Device enrollment permissions

Device enrollment permissions determine which users can connect new devices to your organization’s Cloudflare Zero Trust instance.

Set device enrollment permissions

1. In Zero Trust ↗, go to Settings > WARP Client.
2. In Device enrollment permissions, select Manage.
3. In the Rules tab, configure one or more Access policies to define who can join their device. For example, you could allow all users with a company email address:

   Rule type	Selector	Value
   Include	Emails ending in	@company.com

Note

Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.

4. In the Authentication tab, select the identity providers users can authenticate with. If you have not integrated an identity provider, you can use the one-time PIN.
5. Select Save.

Users can now enroll their device by logging in to your identity provider. To prevent users from logging out of your organization after they enroll, disable Allow devices to leave organization in your WARP client settings.

Example policies

Check for service token

Instead of requiring users to authenticate with their credentials, you can use a service token to enroll devices without any user interaction. Because users are not required to log in to an identity provider, identity-based policies cannot be enforced on these devices.

To enroll devices using a service token:

1. Create a service token.

2. Copy the token’s Client ID and Client Secret.

3. In your device enrollment permissions, create the following policy:

   Rule Action	Rule type	Selector	Value
   Service Auth	Include	Service Token	<TOKEN-NAME>

4. In your MDM deployment parameters, add the following fields:

   • auth_client_id: The Client ID of your service token.
   • auth_client_secret: The Client Secret of your service token.

When you deploy the WARP client with your MDM provider, WARP will automatically connect the device to your Zero Trust organization.

You can verify which devices have enrolled by going to My Team > Devices. Devices that enrolled using a service token (or any other Service Auth policy) will have the Email field show as non_identity@<team-name>.cloudflareaccess.com.

Check for mTLS certificate

Enterprise customers can enforce mutual TLS authentication during device enrollment.

To check for an mTLS certificate:

1. Add an mTLS certificate to your account. You can generate a sample certificate using the Cloudflare PKI toolkit.

2. In Associated hostnames, enter your Zero Trust team domain: <team-name>.cloudflareaccess.com

3. In your device enrollment permissions, add a Common Name or Valid Certificate rule. For example, the following policy requires a client certificate with a specific common name:

   Action	Rule type	Selector	Value
   Allow	Require	Common Name	<CERT-COMMON-NAME>

4. On your device, add the client certificate to the system keychain.

When users log in to your Zero Trust organization from the WARP client, their device must present a valid client certificate in order to connect.