--- title: Cloudflare One Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) Cloudflare One ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Apr 09, 2026 1. ### [Send CASB posture finding instances with webhooks](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-09-casb-webhooks/) [ CASB ](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/) You can now use **CASB webhooks** in Cloudflare One to send posture finding instances to external systems such as chat platforms, ticketing systems, SIEMs, SOAR tools, and custom automation services. This gives security teams a simple way to route CASB posture findings into the tools and workflows they already use for triage and response. To get started, go to **Integrations** \> **Webhooks** in the Cloudflare One dashboard to create a webhook destination. After you configure a webhook, open a posture finding instance and select **Send webhook** to send it. #### Key capabilities * **Flexible authentication** — Configure destinations using **None**, **Basic Auth**, **Bearer Auth**, **Static Headers**, or **HMAC-Signing**. * **Built-in testing** — Use **Test delivery** to send a test request before sending a live finding instance. * **Posture finding workflows** — Send posture finding instances directly from the finding details workflow in **Cloud & SaaS findings**. * **HTTPS destinations** — Configure webhook destinations with public `https://` URLs. #### Learn more * Configure [CASB webhooks](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/cloud-and-saas/webhooks/) in Cloudflare. * Learn how to [manage findings](https://edgetunnel-b2h.pages.dev/cloudflare-one/cloud-and-saas-findings/manage-findings/) in Cloudflare. CASB webhooks are now available in Cloudflare One. Apr 08, 2026 1. ### [User risk scoring for high risk browsing activity](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-08-high-risk-browsing/) [ Risk Score ](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/risk-score/) Cloudflare One's **User Risk Scoring** now incorporates direct signals from **Gateway DNS traffic patterns**. This update allows security teams to automatically elevate a user's risk score when they visit high-risk or malicious domains, providing a more holistic view of internal threats. #### Why this matters Browsing activity is a primary indicator of potential compromise. By tying Gateway DNS logs to specific users, administrators can now flag individuals interacting with: * **Security threats**: Domains associated with malware, phishing, or command-and-control (C2) centers. * **High-risk content**: Categories such as questionable content or violence that may violate corporate compliance. Even if a Gateway policy is set to **Block** the traffic, the interaction is still captured as a "hit" to ensure the user's risk profile reflects the attempted activity. #### New risk behaviors Two new behaviors are now available in the dashboard: * **Suspicious Security Domain Visited**: Triggers when a user visits a domain in the security threats or security risk categories. * **High risk domain visited**: Triggers when a user visits domains categorized as questionable content, violence, or CIPA. To learn more and get started, refer to the [User Risk Scoring documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/risk-score/). Apr 07, 2026 1. ### [Cloudflare One Client for Windows (version 2026.3.851.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-07-warp-windows-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Windows Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for Windows will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** * Fixed an issue causing Windows client tunnel interface initialization failure which prevented clients from establishing a tunnel for connection. * Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. * Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. * Added monitoring for tunnel statistics collection timeouts. * Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. * Fixed packet capture failing on tunnel interface when the tunnel interface is renamed by SCCM VPN boundary support. * Fixed unnecessary registration deletion caused by RDP connections in multi-user mode. * Fixed increased tunnel interface start-up time due to a race between duplicate address detection (DAD) and disabling NetBT. * Fixed tunnel failing to connect when the system DNS search list contains unexpected characters. * Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. * Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. * Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. * Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. * Fixed an issue where degraded Windows Management Instrumentation (WMI) state could put the client in a failed connection state loop during initialization. **Known issues** * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. This warning will be omitted from future release notes. This Windows update was released in July 2025. * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. This warning will be omitted from future release notes. This Microsoft Security Intelligence update was released in May 2025. * DNS resolution may be broken when the following conditions are all true: * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Apr 07, 2026 1. ### [User Submission Triage Status Tracking](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-07-triage-status-tracking/) [ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/) Cloudflare Email security now supports **Triage Status Tracking for User Submissions**. This enhancement gives SOC teams a streamlined way to track, manage, and prioritize user-submitted emails directly within the Cloudflare One dashboard. * The User Submissions table now includes a **Status** column with three states: **Unreviewed** (new submissions awaiting triage), **Reviewed** (submissions assessed by the SOC team), and **Escalated** (submissions escalated to team submissions for further investigation). Analysts can quickly update statuses and filter the table to focus on what needs attention. * SOC teams can now organize their triage workflows, avoid duplicate reviews, and make sure critical threats get escalated for deeper investigation—bringing order to the chaos of high-volume submission management. Triage Status Tracking is **automatically available** for all Email security customers using the user submissions feature. No additional configuration is required; customers just need to make sure user submissions are being sent to their user submission aliases. This applies to all Email security packages: * **Advantage** * **Enterprise** * **Enterprise + PhishGuard** Apr 07, 2026 1. ### [Link aggregation (LACP) support for Cloudflare One Appliance](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-07-link-aggregation-lacp-appliance/) [ Cloudflare One Appliance ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) Cloudflare One Appliance now supports Link Aggregation Control Protocol (LACP), allowing you to bundle up to six physical LAN ports into a single logical interface. Link aggregation increases available bandwidth and eliminates single points of failure on the LAN side of the appliance. This feature is available in beta on physical appliance hardware with the latest OS. No entitlement is required. To configure a Link Aggregation Group, refer to [Configure link aggregation groups](https://edgetunnel-b2h.pages.dev/cloudflare-wan/configuration/appliance/network-options/link-aggregation/). Apr 06, 2026 1. ### [DANE Support for MX Deployments](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-06-dane-support-mx-deployments/) [ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/) Cloudflare Email Security now supports DANE (DNS-based Authentication of Named Entities) for MX deployments. This enhancement strengthens email transport security by enabling DNSSEC-backed certificate verification for our regional MX records. * Regional MX hostnames now publish DANE TLSA records backed by DNSSEC, enabling DANE-capable SMTP senders to cryptographically validate certificate identities before establishing TLS connections—moving beyond opportunistic encryption to verified encrypted delivery. * DANE support is automatically available for all customers using regional MX deployments. No additional configuration is required; DANE-capable mail infrastructure will automatically validate MX certificates using the published records. This applies to all Email Security packages: * **Advantage** * **Enterprise** * **Enterprise + PhishGuard** Apr 06, 2026 1. ### [Organizations is now in public beta for enterprises](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-06-organizations-public-beta/) [ Cloudflare Fundamentals ](https://edgetunnel-b2h.pages.dev/fundamentals/)[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) We're announcing the public beta of **Organizations** for enterprise customers, a new top-level Cloudflare container that lets Cloudflare customers manage multiple accounts, members, analytics, and shared policies from one centralized location. **What's New** **Organizations \[BETA\]**: [Organizations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/) are a new top-level container for centrally managing multiple accounts. Each Organization supports up to 500 accounts and 5000 zones, giving larger teams a single place to administer resources at scale. **Self-serve onboarding**: Enterprise customers can [create an Organization](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/setup/) in the dashboard and assign accounts where they are already Super Administrators. **Centralized Account Management**: At launch, every Organization member has the Organization Super Admin role. Organization Super Admins can invite other users and manage any child account under the Organization implicitly. **Shared policies**: Share [WAF](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) or [Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/tiered-policies/organizations/) policies across multiple accounts within your Organization to simplify centralized policy management. **Implicit access**: Members of an Organization automatically receive Super Administrator permissions across child accounts, removing the need for explicit membership on each account. Additional Org-level roles will be available over the course of the year. **Unified analytics**: View, filter, and download aggregate HTTP analytics across all Organization child accounts from a single dashboard for centralized visibility into traffic patterns and security events. **Terraform provider support**: Manage Organizations with infrastructure as code from day one. Provision organizations, assign accounts, and configure settings programmatically with the [Cloudflare Terraform provider ↗](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/organization). **Shared policies**: Share [WAF](https://edgetunnel-b2h.pages.dev/waf/custom-rules/) or [Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) policies across multiple accounts within your Organization to simplify centralized policy management. Note Organizations is in Public Beta. You must have an Enterprise account to create an organization, but once created, you can add accounts of any plan type where you are a Super Administrator. For more info: * [Get started with Organizations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/) * [Set up your Organization](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/setup/) * [Review limitations](https://edgetunnel-b2h.pages.dev/fundamentals/organizations/limitations/) Apr 02, 2026 1. ### [Cloudflare One Client for macOS (version 2026.3.846.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-02-warp-macos-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the macOS Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for macOS will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** * Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. * Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. * Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. * Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. * Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. * Added monitoring for tunnel statistics collection timeouts. * Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. * Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. Apr 02, 2026 1. ### [Cloudflare One Client for Linux (version 2026.3.846.0)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-02-warp-linux-ga/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new GA release for the Linux Cloudflare One Client is now available on the [stable releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/). This release contains minor fixes and improvements. The next stable release for Linux will introduce the new Cloudflare One Client UI, providing a cleaner and more intuitive design as well as easier access to common actions and information. **Changes and improvements** * Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. * Fixed an issue in local proxy mode where the client could become unresponsive due to upstream connection timeouts. * Fixed an issue where the emergency disconnect status of a prior organization persisted after a switch to a different organization. * Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. * Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. * Added monitoring for tunnel statistics collection timeouts. * Switched tunnel congestion control algorithm for local proxy mode to Cubic for improved reliability across platforms. * Fixed initiating managed network detections checks when no network is available, which caused device profile flapping. Apr 02, 2026 1. ### [Session management for MCP server portals](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-02-mcp-portal-session-management/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) support in-session management of upstream MCP server connections. Users can return to the server selection page at any time to enable or disable servers, reauthenticate, or change which data a server has access to — all without leaving their MCP client. To return to the server selection page, ask your AI agent with a prompt like "take me back to the server selection page." The portal responds with an authorization URL via [MCP elicitation ↗](https://modelcontextprotocol.io/specification/2025-03-26/server/elicitation) that you open in your browser: ```txt https://./authorize?elicitationId= ``` From the server selection page you can: * **Enable or disable servers** — Toggle individual upstream MCP servers on or off. Disabling a server removes its tools from the active session, which reduces context window usage. * **Log out and reauthenticate** — Log out of a server and log back in to change which data the server has access to, or to reauthenticate with different permissions. Users can also enable or disable a server inline by asking their AI agent directly, for example "enable the wiki server" or "disable my Jira server." The portal also automatically prompts connected users to authorize new servers when an admin adds them to the portal. This requires the use of [managed OAuth](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/managed-oauth/#enable-managed-oauth-on-an-mcp-server-portal). For more information, refer to [Manage portal sessions](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#manage-portal-sessions). Apr 01, 2026 1. ### [Logs UI refresh](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-01-logs-ui-refresh/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/)[ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) Access authentication logs and Gateway activity logs (DNS, Network, and HTTP) now feature a refreshed user interface that gives you more flexibility when viewing and analyzing your logs. ![Screenshot of the new logs UI showing DNS query logs with customizable columns and filtering options](https://edgetunnel-b2h.pages.dev/_astro/cf1-new-logs-ui.DxF4x0l-_mRSyH.webp) The updated UI includes: * **Filter by field** \- Select any field value to add it as a filter and narrow down your results. * **Customizable fields** \- Choose which fields to display in the log table. Querying for fewer fields improves log loading performance. * **View details** \- Select a timestamp to view the full details of a log entry. * **Switch to classic view** \- Return to the previous log viewer interface if needed. For more information, refer to [Access authentication logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/access-authentication-logs/) and [Gateway activity logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). Mar 26, 2026 1. ### [Code Mode for MCP server portals](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-26-mcp-portal-code-mode/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) support [Code Mode MCP server patterns](https://edgetunnel-b2h.pages.dev/agents/model-context-protocol/codemode/), a technique that reduces context window usage by replacing individual tool definitions with a single code execution tool. Code Mode is turned on by default on all portals. To turn it off, edit the portal in **Access controls** \> **AI controls** and turn off **Code Mode** under **Basic information**. When Code Mode is active, the portal exposes a single `code` tool instead of listing every tool from every upstream MCP server. The connected AI agent writes JavaScript that calls typed `codemode.*` methods for each upstream tool. The generated code runs in an isolated [Dynamic Worker](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/bindings/worker-loader/) environment, keeping authentication credentials and environment variables out of the model context. To use Code Mode, append `?codemode=search_and_execute` to your portal URL when connecting from an MCP client: ```txt https://./mcp?codemode=search_and_execute ``` For more information, refer to [Code Mode](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#code-mode). Mar 26, 2026 1. ### [Context optimization for MCP server portals](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-26-mcp-portal-context-optimization/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) support two context optimization options that reduce how many tokens tool definitions consume in the model's context window. Both options are activated by appending the `optimize_context` query parameter to the portal URL. #### `minimize_tools` Strips tool descriptions and input schemas from all upstream tools, leaving only their names. The portal exposes a special `query` tool that agents use to retrieve full definitions on demand. This provides up to 5x savings in token usage. ```txt https://./mcp?optimize_context=minimize_tools ``` #### `search_and_execute` Hides all upstream tools and exposes only two tools: `query` and `execute`. The `query` tool searches and retrieves tool definitions. The `execute` tool runs the upstream tools in an isolated [Dynamic Worker](https://edgetunnel-b2h.pages.dev/workers/runtime-apis/bindings/worker-loader/) environment. This reduces the initial token cost to a small constant, regardless of how many tools are available through the portal. ```txt https://./mcp?optimize_context=search_and_execute ``` For more information, refer to [Optimize context](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#optimize-context). Mar 26, 2026 1. ### [Streaming ZIP file scanning removes per-file size limits](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-26-streaming-zip-handler/) [ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) DLP now processes ZIP files using a streaming handler that scans archive contents element-by-element as data arrives. This removes previous file size limitations and improves memory efficiency when scanning large archives. Microsoft Office documents (DOCX, XLSX, PPTX) also benefit from this improvement, as they use ZIP as a container format. This improvement is automatic — no configuration changes are required. Mar 25, 2026 1. ### [Detect and sanitize HAR files](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-25-har-file-detection-and-sanitization/) [ Data Loss Prevention ](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/) HTTP Archive (HAR) files are used by engineering and support teams to capture and share web traffic logs for troubleshooting. However, these files routinely contain highly sensitive data — including session cookies, authorization headers, and other credentials — that can pose a significant risk if uploaded to third-party services without being reviewed or cleaned first. Gateway now includes a predefined DLP profile called **Unsanitized HAR** that detects HAR files in HTTP traffic. You can use this profile in a Gateway HTTP policy to either block HAR file uploads entirely or redirect users to a sanitization tool before allowing the upload to proceed. #### How to configure a HAR file policy In the [Cloudflare dashboard ↗](https://dash.cloudflare.com/), go to **Zero Trust** \> **Traffic policies** \> **Firewall Policies** \> **HTTP** and create a new HTTP policy using the **DLP Profile** selector: | Selector | Operator | Value | Action | | ----------- | -------- | ----------------- | ------ | | DLP Profile | in | _Unsanitized HAR_ | | Then choose one of the following actions: * **Block**: Prevents the upload of any HAR file that has not been sanitized by Cloudflare's sanitizer. Use this for strict environments where HAR file sharing must be disallowed entirely. * **Block** with **Gateway Redirect**: Intercepts the upload and redirects the user to `https://har-sanitizer.pages.dev/`, where they can sanitize the file. Once sanitized, the user can re-upload the clean file and proceed with their workflow. #### Sanitized HAR recognition HAR files processed by the Cloudflare HAR sanitizer receive a tamper-evident sanitized marker. DLP recognizes this marker and will not re-trigger the policy on a file that has already been sanitized and has not been modified since. If a previously sanitized file is edited, it will be treated as unsanitized and flagged again. #### Visibility in Gateway logs Gateway logs will reflect whether a detected HAR file was classified as **Unsanitized** or **Sanitized**, giving your security team full visibility into HAR file activity across your organization. For more information, refer to [predefined DLP profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/). Mar 24, 2026 1. ### [OIDC Claims filtering now available in Gateway Firewall, Resolver, and Egress policies](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-24-oidc-claims-filtering-gateway-policies/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) Cloudflare Gateway now supports [OIDC Claims](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/identity-selectors/#oidc-claims) as a selector in Firewall, Resolver, and Egress policies. Administrators can use custom OIDC claims from their identity provider to build fine-grained, identity-based traffic policies across all Gateway policy types. With this update, you can: * Filter traffic in [DNS](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/dns-policies/), [HTTP](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/http-policies/), and [Network](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/network-policies/) firewall policies based on OIDC claim values. * Apply custom [resolver policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/resolver-policies/) to route DNS queries to specific resolvers depending on a user's OIDC claims. * Control [egress policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/egress-policies/) to assign dedicated egress IPs based on OIDC claim attributes. For example, you can create a policy that routes traffic differently for users with `department=engineering` in their OIDC claims, or restrict access to certain destinations based on a user's role claim. To get started, configure [custom OIDC claims](https://edgetunnel-b2h.pages.dev/cloudflare-one/integrations/identity-providers/generic-oidc/#custom-oidc-claims) on your identity provider and use the **OIDC Claims** selector in the Gateway policy builder. For more information, refer to [Identity-based policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/identity-selectors/). Mar 20, 2026 1. ### [Managed OAuth for Cloudflare Access](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-20-managed-oauth/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) Cloudflare Access supports managed OAuth, which allows non-browser clients — such as CLIs, AI agents, SDKs, and scripts — to authenticate with Access-protected applications using a standard OAuth 2.0 authorization code flow. Previously, non-browser clients that attempted to access a protected application received a `302` redirect to a login page they could not complete. The established workaround was `cloudflared access curl`, which required installing additional tooling. With managed OAuth, clients instead receive a `401` response with a `WWW-Authenticate` header that points to Access's OAuth discovery endpoints ([RFC 8414 ↗](https://datatracker.ietf.org/doc/html/rfc8414) and [RFC 9728 ↗](https://datatracker.ietf.org/doc/html/rfc9728)). The client opens the end user's browser to the Access login page. The end user authenticates with their identity provider, and the client receives an OAuth access token for subsequent requests. Access enforces the same policies as a browser login; the OAuth layer is a new transport mechanism, not a separate authentication path. Managed OAuth can be enabled on any self-hosted Access application or [MCP server portal](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/). It is opt-in for existing applications to avoid interfering with those that run their own OAuth servers and rely on their own `WWW-Authenticate` headers. Note For MCP server portals, managed OAuth is enabled by default on new portals. It remains opt-in for self-hosted applications. To enable managed OAuth, go to **Zero Trust** \> **Access controls** \> **Applications**, edit the application, and turn on **Managed OAuth** under **Advanced settings**. You can also enable it via the API by setting `oauth_configuration.enabled` to `true` on the [Access applications endpoint](https://edgetunnel-b2h.pages.dev/api/resources/zero%5Ftrust/subresources/access/subresources/applications/methods/update/). ![Managed OAuth settings in the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/_astro/managed-oauth.BirLnBpy_Zjg97R.webp) For setup instructions, refer to [Enable managed OAuth](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/applications/http-apps/managed-oauth/). Mar 20, 2026 1. ### [Route MCP server portal traffic through Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-20-mcp-portal-gateway-routing/) [ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) [MCP server portals](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/) can now route traffic through [Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) for richer HTTP request logging and data loss prevention (DLP) scanning. When Gateway routing is turned on, portal traffic appears in your [Gateway HTTP logs](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/). You can create [Gateway HTTP policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) with [DLP profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/) to detect and block sensitive data sent to upstream MCP servers. Note DLP [AI prompt profiles](https://edgetunnel-b2h.pages.dev/cloudflare-one/data-loss-prevention/dlp-profiles/predefined-profiles/#ai-prompt) do not apply to MCP server portal traffic. To enable Gateway routing, go to **Access controls** \> **AI controls**, edit the portal, and turn on **Route traffic through Cloudflare Gateway** under **Basic information**. ![Route MCP server portal traffic through Cloudflare Gateway](https://edgetunnel-b2h.pages.dev/_astro/portal-route-through-gateway.0KMUAXBm_Z1B5rry.webp) For more details, refer to [Route traffic through Gateway](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/ai-controls/mcp-portals/#route-portal-traffic-through-gateway). Mar 20, 2026 1. ### [Stream logs from multiple replicas of Cloudflare Tunnel simultaneously](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-20-tunnel-replica-overview-and-multi-log-streaming/) [ Cloudflare Tunnel ](https://edgetunnel-b2h.pages.dev/tunnel/)[ Cloudflare Tunnel for SASE ](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/) In the Cloudflare One dashboard, the overview page for a specific Cloudflare Tunnel now shows all [replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/) of that tunnel and supports streaming logs from multiple replicas at once. ![View replicas and stream logs from multiple connectors](https://edgetunnel-b2h.pages.dev/_astro/tunnel-multiconn.DEOEaLlu_ZDxArh.webp) Previously, you could only stream logs from one replica at a time. With this update: * **Replicas on the tunnel overview** — All active replicas for the selected tunnel now appear on that tunnel's overview page under **Connectors**. Select any replica to stream its logs. * **Multi-connector log streaming** — Stream logs from multiple replicas simultaneously, making it easier to correlate events across your infrastructure during debugging or incident response. To try it out, log in to [Cloudflare One ↗](https://one.dash.cloudflare.com/) and go to **Networks** \> **Connectors** \> **Cloudflare Tunnels**. Select **View logs** next to the tunnel you want to monitor. For more information, refer to [Tunnel log streams](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/) and [Deploy replicas](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/deploy-replicas/). Mar 15, 2026 1. ### [Unlimited result paging in Investigations](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-15-infinite-paging-investigations/) [ Email security ](https://edgetunnel-b2h.pages.dev/cloudflare-one/email-security/) Investigations now support unlimited result paging in both the dashboard and the API, removing the previous 1,000-record cap. Security teams can page through complete result sets when searching across large mail volumes, giving SOC analysts and automated workflows deeper visibility for forensics and threat hunting. In the dashboard, infinite paging is now supported in the Investigations view. The 1,000-record ceiling has been removed, so you can navigate through the full result set directly in the UI. The [Investigations API](https://edgetunnel-b2h.pages.dev/api/resources/email%5Fsecurity/subresources/investigate/methods/list) now returns up to 10,000 records per page (up from 1,000), with no cap on total result volume across pages. For high-volume use cases, we recommend: * **[Logpush](https://edgetunnel-b2h.pages.dev/cloudflare-one/insights/logs/logpush/email-security-logs/) to a SIEM** for full-fidelity datasets and long-term retention. * **SOAR playbooks** against the async bulk action API for large-scale remediation. Bulk actions initiated from the dashboard remain capped at 1,000 messages per action. * **The Investigations API** for report exports larger than 1,000 results, which is the dashboard download cap. This applies to all Email Security packages: * **Advantage** * **Enterprise** * **Enterprise + PhishGuard** Mar 10, 2026 1. ### [WARP client for macOS (version 2026.3.566.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-10-warp-macos-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the macOS WARP client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and introduces a brand new visual style for the client interface. The new Cloudflare One Client interface changes connectivity management from a toggle to a button and brings useful connectivity settings to the home screen. The redesign also introduces a collapsible navigation bar. When expanded, more client information can be accessed including connectivity, settings, and device profile information. If you have any feedback or questions, visit the [Cloudflare Community forum](https://community.cloudflare.com/t/introducing-the-new-cloudflare-one-client-interface/901362) and let us know. **Changes and improvements** * Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. * Fixed an issue in proxy mode where the client could become unresponsive due to upstream connection timeouts. * Fixed emergency disconnect state from a previous organization incorrectly persisting after switching organizations. * Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. * Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. * Added monitoring for tunnel statistics collection timeouts. * Switched tunnel congestion control algorithm to Cubic for improved reliability across platforms. * Fixed initiating managed network detection checks when no network is available, which caused device profile flapping. **Known issues** * The client may become stuck in a `Connecting` state. To resolve this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Alternatively, change the client's operation mode. * The client may display an empty white screen upon the device waking from sleep. To resolve this issue, exit and then open the client to re-launch it. * Canceling login during a single MDM configuration setup results in an empty page with no way to resume authentication. To work around this issue, exit and relaunch the client. Mar 10, 2026 1. ### [WARP client for Windows (version 2026.3.566.1)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-10-warp-windows-beta/) [ Cloudflare One Client ](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) A new Beta release for the Windows WARP client is now available on the [beta releases downloads page](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/cloudflare-one-client/download/beta-releases/). This release contains minor fixes and introduces a brand new visual style for the client interface. The new Cloudflare One Client interface changes connectivity management from a toggle to a button and brings useful connectivity settings to the home screen. The redesign also introduces a collapsible navigation bar. When expanded, more client information can be accessed including connectivity, settings, and device profile information. If you have any feedback or questions, visit the [Cloudflare Community forum](https://community.cloudflare.com/t/introducing-the-new-cloudflare-one-client-interface/901362) and let us know. **Changes and improvements** * Consumer-only CLI commands are now clearly distinguished from Zero Trust commands. * Added detailed QUIC connection metrics to diagnostic logs for better troubleshooting. * Added monitoring for tunnel statistics collection timeouts. * Switched tunnel congestion control algorithm to Cubic for improved reliability across platforms. * Fixed packet capture failing on tunnel interface when the tunnel interface is renamed by SCCM VPN boundary support. * Fixed unnecessary registration deletion caused by RDP connections in multi-user mode. * Fixed increased tunnel interface start-up time due to a race between duplicate address detection (DAD) and disabling NetBT. * Fixed tunnel failing to connect when the system DNS search list contains unexpected characters. * Empty MDM files are now rejected instead of being incorrectly accepted as a single MDM config. * Fixed an issue in proxy mode where the client could become unresponsive due to upstream connection timeouts. * Fixed emergency disconnect state from a previous organization incorrectly persisting after switching organizations. * Fixed initiating managed network detection checks when no network is available, which caused device profile flapping. **Known issues** * The client may unexpectedly terminate during captive portal login. To work around this issue, use a web browser to authenticate with the captive portal and then re-launch the client. * An error indicating that Microsoft Edge can't read and write to its data directory may be displayed during captive portal login; this error is benign and can be dismissed. * The client may become stuck in a `Connecting` state. To resolve this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Alternatively, change the client's operation mode. * The client may display an empty white screen upon the device waking from sleep. To resolve this issue, exit and then open the client to re-launch it. * Canceling login during a single MDM configuration setup results in an empty page with no way to resume authentication. To work around this issue, exit and relaunch the client. * For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. * Devices with KB5055523 installed may receive a warning about `Win32/ClickFix.ABA` being present in the installer. To resolve this false positive, update Microsoft Security Intelligence to [version 1.429.19.0](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.429.19.0) or later. This warning will be omitted from future release notes. This Microsoft Security Intelligence update was released in May 2025. * DNS resolution may be broken when the following conditions are all true: * The client is in Secure Web Gateway without DNS filtering (tunnel-only) mode. * A custom DNS server address is configured on the primary network adapter. * The custom DNS server address on the primary network adapter is changed while the client is connected. To work around this issue, reconnect the client by selecting **Disconnect** and then **Connect** in the client user interface. Mar 04, 2026 1. ### [User risk score selector in Access policies](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-04-user-risk-score-access-policies/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Access ](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) You can now use [user risk scores](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/risk-score/) in your [Access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/). The new **User Risk Score** selector allows you to create Access policies that respond to user behavior patterns detected by Cloudflare's risk scoring system, including impossible travel, high DLP policy matches, and more. For more information, refer to [Use risk scores in Access policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/users/risk-score/#use-risk-scores-in-access-policies). Mar 04, 2026 1. ### [Gateway Authorization Proxy and hosted PAC files (open beta)](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-04-gateway-authorization-proxy-open-beta/) [ Gateway ](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/) The [Gateway Authorization Proxy](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#authorization-endpoint) and [PAC file hosting](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#create-a-hosted-pac-file) are now in open beta for all plan types. Previously, [proxy endpoints](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#source-ip-endpoint) relied on static source IP addresses to authorize traffic, providing no user-level identity in logs or policies. The new authorization proxy replaces IP-based authorization with [Cloudflare Access](https://edgetunnel-b2h.pages.dev/cloudflare-one/access-controls/policies/) authentication, verifying who a user is before applying Gateway filtering without installing the WARP client. This is ideal for environments where you cannot deploy a device client, such as virtual desktops (VDI), mergers and acquisitions, or compliance-restricted endpoints. #### Key capabilities * **Identity-aware proxy traffic** — Users authenticate through your identity provider (Okta, Microsoft Entra ID, Google Workspace, and others) via Cloudflare Access. Logs now show exactly which user accessed which site, and you can write [identity-based policies](https://edgetunnel-b2h.pages.dev/cloudflare-one/traffic-policies/identity-selectors/) like "only the Finance team can access this accounting tool." * **Multiple identity providers** — Display one or multiple login methods simultaneously, giving flexibility for organizations managing users across different identity systems. * **Cloudflare-hosted PAC files** — Create and host [PAC files](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#create-a-hosted-pac-file) directly in Cloudflare One with pre-configured templates for Okta and Azure, hosted at `https://pac.cloudflare-gateway.com//` on Cloudflare's global network. * **Simplified billing** — Each user occupies a seat, exactly like they do with the Cloudflare One Client. No new metrics to track. #### Get started 1. In [Cloudflare One ↗](https://one.dash.cloudflare.com/), go to **Networks** \> **Resolvers & Proxies** \> **Proxy endpoints**. 2. [Create an authorization proxy endpoint](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#authorization-endpoint) and configure Access policies. 3. [Create a hosted PAC file](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#create-a-hosted-pac-file) or write your own. 4. [Configure browsers](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/#3b-configure-browser-to-use-pac-file) to use the PAC file URL. 5. [Install the Cloudflare certificate](https://edgetunnel-b2h.pages.dev/cloudflare-one/team-and-resources/devices/user-side-certificates/) for HTTPS inspection. For more details, refer to the [proxy endpoints documentation](https://edgetunnel-b2h.pages.dev/cloudflare-one/networks/resolvers-and-proxies/proxy-endpoints/) and the [announcement blog post ↗](https://blog.cloudflare.com/gateway-authorization-proxy-identity-aware-policies/). Mar 02, 2026 1. ### [Copy Cloudflare One resources as JSON or POST requests](https://edgetunnel-b2h.pages.dev/changelog/post/2026-03-copy-resources-as-json-or-post-requests/) [ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/) You can now copy Cloudflare One resources as JSON or as a ready-to-use API POST request directly from the dashboard. This makes it simple to transition workflows into API calls, automation scripts, or infrastructure-as-code pipelines. To use this feature, click the overflow menu (⋮) on any supported resource and select **Copy as JSON** or **Copy as POST request**. The copied output includes only the fields present on your resource, giving you a clean and minimal starting point for your own API calls. Initially supported resources: * Access applications * Access policies * Gateway policies * Resolver policies * Service tokens * Identity providers We will continue to add support for more resources throughout 2026. ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/4/#page","headline":"Cloudflare One Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product-group/cloudflare-one/4/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```