Cloudflare Access

Prevent lateral movement and reduce VPN reliance. Free for up to 50 users.

Works with your identity providers and endpoint protection platforms to enforce default-deny, Zero Trust rules that limit access to corporate applications, private IP spaces and hostnames. Connects users faster and more safely than a VPN.

Get started View pricing

Granular application access control without lateral movement. Users can seamlessly access the resources they need and are blocked from those they do not.

Enforce consistent role-based access controls across all SaaS and self-hosted applications -- cloud, hybrid, or on-premises.

Accelerate remote access and reduce reliance on VPN with ZTNA delivered on Cloudflare's globally distributed, DDoS-resistant edge network.

Protect any app

Cloudflare is both identity and application agnostic, allowing you to protect any application, SaaS, cloud, or on-premises with your preferred identity provider.
Apply strong, consistent authentication methods to even legacy applications with IP firewall and Zero Trust rules.

Enforce device-aware access policies

Before you grant access, evaluate device posture signals including presence of Gateway client, serial number, and mTLS certificate, ensuring that only safe, known devices can connect to your resources.
Integrate device posture from Endpoint Protection Platform (EPP) providers including Crowdstrike, Carbon Black, Sentinel One, and Tanium.

Learn more

Slide 1 of 3

"Access is easier to manage than VPNs and other remote access solutions, which has removed pressure from our IT teams. They can focus on internal projects instead of spending time managing remote access."
Alexandre Papadopoulos
Director of Cyber Security

Enable identity federation across multiple identity providers

Integrate all of your corporate identity providers (Okta, Azure AD, and more) for safer migrations, acquisitions and third-party user access.
Enable one-time-pins for temporary access.
Incorporate social identity sources like LinkedIn and GitHub.

Connect users flexibly, with or without a client

Facilitate web app and SSH connections with no client software or end user configuration required.
For non-web applications, RDP connections, and private routing, utilize one comprehensive client across Internet and application access use cases

Visibility meets simplicity

Access allows you to log any request made in your protected applications - not just login and log out.
Aggregate activity logs in Cloudflare, or export them to your cloud log storage or SIEM provider.

Slide 1 of 4

"We launched quickly in April 2020 to bring remote learning to children throughout the UK during the coronavirus pandemic. Cloudflare Access made it fast and simple to authenticate a huge network of teachers and developers into our production sites and we set it up in literally less than an hour."
John Roberts
Technology Director
"When Peter Hahn transitioned to working remotely, we found that our VPN was causing serious performance issues. Deploying Cloudflare Access in front of the first batch of our internal tools resulted in such a huge increase in performance, reliability and convenience for the whole team that we are gradually transitioning all tools to use Access as soon as possible. Getting started took us only a few minutes."
Francisc Rusznyak
Head of Web-Development, E-Commerce

How it works

Yesterday's approach to securing applications

Put applications behind on-premise hardware, and then force users through a VPN to secure their traffic. As more of the world shifts to mobile and applications move to the cloud, this model breaks.

Cloudflare for Teams

Instead of a VPN, users connect to corporate resources through a client or a web browser. As requests are routed and accelerated through Cloudflare’s edge, they are evaluated against Zero Trust rules incorporating signals from your identity providers, devices, and other context. Where RDP software, SMB file viewers, and other thick client programs used to require a VPN for private network connectivity, teams can now privately route any TCP traffic through Cloudflare’s network where it’s accelerated, verified, and filtered in a single pass, facilitating improved performance and security.