A Management Layer for Multi-Account Enterprises

Cloudflare’s platform was built to be approachable for small teams, but large enterprises often operate hundreds of accounts across thousands of users. While multiple Cloudflare Accounts let organizations segment teams and enforce the principle of least privilege, this approach fragments administrative controls — making it difficult for central administrators to manage users, policies, and analytics across the entire company.

To address this, Cloudflare has launched Organizations (in beta), a new layer in the account hierarchy that gives administrators a single place to manage a collection of Cloudflare Accounts.

Why Enterprises Use Multiple Accounts

Many enterprises rely on Cloudflare’s role-based access control (RBAC) to restrict access. The platform recently introduced fine-grained permissions, but enumerating every resource manually can be tedious. Instead, businesses often create separate accounts per team, so each team has full control over its own resources. This supports organic growth within a team without granting broad administrative access across the company.

While this model properly limits permissions for most users, it places a burden on administrators who need access to every account to perform tasks like reporting or policy management. That setup is also fragile — admins can be removed by other administrators within any given account.

What Organizations Provides

Cloudflare Organizations builds on the existing Tenant system, which was originally designed for the partner ecosystem. It introduces several key capabilities for enterprise administrators.

Central Account Management

The account list is the foundation of an organization — a flat list of all accounts that have been onboarded. A new role, Org Super Administrator, is managed at the organization level. Users with this role can add accounts to the organization, provided they are also a Super Administrator of the account they wish to add.

Org Super Administrators have Super Administrator permissions across every account in the organization, without needing an explicit membership in each child account. They do not appear in the account-level UI. This role is the first of several planned for the organization layer.

Consolidated Analytics

Org Super Administrators can view a roll-up dashboard with HTTP traffic analytics aggregated across all accounts and zones within the organization. HTTP traffic analytics is the first of several analytics dashboards planned for the organization level.

Shared Configurations

Organizations allow a central team to manage configurations like WAF or Gateway policies across all accounts. An Org Super Administrator can share a policy set from one account to the rest of the organization. This enables security analysts — who might not be org administrators or admins of other accounts — to update WAF rules for the entire company from a single source account.

The Infrastructure Behind the Feature

Delivering this feature required what Cloudflare describes as one of the largest changes to its permissions system ever. The effort was run as an innersource project to remove legacy code paths and consolidate all authorization checks onto the domain-scoped roles system. The project added roughly 133,000 lines of new code and removed about 32,000 lines of legacy code.

The work also brought a 27% performance improvement to permission checks on enumeration calls like /accounts and /zones, which previously struggled for users with access to thousands of accounts.

Rollout and Security Considerations

Organizations is rolling out in public beta to enterprise customers over the next several days. Cloudflare deliberately chose not to backfill the feature — that is, they will not create organizations on behalf of customers. Instead, the rollout uses a self-serve invitation process to ensure that no user gains elevated privileges without a Super Administrator's approval.

Enterprise Super Administrators will see an invitation to create an organization in the Cloudflare dashboard if none exists for their company. Once created, they can add accounts where they hold the Super Administrator role. If a colleague has already claimed the organization, they can invite you as an Org Super Administrator, or you can invite them as a Super Administrator of your account to add it to the organization. Cloudflare support will not make these configuration changes on behalf of customers.

What’s Next

The initial launch is limited to enterprise customers, with broader availability (starting with pay-as-you-go customers) expected in the coming months. Cloudflare also plans to extend support to its partner ecosystem after addressing specific scenarios for that audience.

Additional capabilities on the roadmap include:

  • Organization-level audit logs
  • Organization-level billing reports
  • More organization-level analytics reports
  • Additional organization user roles
  • Self-serve account creation

Enterprises can get started from the Organizations tab in the Cloudflare dashboard or via the developer documentation. There is no additional fee for using Organizations.