---
title: Access Changelog
image: https://developers.cloudflare.com/cf-twitter-card.png
---

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://developers.cloudflare.com/changelog/rss/index.xml) [ View RSS feeds ](https://developers.cloudflare.com/fundamentals/new-features/available-rss-feeds/) 

Access

![hero image](https://developers.cloudflare.com/_astro/hero.CVYJHPAd_26AMqX.svg) 

Apr 01, 2026
1. ### [Logs UI refresh](https://developers.cloudflare.com/changelog/post/2026-04-01-logs-ui-refresh/)  
[ Cloudflare One ](https://developers.cloudflare.com/cloudflare-one/)[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)[ Gateway ](https://developers.cloudflare.com/cloudflare-one/traffic-policies/)  
Access authentication logs and Gateway activity logs (DNS, Network, and HTTP) now feature a refreshed user interface that gives you more flexibility when viewing and analyzing your logs.  
![Screenshot of the new logs UI showing DNS query logs with customizable columns and filtering options](https://developers.cloudflare.com/_astro/cf1-new-logs-ui.DxF4x0l-_mRSyH.webp)  
The updated UI includes:  
   * **Filter by field** \- Select any field value to add it as a filter and narrow down your results.  
   * **Customizable fields** \- Choose which fields to display in the log table. Querying for fewer fields improves log loading performance.  
   * **View details** \- Select a timestamp to view the full details of a log entry.  
   * **Switch to classic view** \- Return to the previous log viewer interface if needed.  
For more information, refer to [Access authentication logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/).

Mar 20, 2026
1. ### [Route MCP server portal traffic through Cloudflare Gateway](https://developers.cloudflare.com/changelog/post/2026-03-20-mcp-portal-gateway-routing/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now route traffic through [Cloudflare Gateway](https://developers.cloudflare.com/cloudflare-one/traffic-policies/) for richer HTTP request logging and data loss prevention (DLP) scanning.  
When Gateway routing is turned on, portal traffic appears in your [Gateway HTTP logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). You can create [Gateway HTTP policies](https://developers.cloudflare.com/cloudflare-one/traffic-policies/) with [DLP profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/) to detect and block sensitive data sent to upstream MCP servers.  
Note  
DLP [AI prompt profiles](https://developers.cloudflare.com/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#ai-prompt) do not apply to MCP server portal traffic.  
To enable Gateway routing, go to **Access controls** \> **AI controls**, edit the portal, and turn on **Route traffic through Cloudflare Gateway** under **Basic information**.  
![Route MCP server portal traffic through Cloudflare Gateway](https://developers.cloudflare.com/_astro/portal-route-through-gateway.0KMUAXBm_Z1B5rry.webp)  
For more details, refer to [Route traffic through Gateway](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/#route-portal-traffic-through-gateway).

Mar 04, 2026
1. ### [User risk score selector in Access policies](https://developers.cloudflare.com/changelog/post/2026-03-04-user-risk-score-access-policies/)  
[ Cloudflare One ](https://developers.cloudflare.com/cloudflare-one/)[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
You can now use [user risk scores](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/) in your [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). The new **User Risk Score** selector allows you to create Access policies that respond to user behavior patterns detected by Cloudflare's risk scoring system, including impossible travel, high DLP policy matches, and more.  
For more information, refer to [Use risk scores in Access policies](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/risk-score/#use-risk-scores-in-access-policies).

Mar 01, 2026
1. ### [Clipboard controls for browser-based RDP](https://developers.cloudflare.com/changelog/post/2026-03-01-rdp-clipboard-controls/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
You can now configure clipboard controls for browser-based RDP with Cloudflare Access. Clipboard controls allow administrators to restrict whether users can copy or paste text between their local machine and the remote Windows server.  
![Enable users to copy and paste content from their local machine to remote RDP sessions in the Cloudflare One dashboard](https://developers.cloudflare.com/_astro/rdp-clipboard-controls.B0ZmliDb_Z1Ne5yg.webp)  
This feature is useful for organizations that support bring-your-own-device (BYOD) policies or third-party contractors using unmanaged devices. By restricting clipboard access, you can prevent sensitive data from being transferred out of the remote session to a user's personal device.  
#### Configuration options  
Clipboard controls are configured per policy within your Access application. For each policy, you can independently allow or deny:  
   * **Copy from local client to remote RDP session** — Users can copy/paste text from their local machine into the browser-based RDP session.  
   * **Copy from remote RDP session to local client** — Users can copy/paste text from the browser-based RDP session to their local machine.  
By default, both directions are denied for new policies. For existing Access applications created before this feature was available, clipboard access remains enabled to preserve backwards compatibility.  
When a user attempts a restricted clipboard action, the clipboard content is replaced with an error message informing them that the action is not allowed.  
For more information, refer to [Clipboard controls for browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/#clipboard-controls).

Feb 27, 2026
1. ### [Export MCP server portal logs with Logpush](https://developers.cloudflare.com/changelog/post/2026-02-27-mcp-portal-logpush/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
Availability  
Only available on Enterprise plans.  
[MCP server portals](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) now supports [Logpush](https://developers.cloudflare.com/logs/logpush/) integration. You can automatically export MCP server portal activity logs to third-party storage destinations or security information and event management (SIEM) tools for analysis and auditing.  
#### Available log fields  
The MCP server portal logs dataset includes fields such as:  
   * `Datetime` — Timestamp of the request  
   * `PortalID` / `PortalAUD` — Portal identifiers  
   * `ServerID` / `ServerURL` — Upstream MCP server details  
   * `Method` — JSON-RPC method (for example, `tools/call`, `prompts/get`, `resources/read`)  
   * `ToolCallName` / `PromptGetName` / `ResourceReadURI` — Method-specific identifiers  
   * `UserID` / `UserEmail` — Authenticated user information  
   * `Success` / `Error` — Request outcome  
   * `ServerResponseDurationMs` — Response time from upstream server  
For the complete field reference, refer to [MCP portal logs](https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/mcp%5Fportal%5Flogs/).  
#### Set up Logpush  
To configure Logpush for MCP server portal logs, refer to [Logpush integration](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/).  
Note  
MCP server portals is currently in beta.

Feb 17, 2026
1. ### [Streamlined clientless browser isolation for private applications](https://developers.cloudflare.com/changelog/post/2026-02-17-clientless-access-for-private-apps/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
A new **Allow clientless access** setting makes it easier to connect users without a device client to internal applications, without using public DNS.  
![Allow clientless access setting in the Cloudflare One dashboard](https://developers.cloudflare.com/_astro/allow-clientless-access.BHKwQuVt_1mLRiX.webp)  
Previously, to provide clientless access to a private hostname or IP without a [published application](https://developers.cloudflare.com/cloudflare-one/networks/routes/add-routes/#add-a-published-application-route), you had to create a separate [bookmark application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/) pointing to a prefixed [Clientless Web Isolation](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) URL (for example, `https://<your-teamname>.cloudflareaccess.com/browser/https://10.0.0.1/`). This bookmark was visible to all users in the App Launcher, regardless of whether they had access to the underlying application.  
Now, you can manage clientless access directly within your [private self-hosted application](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/). When **Allow clientless access** is turned on, users who pass your Access application policies will see a tile in their App Launcher pointing to the prefixed URL. Users must have [remote browser permissions](https://developers.cloudflare.com/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/) to open the link.

Feb 17, 2026
1. ### [Policies for bookmark applications](https://developers.cloudflare.com/changelog/post/2026-02-17-policies-for-bookmarks/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
You can now assign [Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) to [bookmark applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/). This lets you control which users see a bookmark in the [App Launcher](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/app-launcher/) based on identity, device posture, and other policy rules.  
Previously, bookmark applications were visible to all users in your organization. With policy support, you can now:  
   * **Tailor the App Launcher to each user** — Users only see the applications they have access to, reducing clutter and preventing accidental clicks on irrelevant resources.  
   * **Restrict visibility of sensitive bookmarks** — Limit who can view bookmarks to internal tools or partner resources based on group membership, identity provider, or device posture.  
Bookmarks support all [Access policy configurations](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) except purpose justification, temporary authentication, and application isolation. If no policy is assigned, the bookmark remains visible to all users (maintaining backwards compatibility).  
For more information, refer to [Add bookmarks](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/bookmarks/).

Feb 13, 2026
1. ### [Fine-grained permissions for Access policies and service tokens](https://developers.cloudflare.com/changelog/post/2026-02-13-access-policy-service-token-permissions/)  
[ Cloudflare Fundamentals ](https://developers.cloudflare.com/fundamentals/)[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
Fine-grained permissions for **Access policies** and **Access service tokens** are available. These new resource-scoped roles expand the existing RBAC model, enabling administrators to grant permissions scoped to individual resources.  
#### New roles  
   * **Cloudflare Access policy admin**: Can edit a specific [Access policy](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) in an account.  
   * **Cloudflare Access service token admin**: Can edit a specific [Access service token](https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/) in an account.  
These roles complement the existing resource-scoped roles for Access applications, identity providers, and infrastructure targets.  
For more information:  
   * [Resource-scoped roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/#resource-scoped-roles)  
   * [Role scopes](https://developers.cloudflare.com/fundamentals/manage-members/scope/)  
Note  
Resource-scoped roles is currently in beta.

Jan 22, 2026
1. ### [Require Access protection for zones](https://developers.cloudflare.com/changelog/post/2026-01-22-deny-by-default-for-zones/)  
[ Cloudflare One ](https://developers.cloudflare.com/cloudflare-one/)[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
You can now require Cloudflare Access protection for all hostnames in your account. When enabled, traffic to any hostname that does not have a matching Access application is automatically blocked.  
This deny-by-default approach prevents accidental exposure of internal resources to the public Internet. If a developer deploys a new application or creates a DNS record without configuring an Access application, the traffic is blocked rather than exposed.  
![Require Cloudflare Access protection in the dashboard](https://developers.cloudflare.com/_astro/require-cloudflare-access-protection.BAUmTYOs_ZxNecb.webp)  
#### How it works  
   * **Blocked by default**: Traffic to all hostnames in the account is blocked unless an Access application exists for that hostname.  
   * **Explicit access required**: To allow traffic, create an Access application with an Allow or Bypass policy.  
   * **Hostname exemptions**: You can exempt specific hostnames from this requirement.  
To turn on this feature, refer to [Require Access protection](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/require-access-protection/).

Jan 22, 2026
1. ### [New granular API token permissions for Cloudflare Access](https://developers.cloudflare.com/changelog/post/2026-01-22-granular-api-token-permissions/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
Three new API token permissions are available for Cloudflare Access, giving you finer-grained control when building automations and integrations:  
   * **Access: Organizations Revoke** — Grants the ability to [revoke user sessions](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/#revoke-user-sessions) in a Zero Trust organization. Use this permission when you need a token that can terminate active sessions without broader write access to organization settings.  
   * **Access: Population Read** — Grants read access to the [SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that only need to read synced user and group data.  
   * **Access: Population Write** — Grants write access to the [SCIM users and groups](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/) synced from an identity provider to Cloudflare Access. Use this permission for tokens that need to create or modify synced user and group data.  
These permissions are scoped at the account level and can be combined with existing Access permissions.  
For a full list of available permissions, refer to [API token permissions](https://developers.cloudflare.com/fundamentals/api/reference/permissions/).

Jan 08, 2026
1. ### [Cloudflare admin activity logs capture creation of DNS over HTTP (DoH) users](https://developers.cloudflare.com/changelog/post/2026-01-08-access-audit-log-for-doh-users/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
Cloudflare [admin activity logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/) now capture each time a [DNS over HTTP (DoH) user](https://developers.cloudflare.com/cloudflare-one/networks/resolvers-and-proxies/dns/dns-over-https/) is created.  
These logs can be viewed from the [Cloudflare One dashboard ↗](https://one.dash.cloudflare.com/), pulled via the [Cloudflare API](https://developers.cloudflare.com/api/), and exported through [Logpush](https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/).

Nov 14, 2025
1. ### [Generate Cloudflare Access SSH certificate authority (CA) directly from the Cloudflare dashboard](https://developers.cloudflare.com/changelog/post/2025-11-14-ssh-ca-enhancements/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
SSH with [Cloudflare Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) allows you to use short-lived SSH certificates to eliminate SSH key management and reduce security risks associated with lost or stolen keys.  
Previously, users had to generate this certificate by using the [Cloudflare API ↗](https://developers.cloudflare.com/api/) directly. With this update, you can now create and manage this certificate in the [Cloudflare One dashboard ↗](https://one.dash.cloudflare.com) from the **Access controls** \> **Service credentials** page.  
![Navigate to Access controls and then Service credentials to see where you can generate an SSH CA](https://developers.cloudflare.com/_astro/SSH-CA-generation.DYa9RnX1_ZKuDAo.webp)  
For more details, refer to [Generate a Cloudflare SSH CA](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/#generate-a-cloudflare-ssh-ca).

Oct 28, 2025
1. ### [Access private hostname applications support all ports/protocols](https://developers.cloudflare.com/changelog/post/2025-10-28-access-application-support-for-all-ports-and-protocols/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[Cloudflare Access for private hostname applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) can now secure traffic on all ports and protocols.  
Previously, applying Zero Trust policies to private applications required the application to use HTTPS on port `443` and support Server Name Indicator (SNI).  
This update removes that limitation. As long as the application is reachable via a Cloudflare off-ramp, you can now enforce your critical security controls — like single sign-on (SSO), MFA, device posture, and variable session lengths — to any private application. This allows you to extend Zero Trust security to services like SSH, RDP, internal databases, and other non-HTTPS applications.  
![Example private application on non-443 port](https://developers.cloudflare.com/_astro/internal_private_app_any_port.DNXnEy0u_2rybRJ.webp)  
For example, you can now create a self-hosted application in Access for `ssh.testapp.local` running on port `22`. You can then build a policy that only allows engineers in your organization to connect after they pass an SSO/MFA check and are using a corporate device.  
This feature is generally available across all plans.

Oct 02, 2025
1. ### [Fine-grained Permissioning for Access for Apps, IdPs, & Targets now in Public Beta](https://developers.cloudflare.com/changelog/post/2025-10-01-fine-grained-permissioning-beta/)  
[ Cloudflare Fundamentals ](https://developers.cloudflare.com/fundamentals/)[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
Fine-grained permissions for **Access Applications, Identity Providers (IdPs), and Targets** is now available in Public Beta. This expands our RBAC model beyond account & zone-scoped roles, enabling administrators to grant permissions scoped to individual resources.  
#### What's New  
   * **[Access Applications ↗](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/)**: Grant admin permissions to specific Access Applications.  
   * **[Identity Providers ↗](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/)**: Grant admin permissions to individual Identity Providers.  
   * **[Targets ↗](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/non-http/infrastructure-apps/#1-add-a-target)**: Grant admin rights to specific Targets  
![Updated Permissions Policy UX](https://developers.cloudflare.com/_astro/2025-10-01-fine-grained-permissioning-ux.BWVmQsVF_Z1p4MJh.webp)  
Note  
During the public beta, members must also be assigned an account-scoped, read only role to view resources in the dashboard. This restriction will be lifted in a future release.  
   * **Account Read Only** plus a fine-grained permission for a specific App, IdP, or Target  
   * **Cloudflare Zero Trust Read Only** plus fine-grained permission for a specific App, IdP, or Target  
For more info:  
   * [Get started with Cloudflare Permissioning](https://developers.cloudflare.com/fundamentals/manage-members/roles/)  
   * [Manage Member Permissioning via the UI & API](https://developers.cloudflare.com/fundamentals/manage-members/manage)

Sep 22, 2025
1. ### [Access Remote Desktop Protocol (RDP) destinations securely from your browser — now generally available!](https://developers.cloudflare.com/changelog/post/2025-09-22-browser-based-rdp-ga/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[Browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is now generally available for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients.  
Since we announced our [open beta](https://developers.cloudflare.com/changelog/access/#2025-06-30), we've made a few improvements:  
   * Support for targets with IPv6.  
   * Support for [Magic WAN](https://developers.cloudflare.com/cloudflare-wan/) and [WARP Connector](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/private-net/warp-connector/) as on-ramps.  
   * More robust error messaging on the login page to help you if you encounter an issue.  
   * Worldwide keyboard support. Whether your day-to-day is in Portuguese, Chinese, or something in between, your browser-based RDP experience will look and feel exactly like you are using a desktop RDP client.  
   * Cleaned up some other miscellaneous issues, including but not limited to enhanced support for Entra ID accounts and support for usernames with spaces, quotes, and special characters.  
As a refresher, here are some benefits browser-based RDP provides:  
   * **Control how users authenticate to internal RDP resources** with single sign-on (SSO), multi-factor authentication (MFA), and granular access policies.  
   * **Record who is accessing which servers and when** to support regulatory compliance requirements and to gain greater visibility in the event of a security event.  
   * **Eliminate the need to install and manage software on user devices**. You will only need a web browser.  
   * **Reduce your attack surface** by keeping your RDP servers off the public Internet and protecting them from common threats like credential stuffing or brute-force attacks.  
![Example of a browser-based RDP Access application](https://developers.cloudflare.com/_astro/browser-based-rdp-access-app.BNXce1JL_1TDoUX.webp)  
To get started, refer to [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/).

Aug 26, 2025
1. ### [Manage and restrict access to internal MCP servers with Cloudflare Access](https://developers.cloudflare.com/changelog/post/2025-08-26-access-mcp-oauth/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
You can now control who within your organization has access to internal MCP servers, by putting internal MCP servers behind [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/).  
[Self-hosted applications](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/linked-apps/) in Cloudflare Access now support OAuth for MCP server authentication. This allows Cloudflare to delegate access from any self-hosted application to an MCP server via OAuth. The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the authorized user, using that user's specific permissions and scopes.  
For example, if you have an MCP server designed for internal use within your organization, you can configure Access policies to ensure that only authorized users can access it, regardless of which MCP client they use. Support for internal, self-hosted MCP servers also works with MCP server portals, allowing you to provide a single MCP endpoint for multiple MCP servers. For more on MCP server portals, read the [blog post ↗](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) on the Cloudflare Blog.

Aug 26, 2025
1. ### [MCP server portals](https://developers.cloudflare.com/changelog/post/2025-08-26-mcp-server-portals/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
![MCP server portal](https://developers.cloudflare.com/_astro/mcp-server-portal.BOKqTCoI_ZXYCcF.webp)  
An [MCP server portal](https://developers.cloudflare.com/cloudflare-one/access-controls/ai-controls/mcp-portals/) centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint. Key benefits include:  
   * **Streamlined access to multiple MCP servers**: MCP server portals support both unauthenticated MCP servers as well as MCP servers secured using any third-party or custom OAuth provider. Users log in to the portal URL through Cloudflare Access and are prompted to authenticate separately to each server that requires OAuth.  
   * **Customized tools per portal**: Admins can tailor an MCP portal to a particular use case by choosing the specific tools and prompt templates that they want to make available to users through the portal. This allows users to access a curated set of tools and prompts — the less external context exposed to the AI model, the better the AI responses tend to be.  
   * **Observability**: Once the user's AI agent is connected to the portal, Cloudflare Access logs the indiviudal requests made using the tools in the portal.  
This is available in an open beta for all customers across all plans! For more information check out our [blog ↗](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) for this release.

Aug 15, 2025
1. ### [SFTP support for SSH with Cloudflare Access for Infrastructure](https://developers.cloudflare.com/changelog/post/2025-08-15-sftp/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[SSH with Cloudflare Access for Infrastructure](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/ssh/ssh-infrastructure-access/) now supports SFTP. It is compatible with SFTP clients, such as Cyberduck.

Aug 14, 2025
1. ### [Cloudflare Access Logging supports the Customer Metadata Boundary (CMB)](https://developers.cloudflare.com/changelog/post/2025-07-01-access-supports-customer-metadata-boundary/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
Cloudflare Access logs now support the [Customer Metadata Boundary (CMB)](https://developers.cloudflare.com/data-localization/metadata-boundary/). If you have configured the CMB for your account, all Access logging will respect that configuration.  
Note  
For EU CMB customers, the logs will not be stored by Access and will appear as empty in the dashboard. EU CMB customers should utilize [Logpush](https://developers.cloudflare.com/logs/logpush/) to retain their Access logging, if desired.

Jul 01, 2025
1. ### [Access RDP securely from your browser — now in open beta](https://developers.cloudflare.com/changelog/post/2025-07-01-browser-based-rdp-open-beta/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[Browser-based RDP](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/) with [Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/) is now available in open beta for all Cloudflare customers. It enables secure, remote Windows server access without VPNs or RDP clients.  
With browser-based RDP, you can:  
   * **Control how users authenticate to internal RDP resources** with single sign-on (SSO), multi-factor authentication (MFA), and granular access policies.  
   * **Record who is accessing which servers and when** to support regulatory compliance requirements and to gain greater visibility in the event of a security event.  
   * **Eliminate the need to install and manage software on user devices**. You will only need a web browser.  
   * **Reduce your attack surface** by keeping your RDP servers off the public Internet and protecting them from common threats like credential stuffing or brute-force attacks.  
![Example of a browsed-based RDP Access application](https://developers.cloudflare.com/_astro/browser-based-rdp-access-app.BNXce1JL_1TDoUX.webp)  
To get started, see [Connect to RDP in a browser](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/use-cases/rdp/rdp-browser/).

Jun 05, 2025
1. ### [Cloudflare One Analytics Dashboards and Exportable Access Report](https://developers.cloudflare.com/changelog/post/dashboards-access-report/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)[ Cloudflare One ](https://developers.cloudflare.com/cloudflare-one/)  
Cloudflare One now offers powerful new analytics dashboards to help customers easily discover available insights into their application access and network activity. These dashboards provide a centralized, intuitive view for understanding user behavior, application usage, and security posture.  
!\[Cloudflare One Analytics Dashboards\](\~/assets/images/changelog/cloudflare-one/Analytics Dashboards.png)  
Additionally, a new exportable access report is available, allowing customers to quickly view high-level metrics and trends in their application access. A **preview** of the report is shown below, with more to be found in the report:  
![Cloudflare One Analytics Dashboards](https://developers.cloudflare.com/_astro/access-report.C744W7JR_2uzMcN.webp)  
Both features are accessible in the Cloudflare [Zero Trust dashboard ↗](https://one.dash.cloudflare.com/), empowering organizations with better visibility and control.

May 16, 2025
1. ### [New Access Analytics in the Cloudflare One Dashboard](https://developers.cloudflare.com/changelog/post/access-analytics-v2/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)[ Cloudflare One ](https://developers.cloudflare.com/cloudflare-one/)  
A new Access Analytics dashboard is now available to all Cloudflare One customers. Customers can apply and combine multiple filters to dive into specific slices of their Access metrics. These filters include:  
   * Logins granted and denied  
   * Access events by type (SSO, Login, Logout)  
   * Application name (Salesforce, Jira, Slack, etc.)  
   * Identity provider (Okta, Google, Microsoft, onetimepin, etc.)  
   * Users (`chris@cloudflare.com`, `sally@cloudflare.com`, `rachel@cloudflare.com`, etc.)  
   * Countries (US, CA, UK, FR, BR, CN, etc.)  
   * Source IP address  
   * App type (self-hosted, Infrastructure, RDP, etc.)  
![Access Analytics](https://developers.cloudflare.com/_astro/accessanalytics.DYXgwZCl_Z2PPi7.webp)  
To access the new overview, log in to your Cloudflare [Zero Trust dashboard ↗](https://one.dash.cloudflare.com/) and find Analytics in the side navigation bar.

Apr 21, 2025
1. ### [Access bulk policy tester](https://developers.cloudflare.com/changelog/post/2025-04-21-access-bulk-policy-tester/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
The [Access bulk policy tester](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/policy-management/#test-all-policies-in-an-application) is now available in the Cloudflare Zero Trust dashboard. The bulk policy tester allows you to simulate Access policies against your entire user base before and after deploying any changes. The policy tester will simulate the configured policy against each user's last seen identity and device posture (if applicable).  
![Example policy tester](https://developers.cloudflare.com/_astro/example-policy-tester.DCY8hQvx_2nxAfs.webp)

Apr 09, 2025
1. ### [Cloudflare Zero Trust SCIM User and Group Provisioning Logs](https://developers.cloudflare.com/changelog/post/2025-04-09-scim-provisioning-logs/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[Cloudflare Zero Trust SCIM provisioning](https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim) now has a full audit log of all create, update and delete event from any SCIM Enabled IdP. The [SCIM logs](https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/scim-logs/) support filtering by IdP, Event type, Result and many more fields. This will help with debugging user and group update issues and questions.  
SCIM logs can be found on the Zero Trust Dashboard under **Logs** \-> **SCIM provisioning**.  
![Example SCIM Logs](https://developers.cloudflare.com/_astro/example-scim-log.Bv5Zqckh_BY26C.webp)

Mar 03, 2025
1. ### [New SAML and OIDC Fields and SAML transforms for Access for SaaS](https://developers.cloudflare.com/changelog/post/2025-03-03-saml-oidc-fields-saml-transformations/)  
[ Access ](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)  
[Access for SaaS applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/) now include more configuration options to support a wider array of SaaS applications.  
**SAML and OIDC Field Additions**  
OIDC apps now include:  
   * Group Filtering via RegEx  
   * OIDC Claim mapping from an IdP  
   * OIDC token lifetime control  
   * Advanced OIDC auth flows including hybrid and implicit flows  
![OIDC field additions](https://developers.cloudflare.com/_astro/oidc-claims.2di8l9Lv_ZrD1mx.webp)  
SAML apps now include improved SAML attribute mapping from an IdP.  
![SAML field additions](https://developers.cloudflare.com/_astro/saml-attribute-statements.CW45j5Qi_1ydeSQ.webp)  
**SAML transformations**  
SAML identities sent to Access applications can be fully customized using JSONata expressions. This allows admins to configure the precise identity SAML statement sent to a SaaS application.  
![Configured SAML statement sent to application](https://developers.cloudflare.com/_astro/transformation-box.DyKn-DdN_2rtirg.webp)

[Search all changelog entries](https://developers.cloudflare.com/search/?contentType=Changelog+entry)