Device profiles

A device profile defines WARP client settings for a specific set of devices in your organization. You can create multiple profiles and apply different settings based on the user's identity, the device's location, and other criteria.

For example, users in one identity provider group (signifying a specific office location) might have different routes that need to be excluded from their WARP tunnel, or some device types (like Linux) might need different DNS settings to accommodate local development services.

Create a new profile

Dashboard

1. In Zero Trust ↗, go to Settings > WARP Client.
2. In the Profile settings card, select Create profile. This will make a copy of the Default profile.
3. Enter any name for the profile.
4. Create rules to define the devices that will use this profile. Learn more about the available Selectors, Operators, and Values.
5. Configure WARP settings for these devices.

Note

At this time, Split Tunnels and Local Domain Fallback can only be modified after you save the profile.

6. Select Create profile.

Your profile will appear in the Profile settings list. You can rearrange the profiles in the list according to your desired order of precedence.

API

Send a POST request to the Devices endpoint:

curl https://api.cloudflare.com/client/v4/accounts/{account_id}/devices/policy \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{
  "allow_mode_switch": false,
  "allow_updates": false,
  "allowed_to_leave": false,
  "auto_connect": 900,
  "captive_portal": 180,
  "description": "Cloudflare'\''s basic device settings profile, recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/",
  "disable_auto_fallback": true,
  "enabled": true,
  "exclude_office_ips": false,
  "match": "identity.email == \"me@mycompany.com\"",
  "name": "Cloudflare basic device profile",
  "precedence": 101,
  "service_mode_v2": {
    "mode": "warp"
  },
  "support_url": "https://it.company.com/help",
  "switch_locked": true
}'

Edit profile settings

1. In Zero Trust ↗, go to Settings > WARP Client.

2. In the Profile settings card, find the profile you want to update and select Configure.

3. Modify WARP settings for this profile.

   Note

   Changing any of the settings below will cause the WARP connection to restart. The user may experience a brief period of connectivity loss while the new settings are being applied.

   • Service mode
   • Local Domain Fallback
   • Split Tunnels

4. Select Save profile.

The new settings may take up to 24 hours to propagate to devices.

Verify device profile

To check which device profile and profile settings are currently on a device, open a terminal and run:

warp-cli settings

The device profile UUID is shown in the Profile ID field.

Alternatively, if you do not have access to the CLI, you can use DEX remote captures to generate a WARP diagnostic log. The warp-settings.txt log file will contain the output of warp-cli settings.

Selectors

Selector	Description	WARP mode required
User email	Email address of a user user-name@company.com	Gateway with WARP
User group emails	Email address of an IdP group contractors@company.com	Gateway with WARP
User group IDs	ID of an IdP group 12jf495bhjd7893ml09o	Gateway with WARP
User group names	Name of an IdP group developers	Gateway with WARP
Operating system	Operating system of the device macOS	Any mode
Operating system version	OS version specified in Semver format 1.2.0	Any mode
Managed network	Network location of the device	Any mode
SAML Attributes	Attribute name and value from a SAML IdP	Gateway with WARP

Comparison operators

Operator	Meaning
is	equals the defined value
in	matches at least one of the defined values

Logical operators

To evaluate multiple conditions in an expression, select a logical operator:

Operator	Meaning
And	match all of the conditions in the expression
Or	match any of the conditions in the expression

Order of precedence

Profiles are evaluated from top to bottom as shown in the UI and follows the first match principle — once a device matches a profile, evaluation stops and no subsequent profiles can override the decision.

The Default profile is always at the bottom of the list, meaning that it will only apply if the device does not match any of the previous profiles. If you make another custom profile the default, all settings will be copied over into the Default profile.