Region-Based Access Controls Arrive in Cloudflare Access
Remote work has untethered employees from the office — and often from their home countries. Teams can now log in from a rented apartment in Lisbon, a co-working space in Mexico City, or anywhere else with a decent connection. But that geographic flexibility creates a compliance headache for organizations that must keep certain data inside specific borders or restrict access from entire countries. In the days of physical offices, geography was implicit: users connecting from the office were, by definition, in the right place. That assumption no longer holds.
Cloudflare Access now offers a straightforward way to re-impose geography-based compliance with only two clicks in the admin UI. Administrators can create rules that require team members to connect from specific countries, or block logins from others. The feature works with any configured identity provider and requires no changes on the user side.
What Cloudflare Access Does
Cloudflare Access applies Zero Trust enforcement to every request made to a protected application. Instead of trusting anyone on a private network, Access verifies identity whenever someone attempts to reach an app. Because the check runs on Cloudflare's global network — spanning data centers in over 200 cities — it does not introduce meaningful latency.
Administrators define policies that determine who can reach protected tools. When users try to connect, they authenticate through one of the configured identity providers, and Access evaluates the login against the policy's allowed user list before permitting the request.
But the platform evaluates more than just a username. Access aggregates multiple signals about a user — such as whether they authenticated with a mutual TLS client certificate or a hard key — and exposes those signals to administrators. For organizations with compliance requirements centered on region, those use-case-driven rules can now include country-level conditions layered on top of multifactor authentication workflows.
Build Country Conditions into Policies
Access policies can be as simple as only allow team members with @team.com email addresses. Usernames and passwords alone, however, are not always enough. Depending on where your organization operates — or must avoid operating — you can layer country-specific rules on top of your identity provider workflows.
The new release lets you add rules that require users to connect from certain countries or restrict logins from others entirely. Need to ensure that only users physically in Portugal can access a system? You can require that. Want to lock out logins from Costa Rica — perhaps to ensure a vacationing employee truly disconnects? An exclusion rule covers that case. And these conditions can be applied per application. A sensitive app that stores regulated data can require specific countries, while other tools continue to rely on identity alone.
Logging and Auditing Without Extra Tools
Every request a user makes to an internal application is captured by Cloudflare Access, with no code changes required on the application side. Logs can be exported to a third-party storage or SIEM solution, letting compliance and security teams audit the country of origin for each user request. This works without deploying additional client-side software on corporate devices.
Combine with Other Zero Trust Signals
Zero Trust starts with a username. Administrators define rules that map users to the applications they can reach, with Access integrating with one or multiple identity providers to make those decisions at the edge of Cloudflare's network.
Identity, however, extends beyond the username. Access aggregates multiple sources of signal from the Cloudflare network to make authorization decisions long before a request reaches your infrastructure. Administrators can combine user rules with mutual TLS requirements, device posture checks, or force logins to always use a hard key. These rules run inline with Cloudflare's other security features, such as the WAF and DDoS mitigation, adding layers of protection to every request.
The country rules announced today become another layer in that model. For example, you can construct a policy allowing a user to log in only when they are connecting from Germany and present a physical hard key. Every available signal can be used as a building block for a comprehensive policy tailored to your compliance or security needs.
Setting Up a Country Rule
To get started, navigate to an application already added to Cloudflare Access — or create a new one. Policies consist of actions that allow, block, or bypass requests based on defined criteria. Access evaluates policies in order of precedence from top to bottom in the UI.
Within a policy, criteria are defined using three types of operators:
- Include: Rules function like AND operators. Users must satisfy at least one criterion in an Include rule. For example, an Include rule could allow anyone with the email domain
@cloudflare.comor the email domain[email protected]to connect. - Require: Rules function like AND operators. Users must meet every Require rule criterion.
- Exclude: Rules function like NOT operators. Users must not meet the criterion of an Exclude rule.
To require connections from a particular country, create an Allow policy that includes your users' email or identity provider group. Within that policy, add a Require rule and choose the required country. To allow users from several countries, add them to an Access Group first.
Then add that group into the Require rule.
Availability
Cloudflare Access is part of Cloudflare for Teams and is available today. The country requirement rule is included in all plans.
