# Share one IdP across accounts with Cloudflare Access IdP federation!

Hey everyone, it's Shii-chan! Today I found an update that fixes the "ugh, I have to set this up again?" problem, so let me share it.

## What was announced?

From Cloudflare's Changelog: Cloudflare Access now supports **IdP federation**. It lets you share a single identity provider (IdP) configuration across multiple Cloudflare accounts in your organization.

## The story so far

Until now, if your organization had several Cloudflare accounts, you had to configure the same IdP (for example, Okta or Entra ID) **separately in every account**. Repeating that setup each time an account was added got a little tedious.

## What changes

Now you configure the IdP once in a source account and share it with the other accounts in your organization. End users just sign in with their existing IdP credentials as before. Each account's [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) evaluate that login exactly like any other IdP login.

## Dive Deep

Here are the key points I picked up from the [IdP federation](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/idp-federation/) docs.

- **One IdP, many accounts** — Configure your IdP once and share it with all accounts in your organization.
- **Lifecycle management** — As accounts join or leave your Cloudflare organization, their IdP connections are provisioned and removed automatically, with no manual cleanup.
- **Immutable recipient connections** — IdP connections in recipient accounts are read-only, so they cannot be accidentally modified or deleted.

Each recipient account routes authentication back to the source account through a **bridge** — a hidden application in the source account that brokers the cross-account login.

## Wrap-up

- Cloudflare Access supports IdP federation, so one IdP config can be shared across multiple accounts
- The flow is: configure in a source account, then distribute to the other accounts in your organization
- Connections are provisioned and removed automatically as accounts join or leave, and recipient connections stay read-only for safety

This one lands well for admins running several Cloudflare accounts in one organization who were tired of managing IdP setup by hand!