JA EN
shiichan

The Cloudflare One Client for Windows Gets a Brand-New UI!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#infrastructure

Hey there, it's me, Shii-chan! Today I've got good news for everyone running Cloudflare One on Windows, so let me share it!

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on Cloudflare's Changelog, a new Beta of the Cloudflare One Client for Windows (version 2026.5.1155.1) has arrived. You can grab it from the beta releases downloads page. The headline is the brand-new client UI ! It's cleaner and more intuitive, so common actions are much easier to reach. You get a right-click context menu for the actions you use most, plus a built-in captive portal login experience.

The story so far

Take virtual networks (VNETs) as an example: until now, every VNET in the organization was visible to every device, so admins couldn't scope things down to "just this network for this person." Authentication had a gap too — there was no clean way to block traffic from boot until a user signed in, leaving a small window of exposure on freshly deployed devices.

What changes

This release hands admins a lot more control. VNETs can now be scoped per WARP device profile, and with mandatory authentication enabled, the client blocks all Internet traffic from the moment the machine boots until the user authenticates. That closes the "invisible window" right after deployment and during re-authentication.

Dive Deep

Here are the concrete changes I could pull from the post.

  • DNS search suffixes: the client now appends the search domains configured in your device profile or network policy to single-label queries. See DNS search suffixes for details.
  • VNET scoping: use the VNET availability setting in the Zero Trust dashboard to limit which VNETs each profile can see.
  • Mandatory authentication: enabled via MDM, and covered in the announcement blog and the documentation.
  • Local-file signal for Emergency Disconnect: on top of the existing HTTPS polling, admins can now have WARP watch for a file on disk to trigger an emergency disconnect — handy even when both Cloudflare and your own infrastructure are unreachable.
  • warp-cli debug commands: new commands for interactive connection diagnosis. See Extra debug logging.
  • DNSSEC passthrough: the local DNS proxy now forwards DNSSEC-signed responses intact (DO/AD bits and RRSIG records), so apps that validate locally, plus dig / drill, work correctly.
  • New MDM format for org-wide settings: a cleaner way to configure compliance environments like FedRAMP is now recommended. The Cloudflare One MDM documentation has been updated.

The bug fixes are nice too. Proxy mode used to reject hostnames with underscores (like ai_app.com), which broke apps that rely on them, including ChatGPT sandbox apps — that's fixed now. And the UseWebView2 registry value is honored again, so admins who prefer the embedded WebView2 browser for sign-in can opt back in.

One heads-up: the new UI doesn't have split tunnel list configuration yet, so for now you manage entries with warp-cli tunnel ip and warp-cli tunnel host. UI support is coming in a future release.

Wrap-up

  • The Cloudflare One Client for Windows Beta (2026.5.1155.1) is out, headlined by a refreshed UI
  • Adds per-profile VNET scoping and mandatory authentication that blocks traffic from boot
  • Ships smaller improvements and fixes too, like DNSSEC passthrough and accepting underscore hostnames
  • A great update for anyone managing Windows devices with Zero Trust!

Related posts