JA EN
shiichan

Pick How Google Workspace Logins Behave in Cloudflare Access: Prompt Controls and Login Hints

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! Today I have news about Cloudflare Access making its login flow a little smarter!

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Google Workspace identity provider integrations now include prompt controls and device-scoped login hints. You can use them in both the Cloudflare dashboard and the API!

The story so far

When Access used Google Workspace as an identity provider, the screens Google showed during login followed Google's default behavior. This update lets you choose that behavior.

What changes

You can tune the login experience to fit how your team works:

  • Teams that want already signed-in users to pass through without a prompt
  • Teams whose users juggle several accounts and want account selection every time
  • Teams that want the consent screen shown reliably

Dive Deep

Prompt options

You can choose from these four:

  • Google's default behavior
  • Silent authentication
  • Consent
  • Account selection

If silent authentication can't use an active Google session, Access retries once with Google's default interactive flow. So choosing silent authentication shouldn't leave people stuck!

Device-scoped login hints

Access can also send a domain-matched login hint. It sends the hint when one email from a previous Access login on the same device matches the Google Workspace domain.

The announcement doesn't list the exact dashboard labels or API field names, so check the "Google Workspace authentication options" section of the documentation for configuration details.

Wrap-up

  • Prompt controls are now available for Google Workspace identity provider integrations
  • Choose from default, silent authentication, consent, or account selection
  • If silent authentication fails, Access retries once with the default interactive flow
  • A login hint can be sent when a previous email on the same device matches the domain
  • Available in both the dashboard and the API

This one is for admins running Access with Google Workspace!

Related posts