Ditching the VPN: How Cloudflare Secures a Distributed Workforce
Cloudflare runs a network spanning 200 cities and employs over 1,200 people across 13 offices. For years, that distributed operation relied on a traditional corporate VPN that backhauled all traffic through physical appliances. As the company grew, that model became unsustainable. Helpdesk tickets piled up, and the central chokepoint became a performance bottleneck.
The solution was to replace the VPN with Cloudflare’s own edge network. The internal project, now productized as Cloudflare Access, was built to handle the scale challenge by running on Workers, Cloudflare’s serverless platform. This turns every data center in the network into an identity proxy node, providing the capacity to support a globally distributed team without a single physical appliance as a constraint.
A Zero-Trust Model on the Edge
Cloudflare Access is the access-control half of Cloudflare for Teams. Instead of putting internal tools on a private network, teams deploy them in any environment—hybrid or multi-cloud—and secure them consistently through Cloudflare’s network.
Administrators define rules that determine who can reach protected resources. When users attempt to connect, they authenticate with their team’s identity provider. Access validates the login against the allowlist and, if permitted, lets the request proceed. Every request is evaluated and logged for identity, giving administrators more visibility than a traditional VPN provides.
Deployment relies on Argo Tunnel, which runs in the user’s infrastructure and makes secure outbound-only calls to the Cloudflare network. This lets organizations replace complex firewall configurations with a single rule: disable all inbound connections. No request can reach the protected IPs without first hitting Cloudflare, where Access enforces authentication.
Seamless SSO for the Atlassian Suite
Cloudflare secures its own productivity stack—Jira, Confluence, and Bitbucket—with Access. Previously, employees had to log into the VPN with one set of credentials, then enter a second set unique to the Atlassian suite. That friction is gone.
Cloudflare built a plugin that uses the Access login to SSO end users into Atlassian applications. Users authenticate once with the corporate SSO provider and are redirected into Jira, Wiki, or Bitbucket without managing extra credentials. The change had real impact because nearly every global team member uses these tools daily, and it made access from mobile devices far easier.
The feedback was telling: when the feature was briefly disabled to test a release, the response was loud. The convenience of single sign-on had become a baseline expectation.
SSH Without the VPN
Browser-based applications were only part of the puzzle. The second major step to eliminating the VPN was supporting SSH connections through Cloudflare Access, built on top of Argo Tunnel and Argo Smart Routing.
Argo Smart Routing moves traffic intelligently across Cloudflare’s network, helping engineers reach any data center in the fleet without internet congestion. Argo Tunnel creates secure, outbound-only connections from data centers back to Cloudflare. The result: team members connect with their standard SSH client, no special wrappers or alternate commands. A single config file change via the cloudflared CLI makes servers around the world reachable.
Cloudflare started by exposing internal code repositories through this flow, then expanded to let the reliability engineering team connect to the data centers powering the network—all without a VPN.
Self-Service Onboarding and Granular Logging
As headcount grows globally, manually distributing bookmarks and credentials no longer scales. The Access App Launch feature gives users a single dashboard from which they can open any application they are permitted to reach.
The App Launch requires no per-app configuration. It reads an organization’s Access policies and presents only the apps the user already has permission to access. Each employee gets a personalized view out of the box, removing the need for onboarding sessions to set up tool access.
Remote work creates security blindspots—nobody badges into a front desk at home. To counter that, Access logs every authentication event and, if enabled, every user request to protected resources. Administrators capture each request and attribute it to a user and IP address with no code changes. Cloudflare’s security team uses this data to audit all requests to internal resources without interrupting application owners, supporting compliance requirements for distributed users.
Pricing and Availability During the COVID-19 Emergency
Cloudflare for Teams is available free to any organization until September 1 in response to the Coronavirus emergency. The company initially made the product free for small businesses on March 9, then extended the offer to all organizations as the outbreak’s severity became clearer.
For existing Cloudflare for Teams customers, usage caps have been removed during the emergency, allowing teams to scale to any number of seats for no additional cost. For those not yet using the product, the limits on free trials of the Access and Gateway products have been removed for at least the next six months. Cloudflare is also running no-cost onboarding sessions to help companies set up quickly.
