Cutting VDI out of the web app loop
Virtual desktops made sense when enterprises needed to get desktop applications onto unmanaged devices without risking the internal network. But the economics stopped making sense as web technologies matured: desktop-grade applications now run entirely in the browser, and most VDI sessions are just remote desktops used to open one. Each of those sessions still costs a dedicated VM with multiple CPU cores and gigabytes of RAM.
Browser Isolation with private network connectivity removes that overhead. Users reach private web services through a remote browser hosted on Cloudflare’s network, with no endpoint software to install and no inbound ports opened on your firewall. The feature is built into Cloudflare’s Zero Trust platform, so access control, inspection, and monitoring apply to remote browser sessions the same way they do to other traffic.
What changes for users
The end-user experience is more direct than VDI. With virtual desktops, users connect through a desktop client or portal, then open an embedded browser inside that session — forcing constant context-switching between local and remote applications. With Browser Isolation, users navigate to the private app in their regular browser and interact with it as if it were local.
That also makes third-party access simpler. Contractors or vendors who need to manage a web UI on your network can be added to a Clientless Web Isolation policy and connect without installing any client software. Every request to a private IP is filtered, inspected, and logged through Gateway, and data protection controls — clipboard, printing, file upload/download — can be enabled selectively for high-risk users or sensitive applications.
Under the hood
Two Cloudflare Zero Trust products do the heavy lifting:
- Cloudflare Access authenticates users through your preferred identity provider and connects them to a remote browser with no device software.
- Cloudflare Tunnels links your private network to Cloudflare-hosted browsers without any inbound firewall rules.
Connecting a network requires only outbound internet access; engineers who need a browser-based debugging environment inside a private network can be up with a single command.
Getting connected
Enable Clientless Web Isolation and define who is allowed to reach a remote browser, then any RFC 1918 address is reachable by prefixing its URL with your isolation endpoint. For example, a router admin UI at http://192.0.2.1 becomes
https://<authdomain>.cloudflareaccess.com/browser/http://192.0.2.1
The user is automatically served a remote browser from a nearby Cloudflare data center.
Once basic connectivity is live, you can lock things down further. Gateway → Policies → HTTP allows or blocks traffic to specific private endpoints based on identity or destination IP, and isolation policies determine which interactive features — clipboard, printing, file transfer — users are allowed in the remote browser session. Full configuration details are in the HTTP policies and isolation policies documentation.
Every remote browser session is logged through the Secure Web Gateway. Auditors can filter Logs → Gateway → HTTP by identity or destination IP to see exactly who touched what on the private network.
What is browser isolation?
Browser isolation is a security model where web content executes in a remote browser rather than on the user’s device. In this implementation, the remote browser renders private network applications and streams the session to the user’s local browser. That means sensitive workloads never touch the endpoint, while the user gets a native browser experience without the context-switching overhead of a full virtual desktop. It fits into Zero Trust architectures as a way to deliver application access without granting broad network access.
