Cloudflare Access

Overview

Cloudflare Access is a zero-trust access service for teams protecting applications and infrastructure without granting broad network access. It suits organizations that want per-resource controls across cloud environments and can work within Cloudflare’s domain requirement. The free tier is a practical starting point, while the user thresholds and setup requirements deserve a close look before rollout.

Key features

Identity, policy, and device checks

Access evaluates identity, device posture, and request context, with policies that can grant access to individual resources. Applications deny access by default, so users must match an Allow policy before connecting. That makes least-privilege access the default posture, but administrators need to define the access users should receive.

SAML- and OIDC-compliant identity providers are supported, including enterprise SSO, social providers, and Cloudflare as an identity provider. Contractors, partners, and users on unmanaged devices can use browser access with a social identity provider or one-time PIN. Teams can therefore accommodate some external users without requiring the Cloudflare One Client for every access case.

Applications and infrastructure

Access can replace or supplement a legacy VPN by granting access to specific applications rather than a whole network. It also covers infrastructure targets, including SSH and RDP. Supported protocols include HTTP, HTTPS, TCP, SSH, RDP, SMB, and VNC, giving it a wider remit than web application access alone.

One important deployment constraint applies to publishing a self-hosted public application: it requires an active Cloudflare domain configured with full or partial CNAME setup. That fits teams already using Cloudflare, but adds a prerequisite for organizations that do not.

Administration and surrounding controls

Policy administration can be centralized and scaled through APIs and Terraform, a useful fit for teams managing access as code. Cloudflare identifies Fleet, Hexnode, Intune, Jamf, JumpCloud, and Kandji as partners for deploying its client and remotely configuring devices. The broader offering includes multicloud coverage for AWS, Azure, and GCP, hybrid deployment, network monitoring, firewall policy management, VPN management, application-aware routing, and SIEM log export. Session recording is not supported, which may rule it out where that capability is required.

Pricing

The Free Plan costs free, is billed forever, and supports under 50 users. It is a sensible option for small teams and proofs of concept, but the under-50-user cap makes it unsuitable once a deployment grows beyond that threshold.

Pay-as-you-go costs $7 a month, billed paid annually, and is intended for deployments over 50 users. The annual billing term matters even though the listed rate is monthly. A Contract Plan has custom pricing and maximum support, making it the option to consider when that support level is needed rather than a published per-user price.

Cloudflare One also has a free plan for proof of concept and is offered for free trial. Cloudflare Access is marked as offering a free trial, but no trial duration is given.

Platforms

Cloudflare publishes stable Cloudflare One Client releases for Windows, macOS, Linux, iOS, and Android. Access is also available through web and API platforms. This range covers common desktop and mobile environments, while browser-based access gives contractors and unmanaged-device users another route.

Who it's for

Access is strongest for organizations that want identity- and device-aware controls for applications and infrastructure, especially those already using Cloudflare or prepared to configure a Cloudflare domain. Teams managing multiple clouds or automating policies with APIs and Terraform can also make use of its breadth.

It is less suitable for teams that cannot meet the domain requirement for public self-hosted apps, need session recording, or want a straightforward free tier for 50 or more users. Its default-deny model is a security strength, but requires deliberate policy setup.

Pros and cons

Pros: Per-resource, default-deny policies check identity, device posture, and context, limiting access to what users need.

Pros: Browser access with social identity or one-time PIN supports contractors and unmanaged devices.

Pros: Coverage spans applications and infrastructure protocols, with APIs and Terraform for policy administration.

Cons: Publishing self-hosted public apps requires an active Cloudflare domain with full or partial CNAME setup.

Cons: The free plan is capped at under 50 users, and the paid rate is billed annually.

Cons: Session recording is not supported.

Alternatives

Twingate is worth considering for a freemium option with a free Starter plan for up to five users and 50 resources. OpenVPN CloudConnexa offers a freemium alternative with a Starter plan that includes five seats; its Essential plan is priced at $7 a month.

Pomerium has a Personal Free plan for 10 users, 10 routes, five policies, and two service accounts, making its explicit route and policy caps relevant to smaller deployments. NetBird offers a Free plan for up to five users and 100 machines, with a Team plan at €6 per user / month.

Check Point Harmony SASE is a paid alternative with a 30-day trial. Netskope One Private Access is an enterprise product. Cato Client is a paid option with commercial licensing. Portnox NAC is a network access control alternative.

For broader comparisons, see Zero Trust Network Access Software, SD-WAN Software, Cloud Access Security Broker Software, SaaS Security Posture Management Software, Cloud Network Management Software, and Business VPN Software.

Verdict

Choose Cloudflare Access if you need per-resource, identity- and device-aware control across apps and infrastructure, and can meet its domain and policy setup requirements. Its free tier and broad protocol support make it a credible starting point for smaller deployments, but the under-50-user cap, annual paid billing, and lack of session recording give larger or recording-dependent teams reasons to look elsewhere.