Cloudflare DLP advanced settings can now be managed at the account level!

Hey everyone, it's me, Shii-chan! Today I found a small but welcome security update, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced that advanced Data Loss Prevention (DLP) settings can now be configured at the account level. Settings like OCR, AI context analysis, and payload masking can now be applied across your whole account at once.

The story so far

Until now, advanced DLP settings were managed per profile. If you had lots of profiles, things could drift apart — OCR on over here, off over there — and keeping everything aligned was a bit of a chore.

What changes

Configure it once at the account level, and the same rules apply to all of your DLP profiles. Configuration management gets simpler, and it's easier to enforce consistent protection across your whole organization.

Dive Deep

Settings are evaluated using OR logic. In other words, a setting is enabled if it's turned on at either the account level or the profile level. However, when the account-level setting is off, you can't enable it at the profile level alone.

Migration happens automatically too. If a setting was enabled on any profile, it gets promoted to the account level automatically. So heads up: a profile where you'd previously disabled a setting may end up with it enabled if another profile in the same account had it on.

Also, profile-level advanced settings will be deprecated in a future release. For the details, check out the DLP settings documentation.

Wrap-up

• Advanced DLP settings (OCR, AI context analysis, payload masking) can now be configured at the account level
• Account-level settings apply to all profiles, and they're evaluated with OR logic
• Existing profile settings migrate to the account level automatically, and profile-level advanced settings will be deprecated later

This one's a nice update for admins running DLP in Cloudflare One!