Cloudflare Access now lets you simulate policy changes against your whole user base before deploying!

Hey everyone, it's me, Shii-chan! Today I found an update that should give Zero Trust admins a lot less to worry about.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On the Cloudflare Changelog, they announced that the Access bulk policy tester is now available in the Zero Trust dashboard. With this feature, you can simulate Access policy changes against your entire user base, both before and after you deploy them. The test runs using each user's last seen identity and their device posture, when applicable.

Why it matters

Access controls who can log in, so a policy mistake can bring work to a halt fast. Change one rule, and you might accidentally lock out employees who should have access, or let in people who shouldn't.

There were already ways to test individual policies, but there wasn't much of a way to see, in aggregate, how a change would affect your whole organization. That's exactly the kind of pre-deployment visibility admins have been wanting.

What changes

With the bulk policy tester, you can check, before pushing a policy to production, roughly what percentage of your active users would be allowed and what percentage would be blocked under the new configuration. You can also expand the results to see the actual list of users who would be allowed or blocked.

You can run the same test again after deploying, so it doubles as a way to confirm your change landed the way you expected. The best part is that admins can now ship policy changes with a lot more confidence.

Dive Deep

For this tester to work, a user needs to have logged into the App Launcher or some Access application at least once. Cloudflare uses that user's most recently authenticated device for the simulation.

There seem to be two levels of granularity here.

• Single policy test: from the policy builder, you can check the percentage of active users who'd be allowed or blocked, before you even save the change
• Bulk test for an application: test all policies attached to an application at once, and see the allow/block breakdown across your whole user base. After saving, you can also test a single user by entering their email address, and see their identity details from their last login along with which Allow/Block/Bypass policies they matched

To run it from the dashboard, go to Access controls > Applications, pick your app, then Configure > Policies > Policy tester, and hit Test policies. It's nice that you can just click around and try it right away.

Wrap-up

• The Access bulk policy tester has been added to the Zero Trust dashboard
• It simulates policy changes against your entire user base, both before and after deploying
• It evaluates each user's last seen identity and device posture (when applicable)
• Results show an allow/block percentage plus the affected user list, and you can also run a pinpoint test on a single user

If you're an admin managing Access policies for a large organization, this is a quiet but genuinely useful update!