Zero Trust Access (ZTNA)

Cloudflare Access puts your internal applications behind an identity-aware layer at the edge: every request is authenticated and authorised against policy, replacing the traditional VPN and its all-or-nothing network access.

Overview

The classic VPN model has a structural flaw: once connected, a user (or an attacker with their stolen credentials) is on the network, able to reach far more than the one application they needed. VPN concentrators are also a performance bottleneck and a favourite target — critical VPN vulnerabilities are exploited within days of disclosure.

Zero Trust Network Access (ZTNA) inverts the model: nobody is trusted by network location. Cloudflare Access checks every single request to an internal application against identity, device and context policies, and grants access to that one application only. Applications themselves are never exposed to the internet; they connect outbound to Cloudflare through a lightweight tunnel.

Key capabilities

Per-application access policies based on identity, group, country, device posture and multi-factor method
Integration with your existing identity providers — Microsoft Entra ID, Google Workspace, Okta, generic SAML/OIDC — several at once if needed
Cloudflare Tunnel connects applications outbound, so no inbound firewall ports and no public IP exposure
Support for web apps, SSH, RDP, VNC and arbitrary TCP/UDP services (browser-rendered or via the WARP client)
Service tokens and mutual TLS for automated, non-human access (CI/CD, monitoring, service-to-service)
Device posture checks — disk encryption, OS version, endpoint security agent — as policy inputs
Clientless browser-based access for contractors and partners with no software to install
Full audit logs of every authentication and request, exportable to your SIEM

How it works

You connect an internal application to Cloudflare by running cloudflared (Cloudflare Tunnel) next to it — a small daemon that opens an outbound, encrypted connection to the edge. The application gets a hostname on your domain, but that hostname resolves to Cloudflare, not to your infrastructure, and your firewall needs no inbound rules at all.

When a user visits the application, Cloudflare redirects them to your identity provider to sign in, evaluates your policy (who they are, what group they're in, where they are, whether their device passes posture checks), and only then forwards traffic through the tunnel. The session is bound to a short-lived, signed token that is re-validated on every request — revoking a user in your IdP locks them out immediately, everywhere.

Because enforcement happens at 300+ edge locations rather than one VPN concentrator, access is typically faster than the VPN it replaces, and there is no appliance to patch, scale or fail over.

Plans & licensing

Access is part of the Cloudflare One / Zero Trust platform, priced per user rather than per zone. The free tier covers up to 50 users with core functionality — enough for a genuine production pilot. Paid Zero Trust plans add larger seat counts, longer log retention and advanced features; Enterprise contracts add SLAs and bundle options. As of 2026, subject to change — confirm current packaging with us.

Plan and pricing details reflect Cloudflare’s public packaging as of 2026 and are subject to change. Confirm current terms with us before making decisions based on them.

Deployment with Integrity

As a certified Cloudflare partner for Central and Eastern Europe, Integrity delivers this product end to end — including a free pilot so you see results on your own traffic before committing. A typical rollout:

Assessment. We map your internal applications, user groups, identity provider(s) and current VPN pain points, and pick 2–3 pilot applications.
Free pilot. Your IdP is connected, tunnels are deployed for the pilot apps, and a pilot user group works through Access for two weeks — in parallel with the existing VPN, risk-free.
Policy build-out. Per-application policies are written with least privilege, service tokens replace shared credentials for automation, device posture rules are added where warranted.
Migration waves. Remaining applications move in planned waves; contractors and partners get clientless access; SSH/RDP access is migrated for infrastructure teams.
VPN retirement. Once coverage is complete, the VPN is decommissioned and its attack surface with it.
Handover or managed service. Runbooks and admin training for your team, or Integrity operates the Zero Trust deployment — book the free pilot.

Ready to start? Contact us to arrange the free pilot.

FAQ

Do users need to install anything?

For web applications, no — a browser is enough, which is ideal for contractors. The WARP client is only needed for non-web protocols (arbitrary TCP/UDP) or when you want device posture signals from managed machines.

Can we keep our VPN during the transition?

Yes, and you should. Access runs application-by-application, so the standard rollout keeps the VPN alive while applications migrate in waves, and retires it only at the end.

What about legacy apps that can't do SSO?

That's a core use case: Access adds the SSO and MFA layer in front of the application, which never needs to know about it. Even an old intranet app with basic auth gets modern identity enforcement at the edge.