Mind the gap: new tools for continuous enforcement from boot to login
Mar 4, 2026Alex Holland, Shahed El Baba, Yi Huang, Rhett Griggs

Summary
Introduces mandatory authentication for the Cloudflare One Client on Windows, which blocks all internet traffic by default until the user authenticates. This addresses the gap between client installation and user authentication, ensuring managed devices are accounted for. Additionally, it announces independent multi-factor authentication (MFA) for Cloudflare Access, acting as a secondary root of trust separate from the primary Identity Provider. This MFA supports biometrics, security keys (WebAuthn/FIDO2), and TOTP, and can be configured with granular policies for specific applications or user groups.