JA EN
shiichan

Cloudflare Becomes Its Own Identity Provider — Access Sign-in Just Got Lighter!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey there, it's me, Shiichan! Today I found a little quality-of-life update around sign-in, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

This one comes from Cloudflare's Changelog. Access can now use Cloudflare itself as an identity provider. Users can sign in with the Cloudflare account they already have.

Here's how the post puts it:

users can sign in with their existing Cloudflare account — no one-time PINs, no third-party IdP configuration, and no shared email inboxes

No one-time PINs, no third-party IdP setup, and no shared email inboxes. Nice and light!

The story so far

Until now, newly created Zero Trust accounts defaulted to one-time PIN for login — you know, the flow where a code lands in your inbox and you type it in. With this update, the default identity provider for newly created Zero Trust accounts is now Cloudflare itself.

What changes

If you already have a Cloudflare account, you can log in to Access-protected apps without standing up a separate IdP first. That trims the initial setup work, which is handy when you just want to quickly protect an internal tool.

Dive Deep

Two new mechanisms shipped alongside this:

  • A new policy selector (Cloudflare Account Member) that matches users based on their membership in a Cloudflare account — so you can write policies like "only members of this account get through."
  • An identity provider configuration option that limits authentication to users who are members of your Cloudflare account.

If you want the starting point for configuration, take a peek at the identity provider guide.

Wrap-up

  • Cloudflare Access can now use Cloudflare itself as an identity provider
  • The default for newly created Zero Trust accounts moves from one-time PIN to Cloudflare
  • New Account Member policy selector plus an option to restrict authentication to account members

I think this is a nice fit for small teams that want to spin up Zero Trust quickly, or anyone who just wants to protect an internal tool with Access first.

Related posts