Documentation (access policies) — Cloudflare Zero Trust

Cited by

Facts read from this source

• Access policy actions Report an error

  “Actions: What happens when a user matches the policy (Allow, Block, Bypass, or Service Auth)”

• Access policy rule types Report an error

  “Rule types: How criteria are combined (Include, Require, or Exclude)”

• Access one action per policy Report an error

  “You can set only one action per policy.”

• Access deny by default Report an error

  “Since Access is deny by default, users who do not match a Block policy will still be denied access unless they explicitly match an Allow policy.”

• Bypass no logging Report an error

  “Warning Bypass does not enforce any Access security controls and requests are not logged.”

• Bypass no identity selectors Report an error

  “As Bypass does not enforce Access security controls, Bypass policies do not support identity-based rule types.”

• Service auth no idp Report an error

  “Service Auth rules in Cloudflare Access enforce authentication flows that do not require an identity provider IdP login, such as service tokens and mutual TLS.”

• Include requires rule Report an error

  “All Access policies must contain at least one Include rule.”

• Include or operator Report an error

  “The Include rule in Cloudflare Access is similar to an OR logical operator. In case more than one Include rule is specified, users need to meet only one of the criteria.”

• Exclude not operator Report an error

  “The Exclude rule in Cloudflare Access works like a NOT logical operator. A user meeting any Exclusion criteria will not be allowed access to the application.”

• Require and operator Report an error

  “The Require rule in Cloudflare Access works like an AND logical operator. A user must meet all specified Require rules to be allowed access.”

• Rule groups or logic Report an error

  “Solution: Use a rule group to convert AND logic to OR logic within a Require rule.”

• Selectors all app types Report an error

  “These attributes are available for all Access application types, including SaaS, self-hosted, and non-HTTP applications.”

• Non identity continuous evaluation Report an error

  “Non-identity attributes are polled continuously, meaning they are evaluated with each new HTTP request for changes during the user session.”

• User risk score enterprise only Report an error

  “User Risk Score The user's current risk score (Low, Medium, High, or Unscored). Matches only the values selected in the rule. This selector only displays for Enterprise plans.”

• Ip ranges selector ipv4 ipv6 Report an error

  “IP ranges 192.168.100.1/24 (supports IPv4/IPv6 addresses and CIDR ranges) ✅ ✅”

• Saas policy enforcement limitation Report an error

  “For SaaS applications, Access can only enforce policies at the time of initial sign on and when reissuing the SaaS session.”

• SCIM attribute reattestation Report an error

  “If you have configured SCIM provisioning, you can force a user to re-attest all attributes with Access whenever you revoke the user in the IdP or update their IdP group membership.”

• Connection context per policy Report an error

  “Connection context is configured per policy, allowing you to grant different permissions to different groups of users.”

• Connection context settings by app type Report an error

  “Infrastructure (SSH) Allowed UNIX usernames Browser-based RDP Clipboard controls, file transfer controls”

• Policy execution order Report an error

  “Bypass and Service Auth policies are evaluated first, from top to bottom as shown in the UI. Then, Block and Allow policies are evaluated based on their order from top to bottom.”

• External evaluation selector Report an error

  “External Evaluation Allows or denies access based on custom logic in an external API.”

• Device posture selector Report an error

  “Device posture Checks device posture signals from the Cloudflare One Client or a third-party service provider.”

• Identity provider group idps Report an error

  “Identity provider group Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with SCIM.”

• Bypass incompatibilities Report an error

  “Bypass policies which contain device posture check rules will not function when: Zaraz is enabled for the zone protected by Access A Worker intercepts the request”

• API terraform management Report an error

  “API and Terraform provide programmatic ways to manage your Access policies and configurations.”

• Bypass reverts zone settings Report an error

  “When applying a Bypass action, security settings revert to the defaults configured for the zone and any configured Page Rules.”

Scores citing this record

• The DevOps Engineer Access model & connectivity
• The DevOps Engineer Identity, access policy & device posture
• The DevOps Engineer Logs, audit trail & incident response
• The DevOps Engineer Deployment, API & administration
• The IT Lead Access model & connectivity
• The IT Lead Identity, access policy & device posture
• The IT Lead Logs, audit trail & incident response
• The MSP Technician Access model & connectivity
• The MSP Technician Identity, access policy & device posture
• The MSP Technician Logs, audit trail & incident response
• The Operations Manager Identity, access policy & device posture
• The Information Security Officer Access model & connectivity
• The Information Security Officer Identity, access policy & device posture
• The Information Security Officer Logs, audit trail & incident response
• The Information Security Officer Pricing transparency
• The Skeptic Identity, access policy & device posture
• The Skeptic Logs, audit trail & incident response