Define device enrollment permissions

Device enrollment permissions determine which users can connect new devices to your organization’s Cloudflare Zero Trust instance. Once the user registers their device, the WARP client will store their identity token and use it to authenticate to services in your private network.

Set device enrollment permissions

Dashboard

1. In Zero Trust ↗, go to Settings > WARP Client.
2. In Device enrollment permissions, select Manage.
3. In the Rules tab, configure one or more Access policies to define who can join their device. For example, you could allow all users with a company email address:

   Rule type	Selector	Value
   Include	Emails ending in	@company.com

Note

Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.

4. In the Authentication tab, select the identity providers users can authenticate with. If you have not integrated an identity provider, you can use the one-time PIN.
5. Select Save.

Terraform

1. Add the following permission to your cloudflare_api_token ↗:

   • Access: Apps and Policies Write

2. Use the cloudflare_zero_trust_access_application ↗ resource to create an application with type warp.

   resource "cloudflare_zero_trust_access_application" "warp_enrollment_app" {
     account_id                = var.cloudflare_account_id
     session_duration          = "18h"
     name                      = "Warp device enrollment"
     allowed_idps              = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id]
     auto_redirect_to_identity = true
     type                      = "warp"
     app_launcher_visible      = false
   }

3. Use the cloudflare_zero_trust_access_policy ↗ resource to define enrollment permissions.

   resource "cloudflare_zero_trust_access_policy" "warp_enrollment_employees" {
     application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
     account_id     = var.cloudflare_account_id
     name           = "Allow company emails"
     decision       = "allow"
     precedence     = 1
   
     include {
       email_domain = ["company.com"]
     }
   }

Only allow corporate devices

Device posture evaluation happens after a device has already enrolled in your Zero Trust organization. If you want only specific devices to be able to enroll, we recommend adding a mutual TLS authentication rule to your device enrollment policy. This rule will check for the presence of a specific client certificate on the enrolling devices.

Note

Mutual TLS authentication is only available on Enterprise plans.

To check for an mTLS certificate:

Dashboard

1. Add an mTLS certificate to your account. You can generate a sample certificate using the Cloudflare PKI toolkit.

2. In Associated hostnames, enter your Zero Trust team domain: <team-name>.cloudflareaccess.com

3. In your device enrollment permissions, add a Common Name or Valid Certificate rule. For example, the following policy requires a client certificate with a specific common name:

   Action	Rule type	Selector	Value
   Allow	Require	Common Name	<CERT-COMMON-NAME>

4. On your device, add the client certificate to the system keychain.

Terraform

1. Add the following permissions to your cloudflare_api_token ↗:

   • Access: Mutual TLS Certificates Write
   • Access: Apps and Policies Write

2. Use the cloudflare_zero_trust_access_mtls_certificate ↗ resource to add an mTLS certificate to your account:

   resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" {
     account_id     = var.cloudflare_account_id
     name           = "WARP enrollment mTLS cert"
     certificate    = <<EOT
     -----BEGIN CERTIFICATE-----
     xxxx
     xxxx
     -----END CERTIFICATE-----
     EOT
     associated_hostnames = ["your-team-name.cloudflareaccess.com"]
   }

3. Add the following policy to your WARP enrollment Access application:

   resource "cloudflare_zero_trust_access_policy" "warp_enrollment_employees" {
     application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
     account_id     = var.cloudflare_account_id
     name           = "Allow company emails"
     decision       = "allow"
     precedence     = 1
   
     include {
       email_domain = ["company.com"]
     }
   
     require {
       common_names = ["Common name 1", "Common name 2"]
     }
   }

4. On your device, add the client certificate to the system keychain.

Best practices

Most businesses use a single identity provider as the source of truth for their user directory. You should use this source of truth to onboard your corporate users to Zero Trust, for example by requiring company email addresses to login with your primary identity provider. Later on, you can add other login methods or identity providers as necessary for any contractors, vendors, or acquired corporations who may need access to your network.