Per-Application Identity Providers for Cloudflare Access
Cloudflare Access, part of Cloudflare for Teams, replaces traditional corporate VPNs by routing users through Cloudflare’s global network when they connect to internal applications. Instead of launching a VPN client, users visit the app’s hostname and authenticate with their team’s SSO provider. Administrators get centralized granular controls and audit logging, while end users experience internal tools much like any SaaS app.
Since Access launched two years ago, it has supported multiple SSO providers simultaneously—a feature that lets employees sign in with Okta or Azure AD while partners and contractors use LinkedIn or GitHub. However, those integrations were always global: every provider appeared on every application protected by Access. For organizations connecting distributed and mixed workforces to various resources, presenting all providers everywhere no longer scales.
Consider an internal GitLab instance that only employees access via corporate G Suite, while the marketing department shares QA builds with an external agency using LinkedIn. In this scenario, prompting everyone to pick an SSO provider on both applications introduces an unnecessary step and invites confusion or support tickets.
The ability to restrict which identity providers appear for specific applications became Access’s most requested feature in recent months. It’s now available in the Cloudflare for Teams UI.
Zero-Trust Access
Access protects applications by enforcing zero-trust on every request. Rather than trusting anyone on the private network, Access verifies identity whenever someone attempts to reach an app. That check runs in a data center within Cloudflare’s network of more than 200 cities, keeping performance impact minimal.
Administrators define rules determining who can access each protected tool. When users try to connect, they authenticate with one of the enabled identity providers, and Access verifies their login against the approved user list before allowing the request to proceed.
The Single-Identity Problem
Most zero-trust solutions—like the VPN appliances they replace—depend on a single source of identity. If you need to share an application with partners or contractors, you must agree on one standard for all users.
Some organizations address this by onboarding external users into their own identity provider. That approach means help desk tickets to provision accounts, instructions for sign-up, and new passwords to manage. The organization retains control over identity, but pays in time, seat licenses, and IT effort—including offboarding when contractors leave. Users must also learn another system and maintain credentials for your internal resources.
Alternatively, some groups federate identity, connecting their directory to a partner’s service. External users authenticate with their own credentials, but administrators must configure trust between the two systems. This avoids new passwords, but requires both organizations to invest in integration work—when the providers can integrate at all. That model also fails for freelancers and sole users who don’t belong to a larger organization.
Cloudflare Access instead supports multiple identity sources simultaneously. Users see the available providers, pick the correct one, and Access checks their login against authorized users.
Restricting Providers Per App
Not every provider applies to every application. To segment apps and reduce user confusion, you can now scope specific applications to specific providers in the Cloudflare for Teams UI.
Select the application you want to segment, open the “Authentication” tab, and you’ll see all providers integrated with your account. By default, all providers remain enabled for end users. Toggle any provider on or off in this view and save. The next time users visit this application, they’ll see only the enabled options.
If you enable just one provider, Access skips the login page entirely and redirects users straight to that provider—eliminating an extra click.
Availability and Moving Forward
Per-application identity provider config is available now in the Cloudflare for Teams dashboard, with documentation to accompany it. The end-user login page still uses the legacy design from the original Access dashboard released two years ago; Cloudflare for Teams plans to update that page’s styling within the next month to align with the new UI.
