SCIM Comes to Cloudflare Access and Gateway
Cloudflare Access and Gateway now support the System for Cross-domain Identity Management (SCIM) protocol. SCIM is an open standard (RFC 7642) that lets organizations automate creation, updates, and deletion of user accounts and permissions across systems, keeping identity data in sync without manual intervention.
In a typical deployment, an identity provider like Okta or Azure Active Directory holds authoritative employee records—names, emails, job titles. When that directory changes, SCIM pushes the change out to connected services. A new hire automatically gets an account in a cloud application; a job title change propagates; a terminated employee is removed everywhere. The organization no longer relies on an administrator to replicate each change by hand.
Cloudflare Access protects internal applications by integrating with an existing identity provider to enforce strong authentication. After a user authenticates, Access starts a session that eventually expires, at which point the user is redirected back to the identity provider. Cloudflare Gateway is a secure web gateway (SWG) that reuses the same identity provider configuration to build DNS, Network, and HTTP inspection policies based on identity. Once a user logs in through the WARP client, their identity is logged and evaluated against administrator-defined policies.
What was missing before
Prior to SCIM support, deprovisioning was awkward. Removing a departing or compromised user meant manually deleting their access in both the identity provider and Cloudflare Access. Merely disabling the account in the directory wasn't enough: the user's Cloudflare Zero Trust session would persist until they attempted to authenticate again, leaving a window of potential exposure. That manual, two-step workflow was slow and error-prone.
Groups faced a similar problem. Identity provider groups had to be typed into the Zero Trust dashboard by hand, so any group change in the identity provider required a corresponding manual update. If those updates were missed, policies could reference stale group data, and keeping everything consistent demanded ongoing effort and expertise.
What SCIM changes
With SCIM integrated into Access and Gateway, deactivating a user in the identity provider automatically triggers deprovisioning in Cloudflare. A SCIM listener detects the deactivation event and revokes all active sessions for that user, immediately cutting off access to any application protected by Access as well as blocking their WARP session for Gateway.
SCIM also automates group synchronization. All identity provider groups become available automatically in both the Access and Gateway policy builders. Administrators can optionally require users to reauthenticate when their group membership changes.
For example, an Access policy intended to allow users with emails from example.com except for those in a "risky user" group can be assembled simply by selecting that group from a drop-down. Likewise, a Gateway policy blocking example.com and all its subdomains for that same set of users is built the same way.
Availability and roadmap
SCIM support for Access and Gateway is available today for all Zero Trust customers. Initial provider support covers Azure Active Directory and Okta for Self-Hosted Access applications; broader identity provider support and Access for SaaS are planned for future releases.
