Module 1b — Account Administration & Roles

Goal: Set up your admin team the right way — the correct roles, safe ways to add people, group-based permissions, and (for larger orgs) Organizations — so access is least-privilege and nobody is ever locked out.

This is an optional deep-dive that expands Part E of Module 1. If you're a one-person team just evaluating, a single backup Super Admin is enough — come back here when you're ready to roll out for real.

How access actually works (read this first)

There are two separate permission systems, and mixing them up causes most access confusion:

💡 Rule of thumb: Admins get account roles; employees using the service get enrollment permissions + Access policies. An employee does not need an account role to use WARP or reach an app.

Part A — Choose the right roles

When you invite someone (Part B), you assign one or more roles. The common account-scoped roles:

Resource-scoped roles (narrow, least-privilege — great for delegating one thing):

⭐ Best practice — least privilege. Keep Super Administrator to a small number of people. Give platform engineers Administrator, give auditors Administrator Read Only, and use resource-scoped roles when someone only needs to manage one tunnel or token.

Part B — Add members (two ways)

You must be a Super Administrator with a verified email to add members.

Method 1 — Invite by email (works on any plan)

1. 👉 Account dashboard (https://dash.cloudflare.com) → Manage Account → Members.
2. 👉 Click Invite.
3. ⌨️ Enter one or more email addresses.
4. 👉 Define the scope of their access and choose one or more roles (see Part A).
5. 👉 Click Continue to summary → review → Invite.
6. 📺 The person shows as Pending until they accept the email invitation.

💡 Resend or revoke: open the member's record → Resend Invite (if still pending) or expand → Revoke → confirm.

Method 2 — Direct Add (Enterprise only)

If the person already has a Cloudflare account and you're on Enterprise, you can add them without an email round-trip:

1. 👉 Members → Invite → enter their email.
2. 👉 Choose Direct Add → assign roles → confirm. They gain access immediately.

Editing or removing later

• Change roles: open the record → Edit → adjust roles/scope → Continue to summary → Update.
• Remove someone: expand their record → Revoke → confirm.
• Remove yourself: Members → your record → Leave. ⚠️ If you're the only Super Admin, invite another Super Admin before you leave.

Part C — User groups (scale permissions without repeating yourself)

Instead of assigning the same roles to person after person, create a user group once and add people to it. Members inherit all roles assigned to the group (plus any assigned to them directly).

1. 👉 Account dashboard → Manage Account → Members → User groups (or Account → Members, then the Groups tab).
2. 👉 Create a group, e.g. Security Admins, and assign the roles it should carry.
3. 👉 Add members to the group.

💡 Tip: Groups make onboarding/offboarding trivial — add or remove one person from the group instead of editing individual role assignments across the account.

Part D — Organizations (Enterprise / MSSP / Distributors)

If you manage multiple Cloudflare accounts (a large enterprise with several accounts, or a managed-service provider), Organizations sit above accounts:

• The initial user becomes the Organization Super Administrator.
• Organization members get implicit access — automatic Super Administrator permissions on every account in the Organization, without being added to each one individually.
• Any Organization Super Administrator can add/remove other Organization Super Admins.
• Implicit access is all-or-nothing today (no read-only implicit access), and is separate from any existing per-account membership.

This is only relevant if you operate more than one account. Single-account customers can skip it. See Cloudflare's Organizations docs for Enterprise vs. MSSP/Distributor specifics.

Part E — Account-owned API tokens (for automation)

When you automate Cloudflare One with scripts, Terraform, or CI/CD, don't tie automation to a person's login.

1. 👉 Only a Super Administrator can create account-owned API tokens.
2. 👉 Account dashboard → Manage Account → API Tokens (account-owned) → Create Token.
3. 👉 Scope the token to the minimum permissions needed (e.g. Access: Organizations, Identity Providers, and Groups — Edit for IdP automation).

⚠️ Watch out: Treat tokens like passwords — store them in a secrets manager, set expiries, and rotate them. Prefer account-owned tokens over personal ones so automation keeps working after someone leaves.

Part F — Document your break-glass plan

Put this in your runbook / password vault:

BREAK-GLASS PLAN
[ ] Primary Super Admin:  ____________________  (person)
[ ] Backup Super Admin:   ____________________  (person or shared secured mailbox)
[ ] Both accounts have 2FA enabled and recovery codes stored in the vault
[ ] Break-glass credentials stored in: ____________________ (vault location)
[ ] "Restrict to account members" enabled on the Cloudflare IdP
[ ] Reviewed quarterly

⚠️ Watch out: If you later put the admin dashboard itself behind an Access policy, make sure your break-glass identity can always satisfy that policy — otherwise a bad policy can lock everyone out.

Part G — Keep an eye on things (audit logs)

• Account changes (members, settings): Account dashboard → Manage Account → Audit Log.
• Zero Trust user activity & sessions: Cloudflare One → Logs, and Insights → Dashboards (e.g. Network session analytics) for traffic visibility.

💡 Tip: Review the audit log after any admin change and on a regular cadence — it's the fastest way to catch an unexpected permission grant.

✅ Module 1b complete!

You now have:

• ✅ Admins assigned least-privilege roles (Super Admin kept small)
• ✅ A repeatable way to add people (Invite or Direct Add) and user groups for scale
• ✅ An understanding of Organizations (if you run multiple accounts)
• ✅ Account-owned API tokens for automation
• ✅ A written break-glass plan and a place to watch audit logs

Quick troubleshooting

👉 Next: Module 2 — Identity Provider

Connect your corporate login (Entra ID / Okta / Google) so employees sign in with their existing company identity.