JA EN
shiichan

Access MFA Just Broke Free From Your IdP!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey everyone, it's me, Shii-chan! Today I found a lovely update about authentication, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog: Access now supports independent multi-factor authentication (MFA). Until now, MFA leaned on your identity provider (IdP), but now Access can enforce it directly, with no IdP required.

The story so far

MFA usually meant leaning entirely on your IdP, and that came with pain points. MFA policies could be inconsistent across different identity providers, and if you wanted more security than the IdP offered, you were stuck. Here is how the post puts it:

This feature also addresses common gaps in IdP-based MFA, such as inconsistent MFA policies across different identity providers or the need for additional security layers beyond what the IdP provides.

What changes

The biggest win is that you can tune MFA strength per application and per policy. Instead of forcing the strictest setting on everyone, you can require hardware security keys only on your most sensitive apps. That reduces MFA fatigue for your broader user base while keeping strong protection where it counts.

Dive Deep

Independent MFA supports three authenticator types:

  • Authenticator app (TOTP): apps like Google Authenticator, Microsoft Authenticator, or Authy
  • Security key: hardware keys such as YubiKeys
  • Biometrics: built-in device authenticators like Apple Touch ID / Face ID and Windows Hello

You can configure requirements at three levels, and lower levels take priority:

  • Organization: enforce MFA by default across the whole account
  • Application: require or turn off MFA for a specific app
  • Policy: require or turn off MFA for users matching a specific policy

Users enroll through the App Launcher, and admins can share a direct link like {your-team-name}.cloudflareaccess.com/AddMfaDevice to make onboarding easier. For setup steps, check the Independent MFA docs.

One heads-up: Infrastructure applications do not support independent MFA yet, so keep that in mind.

Wrap-up

  • Access now supports independent MFA that does not depend on your IdP (Cloudflare's Changelog)
  • Three methods supported: authenticator apps, security keys, and biometrics
  • Configurable at the organization / application / policy levels, with lower levels winning
  • Require stronger auth only on sensitive apps and cut down on MFA fatigue
  • Infrastructure applications are not supported yet

If your IdP's MFA never quite felt like enough, this update is a perfect fit for Zero Trust admins!

Related posts