File transfer controls have arrived for browser-based RDP! You can now restrict uploads and downloads separately

Hey friends, it's Shii! I found a nice update around remote desktop access, so let me share it with you.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Cloudflare Access has released a beta feature that lets you control file transfers for browser-based RDP (Remote Desktop) sessions. Administrators can now configure, per policy, whether users are allowed to upload or download files between their local device and the remote Windows server.

This is especially useful for organizations that support BYOD (bring-your-own-device) policies or that work with third-party contractors using unmanaged devices. By restricting file transfers, you can prevent sensitive data from being moved out of the remote session onto a user's personal device.

The story so far

Until now, Cloudflare Access's browser-based RDP already had text clipboard controls (allowing or blocking copy and paste). However, there was no mechanism to control the transfer of files themselves, so clipboard controls alone couldn't cover file exchange.

As a result, even when connecting to RDP from a BYOD or contractor device, there was no way to individually block file uploads or downloads.

What changes

With this update, file transfer controls can now be configured per policy within your Access application, alongside the existing text clipboard controls.

You can choose from four options:

• Client to remote RDP session allowed — Users can upload files from their local machine into the browser-based RDP session.
• Remote RDP session to client allowed — Users can download files from the browser-based RDP session to their local machine.
• Both directions allowed — Users can upload and download files between their local machine and the browser-based RDP session.
• Disable copying/pasting — Users are not allowed to transfer files between their local machine and the browser-based RDP session at all.

One important point: by default, file transfer is denied for new policies. For existing Access applications created before this feature was available, file transfer also remains denied. So nothing suddenly becomes more permissive on existing setups — an administrator has to explicitly opt in when needed.

Dive Deep

The original post also explains how this works in practice.

To upload, you drag files into the browser window, or use the settings gear icon on the left side of the RDP session.

To download, you copy a file inside the remote session, then select the settings gear icon to download that file, download multiple files together as a zip, or print PDFs to a local printer.

This interaction pattern feels close to how the existing text clipboard controls already work.

Wrap-up

• File transfer controls for browser-based RDP are now available in beta on Cloudflare Access
• You can choose "upload only," "download only," "both allowed," or "denied" per policy
• New policies deny file transfer by default, and existing applications keep denying it too
• Uploads work via drag-and-drop or the settings gear icon; downloads support individual files, zip bundles, or printing via the settings gear icon

This one should really matter to admins who allow remote connections from BYOD environments or external contractor devices.