Define device enrollment permissions
2 min read
Device enrollment permissions determine which users can connect new devices to your organization’s Cloudflare Zero Trust instance. Once the user registers their device, the WARP client will store their identity token and use it to authenticate to services in your private network.
Set device enrollment permissions
- In , go to Settings > WARP Client.
- In Device enrollment permissions, select Manage.
- In the Rules tab, configure one or more to define who can join their device. For example, you could allow all users with a company email address:
Rule type Selector Value Include Emails ending in
- In the Authentication tab, select the users can authenticate with. If you have not integrated an identity provider, you can use the .
- Select Save.
Only allow corporate devices
Device posture evaluation happens after a device has already enrolled in your Zero Trust organization. If you want only specific devices to be able to enroll, we recommend adding a rule to your device enrollment policy. This rule will check for the presence of a specific client certificate on the enrolling devices.
To check for an mTLS certificate:
In Associated hostnames, enter your Zero Trust team domain:
Action Rule type Selector Value Allow Require Common Name
Most businesses use a single identity provider as the source of truth for their user directory. You should use this source of truth to onboard your corporate users to Zero Trust, for example by requiring company email addresses to login with your primary identity provider. Later on, you can add other login methods or identity providers as necessary for any contractors, vendors, or acquired corporations who may need access to your network.