Only healthy devices reach your apps.
Cloudflare Zero Trust, wired into your Entra ID and Intune.
Access log for finance.example.com
Rule: Entra ID sign-in with MFA, on an Intune-compliant device identified by WARP.
| Time | Who | Sign-in | Device | Result |
|---|---|---|---|---|
| 09:02 | a.lee@example.com | MFA passed | Compliant | Allowed |
| 09:05 | j.chen@example.com | MFA passed | Patch overdue | Blocked |
| 09:11 | k.ng@example.com | MFA passed | Compliant | Allowed |
| 09:14 | guest@partner.example | MFA passed | Not managed | Blocked |
| 09:20 | r.patel@example.com | No MFA | Compliant | Blocked |
How to read the log
Each column is one check, made at the Cloudflare edge.
Sign-in
Entra ID with MFA. One identity for Microsoft and Cloudflare.
Device
WARP says which device it is. Intune says if it’s healthy.
Result
One rule per app. Every answer is logged.
Five pieces, wired to your tenant
- Access and Gateway
- Entra ID sign-in. Rules follow each person.
- WARP device posture
- Intune compliance checked for each device WARP identifies.
- Data loss prevention
- What data may leave managed apps.
- Edge protection
- WAF, DDoS and bot rules for your sites.
- DNS, Pages and Workers
- Your domains and sites. This site and Orbit ITSM run there too.
Map your tenant on a first call
Your apps, your devices and who needs what. Then a plan.