Module 2 — Connect Your Identity Provider

Goal: Connect your company login system so Cloudflare knows who each user is and which groups they belong to. This is the foundation every later policy depends on.

First: copy your callback URL

Every identity provider needs this one value from you. Write it down now (replace <team-name>):

https://<team-name>.cloudflareaccess.com/cdn-cgi/access/callback

This guide calls it your callback URL. (Google also needs the JavaScript origin: https://<team-name>.cloudflareaccess.com.)

💡 Which provider are you using? Jump to your section:

• Part A — Microsoft Entra ID (Azure AD)
• Part B — Okta
• Part C — Google Workspace
• Part D — None of these / start simple

Then everyone does Part E — Test and Part F — MFA.

Part A — Microsoft Entra ID (Azure AD)

You'll do this in two places: first in Microsoft's admin center, then in Cloudflare.

A1. Register an application in Microsoft Entra

1. 👉 Open https://entra.microsoft.com and sign in with a Global Administrator account.
2. 👉 In the left menu: Applications → Enterprise applications.
3. 👉 Click + New application (top of the page).
4. 👉 Click + Create your own application (top of the page).
5. 📺 A panel opens on the right. ⌨️ Name it Cloudflare Access.
6. 👉 Select the option "Register an application to integrate with Microsoft Entra ID (App you're developing)". ⚠️ Watch out: Do not pick a gallery/SaaS app — you're registering your own.
7. 👉 Click Create.

📺 What you'll see: A "Register an application" page with a Redirect URI section.

8. 👉 Under Redirect URI, set the platform dropdown to Web.
9. ⌨️ Paste your callback URL:

   https://<team-name>.cloudflareaccess.com/cdn-cgi/access/callback
   

10. 👉 Click Register.

✅ Checkpoint: You're now on the app's Overview page.

A2. Copy three values

On the app Overview page:

1. 📋 Copy Application (client) ID → save it.
2. 📋 Copy Directory (tenant) ID → save it.

Now create the secret: 3. 👉 Left menu of the app → Certificates & secrets → Client secrets tab → + New client secret. 4. ⌨️ Description: Cloudflare. Set an expiry (e.g. 24 months). 5. 👉 Click Add. 6. 📋 Immediately copy the secret Value (not the "Secret ID") → save it.

⚠️ Watch out: The secret Value is shown only once. If you navigate away, you must delete it and make a new one. Also, when it expires, all logins stop — set a calendar reminder to renew before the expiry date.

A3. Grant permissions (so Cloudflare can read groups)

1. 👉 Left menu of the app → API permissions → + Add a permission.

2. 👉 Choose Microsoft Graph → Delegated permissions.

3. ⌨️ Search for and tick each of these seven permissions:

   Permission	Why
   email	The user's email
   offline_access	Keeps sessions refreshed
   openid	Standard sign-in
   profile	Basic profile info
   User.Read	Read the signed-in user
   Directory.Read.All	Read your directory
   GroupMember.Read.All	Read group membership (needed for group rules)

4. 👉 Click Add permissions.

5. 👉 Click Grant admin consent for [your org] → Yes.

✅ Checkpoint: All seven permissions show "Granted for [your org]" with green checkmarks.

A4. Add Entra ID to Cloudflare

1. 👉 Go to the Zero Trust dashboard (https://one.dash.cloudflare.com).
2. 👉 Settings → Authentication (you may see it as Integrations → Identity providers).
3. 👉 Under Login methods, click Add new.
4. 👉 Select Azure AD (Microsoft Entra ID).
5. ⌨️ Fill in:

   Field	Paste
   Application (client) ID	from A2
   Application (client) Secret	the secret Value from A2
   Directory (tenant) ID	from A2

6. 👉 Turn on these options:
   • ✅ Support Groups (so Cloudflare reads Entra groups)
   • ✅ Proof Key for Code Exchange (PKCE)
   • ✅ Enable SCIM (recommended — auto-syncs users/groups and can revoke access when someone is disabled)
7. 👉 Click Save.

✅ Checkpoint: "Azure AD" now appears in your list of login methods. Now jump to Part E — Test.

Part B — Okta

B1. Create an app in Okta

1. 👉 Sign in to your Okta admin console.
2. 👉 Applications → Applications → Create App Integration.
3. 👉 Choose OIDC - OpenID Connect → Web Application → Next.
4. ⌨️ Name it Cloudflare Access.
5. ⌨️ Under Sign-in redirect URIs, paste your callback URL:

   https://<team-name>.cloudflareaccess.com/cdn-cgi/access/callback
   

6. 👉 Under Assignments, choose who can use it (e.g. "Allow everyone in your organization"), then Save.

B2. Copy two values

On the app's General tab:

1. 📋 Copy Client ID.
2. 📋 Copy Client secret.
3. 📝 Note your Okta domain (the URL you log in at, e.g. https://my-company.okta.com).

B3. Add Okta to Cloudflare

1. 👉 Zero Trust → Settings → Authentication → Add new → Okta.
2. ⌨️ Fill in:

   Cloudflare field	Value
   App ID	Okta Client ID
   Client secret	Okta Client secret
   Okta account URL	https://my-company.okta.com

3. 👉 Turn on Support Groups if you'll use group-based rules.
4. 👉 Click Save.

⚠️ Watch out: If your org has more than 100 Okta groups, you must also create a read-only Okta API token and paste it in, or group lookups will fail. (Okta admin → Security → API → Tokens → Create Token.)

✅ Checkpoint: "Okta" appears in your login methods. Now go to Part E — Test.

Part C — Google Workspace

C1. Create OAuth credentials in Google

1. 👉 Open https://console.cloud.google.com → select or create a project.
2. 👉 APIs & Services → Credentials → + Create Credentials → OAuth client ID.
3. 👉 Application type: Web application.
4. ⌨️ Authorized JavaScript origins → add:

   https://<team-name>.cloudflareaccess.com
   

5. ⌨️ Authorized redirect URIs → add your callback URL:

   https://<team-name>.cloudflareaccess.com/cdn-cgi/access/callback
   

6. 👉 Click Create.
7. 📋 Copy the Client ID and Client secret.

C2. Add Google to Cloudflare

1. 👉 Zero Trust → Settings → Authentication → Add new.
2. 👉 Choose Google (for any Gmail) or Google Workspace (for your company domain + groups).
3. ⌨️ Paste the Client ID and Client secret.
4. For Google Workspace (to read groups): follow the on-screen prompt to provide your admin email / domain so Cloudflare can read group membership.
5. 👉 Click Save.

✅ Checkpoint: "Google Workspace" appears in your login methods. Now go to Part E — Test.

Part D — No corporate IdP yet?

You can still proceed and connect a real IdP later.

• Cloudflare is the default login for new accounts — users sign in with a Cloudflare account.
• Or add One-time PIN (OTP): Zero Trust → Settings → Authentication → Add new → One-time PIN. Users get a code by email. Good for contractors and quick testing.

💡 Tip: Keep OTP or Cloudflare login enabled as a backup even after you add your corporate IdP — it's your safety net if the SSO connection ever breaks.

Part E — Test your connection (everyone does this)

1. 👉 In Settings → Authentication → Login methods, find your provider in the list.
2. 👉 Click the provider, then click the Test button.

📺 What you'll see: A new tab opens, runs a real login against your provider, and then shows a success page listing the identity Cloudflare received — the user's email and (importantly) their groups.

✅ Checkpoint — this is the key moment:

• ✅ Login succeeds.
• ✅ The result shows your email.
• ✅ The result shows your groups (e.g. Engineering, Finance).

⚠️ If groups are missing: your group permissions/claims aren't set. Go back to your provider:

• Entra ID: confirm GroupMember.Read.All was added and admin consent granted (Step A3), and Support Groups is on in Cloudflare (A4).
• Okta: enable a groups claim, and add the API token if you have >100 groups.
• Google: make sure you chose Google Workspace (not plain Google) and provided admin/domain access.

Without groups in this test, your group-based access rules in later modules will not match. Fix this before continuing.

Part F — Turn on multi-factor authentication

1. 👉 Zero Trust → Access controls → Access settings (older menus: Settings → Authentication → Authentication settings).
2. 👉 Configure:

   Setting	Recommended
   Allow multi-factor authentication (MFA)	On
   Authentication methods	Select your approved factors
   Use identity provider MFA	On — re-uses your IdP's MFA so users aren't prompted twice
   Apply global MFA settings by default	On
   Authentication duration	24h (use shorter for sensitive apps later)

3. 👉 Click Save.

✅ Checkpoint: MFA is enforced for sign-ins going forward.

✅ Module 2 complete!

You now have:

• ✅ Your company login connected to Cloudflare
• ✅ A passing Test showing email and groups
• ✅ (Recommended) SCIM auto-sync enabled
• ✅ MFA turned on
• ✅ A backup login method (OTP / Cloudflare) retained

Quick troubleshooting

👉 Next: Module 3 — Device Enrollment (WARP)

You'll install the Cloudflare One Client so devices connect securely and report their health.