Multiple users on a Windows device
Feature availability
WARP modes | Zero Trust plans ↗ |
---|---|
All modes | All plans |
System | Availability | Minimum WARP version |
---|---|---|
Windows | ✅ | 2025.1.447.1 |
macOS | ❌ | |
Linux | ❌ | |
iOS | ❌ | |
Android | ❌ | |
ChromeOS | ❌ |
Cloudflare WARP supports multiple user registrations on a single Windows device. When deployed in multi-user mode, the WARP client will automatically switch user registrations after a user logs in to their Windows account. All traffic to Cloudflare will be attributed to the currently active Windows user. This allows administrators to apply identity-based policies and device settings, audit user activity, and remove individual users from a shared workstation.
To enable multi-user support on Windows, deploy an MDM file onto the device with the multi_user
key set to true
. For example:
<dict> <key>multi_user</key> <true/> <key>configs</key> <array> <dict> <key>organization</key> <string>your-team-name</string> <key>display_name</key> <string>Default</string> </dict> </array></dict>
To use multi-user mode alongside the Windows pre-login and Switch between Zero Trust organizations options:
<dict> <key>multi_user</key> <true/> <key>pre_login</key> <dict> <key>organization</key> <string>mycompany</string> <key>auth_client_id</key> <string>88bf3b6d86161464f6509f7219099e57.access</string> <key>auth_client_secret</key> <string>bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5</string> </dict> <key>configs</key> <array> <dict> <key>organization</key> <string>mycompany</string> <key>display_name</key> <string>Production environment</string> </dict> <dict> <key>organization</key> <string>test-org</string> <key>display_name</key> <string>Test environment</string> </dict> </array></dict>
When enabling multi-user mode for the first time, users will need to re-register even if they had a previous registration.
The following flowchart shows how WARP registration settings take effect as users log in and out:
flowchart TB start(["Enable multi-user mode"])-->reg["Active Windows user is prompted to register WARP"] reg--"Log out of Windows"-->prelogin subgraph preloginbehavior["Windows login screen"] prelogin{{"Is there a pre-login <br />registration?"}} preloginyes["Use pre-login settings"] prelogin--"Yes"-->preloginyes prelogin-. "No" .->preloginno preloginno["Stay registered as <br />previous Windows user"] end preloginbehavior--"Log in to Windows"---->regexists{{"Has the user already registered with WARP?"}} regexists--"Yes"-->user["Switch to that user's registration"] regexists-. "No" .->reg