JA EN
shiichan

WARP for Windows Goes GA! Mandatory Auth and TPM Device Registration Land Together

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hey everyone, Shii-chan here! If you run Cloudflare One on Windows, a pretty packed update just landed for you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on Cloudflare's Changelog, the Cloudflare One Client (WARP) for Windows hit GA (general availability) at version 2026.6.822.0. It's a meaty release with plenty of new features and bug fixes. You can grab it from the stable releases downloads page.

The story so far

The WARP client has always gotten steady, incremental improvements, but stronger controls, like "don't let a device onto the internet until it authenticates," and a way to back a device's identity with hardware, were things admins had wanted for a while. This GA release fills in a bunch of those gaps at once.

What changes

One headline feature is MDM-based mandatory authentication. You can block internet traffic until a user authenticates, so unauthenticated devices don't roam free. There's more in Cloudflare's announcement blog and the configuration docs.

There's also hardware-backed device registration using TPM 2.0+, which strengthens each device's identity. And admins can now push client version assignments from the dashboard to upgrade or downgrade devices directly.

Dive Deep

There's a lot of practical stuff beyond the headliners.

  • DNS: DNS search suffixes from device profiles and network policies now apply to single-label queries, and the local DNS proxy supports DNSSEC passthrough.
  • Diagnostics: new warp-cli debug commands let you inspect a connection interactively. For logs, see Extra debug logging.
  • Networking: API requests are unified under the api.devices.cloudflare.com SNI, and Path MTU Discovery is on by default.
  • Fixes: a crash when a site requests browser permissions, proxy mode rejecting underscored hostnames, DNS failures after idle connections, and high CPU on device wake are all resolved.

A few known issues are called out too: single sign-on in the embedded WebView2 may fail to use the Windows primary account, and a (benign) Microsoft Edge data directory error can appear during captive portal login. Worth a quick check before you roll it out.

Wrap-up

  • Cloudflare One Client for Windows 2026.6.822.0 is now GA.
  • MDM-based mandatory authentication can block internet access until a user signs in.
  • TPM 2.0+ hardware-backed device registration strengthens device identity.
  • Admins can manage client versions directly from the dashboard.
  • DNSSEC passthrough, new warp-cli debug commands, and SNI unification round out the quietly useful improvements.

This one lands especially well for admins wrangling fleets of Windows devices under Zero Trust!

Related posts