Require hard key auth with Cloudflare Access

This post details the implementation of a new rule in Cloudflare Access that allows administrators to enforce specific Multi-Factor Authentication (MFA) methods, such as hardware security keys (WebAuthn, FIDO2, Touch ID, Windows Hello), for accessing protected resources. This is achieved by leveraging the 'amr' (Authentication Method Reference) field within the JSON Web Token (JWT) generated by the identity provider and passed to Cloudflare Access. The system now checks this field to ensure that only users who authenticated with the required MFA method are granted access, preventing fallback to less secure methods like TOTP or SMS.