1 Who are our people, and what are they allowed to reach?

ReadyLab and laptop~4 minAccessFlareID (OIDC + SCIM)App LauncherAccess audit log

One sign-in, groups that come from the identity provider rather than being typed into Cloudflare, and an application that simply does not exist for someone not entitled to it.

The problem

Before anyone believes you can replace their VPN or protect their data, they need to believe you know who their people are. Horizon Inc has thirty of them, in five departments, with four contractors among them, and its identity provider is the source of truth for all of it.

Lands with: every audience - run it first, briefly, and everything later stands on it

Before you start

Signed in to the Cloudflare dashboard on the lab account.
A browser profile with no Access session, for signing in as - password Savetheinternet!1 unless the lab set another.
A second private window for (the CEO) and one for (a contractor).

Run it

Where identity comes from

Do	Say
Zero Trust → Settings → Authentication. Open the FlareID login method.	Horizon Inc's identity provider is connected over OIDC for sign-in and SCIM for the directory. Cloudflare does not keep its own list of people - groups arrive from the identity provider, so when HR changes something, access changes with it.
Open FlareID's admin at `/admin` → Groups → All Employees.	This group is not a list somebody maintains. It is a rule - everyone whose employment type is full time - so twenty-six people are in it and the four contractors are not, and nobody had to remember to do that.

Per-application, not per-network

Do	Say
Zero Trust → Access controls → Applications. Open Ledger (Finance) and its policy.	Every application has its own policy. Ledger holds the board pack and payroll, so it allows one group: Executives.
As Alice, open the App Launcher. Then, as Nikita, the same.	Alice is a content strategist in Marketing. Ledger is not hidden from her - it does not exist for her. Nikita sees it.
As Alice, go to Ledger's address directly anyway.	Knowing the address does not help. Access refuses before the application ever sees the request.
As Ramona, open any of the five apps.	Ramona is a contractor. She is a valid identity, she signs in successfully - and she is not an employee, so the employee policy does not let her in. Contractors get their own, narrower path.

What the audience should see

Alice's launcher without Ledger; Nikita's with it.
Alice refused at Ledger's address with an Access page, not an application error.
Ramona refused by the employee applications despite signing in.

Where the evidence is

Zero Trust → Insights → Logs → Access authentication. Filter to Alice: the denied request to Ledger, with the application and the policy that decided it.

Known limitations

FlareID is a demo identity provider. The point being made - groups and attributes come from the identity provider and Access acts on them - holds for any OIDC or SAML provider, and the dashboard lists the others.

Part of: The whole of Cloudflare One · Replace the VPN · The full tour