Cloudflare Access

Overview

Cloudflare Access is a zero-trust access service for organizations protecting applications and infrastructure. It suits teams that want granular controls for employees and outside partners, and are comfortable building access around Cloudflare’s domain and device ecosystem. Its per-resource model is compelling; the domain requirement and free-tier user cap deserve attention before rollout.

Key features

Access policies and identity

Access evaluates identity, device posture, and request context, with policies applied to individual resources rather than broad network access. Applications deny access unless a user matches an Allow policy. That default is a sound fit for least-privilege deployments, though it puts the onus on administrators to define who needs access to each resource.

SAML- and OIDC-compliant identity providers are supported, including enterprise SSO, social identity providers, and Cloudflare itself. Contractors, partners, and users on unmanaged devices can connect through a browser using social identity or a one-time PIN. This clientless option is useful for external access without requiring those users to install a client.

Applications and infrastructure

Access can protect self-hosted and SaaS applications as well as infrastructure targets such as SSH and RDP. Supported protocols also include HTTP, HTTPS, TCP, SMB, and VNC. Cloudflare positions the service as a way to replace or supplement legacy VPNs by granting access to specific applications, which is a more focused choice than broad network access when that is the goal.

Publishing a self-hosted public application requires an active Cloudflare domain configured through full or partial CNAME setup. That requirement may make Access a less direct fit for teams unwilling or unable to use a Cloudflare domain for this purpose.

Deployment and administration

The deployment model is hybrid, with multicloud support across AWS, Azure, and GCP. Access policies can be managed centrally and scaled through APIs and Terraform, a useful combination for teams automating configuration. Cloudflare lists Fleet, Hexnode, Intune, Jamf, JumpCloud, and Kandji as technology partners for deploying its One Client and remotely configuring devices. The product supports device posture checks; session recording is not supported.

Pricing

Cloudflare Access uses a freemium model, with a free trial also offered. The Free Plan costs nothing, is billed forever, and is capped at under 50 users. It is the natural starting point for small teams or a proof of concept, but the user ceiling rules it out for larger deployments.

Pay-as-you-go costs $7 a month, billed paid annually, and applies to over 50 users. It is the published paid step for organizations beyond the free cap; the annual billing term matters for buyers comparing it with month-to-month services. The Contract Plan has custom pricing and maximum support, making it the option to consider when that support level matters and a standard per-user plan is not the fit.

Cloudflare One also has a free plan described for proof of concept, and is offered for free trial. The published plan terms do not state a trial length.

Platforms

Cloudflare Access supports Android, iOS, Linux, macOS, web, Windows, and API. Cloudflare publishes stable One Client releases for Windows, macOS, Linux, iOS, and Android.

Who it's for

Access is a strong fit for organizations that need per-application controls, device checks, and access to infrastructure targets in one zero-trust approach, especially when they already work with Cloudflare or can meet its domain setup requirement. Its free tier gives smaller deployments a route to start, while teams above 50 users should weigh the annual paid term and contract option. It is less suited to buyers who need session recording or cannot use an active Cloudflare domain to publish a self-hosted public application.

Pros and cons

• Pros: Default-deny applications and per-resource policies support least-privilege access instead of blanket network permissions.
• Pros: Browser access with social identity or one-time PINs gives contractors and partners a clientless route in.
• Pros: API and Terraform administration can help teams centralize and scale policy management.
• Cons: Public self-hosted application publishing requires an active Cloudflare domain with full or partial CNAME setup.
• Cons: The free plan is limited to under 50 users, and the paid plan is billed annually.
• Cons: Session recording is not supported.

Alternatives

For readers comparing adjacent categories, see Zero Trust Network Access Software, Business VPN Software, Cloud Access Security Broker Software, SaaS Security Posture Management Software, Cloud Network Management Software, and SD-WAN Software.

D-Link Nuclias Cloud SD-WAN Gateway (DBG-2000) is an alternative to consider if you want a free-plan SD-WAN gateway product with Android, iOS, Linux, web, and Windows support; its listed one-year gateway license costs $111.99 a year.

flexiWAN may suit readers seeking a Linux, API, self-hosted, and web option with a free tier for 1–5 flexiEdge instances and a free trial.

Arista NG Firewall has a free plan with basic security and connectivity features, with limited capabilities.

Fortinet Secure SD-WAN is worth considering for basic SD-WAN functionality included on FortiGate models without an additional charge.

AccessOne is another paid option with web, Windows, macOS, Linux, iOS, and Android support.

Versa Zero Trust Network Access is a paid option with no free plan; its Essential plan covers 10 applications.

Cato Client is a paid alternative with a free trial and Android, iOS, Linux, macOS, and Windows support.

Bigleaf SD-WAN is another paid option with web support.

Verdict

Choose Cloudflare Access if your priority is resource-level zero-trust access for applications and infrastructure, with identity and device checks and a clientless path for outside users. Its strongest case is the combination of default-deny policies and flexible identity options; look elsewhere if the Cloudflare domain prerequisite, under-50 free cap, annual paid billing, or lack of session recording conflicts with your deployment.