Cloudflare’s Privacy Proxy Now Underpins Edge Secure Network

Microsoft Edge users in most markets can now enable a built-in VPN—Edge Secure Network—without installing a separate app or configuring anything. Behind the feature is Cloudflare’s Privacy Proxy Platform, which handles the tunneling, authentication, and egress selection. The service ships with 5 GB of data and can be turned on from Browser essentials under the Edge settings menu.

Cloudflare’s approach here is deliberately different from conventional VPN products. Rather than relying on WireGuard, IPsec, or OpenVPN, the platform uses HTTP CONNECT, a standard proxying method that establishes a tunnel and forwards reliable, ordered byte streams through it. The design leans on Cloudflare’s existing privacy infrastructure: DNS resolution through 1.1.1.1, client authentication via a token proxy based on the Privacy Pass protocol, and Geo-egress to select an egress IP that matches the user’s region without pinpointing their exact location.

How the Platform is Put Together

The system consists of three cooperating components:

  • Token Proxy: verifies that a client is an Edge Secure Network user with a legitimate Microsoft account.
  • Privacy API: issues authentication tokens based on that verification, which clients then present to the proxy.
  • Privacy Proxy: an HTTP CONNECT-based service running across Cloudflare’s network. It validates client tokens, proxies encrypted requests to origin websites, and picks the egress IP.

When a user connects from an untrusted network—say, a coffee shop’s open Wi-Fi—the proxy asks the client for a token. If none is available, the client works with the token proxy to mint one: an attester checks the validity of the client and its Microsoft account, and an issuer returns tokens. This exchange is built on the Privacy Pass protocol, letting Cloudflare confirm identity without collecting or storing personal data from Microsoft users.

Once authenticated, the proxy selects an egress IP by hashing the client’s geolocation, then uses the DNS record from 1.1.1.1 to open an encrypted session to the destination site. Subsequent requests from the same browsing session reuse that connection; it closes when the user navigates away or shuts the browser. On the operational side, many of the proxy’s day-to-day tasks—telemetry, graceful restarts, stream multiplexing, IP fallbacks, and authentication hooks—are handled by Oxy, Cloudflare’s proxying framework.

Latency and Location Awareness by Design

Cloudflare’s network footprint is central to how the service performs. With data centers in over 300 cities and an anycast model where every service runs in every location, Edge clients automatically connect to the nearest Cloudflare data center, which keeps last-mile latency low. Egress addresses are chosen so that search and browsing results reflect the user’s actual geographic region—what Cloudflare calls the “pizza test”: a user should still see relevant results for “pizza places near me.” Sites already on Cloudflare’s CDN also benefit from a faster path through the network.

Microsoft has published more details on its Edge Secure Network page and support documentation. Cloudflare is also offering the underlying privacy proxy technology to other partners interested in a similar privacy-preserving architecture.