Cloudflare Zero Trust — Onboarding Guide (START HERE)

Welcome 👋 This is a follow-along onboarding guide. If you work through the modules in order and do exactly what each step says, you will have a working Cloudflare Zero Trust deployment at the end — account, identity, devices, private-app access, web filtering, data protection, AI controls, and (optionally) site connectivity with Cloudflare WAN.

You do not need prior Cloudflare experience. Each step tells you what to click, what to type, and how to confirm it worked before moving on.

How this guide works

The onboarding is split into 9 modules. Do them in order — each one builds on the previous.

💡 You can stop after any module and still have something useful. Many customers do Modules 1–3 in week one (identity + devices), add Access (4) and Gateway (5) in week two, and layer DLP/AI/Cloudflare WAN later.

Symbols used in every module

Before you start: the big picture (2-minute read)

Cloudflare Zero Trust replaces the old "castle and moat" model (VPN + firewall) with check every request, trust nothing by default. Here's how the pieces fit together:

   Your people & devices                 CLOUDFLARE (runs in 330+ cities)            Where they're going
   ┌──────────────────┐      connect      ┌─────────────────────────────────┐
   │ Laptop + WARP app │ ───────────────► │ 1. Who are you?   (Identity)     │ ──► The internet
   │ Phone  + WARP app │                   │ 2. Is your device safe? (Posture)│ ──► SaaS apps (M365…)
   │ Office (Cloudflare WAN)│                   │ 3. Can you reach this app?(Access)│ ──► Your private apps
   └──────────────────┘                   │ 4. Is this site safe?  (Gateway) │     (via Tunnel)
                                           │ 5. Any sensitive data?   (DLP)   │
                                           │ 6. Safe AI use?      (AI controls)│
                                           └─────────────────────────────────┘

• Identity (Module 2): Cloudflare asks your existing company login "who is this?"
• Device + WARP (Module 3): the WARP app is the secure "on-ramp" that carries traffic to Cloudflare and reports if the device is healthy.
• Access / ZTNA (Module 4): lets the right people reach specific private apps — no VPN.
• Gateway (Module 5): filters DNS and web traffic, blocking malware/phishing and enforcing your acceptable-use rules.
• DLP (Module 6) + AI controls (Module 7): stop sensitive data leaving and govern AI tools.
• Cloudflare WAN (Module 8): connects whole offices/data centers to Cloudflare so even non-laptop traffic is protected.

What you need before Module 1 (prerequisites checklist)

Gather these now so you're not interrupted later.

Accounts & access

• [ ] A work email you can receive mail at (to create/verify the Cloudflare account)
• [ ] Admin access to your identity provider (Microsoft Entra ID / Okta / Google Workspace) — you'll register an app there in Module 2
• [ ] Admin access to your device management (MDM) tool if you have one (Intune, Jamf, Kandji, Workspace ONE) — for Module 3 at scale
• [ ] A credit card or billing details (required even on the free plan)

Decisions to make (write these down)

• [ ] Team name — a short, permanent nickname for your org (e.g. acme). It becomes your login URL https://acme.cloudflareaccess.com. ⚠️ Hard to change later — pick carefully.
• [ ] Pilot group — 5–25 friendly users (often IT/security) to test with before company-wide rollout
• [ ] First private app to protect with Access (Module 4) — e.g. an internal wiki, Grafana, a dev tool
• [ ] Plan tier — Free / Pay-as-you-go / Enterprise (see below)

Technical (only if doing Modules 4 & 8)

• [ ] A server/VM that can reach your private app (for Cloudflare Tunnel in Module 4)
• [ ] Router/firewall admin access at each site (for Cloudflare WAN in Module 8)

Which plan do I need?

💡 You can start on Free to learn the platform (Modules 1–5), then upgrade. If you already bought Enterprise / Cloudflare WAN, confirm it's active before Modules 6–8 or the relevant settings will be greyed out. Not sure? Ask your Cloudflare account team.

Roles: who should do what

You can do everything yourself, but in larger orgs these tasks often split across teams:

⭐ Golden rule for the whole onboarding: pilot → verify → expand. Never push a new rule to everyone at once. Test with your pilot group, confirm it works, then widen it. Every module follows this pattern.

The 8 habits that make this go smoothly

1. Do modules in order. Identity before devices, devices before filtering.
2. Pilot first, always. 5–25 users before company-wide.
3. Start in "monitor/log" mode, then switch to "block." (Especially Gateway, DLP, AI.)
4. Keep a backup admin login. Always have a second Super Administrator so a misconfigured policy can't lock you out.
5. Install the Cloudflare certificate before turning on HTTPS inspection (Module 3 → 5), or websites will break.
6. Write down your team name and keep it consistent — it's in every login URL.
7. Turn on logging early so you can see what's happening and tune rules.
8. Reuse, don't repeat. Build reusable groups/lists once and apply them everywhere (you'll learn how in Module 4).

Master onboarding checklist (track your progress)

Copy this and tick items off as you complete each module.

PHASE 1 — FOUNDATION
[ ] M1  Cloudflare account created + Zero Trust activated
[ ] M1  Team name set (________________.cloudflareaccess.com)
[ ] M1  Second Super Admin added (break-glass)
[ ] M2  Identity provider connected and TEST passes (shows email + groups)
[ ] M2  (Recommended) SCIM / auto-sync enabled
[ ] M3  Device enrollment rule created
[ ] M3  Cloudflare One Client installed on a pilot device, shows "Connected"
[ ] M3  Cloudflare certificate distributed to devices
[ ] M3  At least one device posture check working

PHASE 2 — ACCESS & FILTERING
[ ] M4  First private app published via Cloudflare Tunnel
[ ] M4  Access policy allows the right people, blocks others
[ ] M5  DNS filtering blocking malware/phishing
[ ] M5  TLS (HTTPS) decryption on for pilot group, websites still work
[ ] M5  HTTP policy enforcing acceptable use

PHASE 3 — DATA, AI, NETWORK (as licensed)
[ ] M6  DLP profile in monitor mode, detections visible
[ ] M6  DLP block policy live on high-risk destinations
[ ] M7  Shadow-AI usage reviewed
[ ] M7  AI prompt protection / app controls enforced
[ ] M8  Cloudflare WAN tunnels healthy, sites connected, failover tested

GO-LIVE
[ ] Logs flowing to your SIEM
[ ] Pilot validated, rollout expanded company-wide
[ ] Old VPN decommissioned for migrated apps

Key terms (plain-English glossary)

Ready?

👉 Go to Module 1 — Account setup and let's begin.

📚 Looking for the "why" behind the choices? Two companion documents explain strategy and give a settings cheat-sheet:

• Implementation & Best-Practice Guide (the reasoning, phasing, golden rules)
• Configuration Runbook (a quick field-by-field reference)

Guide prepared 2026-06-09 from current Cloudflare documentation. Cloudflare updates the dashboard often — if a menu label differs slightly, use the nearest match. Verify plan entitlements before Modules 6–8.