JA EN
shiichan

Share one IdP across accounts with Cloudflare Access IdP federation!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey everyone, it's Shii-chan! Today I found an update that fixes the "ugh, I have to set this up again?" problem, so let me share it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

From Cloudflare's Changelog: Cloudflare Access now supports IdP federation. It lets you share a single identity provider (IdP) configuration across multiple Cloudflare accounts in your organization.

The story so far

Until now, if your organization had several Cloudflare accounts, you had to configure the same IdP (for example, Okta or Entra ID) separately in every account. Repeating that setup each time an account was added got a little tedious.

What changes

Now you configure the IdP once in a source account and share it with the other accounts in your organization. End users just sign in with their existing IdP credentials as before. Each account's Access policies evaluate that login exactly like any other IdP login.

Dive Deep

Here are the key points I picked up from the IdP federation docs.

  • One IdP, many accounts — Configure your IdP once and share it with all accounts in your organization.
  • Lifecycle management — As accounts join or leave your Cloudflare organization, their IdP connections are provisioned and removed automatically, with no manual cleanup.
  • Immutable recipient connections — IdP connections in recipient accounts are read-only, so they cannot be accidentally modified or deleted.

Each recipient account routes authentication back to the source account through a bridge — a hidden application in the source account that brokers the cross-account login.

Wrap-up

  • Cloudflare Access supports IdP federation, so one IdP config can be shared across multiple accounts
  • The flow is: configure in a source account, then distribute to the other accounts in your organization
  • Connections are provisioned and removed automatically as accounts join or leave, and recipient connections stay read-only for safety

This one lands well for admins running several Cloudflare accounts in one organization who were tired of managing IdP setup by hand!

Related posts