Connecting Entra ID to Cloudflare Access

Why

Before you start

• Global Administrator or Application Administrator role in Entra ID
• Access to the Cloudflare Zero Trust dashboard (one.dash.cloudflare.com)
• Your Cloudflare team domain — found in Zero Trust → Settings → Custom Pages (looks like stellarai.cloudflareaccess.com)

Part 1 — Register the app in Entra ID

1. Sign in to portal.azure.com with your admin account. In the top search bar type Microsoft Entra ID and open it.

2. In the left sidebar choose App registrations, then click + New registration.

   • Name: Cloudflare Zero Trust (or your preferred label)
   • Supported account types: Accounts in this organizational directory only (single tenant)
   • Redirect URI: Web → paste the URL below

   Redirect URI

   https://stellarai.cloudflareaccess.com/cdn-cgi/access/callback

   Click Register.

3. On the Overview page that appears, copy and save both values — you will need them in Part 2:

   Application (client) ID

   xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

   Directory (tenant) ID

   xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

4. In the left sidebar choose Certificates & secrets → + New client secret.

   • Description: Cloudflare Access
   • Expires: choose your org's standard rotation period

   Click Add.

   Copy now The secret Value is shown only once. Copy it immediately and store it in your secrets manager before navigating away.

5. Go to API permissions → + Add a permission → Microsoft Graph → Delegated permissions.

   Search for and add each of these:

   • email
   • openid
   • profile
   • User.Read

   Optional — group-based policies If you want to use Entra security groups inside Cloudflare Access policies, also add Directory.Read.All (Application permission). This requires admin consent and allows Cloudflare to read group membership.

   Click Grant admin consent for [your org] → Yes.

Part 2 — Add Entra ID as a login method in Cloudflare

1. Open one.dash.cloudflare.com, select your account, and navigate to Settings → Authentication → Login methods.

2. Click + Add new and choose Azure AD (Cloudflare's label for Entra ID).

3. Fill in the form using the values you saved in Part 1:

   • Name: Entra ID (displayed to users on the login screen)
   • App ID: Application (client) ID from step 3
   • Client secret: secret Value from step 4
   • Directory ID: Directory (tenant) ID from step 3

   If you granted Directory.Read.All in step 5, toggle Support groups on.

4. Click Test. A new browser tab opens with a Microsoft login prompt. Sign in with a regular employee account.

   Success looks like "Your connection is working" — Cloudflare shows the authenticated user's email. Close the test tab and return.

   If the test fails Double-check the redirect URI in Entra exactly matches your team domain, and confirm admin consent was granted in step 5.

5. Click Save.

Part 3 — Apply to Access applications

1. Go to Access → Applications, open an existing app (or create a new one).

2. On the app's Authentication tab, under Identity providers, select Entra ID (the name you set in Part 2, step 3) and deselect any providers you no longer want.

3. In the app's Policies tab, you can now write rules using Entra attributes, for example:

   • Emails ending with @getstellar.ai
   • Members of a specific Entra security group (requires groups toggle from Part 2)

4. Click Save application and test access with an end-user account.

Ongoing maintenance

• Secret rotation: When the client secret expires, create a new one in Entra (step 4), update the value in Cloudflare (Part 2, step 3), then delete the old secret in Entra.
• New employees: No action needed — they inherit access via Entra group membership and existing policies.
• Offboarding: Disabling or deleting the user in Entra revokes Cloudflare Access on next token refresh (typically within minutes).