Beyond the corporate SSO

Cloudflare Access sits in front of internal applications and replaces the traditional VPN with Cloudflare's network. Teams can attach the single sign-on provider they already use, such as Okta or AzureAD, and make on-premise or self-managed cloud applications behave like SaaS. But the people who need access are rarely just internal employees. Partners, freelancers, and contractors all need entry at some point, and managing that extended access can drain IT resources.

Cloudflare Access addresses this by supporting multiple identity providers simultaneously, including consumer services like Gmail or GitHub that don't require corporate subscriptions. External users authenticate with accounts they already have, while administrators avoid the overhead of creating and deleting accounts for every project cycle. Two new integrations are now available: LinkedIn and GitHub Teams can be added as login methods alongside a corporate SSO.

Why identity sharing is hard

Sharing an application with outside parties requires both sides to agree on where identity comes from. The common approaches each carry tradeoffs.

One option is to onboard external users directly into the organization's own identity provider. When a contractor joins, IT opens help desk tickets, creates user accounts in the directory, and sends sign-up instructions. The contractor sets a new password, learns unfamiliar tooling, and uses those credentials to log in.

This model gives the organization full control over identity but comes with real costs. The project pays for temporary SSO seat licenses, IT spends time onboarding and later offboarding, and the external user manages yet another password that grants access to internal resources.

Another approach is federation, where an organization connects its directory service to a partner's equivalent. External users log in with their own credentials, but administrators on both sides must invest time making the two services trust one another. This only works if the providers support integration, and it typically requires external users to belong to a larger organization, excluding single users and freelancers.

Both paths share a scoping problem. A contractor on one project shouldn't see the whole application portfolio. Administrators have to build rules for each new user to keep permissions narrow. And users still need a way to find the applications they're allowed to reach, which usually means a one-off email from IT.

Multiple providers, one token

With Multi-SSO, Cloudflare Access keeps the same flow but extends it to additional sign-in options. When a user visits a protected application, they see the identity providers your team has configured. After authenticating with their chosen provider, the request proceeds only if policy allows it.

Cloudflare Access standardizes identity across all of those providers. Once a user logs in through any integrated provider, Cloudflare Access issues a signed JSON Web Token containing that identity. Applications use that token to authorize the user, regardless of whether the original provider spoke SAML, OIDC, or another protocol. The company has open sourced an example of this token-based authorization in its Atlassian SSO plugin.

Three real-world payoffs

Faster contractor onboarding

Organizations can add LinkedIn, GitHub, or consumer Google accounts alongside their existing corporate identity provider. New partners join an Access policy as single users or groups, log in with personal accounts, and avoid chasing down another credential.

The Access App Launch replaces the custom email of links typically sent to each new contractor with a single URL. After login, the launcher shows only the applications the user is permitted to reach. The view is generated automatically and updates as permissions change.

Cleaner mergers and acquisitions

Integrating IT systems after a merger or acquisition is expensive and time-consuming; McKinsey estimates such reorganizations take 41% longer than planned, and Ernst & Young data ranks IT work as the third largest one-time integration cost. With Cloudflare Access, both organizations' identity providers can run side by side, so no one loses access while applications are merged or redundant systems retired.

Zero-downtime SSO migration

Multi-SSO also helps teams that are simply changing identity providers. Both the current and the new provider can be integrated at once. Users moved to the new system select that SSO option, while others continue on the legacy provider until the full cutover is complete. Audit logs stay comprehensive and standardized throughout the migration.

Availability

Multi-SSO in Cloudflare Access is available now for more than a dozen identity providers, including the newly added LinkedIn and GitHub Teams options. Setup instructions are available here. The first five users are free on all plans, and adding multiple identity providers carries no additional cost.