You can use Cloudflare Access to require that users log in to certain applications with specific types of multifactor authentication (MFA) methods. For example, you can create rules that only allow users to reach a given application if they authenticate with a physical hard key. This feature is only available to teams using the following identity providers:
- Azure AD
Adding authentication methods into the JWT
Certain identity providers can also share the multifactor authentication (MFA) method presented by the user to login. Cloudflare Access can add these values into the JWT and force. For example, if the user authenticated with their password and a physical hard key, the identity provider can send a confirmation to Cloudflare Access. Cloudflare Access then stores that method into the same JWT issued to the user.
Creating a rule
You can build rules that require users to authenticate with certain types of MFA methods. When added, Cloudflare Access will reject user logins that did not use the required MFA method.
To add an MFA requirement to your application, follow the instructions below.
- Navigate to the application in the Cloudflare for Teams dashboard or create a new application.
- In the
Rulessection of the Application, edit an existing rule that contains an identity requirement or add a new rule.
- The rule must contain an
Includerule which defines an identity. For example, the
Includerule should allow for users who are part of an email domain, identity provider group, or Access Group.
- In the rule builder, add a
Authentication Methodand choose the MFA method to require.
- Save the rule.
What happens if the user fails to present the required MFA method?
Cloudflare Access will reject the user, even if they successfully login to the identity provider with an alternative method.