'%3e%3crect%20x='16'%20y='51'%20width='68'%20height='27'%20rx='13.5'/%3e%3ccircle%20cx='32'%20cy='53'%20r='15'/%3e%3ccircle%20cx='53'%20cy='43'%20r='20'/%3e%3ccircle%20cx='71'%20cy='57'%20r='12'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Cloud Changelog
Access changelog
71 announcements since January 2025 · 1 GA · 2 previews
Free. One email a day, only on days when something you follow has an announcement, or one a week if you switch it in your preferences. You confirm your email with a one-time code; there is no password.
November 20261
October 20268
Inspect users and groups provisioned by each identity provider, with search and delete
User provisioning and deprovisioning from Google Workspace to Cloudflare One via generic SAML
HTML and Liquid templates for login, identity-denied, forbidden and command-line approval pages
App-aware redirects include an account_id query parameter when account context is available
Configurable session duration, default 24 hours, closes active SSH connections when it elapses
New setting returns 401 or 403 on failure and accepts only Service Auth policies
Inline target tagging now needs only Zero Trust Write token permission
September 20266
One endpoint for approved MCP servers, with Access logging of tool, prompt and resource activityGA
Adds prompt controls and device-scoped, domain-matched login hints
Portals can connect to MCP servers on private networks through Cloudflare Gateway
Inactive tokens can be disabled or deleted automatically after 30 to 365 days
Supports tagged targets and include, require and exclude target criteria matching hostname or tag
Option requests fresh authentication from the SAML identity provider on every login
August 20269
New Client Secrets use scannable cfast_ format with checksum; existing secrets keep working
Rotation supports grace periods from one hour to 30 days, with both secrets valid
Members with only resource-scoped roles can list resources limited to their policy scopes
Access can protect one Worker or all Workers, with ctx.access identity and local testing
Infrastructure applications accept FIDO2 SSH keys, PIV keys, or both for MFA
Integrates with Access for gateway protection and per-user spend limits, logs and routing
July 20267
Supports static OAuth client credentials for upstream servers without Dynamic Client Registration
Four Code Mode policies: Off, Opt-in, On by default, Enforced; allow_code_mode deprecated
Plaintext HTTP private apps on port 80 now use the standard browser login flow
Multiple PDFs can be printed as a single print job from the clipboard panel
Fixes post-login redirects that mangled URL fragment characters in single-page applications
Independent MFA for SSH connections using YubiKey PIV keys, configurable per application and policy
June 20264
Access service tokens let bots and agents connect without browser-based OAuth
Cloudflare identity provider is the default login method for new Zero Trust organizations
One identity provider can be shared across multiple Cloudflare accounts from a source account
SAML assertion encryption for identity providers with automatic certificate generation and rotation
May 20263
April 20265
Adds AAGUID authenticator restrictions and AMR matching to skip repeat MFA prompts
Portals show a homepage with endpoint URL and connection instructions, plus a Sign out button
Independent MFA per application and policy, without relying on the identity provider
In-session management to enable, disable or reauthenticate upstream MCP servers from the MCP client
Refreshed log viewer adds field filters, customizable columns and detail view
March 20266
Single code execution tool replaces individual tool definitions, on by default on all portals
minimize_tools and search_and_execute options cut tool definition token usage, up to 5x savings
Portal traffic can route through Gateway for HTTP logging and DLP scanning
New selector lets Access policies use risk scores such as impossible travel and DLP matches
Adds per-policy clipboard controls for browser-based RDP, denied by default for new policies