# Cloudflare Access and Zero Trust [[Cloudflare]] Access is an identity-aware reverse proxy that gates any HTTP application, SSH host, or internal service behind authentication and policy rules. It sits in front of an origin (often via [[Cloudflare Tunnel]]) and enforces "who can reach what under which conditions" before a single byte of the protected app is touched. Zero Trust (rebranded as "Cloudflare One") is the umbrella product family — Access plus Gateway (outbound DNS/HTTP filtering), CASB, browser isolation, DLP, and device posture. Access is the most-used component; the rest are SSE/SASE plays competing with Zscaler and Netskope. ## Why It Matters "Zero Trust" replaces the perimeter model (VPN → trusted network) with per-request authentication. Every request to a protected app gets evaluated: who is the user, what device, from where, with what posture, on what protocol — and only then proxied through. The result: VPN goes away, internal apps become Internet-reachable but only to authorized identities, and lateral-movement risk drops. ## Core Capabilities - **Identity-aware proxy** for HTTP apps - **SSO integration**: SAML, OIDC, Azure AD, Google Workspace, Okta, GitHub - **Policies**: by user, group, country, device posture, MFA, time of day - **Browser-rendered SSH/RDP/VNC** — no client needed - **Service tokens** for machine-to-machine API access - **Logs and audit trails** of every access decision ## What changed in 2026 - **Independent MFA** (April): enforce MFA per application or per policy (hardware keys on the sensitive apps only) without relying on your identity provider - **[[Cloudflare Mesh]]** (April): WARP Connector became Mesh, private any-to-any networking between servers, laptops and phones, with Gateway policies applied to every connection - **Cloudflare as the default identity provider** for new Zero Trust organizations (June), instead of one-time PINs - **Access on [[Cloudflare Workers]]** (August): protect a Worker across all its routes, domains and preview URLs, or make every Worker private by default - **Identity-aware [[Cloudflare AI Gateway]]** (August): put a gateway behind Access and use the user's identity for logs, routing and spend limits - **MCP server portals are GA** (September 24): one Access-protected endpoint for every approved [[Model Context Protocol (MCP)|MCP]] server, with tool-level logs, DLP scanning through Gateway, service tokens for autonomous agents, and [[Code Mode MCP Pattern|Code Mode]] to cut tool-definition tokens ## Common Use Cases - **Replacing corporate VPN** for internal app access - **Gating self-hosted homelab services** by Google/GitHub identity - **Just-in-time SSH access** with audit trail and session recording - **B2B partner portals** with federated identity - **Contractor access** scoped to specific apps, time-bounded ## References - Access home: https://www.cloudflare.com/zero-trust/products/access/ - Zero Trust documentation: https://developers.cloudflare.com/cloudflare-one/ - Changelog, Cloudflare Mesh (2026-04-14): https://developers.cloudflare.com/changelog/post/2026-04-14-cloudflare-mesh/ - Changelog, independent MFA (2026-04-15): https://developers.cloudflare.com/changelog/post/2026-04-15-independent-mfa/ - Changelog, Cloudflare identity provider by default (2026-06-18): https://developers.cloudflare.com/changelog/post/2026-06-18-cloudflare-idp-default/ - Changelog, identity-aware controls in AI Gateway (2026-08-05): https://developers.cloudflare.com/changelog/post/2026-08-05-access-user-id-metadata/ - Changelog, Access on Workers (2026-08-14): https://developers.cloudflare.com/changelog/post/2026-08-14-workers-access/ - Changelog, MCP server portals GA (2026-09-24): https://developers.cloudflare.com/changelog/post/2026-09-24-mcp-portals-ga/ ## Related - [[Cloudflare]] - [[Cloudflare Tunnel]] - [[Cloudflare Mesh]] - [[Cloudflare WAF]] - [[Cloudflare Workers]] - [[Cloudflare AI Gateway]] - [[Model Context Protocol (MCP)]] - [[Code Mode MCP Pattern]]