# WARP for Windows Goes GA! Mandatory Auth and TPM Device Registration Land Together

Hey everyone, Shii-chan here! If you run Cloudflare One on Windows, a pretty packed update just landed for you.

## What was announced?

Over on Cloudflare's Changelog, the Cloudflare One Client (WARP) for Windows hit GA (general availability) at version 2026.6.822.0. It's a meaty release with plenty of new features and bug fixes. You can grab it from the [stable releases downloads page](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/).

## The story so far

The WARP client has always gotten steady, incremental improvements, but stronger controls, like "don't let a device onto the internet until it authenticates," and a way to back a device's identity with hardware, were things admins had wanted for a while. This GA release fills in a bunch of those gaps at once.

## What changes

One headline feature is MDM-based mandatory authentication. You can block internet traffic until a user authenticates, so unauthenticated devices don't roam free. There's more in Cloudflare's [announcement blog](https://blog.cloudflare.com/mandatory-authentication-mfa/) and the [configuration docs](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/windows-no-auth-no-internet/).

There's also [hardware-backed device registration](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) using TPM 2.0+, which strengthens each device's identity. And admins can now push [client version assignments](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) from the dashboard to upgrade or downgrade devices directly.

## Dive Deep

There's a lot of practical stuff beyond the headliners.

- DNS: [DNS search suffixes](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) from device profiles and network policies now apply to single-label queries, and the local DNS proxy supports DNSSEC passthrough.
- Diagnostics: new `warp-cli` debug commands let you inspect a connection interactively. For logs, see [Extra debug logging](https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging).
- Networking: API requests are unified under the `api.devices.cloudflare.com` SNI, and Path MTU Discovery is on by default.
- Fixes: a crash when a site requests browser permissions, proxy mode rejecting underscored hostnames, DNS failures after idle connections, and high CPU on device wake are all resolved.

A few known issues are called out too: single sign-on in the embedded WebView2 may fail to use the Windows primary account, and a (benign) Microsoft Edge data directory error can appear during captive portal login. Worth a quick check before you roll it out.

## Wrap-up

- Cloudflare One Client for Windows 2026.6.822.0 is now GA.
- MDM-based mandatory authentication can block internet access until a user signs in.
- TPM 2.0+ hardware-backed device registration strengthens device identity.
- Admins can manage client versions directly from the dashboard.
- DNSSEC passthrough, new `warp-cli` debug commands, and SNI unification round out the quietly useful improvements.

This one lands especially well for admins wrangling fleets of Windows devices under Zero Trust!