Extending Zero Trust Policies to SaaS Applications
Cloudflare Access applies Zero Trust rules by sitting in the DNS and HTTP path of applications you host, making every request subject to identity-aware and context-driven checks. The application itself doesn't need to change—you can enforce policies on Cloudflare, connect your single sign-on (SSO) provider and tools like Crowdstrike and Tanium, and start protecting access immediately.
The same control plane can now govern SaaS applications, which traditionally sit outside the reach of such policies. Because you don't control where those applications are hosted, you can't influence how users reach them or fully capture per-request logs. Even with SSO or IP allowlists, most SaaS tools limit your ability to enforce location or device rules, and logging granularity varies widely between vendors.
Access for SaaS addresses that by injecting Zero Trust checks into the SAML authentication flow of any supported SaaS application. When a user attempts to log in, they are redirected through Cloudflare to your identity provider, authenticate, and return to Cloudflare where additional rules—device posture, multi-factor method, login country—are layered on. Only if the user passes every check does Cloudflare translate the authentication into a SAML assertion and forward it to the SaaS application.
This architecture uses Cloudflare Workers to convert JWT content into SAML assertions. The SaaS application sees Cloudflare Access as its identity provider, even though Access is merely aggregating signals from your SSO provider and other sources into the JWT and summarizing them in the SAML payload. Running entirely on Cloudflare's network, the added security checks don't create a performance penalty for users.
Managed Device Enforcement and Gateway Logging
With SaaS applications, remote and personal devices broaden the access surface. In many cases, these tools store data that should only be reachable from corporately managed hardware. Once Access for SaaS acts as the SSO provider, you can enforce device requirements: policies can restrict a tool like Salesforce to users whose device has a known serial number, requires a hardware auth key, runs an up to date OS, and more.
Cloudflare Gateway already blocks, allows, or logs all Internet-bound connections and requests to SaaS applications, protecting users from web threats when traffic leaves laptops and offices. The weakness is that users on personal devices and home networks can bypass that filtering entirely. With a valid password and MFA token, anyone can reach a SaaS app from an unprotected device and dodge corporate Internet security.
To close that gap, Access adds a new rule type requiring Gateway connections at login. Once enforced, users can only reach your SaaS applications through Cloudflare Gateway, and Gateway records every action inside those apps along with all other Internet traffic, giving you unified visibility.
Getting Started
You can start protecting SaaS applications today from the Cloudflare for Teams Dashboard using step-by-step integration guides for the AWS management console, Zendesk, and Salesforce. Configuration via metadata files is planned, and additional SaaS-specific guides will be published as they become available.
