Cloudflare Access Review: Plan Gates, Outages and Real Fit

Short answer: Cloudflare Access fits teams under 50 users and engineering-led organizations already using Cloudflare for DNS, because the Free plan carries production zero trust network access at $0 and the next tier is a published $7 per user per month. It does not fit organizations that need long log retention or a support SLA without an annual contract.

Cloudflare Access at a glance

Who Cloudflare Access is for

Cloudflare Access fits three concrete situations. The first is a team under 50 people, because the Free plan lists ZTNA, Secure Web Gateway, the application connector and the device client as "Included" at $0, which means a 35-person software company can retire a legacy VPN with no license line in the budget.

The second is an organization already running its public domains on Cloudflare. Protecting a self-hosted application requires "An active domain on Cloudflare" using "either a full setup or a partial (CNAME) setup", so the prerequisite is already paid for and the DNS work is already done.

The third is a team that needs to onboard contractors onto internal SSH, RDP or VNC targets. Cloudflare documents browser-rendered terminal access that lets users "connect over SSH, RDP, and VNC without any configuration", which removes the device client from the contractor onboarding path.

Who should not buy Cloudflare Access

Skip Cloudflare Access if your audit or SIEM requirements exceed 30 days of log history and you are not ready for an annual contract. Cloudflare's plan page lists log retention as "Up to 24 hours" on Free and "Up to 30 days" on Pay-as-you-go, with "Up to 6 months; Logpush to SIEM/cloud storage" reserved for the Contract tier (Cloudflare SASE and Zero Trust plans, checked September 23, 2026). A regulated buyer who needs 180-day Access logs is buying the Contract tier regardless of seat count.

Skip it if you need a contractual support response time. Cloudflare lists "Community forums + Discord" for Free and "Chat and ticket support" for Pay-as-you-go, and does not publish a response-time SLA for any Zero Trust plan on that page.

Skip it if a single provider's control plane is an unacceptable dependency. During the June 12, 2025 incident, Cloudflare reported that Access "failed 100% of identity-based logins across all application types" for 2 hours and 28 minutes (Cloudflare outage post-mortem, June 12, 2025). If that risk is unacceptable, consider a ZTNA product whose policy enforcement can run independently of the vendor's identity path, and read the security record below before deciding.

Features that matter

Access policies and selectors in Cloudflare Access

Cloudflare Access evaluates each request against policies built from four actions and three rule types. The actions are Allow, Block, Bypass and Service Auth; Bypass "disables Access enforcement for specific traffic" without logging, and Cloudflare does not recommend it for permanent internal application access. Rule types are Include (OR logic), Require (AND logic) and Exclude (NOT logic).

Twenty-two selectors are available. Identity selectors include emails, email domains, login methods, identity provider groups, SAML group, OIDC claim and User Risk Score. Non-identity selectors include IP ranges, country, common name, valid certificate, service token, device posture, WARP and Gateway. The User Risk Score selector "only displays for Enterprise plans", so risk-based policy is the one policy capability documented as tier-gated.

Identity providers, SSO and SCIM in Cloudflare Access

Cloudflare Access works with SAML and OIDC identity providers, and supports up to 50 identity providers per account. SCIM provisioning is supported "for all SAML and OIDC identity providers that use SCIM version 2.0", which is broader than a named-integrations list.

Watch out: SCIM in Cloudflare Access does not work the way it does in most SaaS applications. Cloudflare's documentation states it "does not provision new users in Zero Trust when they are added to the identity provider -- users must first register a device with the Cloudflare One Client or authenticate to an Access application." Access policy evaluation also relies on SAML assertions or OIDC tokens rather than SCIM group membership, so a group change in Okta or Entra ID reaches policy through the login flow, not through SCIM.

Device posture checks in Cloudflare Access

Device posture selectors let a policy require a managed, healthy endpoint. Cloudflare documents Windows checks for antivirus, application check, client certificate, device serial numbers, disk encryption, domain joined, file check, firewall, OS version, Carbon Black, SentinelOne and Tanium, plus Require Gateway and Require WARP. macOS and Linux cover the same set minus domain joined, and Linux also drops antivirus and firewall. iOS, Android and ChromeOS are limited to device UUID, OS version, Require Gateway and Require WARP.

Cloudflare does not document per-plan availability for individual posture checks, so treat posture parity across tiers as unconfirmed and verify it in the dashboard during a pilot.

Application types and non-HTTP access in Cloudflare Access

Cloudflare Access covers HTTP applications, SaaS applications and non-HTTP targets over SSH, RDP and VNC. Private networks reach Cloudflare through Cloudflare Tunnel rather than inbound firewall rules.

Admins have three connection paths for users: the Cloudflare One device client, which lets users "connect to your applications as if they were on your private network"; a browser-rendered terminal for SSH, RDP and VNC with no client install; and client-side cloudflared for users who cannot run the full client. The clientless path is what makes third-party and unmanaged-device access practical.

Admin tip: protecting a self-hosted application has two documented prerequisites, "An active domain on Cloudflare" and a domain that "uses either a full setup or a partial (CNAME) setup". Confirm the partial CNAME path works with your registrar before scoping a migration.

Logging and reporting in Cloudflare Access

Cloudflare One exposes admin logs, Access logs, DNS logs, network logs, HTTP logs, DEX logs and device posture logs. On Enterprise, Cloudflare documents 180 days of retention for admin and Access logs, 180 days for DNS logs with a footnote caveat, 30 days for network and HTTP logs, and 7 days for DEX and device posture logs. On the self-serve tiers the plan page caps retention at 24 hours (Free) and 30 days (Pay-as-you-go).

That split is the practical reason mid-sized regulated teams end up on a contract. Logpush to a SIEM or cloud storage appears only in the Contract column of Cloudflare's own plan comparison.

Day-to-day admin and scale

Running Cloudflare Access is mostly tunnel and policy work. Applications behind a private network are reached through Cloudflare Tunnel, and Cloudflare documents a limit of 1,000 tunnels per account and 1,000 routes per account, with routes shared with Mesh.

The documented Access ceilings are generous for most environments: 500 applications, 1,000 rules per application, 300 rule groups, 1,000 rules per rule group, 500 reusable policies, 50 service tokens and 50 identity providers per account. Gateway objects are tighter and tier-split: list entries are 1,000 on Standard and 5,000 on Enterprise, PAC files 50 and 1,000, proxy endpoints 50 and 500.

Automation runs against the Cloudflare API, which has a global rate limit of "1200/5 minutes" per user or account token and "200/second" per IP address, returning HTTP 429 and blocking calls for the following five-minute window when exceeded. Bulk policy migration scripts need to respect that ceiling.

Seat counting is behavioral rather than directory-driven. Cloudflare states that "When users authenticate to an application or enroll their agent into the Cloudflare One Client, they count against one of your active seats", which is why the 50-user free cap is reached by activity, not by headcount in the identity provider.

The fine print

• Licensing tiers and feature gates: three tiers, Free ($0, 50 users), Pay-as-you-go ($7 per user per month, no user limit) and Contract (custom annual price per user). ZTNA, Secure Web Gateway, Digital Experience Monitoring and Network Flow Monitoring are listed as "Included" on all three.
• SSO and SCIM plan requirements: not documented as plan-gated. All SAML and OIDC identity providers are supported, and SCIM requires only SCIM version 2.0 on the identity provider side.
• Agent footprint: the Cloudflare One device client (WARP) runs on Windows, macOS, Linux, iOS, Android and ChromeOS. Cloudflare does not publish CPU or memory figures for the client. Clientless browser access and client-side cloudflared are documented alternatives.
• API access by plan: the Cloudflare API is not documented as plan-gated for Cloudflare One. Limits are 1,200 requests per five minutes per user or account token, 200 requests per second per IP, 50 user API tokens and 500 account API tokens.
• Key integrations: any SAML or OIDC identity provider, including Okta and Microsoft Entra ID, both of which have documented provider-specific SCIM caveats. Okta requires separate user sync and group sync configuration with "Push Groups" enabled; Entra ID syncs only groups inside the provisioning scope and expects userName to match the user's email address.
• Data residency and hosting regions: Cloudflare's Data Localization Suite is documented as an "Enterprise-only paid add-on" covering Regional Services, Geo Key Manager and traffic metadata boundaries. The Data Localization Suite documentation does not state whether it covers Cloudflare One logs and metadata, so treat Zero Trust log residency as not published.
• Compliance reports: Cloudflare states that "Super Administrators can access common compliance documentation, such as PCI, SOC 2, ISO, and more, through the Cloudflare dashboard." The full report list is not published publicly.
• MSP multi-tenancy: Cloudflare does not publish a Cloudflare One multi-tenant management model on the pages reviewed here. Not published.
• Trial realities: there is no countdown trial. The Free plan is the proof of concept path, and Cloudflare's own plan page describes it as suited to "Teams under 50 users or enterprise proof-of-concept tests." Setup documentation notes that payment details are entered during onboarding even on the Free plan, without a charge.
• Contract terms: Cloudflare states you "can change or cancel your subscription at any time" and that "if you downgrade your plan during a billing cycle, your downgraded pricing will apply in the next billing cycle." Minimum seats and auto-renewal terms for the Contract tier are not published.

Support

Support in Cloudflare Access is tiered with the plan, and the Free tier has no ticket path. Cloudflare's plan comparison lists "Community forums + Discord" for Free, "Chat and ticket support" for Pay-as-you-go, and "Phone, chat, ticket; professional services available (add-on)" for the Contract tier.

Cloudflare does not publish a response-time SLA for any Zero Trust plan on that page, so there is no documented escalation commitment to hold it to. Professional services are an add-on on the Contract tier rather than an included onboarding package.

No corroborated practitioner pattern on Cloudflare One support response times was found during this research, so nothing is claimed here beyond the published channels.

Exit and lock-in

Exiting Cloudflare Access is mostly a DNS and connectivity problem rather than a data export problem. Access stores policies and application definitions rather than business data, and those objects are readable and writable through the Cloudflare API, so configuration can be exported programmatically within the documented rate limits.

The harder dependency is the domain. A self-hosted application protected by Access requires an active domain on Cloudflare in a full or partial CNAME setup, and private application reachability depends on Cloudflare Tunnel, so leaving means re-establishing inbound connectivity by another route before cutting over. Logs are the other exit cost: with 24-hour retention on Free and 30 days on Pay-as-you-go, historical access records do not survive a migration unless they were already being pushed elsewhere, and Logpush is a Contract-tier capability.

Cloudflare does not publish a data deletion timeline for Cloudflare One after cancellation. Not published.

Cloudflare Access pricing

Cloudflare publishes seat-based Zero Trust pricing in three tiers, and the self-serve numbers are list prices with no quote required.

Cloudflare Zero Trust plans and prices, checked September 23, 2026

At list price, a 50-user team pays $0, and a 100-user team on Pay-as-you-go pays $700 per month, or $8,400 per year before tax and discounts. CASB is capped at "Up to 2 read-only API integrations" on Free and Pay-as-you-go, DLP is limited to "Limited predefined profiles" on both, and Remote Browser Isolation, Email Security and Network Services are Contract-tier add-ons, so a full SASE build is a quoted purchase rather than a self-serve one.

Pricing note: all figures above come from Cloudflare's own SASE and Zero Trust plan page, checked September 23, 2026; Contract pricing is not published.

Security and reliability record

Watch out: the June 12, 2025 post-mortem is the most useful document in this list for an architect, because it records which policy types kept working. Service token, mutual TLS and IP-based policies survived an outage that failed every identity-based login, which is a documented argument for configuring a service-auth break-glass path on at least one administrative application before rollout. Cloudflare does not publish an uptime percentage commitment for Cloudflare One on the pages reviewed here.

Cloudflare Access vs the alternatives

Twingate and Tailscale prices were checked on their own pricing pages on September 23, 2026. Zscaler does not publish list pricing, so a like-for-like seat comparison against Cloudflare's published $7 is not possible without a quote.

Bottom line

If your team is under 50 users and your domains already sit on Cloudflare, start on the Free plan and treat it as the pilot, since it carries production ZTNA rather than a countdown trial. If you need Access logs beyond 30 days, Logpush into a SIEM or a support path with a phone number, budget for the Contract tier from the start rather than growing into it, because that is where retention and support actually change. The verdict flips against Cloudflare Access if a single-provider control plane dependency is unacceptable to your risk team: read the June 12, 2025 post-mortem first. To weigh it against the rest of the field, start from the zero trust network access category hub or build requirements in the shortlist builder.