Define device enrollment permissions

In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles > Management.

In Device enrollment > Device enrollment permissions, select Manage.

In the Policies tab, configure one or more Access policies to define who can join their device. For example, you could allow all users with a company email address:

In the Login methods tab:

a. Select the identity providers users can authenticate with. If you have not integrated an identity provider, you can use the one-time PIN.

b. (Optional) If you plan to only allow access via a single IdP, turn on Apply instant authentication. End users will not be shown the Cloudflare Access login page. Instead, Cloudflare will redirect users directly to your SSO login event.

Select Save.

Add the following permission to your cloudflare_api_token ↗:

• Access: Apps and Policies Write

Create a reusable Access policy using the cloudflare_zero_trust_access_policy ↗ resource:

resource "cloudflare_zero_trust_access_policy" "allow_company_emails" {
	account_id   = var.cloudflare_account_id
	name         = "Allow company emails"
	decision     = "allow"
	include      = [
		{
			email_domain = {
				domain = "@example.com"
			}
		}
	]
}

Use the cloudflare_zero_trust_access_application ↗ resource to create an application with type warp.

resource "cloudflare_zero_trust_access_application" "device_enrollment" {
	account_id       = var.cloudflare_account_id
	type             = "warp"
	name             = "Warp device enrollment"
	allowed_idps              = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id]
	auto_redirect_to_identity = true
	app_launcher_visible      = false
	policies = [
		{
			id = cloudflare_zero_trust_access_policy.allow_company_emails.id
			precedence = 1
		}
	]
}

In the Cloudflare dashboard ↗, go to Zero Trust > Access controls > Service credentials > Mutual TLS.

Select Add mTLS Certificate.

Enter any name for the root CA.

In Certificate content, paste the contents of your root CA.

If the client certificate is directly signed by the root CA, you only need to upload the root. If the client certificate is signed by an intermediate certificate, you must upload the entire CA chain (intermediate and root). For example:

-----BEGIN CERTIFICATE-----
<intermediate.pem>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<rootCA.pem>
-----END CERTIFICATE-----

In Associated hostnames, enter your Zero Trust team domain: <team-name>.cloudflareaccess.com

In your device enrollment permissions, add a Common Name or Valid Certificate rule. For example, the following policy requires a client certificate with a specific common name:

On your device, add the client certificate to the system keychain.

Add the following permissions to your cloudflare_api_token ↗:

• Access: Mutual TLS Certificates Write
• Access: Apps and Policies Write

Use the cloudflare_zero_trust_access_mtls_certificate ↗ resource to add an mTLS certificate to your account:

resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" {
	account_id     = var.cloudflare_account_id
	name           = "WARP enrollment mTLS cert"
	certificate    = <<EOT
	-----BEGIN CERTIFICATE-----
	xxxx
	xxxx
	-----END CERTIFICATE-----
	EOT
	associated_hostnames = ["your-team-name.cloudflareaccess.com"]
}

Create the following Access policy:

resource "cloudflare_zero_trust_access_policy" "warp_enrollment_mtls" {
	account_id     = var.cloudflare_account_id
	name           = "Allow employees with mTLS cert"
	decision       = "allow"
	include = [
		{
			email_domain = {
				domain = "@example.com"
			}
		}
	]

	require = [
		{
			common_name = {
				common_name = "Common name 1"
			}
		},
				{
			common_name = {
				common_name = "Common name 2"
			}
		}
	]
}

Add the policy to your cloudflared_zero_trust_access_application for the Cloudflare One Client.

On your device, add the client certificate to the system keychain.