# Cloudflare Becomes Its Own Identity Provider — Access Sign-in Just Got Lighter!

Hey there, it's me, Shiichan! Today I found a little quality-of-life update around sign-in, so let me walk you through it.

## What was announced?

This one comes from Cloudflare's Changelog. [Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) can now use Cloudflare itself as an [identity provider](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/cloudflare/). Users can sign in with the Cloudflare account they already have.

Here's how the post puts it:

> users can sign in with their existing Cloudflare account — no one-time PINs, no third-party IdP configuration, and no shared email inboxes

No one-time PINs, no third-party IdP setup, and no shared email inboxes. Nice and light!

## The story so far

Until now, newly created Zero Trust accounts defaulted to one-time PIN for login — you know, the flow where a code lands in your inbox and you type it in. With this update, the default identity provider for newly created Zero Trust accounts is now Cloudflare itself.

## What changes

If you already have a Cloudflare account, you can log in to Access-protected apps without standing up a separate IdP first. That trims the initial setup work, which is handy when you just want to quickly protect an internal tool.

## Dive Deep

Two new mechanisms shipped alongside this:

- A new [policy selector](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/#cloudflare-access-selectors) (Cloudflare Account Member) that matches users based on their membership in a Cloudflare account — so you can write policies like "only members of this account get through."
- An identity provider configuration option that limits authentication to users who are members of your Cloudflare account.

If you want the starting point for configuration, take a peek at the identity provider guide.

## Wrap-up

- Cloudflare Access can now use Cloudflare itself as an identity provider
- The default for newly created Zero Trust accounts moves from one-time PIN to Cloudflare
- New Account Member policy selector plus an option to restrict authentication to account members

I think this is a nice fit for small teams that want to spin up Zero Trust quickly, or anyone who just wants to protect an internal tool with Access first.