Access App Launch: A Home Page for Cloudflare-Protected Applications

Once Cloudflare Access is protecting an application, the heavy lifting of identity verification is done. The user is authenticated, every request is logged, and connections happen without a VPN client. But there is still a gap: users need a way to discover the applications they are allowed to reach. For growing teams, manually maintained link lists become unwieldy, and publishing custom views for contractors or partners adds more upkeep.

Cloudflare is addressing that with the Access App Launch portal, now available to all Access customers. It provides a dashboard showing only the applications a user has permission to reach, so they can log in and connect with a single click.

The Portal's Logic: Reusing Identity and Access Policies

When an application is secured with Access, requests to its hostname stop at Cloudflare’s network for policy evaluation. User identity is confirmed through the organization’s existing identity provider, such as OneLogin, Okta, AzureAD, or G Suite. If the user has not yet authenticated, they are prompted to sign in.

After login, the user is redirected through a subdomain unique to the Access account. That subdomain is derived from an active hostname; for example, an account with the hostname "widgetcorp.tech" gets "widgetcorp.cloudflareaccess.com".

The Access App Launch lives at that unique subdomain. When a user visits it directly, Access verifies identity and renders a page that lists only the applications their existing Access policies allow. Clicking a tile redirects them to the actual application, and since they are already authenticated, there is no second login. The portal validates the token stored in the cookie on the account’s subdomain.

Configuration: Three Steps, No Per-App Setup

Setting up the portal in the Cloudflare dashboard requires three steps:

  • Open the Access tab in the dashboard.
  • Enable the feature in the “App Launch Portal” card.
  • In the modal that appears, define who can use the portal, then click “Save.”

Granting access to the launch portal does not override existing Access policies for protected applications. Administrators do not need to manually add each application to the portal; it uses the account’s existing policies to generate a personalized page for each user automatically.

Defense-in-Depth Against Lookalike Login Pages

Phishing often succeeds by presenting a replica of a legitimate application at a deceptively similar hostname. The string "example.com" and "examрle.com" may appear nearly identical, but the latter uses a Cyrillic "р" and resolves to an entirely different site. Attackers typically rely on email from untrusted senders to steer victims to such fraudulent URLs.

For internal tools, the Access App Launch creates a clear mitigation: instruct users to reach internal applications only through the portal. Every tile click sends the user to the application via the organization’s SSO flow, reducing the chance they will be tricked into typing credentials into a spoofed page.

For lookalike sites that are not behind Access at all, Cloudflare Gateway can complement the portal with DNS resolver filtering to block phishing attempts. Gateway is available as part of the Cloudflare for Teams beta.

Availability and Next Steps

The Access App Launch is available to all Access customers effective today. Setup details are documented in the Cloudflare for Teams developer documentation. The portal is one component of the broader Cloudflare for Teams platform, which provides network-level security without the constraints of traditional VPN appliances.