Skip to content

Commit 285ace7

Browse files
ranbelasamborski
ranbel
and
asamborski
authored
[ZT] Independent MFA (#29713)
* Initial commit for independent MFA docs + changelog initial commit, missing the bulk of doc update * First proper draft of MFA docs * independent-mfa updates * small changelog edits * edit lockout recovery note * clarify PUT instructions * clarify MFA duration * CF_Device cookie * MFA sessions * fix links * add related link * fix link * Apply suggestions from code review Co-authored-by: ranbel <101146722+ranbel@users.noreply.github.com> * review feedback * remove extraneous parameter * review feedback * new Access app UI * remove MFA from SaaS docs * changelog updates * change changelog date * fix typo --------- Co-authored-by: asamborski <asamborski@cloudflare.com>
1 parent 34a9e58 commit 285ace7

11 files changed

Lines changed: 451 additions & 83 deletions

File tree

‎src/content/changelog/access/2026-04-15-independent-mfa.mdx‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
title: Independent MFA for Access applications
3+
description: Enforce multi-factor authentication for Access applications without relying on your identity provider.
4+
date: 2026-04-15
5+
products:
6+
- access
7+
---
8+
9+
Cloudflare Access now supports independent multi-factor authentication (MFA), allowing you to enforce MFA requirements without relying on your identity provider (IdP). This feature addresses common gaps in IdP-based MFA, such as inconsistent MFA policies across different identity providers or the need for additional security layers beyond what the IdP provides.
10+
11+
Independent MFA supports the following authenticator types:
12+
13+
- **Authenticator application** — Time-based one-time passwords (TOTP) using apps like Google Authenticator, Microsoft Authenticator, or Authy.
14+
- **Security key** — Hardware security keys such as YubiKeys.
15+
- **Biometrics** — Built-in device authenticators including Apple Touch ID, Apple Face ID, and Windows Hello.
16+
17+
:::note
18+
Infrastructure applications do not yet support independent MFA.
19+
:::
20+
21+
## Configuration levels
22+
23+
You can configure MFA requirements at three levels:
24+
25+
| Level | Description |
26+
| ---------------- | -------------------------------------------------------------- |
27+
| **Organization** | Enforce MFA by default for all applications in your account. |
28+
| **Application** | Require or turn off MFA for a specific application. |
29+
| **Policy** | Require or turn off MFA for users who match a specific policy. |
30+
31+
Settings at lower levels (policy) override settings at higher levels (organization), giving you granular control over MFA enforcement.
32+
33+
## User enrollment
34+
35+
Users enroll their authenticators through the [App Launcher](/cloudflare-one/access-controls/access-settings/app-launcher/). To help with onboarding, administrators can share a direct enrollment link: `<your-team-name>.cloudflareaccess.com/AddMfaDevice`.
36+
37+
To get started with Independent MFA, refer to [Independent MFA](/cloudflare-one/access-controls/access-settings/independent-mfa/).

‎src/content/docs/cloudflare-one/access-controls/access-settings/independent-mfa.mdx‎

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
---
2+
pcx_content_type: how-to
3+
title: Independent MFA
4+
sidebar:
5+
order: 4
6+
tags:
7+
- Authentication
8+
---
9+
10+
import { Tabs, TabItem, APIRequest, Details } from "~/components";
11+
12+
Independent multi-factor authentication (MFA) allows you to enforce MFA requirements directly in Access without relying on your identity provider (IdP). Users authenticate with their IdP as usual, and Access prompts for an additional authentication method before granting access to the application.
13+
14+
## Supported MFA methods
15+
16+
| MFA method | Description |
17+
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
18+
| Authenticator application | Time-based one-time passwords (TOTP) generated by apps such as Google Authenticator, Microsoft Authenticator, or Authy. Access supports one TOTP authenticator per user at a time. |
19+
| Security key | YubiKeys and hardware security keys that support the [WebAuthn](https://www.w3.org/TR/webauthn-2/) standard. Users can enroll multiple security keys. |
20+
| Biometrics | Built-in device authenticators that use [WebAuthn](https://www.w3.org/TR/webauthn-2/), including Apple Touch ID, Apple Face ID, and Windows Hello. Users can enroll multiple biometrics. |
21+
22+
## Turn on independent MFA
23+
24+
Before you can [enforce independent MFA on applications and policies](/cloudflare-one/access-controls/policies/mfa-requirements/#independent-mfa), you must turn on independent MFA at the organization level.
25+
26+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
27+
28+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**.
29+
2. Under **Allow multi-factor authentication (MFA)**, select the [MFA methods](#supported-mfa-methods) you want to allow in your organization.
30+
3. Set an **Authentication duration**. This determines how long a user can log in to Access without being prompted for MFA again. If the user does not have an active MFA session for the required authenticator method, they must complete MFA in addition to IdP authentication.
31+
4. (Optional) To apply your MFA methods and authentication duration to all Access applications, select **Apply global MFA settings by default**. You can [override the global MFA settings](/cloudflare-one/access-controls/policies/mfa-requirements/#configure-independent-mfa-for-an-application) for individual applications and policies.
32+
:::note
33+
The [App Launcher](/cloudflare-one/access-controls/access-settings/app-launcher/) is exempt from the global MFA requirement. Users must be able to access the App Launcher without MFA to enroll their authenticators.
34+
:::
35+
4. Select **Save**.
36+
37+
</TabItem> <TabItem label="API">
38+
39+
1. Get your existing Zero Trust organization configuration:
40+
41+
<APIRequest
42+
path="/accounts/{account_id}/access/organizations"
43+
method="GET"
44+
/>
45+
46+
2. Send a `PUT` request to update your organization's MFA settings. To avoid overwriting your existing configuration, the `PUT` request body should contain all fields returned by the previous `GET` request.
47+
48+
<APIRequest
49+
path="/accounts/{account_id}/access/organizations"
50+
method="PUT"
51+
json={{
52+
auth_domain: "your-team-name.cloudflareaccess.com",
53+
name: "Your Team Name",
54+
mfa_config: {
55+
allowed_authenticators: ["totp", "biometrics", "security_key"],
56+
session_duration: "24h",
57+
},
58+
mfa_required_for_all_apps: false,
59+
}}
60+
/>
61+
62+
Set `allowed_authenticators` to an array containing one or more of:
63+
64+
- `totp` — Authenticator application (time-based one-time passwords).
65+
- `biometrics` — Biometrics (Touch ID, Face ID, Windows Hello).
66+
- `security_key` — Security keys (YubiKeys)
67+
68+
Set `session_duration` to a duration string (for example, `30m`, `1h`, `24h`). To require MFA on every access, use `0m`.
69+
70+
</TabItem> </Tabs>
71+
72+
After you turn on independent MFA, users can [enroll authenticators](#enroll-authenticators) through the [App Launcher](/cloudflare-one/access-controls/access-settings/app-launcher/).
73+
74+
## Turn off independent MFA
75+
76+
:::caution
77+
Turning off independent MFA removes MFA protection on all Access applications. Before turning off independent MFA, verify that your Access policies provide adequate coverage. Remove [custom MFA settings](/cloudflare-one/access-controls/policies/mfa-requirements/) from any applications and policies that use it, then turn off independent MFA at the organization level.
78+
:::
79+
80+
To turn off independent MFA for the organization:
81+
82+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
83+
84+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Access controls** > **Access settings**.
85+
2. Under **Allow multi-factor authentication (MFA)**, turn off **Apply global MFA settings by default**.
86+
3. Turn off all MFA methods (**Biometrics**, **Security key**, and **Authenticator application**).
87+
88+
If you get an error updating MFA settings, ensure that you have removed custom MFA settings from all applications and policies.
89+
90+
</TabItem> <TabItem label="API">
91+
92+
93+
1. Get your existing Zero Trust organization configuration:
94+
95+
<APIRequest
96+
path="/accounts/{account_id}/access/organizations"
97+
method="GET"
98+
/>
99+
100+
2. Send a `PUT` request with an empty `allowed_authenticators` array. To avoid overwriting your existing configuration, the `PUT` request body should contain all fields returned by the previous `GET` request.
101+
102+
<APIRequest
103+
path="/accounts/{account_id}/access/organizations"
104+
method="PUT"
105+
json={{
106+
auth_domain: "your-team-name.cloudflareaccess.com",
107+
name: "Your Team Name",
108+
mfa_config: {
109+
allowed_authenticators: [],
110+
},
111+
}}
112+
/>
113+
114+
</TabItem> </Tabs>
115+
116+
## Enroll authenticators
117+
118+
Users enroll authenticators through the [App Launcher](/cloudflare-one/access-controls/access-settings/app-launcher/).
119+
120+
To enroll an authenticator:
121+
122+
1. Go to your organization's App Launcher at `<your-team-name>.cloudflareaccess.com`.
123+
2. Log in with your identity provider or with a one-time PIN (OTP).
124+
3. Go to **Account** > **MFA devices** > **Add an MFA device**.
125+
:::note
126+
Administrators can also share a direct enrollment link to help onboard users: `<your-team-name>.cloudflareaccess.com/AddMfaDevice`
127+
:::
128+
4. Select the authenticator type you want to enroll and follow the on-screen instructions.
129+
130+
<Details header="Authenticator application">
131+
1. Select **Authenticator application**.
132+
2. Scan the QR code with your authenticator app (for example, Google Authenticator, Microsoft Authenticator, or Authy). Alternatively, you can manually enter the setup key into your authenticator app. Use SHA1 as the hash function and set the time-step size to 30 seconds.
133+
3. Enter the 6-digit time-based one-time password (TOTP) generated by your authenticator app to verify enrollment.
134+
135+
:::note
136+
You can only have one TOTP authenticator enrolled at a time. If you use multiple devices, scan the same QR code on each device during enrollment. To replace an existing TOTP authenticator, delete it first and then enroll a new one.
137+
:::
138+
</Details>
139+
140+
<Details header="Security key">
141+
1. Select **Security key**.
142+
2. When your browser prompts you, insert your security key and follow the on-screen instructions.
143+
3. After your browser confirms the registration, the security key is enrolled.
144+
145+
You can enroll multiple security keys for backup purposes.
146+
</Details>
147+
148+
<Details header="Biometrics">
149+
1. Select **Biometrics** > **Register biometrics**.
150+
2. You will be prompted to enroll with an authenticator type that is available on your device (for example, **Add macOS Touch ID** or **Add Windows Hello**).
151+
3. After your browser confirms the registration, the platform authenticator is enrolled.
152+
</Details>
153+
154+
You can now use these authenticators to log in to your organization's applications.
155+
156+
### Delete an authenticator
157+
158+
Users can delete their own authenticators from the App Launcher:
159+
160+
1. Go to your organization's App Launcher at `<your-team-name>.cloudflareaccess.com`.
161+
2. Go to **Account** > **MFA devices**.
162+
3. Select the 3-dot menu next to the MFA device, then select **Remove MFA device**.
163+
164+
Administrators can also [delete authenticators on behalf of users](/cloudflare-one/access-controls/access-settings/independent-mfa/#delete-a-user-authenticator).
165+
166+
## Manage user authenticators
167+
168+
Administrators can view and delete authenticators enrolled by users. This is useful for resolving lockouts or responding to security events.
169+
170+
### View user authenticators
171+
172+
To view a user's enrolled authenticators:
173+
174+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Users**.
175+
2. Select a user.
176+
3. Go to **MFA devices**. Each entry shows the authenticator's ID, its user-configured name, and the MFA method.
177+
178+
### Delete a user authenticator
179+
180+
If a user is locked out or you need to revoke an authenticator for security reasons, you can delete it from the dashboard or API.
181+
182+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
183+
184+
1. In the [Cloudflare dashboard](https://dash.cloudflare.com/), go to **Zero Trust** > **Team & Resources** > **Users**.
185+
2. Select the user whose authenticator you want to delete.
186+
3. Under **MFA devices**, find the authenticator and select **Delete**.
187+
188+
The user will need to enroll a new authenticator the next time they access an application that requires MFA.
189+
190+
</TabItem> <TabItem label="API">
191+
192+
Send a `DELETE` request to remove a specific authenticator:
193+
194+
<APIRequest
195+
path="/accounts/{account_id}/access/users/{user_id}/mfa_authenticators/{authenticator_id}"
196+
method="DELETE"
197+
/>
198+
199+
Parameters:
200+
201+
- `user_id` — The UUID of the user. You can find this in the user details under **Team & Resources** > **Users**.
202+
- `authenticator_id` — The unique identifier for the authenticator.
203+
204+
</TabItem> </Tabs>
205+
206+
### Lockout recovery
207+
208+
If a user loses access to all of their enrolled authenticators:
209+
210+
1. [Delete](#delete-a-user-authenticator) the user's authenticators.
211+
2. The user can then access a protected application and will be provided a link to enroll a new authenticator.
212+
3. Alternatively, share the direct enrollment link with the user: `<your-team-name>.cloudflareaccess.com/AddMfaDevice`.
213+
214+
:::tip
215+
To prevent lockouts, users should enroll multiple authenticators (for example, a security key and an authenticator application) when available.
216+
:::
217+
218+
## Related links
219+
220+
- [Enforce MFA on applications and policies](/cloudflare-one/access-controls/policies/mfa-requirements/)

‎src/content/docs/cloudflare-one/access-controls/access-settings/session-management.mdx‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ title: Session management
44
sidebar:
55
order: 2
66
tags:
7-
- JSON web token (JWT)
8-
- Authentication
7+
- JSON web token (JWT)
8+
- Authentication
99
---
1010

1111
import { GlossaryTooltip, Render } from "~/components";
@@ -16,9 +16,9 @@ A user session determines how long a user can access an Access application witho
1616

1717
When a user logs in to an application protected by Access, Access validates their identity against your Access policies and generates two signed JSON Web Tokens (JWTs):
1818

19-
| Token | Description | Expiration | Storage |
20-
| ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- |
21-
| Global session token | Stores the user's identity from the IdP and provides single sign-on (SSO) functionality for all Access applications. | [Global session duration](#global-session-duration) | Your Cloudflare <GlossaryTooltip term="team domain">team domain</GlossaryTooltip> |
19+
| Token | Description | Expiration | Storage |
20+
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
21+
| Global session token | Stores the user's identity from the IdP and provides single sign-on (SSO) functionality for all Access applications. | [Global session duration](#global-session-duration) | Your Cloudflare <GlossaryTooltip term="team domain">team domain</GlossaryTooltip> |
2222
| [Application token](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/application-token/) | Allows the user to access a specific Access application. | [Policy session duration](#policy-session-duration), which defaults to the [application session duration](#application-session-duration) | The hostname protected by the Access application |
2323

2424
The user can access the application for the entire duration of the application token's lifecycle. When the application token expires, Cloudflare will automatically issue a new application token if the global token is still valid (and the user's identity still passes your Access policies). If the global token has also expired, the user will be prompted to re-authenticate with the IdP.
@@ -96,6 +96,9 @@ Users who match a policy configured with a _Same as application session timeout_
9696

9797
When [Device authentication identity](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/client-sessions/#configure-client-sessions-in-access) is enabled for an Access application, the Cloudflare One Client session duration takes precedence over all other session durations (application, policy, and global). As long as the Cloudflare One Client session is valid and the user is running the Cloudflare One Client, the user will not be prompted to re-authenticate with the IdP — even if the global session has expired.
9898

99+
### MFA session duration
100+
If you use [independent multi-factor authentication (MFA)](/cloudflare-one/access-controls/access-settings/independent-mfa/), the MFA session duration determines how long a user can log in to Cloudflare Access without being prompted for MFA. The MFA session is independent of the global, policy, and application session durations. When logging in to an Access app with [MFA enabled](/cloudflare-one/access-controls/policies/mfa-requirements/#configure-independent-mfa-for-an-application), users must complete an MFA challenge if their last MFA authentication falls outside the configured session duration. After authenticating with their identity provider, users are prompted for MFA. The [`CF_Device` cookie](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#cf_device) ensures both authentication steps occur on the same device. MFA session durations do not affect how long a user has access to the application (that is controlled by the [application token](#session-durations)).
101+
99102
### Order of enforcement
100103

101104
The following flowchart illustrates how Access enforces user sessions for a self-hosted application.

‎src/content/docs/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/index.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ The following Access cookies are essential to Access functionality. Cookies that
6969

7070
| Details | Expiration | HttpOnly | SameSite | Required? |
7171
| ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | -------- | -------- | --------- |
72-
| Cookie used to help prevent abuse of the [Access OTP flow](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/) | 30 days | Yes | Strict | Required |
72+
| Cookie set on the `cloudflareaccess.com` [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name), used to prevent abuse of [one-time PIN](/cloudflare-one/integrations/identity-providers/one-time-pin/) and [multi-factor authentication](/cloudflare-one/access-controls/access-settings/independent-mfa/) flows | 30 days | Yes | Strict | Required |
7373

7474
## Cookie settings
7575

0 commit comments

Comments
 (0)