JA EN
shiichan

Access Independent MFA Gets Smarter: AAGUID Restrictions and AMR Matching!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey everyone, it's Shiichan! Today I found a quiet but really welcome update about authentication. That annoying moment where you have to do MFA twice? It's about to get a little less painful.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare Access added two new organization-level controls to its Independent MFA feature. This came from the Cloudflare Changelog.

The first is restricting authenticators by AAGUID, and the second is AMR matching. Both give you finer control over who authenticates, with which key, and how many times.

The story so far

Independent MFA lets Access add its own MFA step on top of your identity provider (IdP). That boosts security, but it also meant any authenticator could enroll, and users who already did MFA at the IdP still got prompted again. These updates fill in exactly those gaps.

What changes

  • AAGUID restrictions: You can limit enrollment to WebAuthn authenticators that carry a specific AAGUID (Authenticator Attestation GUID). This is ideal for organizations that require FIPS-validated security keys or company-issued hardware.
  • AMR matching: If your IdP already performed an equivalent MFA, Access can skip its own MFA prompt, so users don't complete MFA twice.

Dive Deep

AAGUID is an ID that identifies the type of an authenticator. These are now managed through a new List type, so you can gather the AAGUIDs you want to allow into a single list.

For AMR matching, Access reads the amr claim defined in RFC 8176. It matches values like hwk (hardware key), otp (one-time password), and fpt (fingerprint) against the authenticator types allowed on the application or policy, and if they line up it treats MFA as already done and skips the prompt. Setup details live in the Independent MFA docs.

Wrap-up

  • Cloudflare Access independent MFA gained two new org-level controls
  • AAGUID restrictions narrow enrollment to FIPS-validated or company-issued keys (managed via a new List type)
  • AMR matching reads the amr claim (RFC 8176) to recognize IdP-side MFA and avoid double MFA
  • It matches values like hwk, otp, and fpt against your app/policy's allowed authenticators

This one lands well for admins running Access with Zero Trust who've struggled with hardware-key governance or the double-MFA hassle!

Related posts