Closing the Authentication Gap in Cloudflare One
For security teams, one of the most persistent headaches is the "unknown device" problem: a managed endpoint that has the Cloudflare One Client installed but no authenticated user behind it. This typically happens in two situations: a new device is deployed via MDM but the user hasn't logged in yet, or an existing session expires and the user doesn't bother to re-authenticate. In both cases, the device falls back to whatever local policy permits, creating a blind spot that attackers can exploit.
Cloudflare is addressing this with mandatory authentication, a new capability in the Cloudflare One Client. When enabled through MDM configuration, the client enforces authentication as a prerequisite for any network access from the moment the machine boots. If a user isn't actively authenticated, the client blocks all Internet traffic via the system firewall, except for a process-specific exception that allows the authentication flow itself to reach Cloudflare. Users are also proactively prompted to log in, so they don't have to search for the correct settings.
This approach ensures that every managed device is accounted for before it can reach the open Internet. The feature is initially available for Windows, with support for other platforms planned for later.
Adding a Second Root of Trust Beyond SSO
Most organizations rely on single sign-on (SSO) with their identity provider (IdP) as the primary security anchor. While this typically includes MFA at the initial login, it leaves a critical vulnerability: IdPs are high-value targets. If an attacker compromises an SSO session through session hijacking or social engineering, they gain access to every application behind that SSO.
To mitigate this, Cloudflare is introducing its own independent MFA solution, functioning as a "step-up" verification layer at the network edge, entirely separate from your IdP. This creates a second authority that must sign off before any user can reach a protected resource. Even if primary IdP credentials are compromised, an attacker would still face a second factor they don't possess when trying to reach sensitive systems like production databases.
Cloudflare Access will support several MFA methods:
- Biometrics (Windows Hello, Apple Touch ID, Apple Face ID)
- Security keys (WebAuthn, FIDO2, and PIV for SSH via Access for Infrastructure)
- Time-based one-time passwords (TOTP) from authenticator apps
Administrators can define authentication requirements globally or per application, allowing for granular control. For example, lower-assurance methods might suffice for chat applications, while security keys could be required for source code access. This also enables adding modern MFA to legacy applications that don't natively support it, and applying stronger verification for third-party contractors using social identities. End users can enroll their MFA devices through the App Launcher.
The independent MFA feature is currently in closed beta, with new customers onboarded weekly.
Continuous Enforcement, Smaller Blast Radius
These two features address different ends of the same problem: ensuring that authentication is not a one-time event but a continuous state. Mandatory authentication closes the gap between device enrollment and user login, while independent MFA reduces the risk of relying on a single compromised credential. Together they shrink the potential blast radius of an attack, providing administrators with greater certainty that their policies are enforced and that a single stolen password won't lead to a total breach.
The shift here is from simple access control to ongoing, automated posture enforcement — a step forward in making the zero trust journey less about friction and more about consistent, verifiable security.
