With Cloudflare One, you can create Secure Web Gateway policies that filter outbound traffic down to the user identity level. To do that, you can build DNS, HTTP or Network policies using a set of identity-based selectors. These selectors require you to deploy the Cloudflare One Client in Traffic and DNS mode.
For example, you can create different security rules for different teams — block social media for contractors but allow it for marketing.
You may also filter outbound traffic based on additional signals from device posture checks.
Gateway checks identity when a user logs in or re-authenticates. To check your users' identities and require re-authentication at regular intervals, you can enforce a Cloudflare One Client session duration.
There are two ways a user can re-authenticate:
- Log out from an Access-protected application and log back in.
- In the Cloudflare One Client, re-authenticate the session by going to Profile > Account information > Re-authenticate 1. This will open a browser window and prompt the user to log in.
To view the identity that Gateway will use when evaluating policies, check the user registry.
Gateway will automatically detect changes in user name, title, and group membership for IdPs configured with System for Cross-domain Identity Management (SCIM) provisioning. For more information, refer to SCIM provisioning.
Extended email addresses (also known as plus addresses) are variants of an existing email address with + or . modifiers. Many email providers, such as Gmail and Outlook, deliver emails intended for an extended address to its original address. For example, providers will deliver emails sent to contact+123@example.com or con.tact@example.com to contact@example.com.
By default, Gateway will either filter only exact matches or all extended variants depending on the type of policy and action used:
DNS policies
| Action | Behavior |
|---|---|
| Allow | Match exact address only |
| Block | Match exact address and all variants |
| Override | Match exact address and all variants |
| Safe Search | Match exact address and all variants |
| YouTube Restricted | Match exact address and all variants |
Network policies
| Action | Behavior |
|---|---|
| Allow | Match exact address only |
| Audit SSH | Match exact address and all variants |
| Block | Match exact address and all variants |
| Network Override | Match exact address only |
HTTP policies
| Action | Behavior |
|---|---|
| Allow | Match exact address only |
| Block | Match exact address and all variants |
| Do Not Inspect | Match exact address only |
| Do Not Isolate | Match exact address only |
| Do Not Scan | Match exact address only |
| Isolate | Match exact address and all variants |
Other policies
| Policy type | Behavior |
|---|---|
| Egress policy | Match exact address only |
| Resolver policy | Match exact address only |
To force Gateway to match all email address variants, go to Traffic policies > Traffic settings > Policy settings and turn on Match extended email addresses. This setting applies to all firewall, egress, and resolver policies.
Specify a value from a custom OIDC claim configured on your identity provider.
| UI name | API example |
|---|---|
| OIDC Claims | any(identity.oidc_claims[*] == "\"department=engineering\"") |
Specify a value from the SAML Attribute Assertion.
| UI name | API example |
|---|---|
| SAML Attributes | identity.saml_attributes == "\"group=finance\"" |
Use this selector to create identity-based Gateway policies based on a user's email.
| UI name | API example value |
|---|---|
| User Email | identity.email == "user-name@company.com" |
Use this selector to create identity-based Gateway policies based on an IdP group ID of which the user is configured as a member in the IdP.
| UI name | API example |
|---|---|
| User Group IDs | identity.groups.id == "12jf495bhjd7893ml09o" |
Use this selector to create identity-based Gateway policies based on an IdP group email address of which the user is configured as a member in the IdP.
| UI name | API example |
|---|---|
| User Group Email | identity.groups.email == "contractors@company.com" |
Use this selector to create identity-based Gateway policies based on an IdP group name of which the user is configured as a member in the IdP.
| UI name | API example |
|---|---|
| User Group Names | identity.groups.name == "\"finance\"" |
Use this selector to create identity-based Gateway policies based on an IdP username for a particular user in the IdP.
| UI name | API example |
|---|---|
| User Name | identity.name == "user-name" |
Cloudflare Gateway can integrate with your organization's identity providers (IdPs). Before building a Gateway policy for IdP users or groups, be sure to add the IdP as an authentication method.
Because IdPs expose user groups in different formats, reference the list below to choose the appropriate identity-based selector.
| Selector | Value |
|---|---|
| User Group IDs | 61503835-b6fe-4630-af88-de551dd59a2 |
Value is the Object Id for an Entra group.
If you enabled user and group synchronization with SCIM, the synchronized groups will appear under User Group Names:
| Selector | Value |
|---|---|
| User Group Names | SCIM group |
| Selector | Value |
|---|---|
| User Group Names | Marketing |
| Selector | Value |
|---|---|
| User Group Names | Marketing |
If you added Okta as an OIDC provider, use the User Group Names selector:
| Selector | Value |
|---|---|
| User Group Names | Marketing |
The Okta OIDC integration supports user and group synchronization with SCIM.
If you added Okta as a SAML provider, use the SAML Attributes selector:
| Selector | Attribute name | Attribute value |
|---|---|---|
| SAML Attributes | groups |
Marketing |
For a generic SAML provider, use the SAML Attribute selector:
| Selector | Attribute name | Attribute value |
|---|---|---|
| SAML Attributes | department |
Marketing |
For a generic OIDC provider, use the OIDC Claims selector to filter traffic based on custom OIDC claims configured on your IdP:
| Selector | Claim name | Claim value |
|---|---|---|
| OIDC Claims | department |
Engineering |
-
In Cloudflare One Client version 2026.1 and earlier, select Preferences > Account > Re-Authenticate Session. ↩