Access joins the Cloudflare for Teams dashboard

Cloudflare Access is now available from the Cloudflare for Teams dashboard, putting security policies for people and devices in the same console used to manage zero-trust rules for applications. The move consolidates two previously separate administrative interfaces and is intended to clear up a long-standing source of confusion in the Access UI.

Cloudflare for Teams is a security platform that runs on Cloudflare's network. Cloudflare Access replaces corporate VPNs with a zero-trust model: internal tools are deployed in any environment—hybrid, multi-cloud, or otherwise—and secured through Cloudflare's network. When users connect to those tools, they log in with their team's identity provider, and Cloudflare Access checks the login against the list of allowed users before permitting the request.

Access doesn't require opening new holes in corporate firewalls. Resources are connected through Argo Tunnel, a secure outbound connection that runs in an organization's infrastructure, so configurations can replace complex firewall rules with a single directive: disable all inbound connections.

The source of the problem

The original Access dashboard operated at two levels: account and site. A single Cloudflare account holds billing details and notifications; within that account, users configure sites, which are hostnames or zones added to Cloudflare. Site-level features include the web application firewall (WAF) and caching rules.

When Access launched two years ago, users had to select a site, toggle to its Access tab, and build a rule specific to that hostname, subdomain, or path. To configure a different site, they'd step back up, choose that site from the dropdown, and load its Access tab. Visually, the Access tab made one model-specific assumption — that everything on the page belonged to the selected site — but not everything did.

Two components shared configuration across an entire account regardless of which site was selected:

  • SSO integration
  • Logs

SSO integration is where Access pulls identity information, such as connections to Okta, AzureAD, or GSuite. That integration intentionally applied across all sites, since users shouldn't have to reconfigure their identity provider per site. Logs followed a similar pattern. But those account-level features were displayed in a site-specific page, creating a mismatch between what users saw and what those components actually governed.

The result: a logs table displayed at the bottom of a site's Access tab would also show entries from every other hostname in the account. As more features were added, this exception grew, and the majority of items on the Access tab became account-level features presented within the site view. That confusion is a real problem in a security product, since users must know whether a policy they're editing applies to their whole account or just one site.

Gateway provides the template

Cloudflare for Teams consists of Access and Cloudflare Gateway. Gateway has no concept of sites that users host themselves; it secures a team from the Internet rather than securing an organization's own Internet-facing properties. This introduced concepts unrelated to domain names: office networks, home WiFi, and mobile devices can all be added, along with rules to block any site on the Internet.

Because Gateway had no site model, Cloudflare built its UI from scratch, launching a dedicated dashboard for it. The new Access UI takes the same approach: because the Teams dashboard isn't constrained by the site-specific model, the Access page can group tools according to how people actually use them.

A cleaner separation of concerns

Moving Access into the Teams dashboard did more than consolidate administration. It provided the opportunity to untangle account-level features—like the methods used to secure resources—from site-specific ones, like the rules that protect a particular resource. The new dashboard separates those clearly, and now both principals live under one roof.

Available today

The new Access UI is available to all customers now in the Cloudflare for Teams dashboard. You can sign in by visiting dash.teams.cloudflare.com. To use the Access UI, you'll first need to enable Cloudflare Access and add a site to Cloudflare in the existing dashboard; instructions are available for a quick start. A guided tour of the effective new interface is also viewable.

No new features have shipped as part of this release, which focused entirely on improving how users approach the Access product. The UI implements, for example, account-context fields that can be reused by both Access and Gateway. Categories like "My Teams" and "Logs" apply now, or will apply in the future, to both products. Going forward, Cloudflare says it will work from this foundation to avoid repeating the mistake of conflating account, site, and product objects.