through Cloudflare Gateway, including traffic to [Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) SSH targets, have a maximum guaranteed duration of 10 hours. If a connection is active during a Gateway release, it will be terminated 10 hours later. To prevent unexpected disconnects, we recommend terminating sessions on a predefined schedule (for example, an 8-hour idle timeout). You can configure this using `ChannelTimeout` in your SSH server or client configuration. --- ## More Access resources For more information, refer to the full Access troubleshooting guide. [Full Access troubleshooting guide ❯](https://developers.cloudflare.com/cloudflare-one/access-controls/troubleshooting/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/access/#page","headline":"Access","description":"Access for Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/access/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/access/og.png?v=9bffd60be15eac96","dateModified":"2026-04-17","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Gateway for Zero Trust. title: Gateway image: https://developers.cloudflare.com/cloudflare-one/troubleshooting/gateway/og.png?v=99a900cbe73b71a8 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Gateway Last updated Oct 12, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/troubleshooting/gateway/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This guide helps you troubleshoot common issues with Cloudflare Gateway policies. ## Blocked websites and connectivity ### A website is blocked incorrectly If you believe a domain has been incorrectly blocked by Gateway's security categories or threat intelligence, you can use the [Cloudflare Radar categorization feedback form ↗︎](https://radar.cloudflare.com/categorization-feedback/) to request a review. ### Error 526: Invalid SSL certificate Gateway presents a **526** error page when it cannot establish a secure connection to the origin. This typically occurs in two cases: - **Untrusted origin certificate**: The certificate presented by the origin server is expired, revoked, or issued by an unknown authority. - **Insecure origin connection**: The origin does not support modern cipher suites or redirects all HTTPS requests to HTTP. For more information, refer to [Error 526](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-526/). ### Error 502: Bad Gateway This issue can occur when communicating with an origin that partially supports HTTP/2. If the origin requests a downgrade to HTTP/1.1 (for example, via a `RST_STREAM` frame with `HTTP_1_1_REQUIRED`), Gateway will not automatically reissue the request over HTTP/1.1 and will instead return a `502 Bad Gateway`. To resolve this, disable HTTP/2 at the origin server. ### Untrusted certificate warnings If users see certificate warnings for every page, ensure that the [Cloudflare root certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) is installed and trusted on their devices. This is required for Gateway to inspect HTTPS traffic. ## Dashboard and analytics ### Gateway analytics not displayed If you do not see analytics on the Gateway Overview page: - **Verify DNS traffic**: Ensure your devices are actually sending queries to Gateway. Check your [DNS locations](https://developers.cloudflare.com/cloudflare-one/traffic-controls/resolver-endpoints/) and verify the source IPv4 address. - **Check other resolvers**: Ensure that no other DNS resolvers are configured on the device, as they might be bypassing Gateway. - **Wait for processing**: It can take up to 5 minutes for analytics to appear in the dashboard. ## Egress policies Egress policies symptoms include traffic not using your dedicated egress IP, incorrect failover behavior, or high latency due to Gateway routing traffic through a distant data center. ### Symptom: traffic is not using your dedicated egress IP Even with an active egress policy, you may find that traffic is egressing from a default Cloudflare IP address instead of your dedicated egress IP. | Common cause | Solution | | --- | --- | | DNS resolution to an initial resolved IP | When an egress policy uses a *Domain* or *Host* selector, Gateway must first resolve that domain to an [initial resolved IP](https://developers.cloudflare.com/cloudflare-one/networks/routes/reserved-ips/#gateway-initial-resolved-ips). If your account still uses a legacy range within CGNAT (carrier-grade NAT) address space, this IP may be treated as internal to Cloudflare's network and may not be subject to egress policies, which apply to traffic leaving the network. Change the selector in your egress policy from *Domain* or *Host* to *Destination IP* (using the public IP addresses of the service you are trying to reach), or [move your initial resolved IP range off CGNAT](https://developers.cloudflare.com/cloudflare-one/networks/routes/configure-initial-resolved-ips/). | | Policy precedence | A different egress policy with a higher precedence (a lower number) is matching the traffic first. Remember that egress policies follow the same first-match-wins logic. | | Split Tunnel configuration | The destination IP or domain is excluded from the WARP tunnel via your Split Tunnel configuration. Traffic that is excluded from the tunnel will not be subject to any Gateway policies, including egress. | | No egress logs | Egress logging is available via Logpush with the Gateway Egress dataset. This is essential for troubleshooting. You can also use a third-party IP check service to verify the egress IP from a test device. | ### Symptom: failover is not working or is using the wrong IP Your primary dedicated egress IP becomes unavailable, but instead of using your configured secondary dedicated IP, traffic fails over to a default Cloudflare shared IP. | Common cause | Solution | | --- | --- | | Routing or configuration issue on the Cloudflare side | Document the time of the incident and collect Request IDs from Gateway HTTP or DNS logs for affected users. Open a support ticket and provide this information. Temporarily, you can edit the egress policy to set your secondary IP as the primary to restore service. | ### Symptom: users are egressing from a geographically distant location Gateway routes your users in one country (such as Australia) through a dedicated egress IP located in another region (such as Germany), causing high latency and breaking access to geo-restricted content. | Common cause | Solution | | --- | --- | | Single egress policy | You may have one broad egress policy that applies to all users regardless of their location. Create location-aware egress policies. Use the *User Location* selector in your policy to tie specific user locations to their nearest dedicated egress IP. For example, create one policy for when *User Location* is `United Kingdom`, egress via London IP; create a second policy for when *User Location* is `Australia`, egress via Sydney IP. | | Incorrect geolocation data | The IP address of the user's ISP may not be correctly geolocated. Check the user's location as seen by Cloudflare in the Gateway logs. If it appears incorrect, you can report it to Cloudflare Support. | ## Policy precedence A common point of confusion is how Gateway evaluates its different policy types and the rules within them. ### Symptom: a Block policy is overriding a more specific Allow or Do Not Scan policy You have a high-precedence Allow or Do Not Scan policy for a specific application (such as Allow finance.example.com), but Gateway still block traffic with a low-precedence Block policy (such as Block All High-Risk Sites). The most important concept is [Gateway policy precedence](https://developers.cloudflare.com/cloudflare-one/traffic-controls/order-of-enforcement/), which Gateway enforces based on the policy's order number. A lower order number in the list means a higher precedence. Gateway stops processing further policies when it encounters the first rule that matches. To resolve Gateway policy precedence issues: 1. In the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/), go to **Zero Trust** > **Traffic policies** > **Firewall policies**. 2. Review the order of your DNS, Network, and HTTP policies. 3. Ensure that your most specific Allow, Do Not Scan, or Do Not Inspect policies have a lower order number than your general Block policies. 4. Drag and drop policies to reorder them as needed. An Allow policy for `teams.microsoft.com` should be placed before a general Block policy for all file sharing applications. ## TLS decryption breaks applications Turning on [TLS decryption](https://developers.cloudflare.com/cloudflare-one/traffic-controls/http-policies/tls-decryption/) is required for Gateway features such as Data Loss Prevention (DLP), Browser Isolation, and application-aware HTTP policies. However, it can cause issues with certain types of software. ### Symptom: command-line tools (CLI tools) or native applications fail with certificate errors If after turning on TLS decryption, command-line tools (such as `git`, `aws`, `kubectl`, and `terraform`) or desktop applications (such as ChatGPT or Docker) stop working, this may be due to certificate errors. Applications may return errors such as `SSL: CERTIFICATE_VERIFY_FAILED`, `self-signed certificate in certificate chain`, or similar TLS errors. These applications do not use the operating system's trust store and therefore do not trust the Cloudflare root certificate that you installed. They often have their own certificate trust store or use certificate pinning, which expects the server's original certificate, not one re-signed by Cloudflare. To resolve this issue: Create a targeted HTTP policy to bypass decryption for the specific domains these tools need to access. Place this policy at a higher precedence (lower order number) than your main TLS decryption policy. Create a [list](https://developers.cloudflare.com/cloudflare-one/reusable-components/lists/) that includes hosts such as `github.com`, `*.amazonaws.com`, and `*.docker.io`. | Selector | Operator | Value | Action | | --- | --- | --- | --- | | Domain | in list | *CLI Tool Domains* | Do Not Inspect | You can configure some tools to trust a custom CA or disable SSL verification. This is less secure and harder to manage at scale. For more information, refer to [Install certificate manually](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/manual-deployment/). ### Symptom: the custom block page is not displayed When an HTTP policy blocks a user's request, their browser will return a generic error (`ERR_SSL_PROTOCOL_ERROR`) instead of your configured Gateway block page. This happens because the browser does not trust the certificate presented by the block page, which is signed by the Cloudflare root certificate. This means the certificate is not installed or not trusted on the user's device. To resolve this issue: 1. Confirm that a [Cloudflare root certificate](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/user-side-certificates/) is installed on the device. 2. Ensure the certificate is placed in the correct system-level trust store (such as, Keychain's System store on macOS, or Trusted Root Certification Authorities for the Local Computer on Windows). 3. If you are using an MDM, verify that your deployment script correctly installs and trusts the certificate. ## Private DNS and internal resources are not working You have configured Gateway to resolve internal hostnames, but users are unable to access them. For example, a user connected to the Cloudflare One Client tries to access an internal service like `jira.mycompany.local`, but the DNS query fails. | Common causes | Solution | | --- | --- | | Missing or incorrect resolver policy | Go to **Traffic policies** > **Resolver policies**. Create a policy that matches your internal domain suffix and forwards queries to your internal DNS servers' IP addresses. | | Split Tunnel excludes the private IP range | If your internal resources are in a private IP range (such as `10.0.0.0/8`), that range must be included in the tunnel. If it is in the Exclude list of your Split Tunnel configuration, the Cloudflare One Client will not proxy the traffic. | | Local Domain Fallback misconfiguration | Use resolver policies for corporate DNS. Only use Local Domain Fallback for domains specific to a user's immediate physical network. | --- ## More Gateway resources For more information, refer to the full Gateway troubleshooting guide. [Full Gateway troubleshooting guide ❯](https://developers.cloudflare.com/cloudflare-one/traffic-controls/troubleshooting/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/gateway/#page","headline":"Gateway","description":"Gateway for Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/gateway/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/gateway/og.png?v=99a900cbe73b71a8","dateModified":"2026-10-12","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Tunnel for Zero Trust. title: Tunnel image: https://developers.cloudflare.com/cloudflare-one/troubleshooting/tunnel/og.png?v=55ad55c7ab9d5e27 --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Tunnel Last updated Sep 2, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/troubleshooting/tunnel/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) Explore common issues and solutions for Cloudflare Tunnel. ## I see `cloudflared service is already installed`. If you see this error when installing a remotely-managed tunnel, ensure that no other `cloudflared` instances are running as a service on this machine. Only a single instance of `cloudflared` may run as a service on any given machine. Instead, add additional routes to your existing tunnel. Alternatively, you can run `sudo cloudflared service uninstall` to uninstall `cloudflared`. ## I see `An A, AAAA, or CNAME record with that host already exists`. If you are unable to save your tunnel's public hostname, choose a different hostname or delete the existing DNS record. [Check the DNS records](https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/) for your domain from the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com). ## Tunnel credentials file does not exist or is not a file. If you encounter the following error when running a tunnel, double check your `config.yml` file and ensure that the `credentials-file` points to the correct location. You may need to change `/root/` to your home directory. ```sh cloudflared tunnel run ``` ```sh 2021-06-04T06:21:16Z INF Starting tunnel tunnelID=928655cc-7f95-43f2-8539-2aba6cf3592d Tunnel credentials file '/root/.cloudflared/928655cc-7f95-43f2-8539-2aba6cf3592d.json' doesn't exist or is not a file ``` ## My tunnel fails to authenticate. To start using Cloudflare Tunnel, a super administrator in the Cloudflare account must first log in through `cloudflared login`. The client will launch a browser window and prompt the user to select a hostname in their Cloudflare account. Once selected, Cloudflare generates a certificate that consists of three components: - The public key of the origin certificate for that hostname - The private key of the origin certificate for that domain - A token that is unique to Cloudflare Tunnel Those three components are bundled into a single PEM file that is downloaded one time during that login flow. The host certificate is valid for the root domain and any subdomain one-level deep. Cloudflare uses that certificate file to authenticate `cloudflared` to create DNS records for your domain in Cloudflare. The third component, the token, consists of the zone ID (for the selected domain) and an API token scoped to the user who first authenticated with the login command. When user permissions change (if that user is removed from the account or becomes an admin of another account, for example), Cloudflare rolls the user's API key. However, the certificate file downloaded through `cloudflared` retains the older API key and can cause authentication failures. The user will need to login once more through `cloudflared` to regenerate the certificate. Alternatively, the administrator can create a dedicated service user to authenticate. ## I see an error: x509: certificate signed by unknown authority. This means the origin is using a certificate that `cloudflared` does not trust. For example, you may get this error if you are using SSL/TLS inspection in a proxy between your server and Cloudflare. To resolve: - Add the CA certificate to the system trust store, then restart `cloudflared`. - Set [`caPool`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/) to a local PEM file that contains the CA certificate. - As a temporary last resort, set [`noTLSVerify`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/) to `true`. Turn it off after you fix the certificate trust chain. The `--origin-ca-pool` and `--no-tls-verify` command-line flags apply only when you define a single origin with `--url`. For ingress rules, configure these settings under `originRequest`. ## I see an error 1033 when attempting to run a tunnel. A `1033` error indicates your tunnel is not connected to Cloudflare's network because Cloudflare's network cannot find a healthy `cloudflared` instance to receive the traffic. First, review whether your tunnel is listed as `Active` in the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) by going to **Networking** > **Tunnels** or run `cloudflared tunnel list`. If the tunnel is not `Active`, review the following and take the action necessary for your tunnel status: | Status | Meaning | Recommended Action | | --- | --- | --- | | **Healthy** | The tunnel is active and serving traffic through four connections to the Cloudflare global network. | No action is required. Your tunnel is running correctly. | | **Inactive** | The tunnel has been created (via the API or dashboard) but the `cloudflared` connector has never been run to establish a connection. | Install and run `cloudflared` on your origin server to connect the tunnel to Cloudflare. You can find the installation command in the Cloudflare dashboard under **Networking** > **Tunnels** — select your tunnel, then on the **Overview** tab select **Add a replica**. For API-based setup, refer to [Install and run the tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel-api/#4-install-and-run-the-tunnel). | | **Down** | The tunnel was previously connected but is currently disconnected because the `cloudflared` process has stopped. | 1. Ensure the `cloudflared` [service](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/as-a-service/) or process is actively running on your server.
2. Check for server-side issues, such as the machine being powered off, an application crash, or recent network changes. | | **Degraded** | The `cloudflared` connector is running and the tunnel is serving traffic, but at least one individual connection has failed. Further degradation in [tunnel availability](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) could risk the tunnel going down and failing to serve traffic. | 1. Review your `cloudflared` [logs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) for connection failures or error messages.
2. Investigate local network and firewall rules to ensure they are not blocking connections to the [Cloudflare Tunnel IPs and ports](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-with-firewall/).
| If your tunnel is `Active` but you still receive `1033` errors, verify that your DNS record points to the correct tunnel subdomain. On accounts in Cloudflare's [FedRAMP High ↗︎](https://www.cloudflare.com/cloudflare-for-government/) environment, CNAME records must point to `.fed-cfargotunnel.com`. A CNAME record that points to `.cfargotunnel.com` returns `1033` errors even when the tunnel is healthy. For more information, refer to [DNS records](https://developers.cloudflare.com/tunnel/concepts/routing/#dns-records). For more information, refer to the [comprehensive list of Cloudflare 1xxx errors](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-1xxx-errors/). ## I see a 502 Bad Gateway error when connecting to an HTTP or HTTPS application through tunnel. A `502 Bad Gateway` error with `Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared` on a tunnel route means the tunnel itself is connected to the Cloudflare network, but `cloudflared` cannot reach the origin service defined in your ingress rule. Unlike [error 1033](#i-see-an-error-1033-when-attempting-to-run-a-tunnel), which indicates the tunnel is not connected to Cloudflare, a 502 error indicates the problem is between `cloudflared` and your local service. To identify the specific cause, review your [Tunnel logs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) for `error`-level messages. Common causes include: #### Origin service is not running If the origin service has stopped or never started, `cloudflared` logs will show an error similar to: ```txt error="dial tcp [::1]:8080: connect: connection refused" ``` To resolve, verify the service is running and listening on the expected port: ```sh curl -v http://localhost:8080 ``` If the service is not running, start or restart it. You can confirm the service is listening by running `ss -tlnp | grep ` (Linux) or `lsof -iTCP -sTCP:LISTEN -nP | grep ` (macOS). #### Origin service URL uses the wrong protocol If the origin expects HTTPS but the tunnel route specifies `http://`, or vice versa, `cloudflared` logs will show an error similar to: ```txt error="net/http: HTTP/1.x transport connection broken: malformed HTTP response \"\x15\x03\x01\x00\x02\x02\"" ``` To resolve, update the service URL in your tunnel route to match the [protocol](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols/) your origin expects. For example, change `http://localhost:8080` to `https://localhost:8080`. If you are using a locally-managed tunnel, update your ingress rule in the [configuration file](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/). #### Origin service URL points to the wrong port If the port in your tunnel route does not match the port your service is listening on, `cloudflared` will log a `connection refused` error for that port. Double-check the service URL in your ingress rule and compare it against the port your application is bound to. #### `cloudflared` cannot validate the origin certificate If the origin presents a TLS certificate that `cloudflared` cannot verify, the logs will show an error similar to: ```txt error="x509: certificate is valid for example.com, not localhost" ``` This error indicates that the certificate does not cover the service hostname. An `x509: certificate signed by unknown authority` error instead indicates that `cloudflared` does not trust the certificate authority. To resolve, use one of the following approaches: - Set [`originServerName`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/) to the hostname on the origin certificate in your tunnel route. If you are using a locally-managed tunnel, here is an example of a [configuration file](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/): ```yml ingress: - hostname: app.example.com service: https://localhost:443 originRequest: originServerName: app.example.com ``` - Provide the CA certificate using [`caPool`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/): ```yml ingress: - hostname: app.example.com service: https://localhost:443 originRequest: caPool: /path/to/ca-cert.pem ``` - As a temporary last resort, disable TLS verification with [`noTLSVerify`](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/). Turn it off after resolving the certificate issue. ```yml ingress: - hostname: app.example.com service: https://localhost:443 originRequest: noTLSVerify: true ``` ## A published application returns `ERR_TOO_MANY_REDIRECTS`. This error can occur when the origin redirects HTTP requests to HTTPS but the published application route uses an `http://` `Service URL`. Each request reaches the origin over HTTP and receives the same redirect. To choose the correct service URL and origin settings, refer to [Troubleshoot HTTPS origins](https://developers.cloudflare.com/tunnel/troubleshooting/https-origins/). If the redirect chain alternates between HTTP and HTTPS, also refer to [ERR\_TOO\_MANY\_REDIRECTS](https://developers.cloudflare.com/ssl/troubleshooting/too-many-redirects/). ## `cloudflared access` shows an error `websocket: bad handshake`. This means that your `cloudflared access` client is unable to reach your `cloudflared tunnel` origin. To diagnose this, look at the `cloudflared tunnel` logs. A common root cause is that the `cloudflared tunnel` is unable to proxy to your origin (for example, because the ingress is misconfigured, the origin is down, or the origin HTTPS certificate cannot be validated by `cloudflared tunnel`). If `cloudflared tunnel` has no logs, it means Cloudflare's network is not able to route the websocket traffic to it. There are several possible root causes behind this error: - Your `cloudflared tunnel` is either not running or not connected to Cloudflare's network. - WebSockets are not [enabled](https://developers.cloudflare.com/network/websockets/#enable-websockets). - Your Cloudflare account has Universal SSL enabled but your SSL/TLS encryption mode is set to **Off (not secure)**. To resolve, go to **SSL/TLS** > **Overview** in the Cloudflare dashboard and set your SSL/TLS encryption mode to **Flexible**, **Full**, or **Full (strict)**. - Your requests are blocked by [Super Bot Fight Mode](https://developers.cloudflare.com/bots/get-started/super-bot-fight-mode/). To resolve, make sure you set **Definitely automated** to *Allow* in the bot fight mode settings. - Your SSH or RDP Access application has the [Binding Cookie](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#binding-cookie) enabled. To disable the cookie, go to **Access controls** > **Applications** and edit the application settings. - One or more [Workers routes](https://developers.cloudflare.com/workers/configuration/routing/routes/) are overlapping with the tunnel hostname, and the Workers do not properly handle the traffic. To resolve, either exclude your tunnel from the Worker route by not defining a route that includes the tunnel's hostname, or update your Worker to only handle specific paths and forward all other requests to the origin (for example, by using `return fetch(req)`). ## Tunnel connections fail with SSL error. If `cloudflared` returns error `error="remote error: tls: handshake failure"`, check to make sure the hostname in question is covered by a SSL certificate. If using a multi-level subdomain, an [advanced certificate](https://developers.cloudflare.com/ssl/edge-certificates/advanced-certificate-manager/) may be required as the Universal SSL will not cover more than one level of subdomain. This may surface in the browser as `ERR_SSL_VERSION_OR_CIPHER_MISMATCH`. ## Tunnel connections fail with `Too many open files` error. If your [Cloudflare Tunnel logs](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) return a `socket: too many open files` error, it means that `cloudflared` has exhausted the open files limit on your machine. The maximum number of open files, or file descriptors, is an operating system setting that determines how many files a process is allowed to open. To increase the open file limit, you will need to [configure ulimit settings](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/availability/ulimits/) on the machine running `cloudflared`. ## I see `failed to sufficiently increase receive buffer size` in my cloudflared logs. This buffer size increase is reported by the [quic-go library ↗︎](https://github.com/quic-go/quic-go) leveraged by [cloudflared ↗︎](https://github.com/cloudflare/cloudflared). You can learn more about the log message in the [quic-go repository ↗︎](https://github.com/quic-go/quic-go/wiki/UDP-Buffer-Sizes). This log message is generally not impactful and can be safely ignored when troubleshooting. However, if you have deployed `cloudflared` within a unique, high-bandwidth environment then buffer size can be manually overridden for testing purposes. To set the maximum receive buffer size on Linux: 1. Create a new file under `/etc/sysctl.d/`: ```sh sudo vi 98-core-rmem-max.conf ``` 2. In the file, define the desired buffer size: ```txt net.core.rmem_max=2500000 ``` 3. Reboot the host machine running `cloudflared`. 4. To validate that these changes have taken effect, use the `grep` command: ```sh sudo sysctl -a | grep net.core.rmem_max ``` ```sh net.core.rmem_max = 2500000 ``` ## Cloudflare Tunnel is buffering my streaming response instead of streaming it live. Proxied traffic through Cloudflare Tunnel is buffered by default unless the origin server includes the `Content-Type: text/event-stream` response header. This header tells `cloudflared` to stream data as it arrives instead of buffering the entire response. --- ## More Tunnel resources For more information, refer to the full Tunnel troubleshooting guide. [Full Tunnel troubleshooting guide ❯](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/) Was this helpful? YesNo ## On this page [![](https://developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org/","@type":"WebPage","@id":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/tunnel/#page","headline":"Tunnel","description":"Tunnel for Zero Trust.","url":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/tunnel/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-one/troubleshooting/tunnel/og.png?v=55ad55c7ab9d5e27","dateModified":"2026-09-02","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Cloudflare One Client for Zero Trust. title: Cloudflare One Client image: https://developers.cloudflare.com/cloudflare-one/troubleshooting/warp-client/og.png?v=ac442acb788a02de --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-one/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare One Client Last updated Apr 17, 2026|Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/cloudflare-one/troubleshooting/warp-client/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/) This guide helps you diagnose and resolve common issues with the Cloudflare One Client (formerly WARP). It covers how to troubleshoot the Cloudflare One Client on desktop operating systems, including Windows, macOS, and Linux. 1. **Before you start**: [Prerequisites](#prerequisites), permissions, [version control](#check-your-client-version), and client basics. 2. **Collect logs**: Through the [Cloudflare dashboard](#option-a-collect-logs-via-the-cloudflare-dashboard) (with DEX remote capture) or the [command-line interface](#option-b-collect-logs-via-the-cli) (CLI) ( `warp-diag`). 3. **Review logs**: [Status](#check-client-status), [settings](#check-client-settings), [profile ID](#profile-id), [split tunnel](#exclude-mode-with-hostsips) configuration, and other settings. 4. **Fix common misconfigurations**: [Profile mismatch](#wrong-profile-id), [split tunnel issues](#wrong-split-tunnel-configuration), [managed network issues](#review-your-managed-network-settings), [user group mismatch](#check-a-users-group-membership). 5. **File a support ticket**: [How to file a ticket](#5-file-a-support-ticket) after you have exhausted your troubleshooting options. AI-assisted troubleshooting Cloudflare One includes two free AI helpers to speed up Cloudflare One Client investigations: [**Diagnostics Analyzer**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#diagnostics-analyzer-beta) - Uses AI to parse a device's client diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. This analyzer is available for logs collected via the dashboard. [**DEX MCP server**](https://developers.cloudflare.com/cloudflare-one/insights/dex/dex-mcp-server/) — An AI tool that allows customers to ask a question like, "Show me the connectivity and performance metrics for the device used by [carly@acme.com](mailto:carly@acme.com)", and receive an answer that contains data from the DEX API. ## 1. Before you start ### Prerequisites - You must have completed the [Zero Trust onboarding flow](https://developers.cloudflare.com/cloudflare-one/setup/) with a Zero Trust organization created. - You must have the Cloudflare One Client installed on an end user device. - You must have a [role](https://developers.cloudflare.com/cloudflare-one/roles-permissions/) that gives admin permission to access logs on the Cloudflare dashboard. ### Check your client version Many troubleshooting issues are caused by outdated client versions. For the best performance and compatibility, administrators should check for new releases and [update the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) before attempting to troubleshoot other issues. After updating the Cloudflare One Client, monitor the issue to see if it recurs. If the issue persists, continue with the troubleshooting guide. #### Via the device 1. Open the Cloudflare One Client on your desktop. 2. Select **About**. 3. Compare your device's version with the [latest version](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). 4. Open the Cloudflare One Client on the desktop. 5. Select the gear icon. 6. Select **About WARP**. 7. Compare your device's version with the [latest version of the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). #### Via the Cloudflare dashboard 1. Log in to the [Cloudflare dashboard ↗︎](https://dash.cloudflare.com/) and go to **Zero Trust** > **Team & Resources** > **Devices** > **Your devices**. 2. Select the device you want to investigate. 3. Find the device's client version under **Client version** in the side menu. 4. Compare your device's version with the [latest version of the Cloudflare One Client](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). ### Client basics Understand the Cloudflare One Client's architecture, installation paths, and modes to help you diagnose issues with greater accuracy.
Chapters - ![Introduction and WARP GUI Basics](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=0s)**Introduction and WARP GUI Basics**0s - ![Consumer vs. Corporate WARP](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=57s)**Consumer vs. Corporate WARP**57s - ![Device Profiles Explained](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=95s)**Device Profiles Explained**1m35s - ![WARP Operating Modes](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=132s)**WARP Operating Modes**2m12s - ![Split Tunneling](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=224s)**Split Tunneling**3m44s - ![Conclusion](https://customer-1mwganm1ma0xgnmj.cloudflarestream.com/31178cc41d0ec56d42ef892160589635/thumbnails/thumbnail.jpg?fit=crop&time=296s)**Conclusion**4m56s
#### Client architecture The Cloudflare One Client consists of: - **Graphical User Interface (GUI)**: Control panel that allows end users to view the client's [status](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/connectivity-status/) and perform actions such as turning the Cloudflare One Client on or off. - **WARP daemon (or service)**: Core background component responsible for establishing secure tunnels (using WireGuard or MASQUE) and handling all client functionality on your device. Refer to [client architecture](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/client-architecture/) for more information on how the Cloudflare One Client interacts with a device's operating system to route traffic. #### Client installation details The GUI and daemon (or service) have different names and are stored in the following locations:
Windows | | Windows | | --- | --- | | **Service / Daemon** | C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe | | **GUI application** | C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe | | **Logs Location** |
DaemonC:\ProgramData\Cloudflare\

GUI LogsC:\Users\<USER>.WARP\AppData\Local
or
%LOCALAPPDATA%\Cloudflare
|
macOS | | macOS | | --- | --- | | **Service / Daemon** | /Applications/Cloudflare WARP.app/Contents/Resources/CloudflareWARP | | **GUI application** | /Applications/Cloudflare WARP.app/Contents/MacOS/Cloudflare WARP | | **Logs Location** |
Daemon/Library/Application Support/Cloudflare/
GUI Logs~/Library/Logs/Cloudflare/
|
Linux | | Linux | | --- | --- | | **Service / Daemon** | /bin/warp-svc | | **GUI application** | /bin/warp-taskbar | | **Logs Location** | /var/log/cloudflare-warp/
/var/lib/cloudflare-warp |
Along with the Cloudflare One Client GUI and daemon, `warp-cli` and `warp-diag` are also [installed](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/) on the machine and added to the system path for use from any terminal session. [`warp-diag`](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/) is a command-line diagnostics tool that collects logs, configuration details, and connectivity data from the Cloudflare One Client to help troubleshoot issues. `warp-cli` is the command-line interface (CLI) for managing and configuring the Cloudflare One Client, allowing users to connect, disconnect, and adjust settings programmatically. #### Client modes The Cloudflare One Client operates in several modes, each with different traffic handling capabilities: Each client mode offers a different set of Zero Trust features. | Client mode | DNS Filtering | Network Filtering | HTTP Filtering | Service mode (displayed in `warp-cli settings`) | | --- | --- | --- | --- | --- | | [**Traffic and DNS mode (default)**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#traffic-and-dns-mode-default) | ✅ | ✅ | ✅ | `WarpWithDnsOverHttps` | | [**DNS only mode**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#dns-only-mode) | ✅ | ❌ | ❌ | `DnsOverHttps` | | [**Traffic only mode**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#traffic-only-mode) | ❌ | ✅ | ✅ | `TunnelOnly` | | [**Local proxy mode**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#local-proxy-mode) | ❌ | ❌ | ✅ | `WarpProxy` | | [**Posture only mode**](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#posture-only-mode) | ❌ | ❌ | ❌ | `PostureOnly` | ## 2. Collect diagnostic logs You can collect diagnostic logs in two ways: the [Cloudflare dashboard](#option-a-collect-logs-via-the-cloudflare-dashboard) or the [`warp-diag`](#option-b-collect-logs-via-the-cli) command-line interface (CLI). ### Option A: Collect logs via the Cloudflare dashboard Collect client diagnostic logs remotely from the Cloudflare dashboard by using Digital Experience Monitoring's (DEX) remote captures. Best practice To troubleshoot effectively, Cloudflare recommends reproducing the issue and noting your timestamps immediately before collecting logs. Though recreating the issue may not be possible in all cases, reproducing the issue right before diagnostic log collection or during the window that a packet capture (PCAP) is running will help you troubleshoot with greater visibility. Refer to [diagnostic log retention window](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#log-retention-window) to learn more. #### Start a remote capture Devices must be actively connected to the Internet for remote captures to run. To capture data from a remote device: 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **DEX** > **Remote captures**. 2. Select up to 10 devices that you want to run a capture on. Devices must be [registered](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/) in your Zero Trust organization. 3. Configure the types of captures to run. - **Packet captures (PCAP)**: Performs packet captures for traffic outside of the WARP tunnel (default network interface) and traffic inside of the WARP tunnel ([virtual interface](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/client-architecture/#ip-traffic)). - **Device diagnostic logs**: Generates a [Cloudflare One Client diagnostic log](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#warp-diag-logs) of the past 96 hours. To include a routing test for all IPs and domains in your [Split Tunnel configuration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/), select **Test all routes**. Note **Test all routes** will extend the time for diagnostics to run and may temporarily impact device performance during the test. You must select Device Diagnostic Logs. You can also choose to run a PCAP and reproduce the issue in the window the PCAP is running to gain further network insight. The scope of this troubleshooting covers only client diagnostic logs. If not choosing PCAPs, reproduce the issue right before running diagnostics. 4. Select **Run diagnostics**. DEX will now send capture requests to the configured devices. If the Cloudflare One Client is disconnected, the capture will time out after 10 minutes. #### Check remote capture status To view a list of captures, go to **Insights** > **Digital experience** > **Diagnostics**. The **Status** column displays one of the following options: - **Success**: The capture is complete and ready for download. Any partially successful captures will still upload to Cloudflare. For example, there could be a scenario where the PCAP succeeds on the primary network interface but fails on the WARP tunnel interface. You can [review PCAP results](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/#download-remote-captures) to determine which PCAPs succeeded or failed. - **Running**: The capture is in progress on the device. - **Pending Upload**: The capture is complete but not yet ready for download. - **Failed**: The capture has either timed out or encountered an error. To retry the capture, check the Cloudflare One Client version and [connectivity status](https://developers.cloudflare.com/cloudflare-one/insights/dex/monitoring/#fleet-status), then start a [new capture](https://developers.cloudflare.com/cloudflare-one/insights/dex/diagnostics/client-packet-capture/#start-a-remote-capture). #### Download remote captures 1. In [Cloudflare One ↗︎](https://one.dash.cloudflare.com/), go to **DEX** > **Remote captures**. 2. Find a successful capture. 3. Select the three-dot menu and select **Download**. This will download a ZIP file to your local machine called `.zip`. DEX will store capture data according to our [log retention policy](https://developers.cloudflare.com/cloudflare-one/insights/logs/#log-retention). After you have your diagnostic files, go to [Review key files](#option-b-collect-logs-via-the-cli) to continue troubleshooting. AI-assisted troubleshooting The [diagnostics analyzer](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#diagnostics-analyzer-beta) uses AI to parse a device's client diagnostic log and summarizes key events, likely causes, and recommended next steps in a concise summary. After you run a [DEX remote capture](#option-a-collect-logs-via-the-cloudflare-dashboard) for client diagnostics: 1. Go to **Insights** > **Digital experience** and select the **Diagnostics** tab. 2. Find your capture in the list of captures. 3. Select the three-dot icon next to **Status** > select **View Device Diag** to generate an AI summary. This analyzer is available for logs collected via the dashboard. ### Option B: Collect logs via the CLI Collect client diagnostic logs on your desktop using the `warp-diag` CLI. To view client logs on desktop devices: 1. Open a Terminal window. 2. Run the `warp-diag` tool: ```sh warp-diag ``` This will place a `warp-debugging-info--