Identity Alone Is No Longer Enough for Zero Trust

Cloudflare for Teams has long let administrators build rules around who connects to a resource. But knowing a user's identity says nothing about the security of the device they're using. Over the past year, as remote work pushed more traffic off corporate networks, that gap became harder to ignore. The latest update to Cloudflare for Teams adds six new device posture checks that give administrators more granular control over the hardware and software state of every device that reaches their applications.

The checks build on the Zero Trust premise that no connection is trusted by default. Instead, every request is evaluated against rules the administrator defines. Those rules now extend beyond identity to cover the device's OS version, disk encryption, firewall state, domain membership, and more—all driven by the Cloudflare WARP agent running on the endpoint. Because rules are applied per application or resource, the same user can be allowed from an unmanaged device for low-risk work but blocked from administrative tools unless their machine meets stricter criteria.

Six New Posture Signals

Cloudflare for Teams previously launched integrations with endpoint protection platforms and device serial number validation, plus support for WARP tunnel connections and the secure web gateway. Today's update adds six more device factors:

  • Application Check — verifies that a specific program you choose is running on the device.
  • File Check — confirms a required file is present, such as an updated signature database or a patch.
  • Disk Encryption — ensures all physical disks on the device are encrypted.
  • OS Version — requires that the operating system is up to a specific version.
  • Firewall — checks that a firewall is configured and active.
  • Domain Joined — requires Windows devices to be joined to the corporate directory.

These checks address a common blind spot. A user with valid credentials could otherwise sign in from a personal device running an outdated OS, exposing corporate data to any vulnerability on that machine. Per-resource posture rules let an administrator decide, for example, that a marketing preview page is fine on any device, but accessing a customer administration tool requires verified disk encryption and domain membership.

Configuration Mirrors Identity Rules

Device posture checks are configured in the same Cloudflare for Teams dashboard used for identity policies, in the Devices section of the My Team page. For example, creating a Disk Encryption check starts by adding a new attribute and giving it a descriptive name—such as "Windows disk encryption required," since encryption checks may need to differ by platform.

Administrators can also bundle multiple posture checks into reusable Groups. Once a group is defined, it appears in the same place as any identity-based group when building an Access policy. Applying it is straightforward: create a new application in Access, or edit an existing one, and add a rule that references the group with a Require action. The rule goes into effect immediately, evaluated at Cloudflare's edge in over 200 cities worldwide.

Not every posture type is supported on every operating system, so it's worth checking the device posture documentation before building rules. Cloudflare is also soliciting community feedback on which additional posture types to support next.