Skip to content
Cloudflare Docs

Register the Cloudflare One Client with minimal user interaction

Administrators can automate Cloudflare One Client (formerly WARP) registration on managed devices and minimize the number of clicks required from an end user.

During the default Cloudflare One Client enrollment process, end users typically need to complete several steps in order to login:

  1. Review Terms and Conditions in the Cloudflare One Client GUI and acknowledge your company's use of the Cloudflare One Client.
  2. Select their identity provider from the Cloudflare Access login screen.
  3. Complete the authentication steps required by the identity provider.
  4. Interact with a browser popup requesting permission to launch the Cloudflare One Client.

This guide covers how to eliminate steps 1, 2 and 4 from your Cloudflare One Client deployment.

On iOS and Android / ChromeOS, end users will still be asked questions required by their platform such as accepting notifications or installing the VPN Profile.

Turn off onboarding screens

To skip the Terms and Conditions screens that are usually presented to users, set the onboarding parameter to false in your MDM deployment file. Here is an example mdm.xml file:

<dict>
  <key>organization</key>
  <string>your-team-name</string>
  <key>onboarding</key>
  <false/>
</dict>

Turn on Instant Auth

If you are only using one identity provider for device enrollment, turn on Instant Auth in your device enrollment permissions. This allow users to skip the Cloudflare Access login page and go directly to your SSO login event.

Allow browser to launch the Cloudflare One Client

You can configure your browser to automatically launch the Cloudflare One Client application after a successful login and skip the Open Cloudflare WARP.app popup.

Browser popup requesting permission to open the Cloudflare One Client

Chromium-based browsers

Chromium-based browsers such as Google Chrome and Microsoft Edge have a policy setting called AutoLaunchProtocolsFromOrigins ↗. This setting takes in two parameters: a protocol for the browser to launch and the origins that are allowed to launch it. For the browser to launch the Cloudflare One Client, you need to set the protocol to com.cloudflare.warp and the origin to your Cloudflare Zero Trust team domain (https://<your-team-name>.cloudflareaccess.com).

On Windows, you can configure AutoLaunchProtocolsFromOrigins by adding a new registry key.

To add the registry key manually:

  1. Open Registry Editor as Administrator.

  2. Navigate to the policies folder for your browser:

    • Google Chrome: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
    • Microsoft Edge: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge

  3. Create a new string value:

    • Value Name: AutoLaunchProtocolsFromOrigins
    • Value Data: [{"allowed_origins": ["https://<your-team-name>.cloudflareaccess.com/"], "protocol": "com.cloudflare.warp"}]

    Be sure to replace <your-team-name> with your actual Zero Trust team name.

Instead of using the Registry Editor, the registry key can also be created using a Group Policy Object (GPO), PowerShell script, or with an MDM such as Intune.