Demo library › Chapter 1
Single sign-on and per-application access
Single sign-on, groups imported from the identity provider, and access to each application decided by Zero Trust policy.
The problem
Before anyone believes you can replace their VPN or protect their data, they need to see that you know who their people are. Horizon Inc has thirty employees and contractors, and its identity provider is the source of truth.
Lands with: every audience - run it first
Before you start
- Signed in to the Cloudflare dashboard.
- Private browser windows for
,and. Password:Savetheinternet!1.
Run it
Where identity comes from
| Do | Say |
|---|---|
| Zero Trust → Settings → Authentication → the FlareID login method. | Sign-in uses the company's identity provider over OIDC, and its groups arrive by SCIM. When HR changes something, access changes with it. |
| Open FlareID's admin → Groups → All Employees. | This group is a rule, not a list: everyone whose employment type is full time. Contractors are left out automatically. |
Whybackground, if you are asked
Cloudflare does not keep its own list of people. Groups come from the identity provider, so nobody has to remember to add a new starter or remove a leaver. The All Employees rule puts 26 people in and leaves the 4 contractors out without anyone maintaining it.
Access per application
| Do | Say |
|---|---|
| Access controls → Applications → Ledger (Finance) → its policy. | Each application has its own policy. Ledger allows the Executives group only. |
| As Alice, open the App Launcher. Then as Rickie. | Alice works in Marketing, so Ledger is not in her launcher. Rickie is an Executive, so it is in his. |
| As Alice, go to Ledger's address directly. | Access refuses her before the application sees the request. |
| As Ramona, open any of the five apps. | She signs in, but she is a contractor, so the employee policies refuse her. Contractors get their own access - see the contractors chapter. |
Whybackground, if you are asked
Ledger holds the board pack and payroll, so it is the clearest example. The point is that access is decided per application, not per network: knowing the address does not help, and an app you are not entitled to is not in your launcher at all.
What the audience should see
- Ledger missing from Alice's launcher, and present in Rickie's.
- Alice refused at Ledger with an Access page, not an application error.
- Ramona signing in, then refused by the employee apps.
Where the evidence is
Insights → Logs → Access authentication, filtered to Alice: the refused request to Ledger and the policy that decided it.
Known limitations
FlareID is a demo identity provider. The same works with any OIDC or SAML provider.
Part of: The whole of Cloudflare One · Replace the VPN · The full tour