Cloudflare Access now supports independent multi-factor authentication (MFA), allowing you to enforce MFA requirements without relying on your identity provider (IdP). This feature addresses common gaps in IdP-based MFA, such as inconsistent MFA policies across different identity providers or the need for additional security layers beyond what the IdP provides.
Independent MFA supports the following authenticator types:
Authenticator application — Time-based one-time passwords (TOTP) using apps like Google Authenticator, Microsoft Authenticator, or Authy.
Security key — Hardware security keys such as YubiKeys.
Biometrics — Built-in device authenticators including Apple Touch ID, Apple Face ID, and Windows Hello.
Note
Infrastructure applications do not yet support independent MFA.
You can configure MFA requirements at three levels:
LevelDescriptionOrganizationEnforce MFA by default for all applications in your account.ApplicationRequire or turn off MFA for a specific application.PolicyRequire or turn off MFA for users who match a specific policy.
Settings at lower levels (policy) override settings at higher levels (organization), giving you granular control over MFA enforcement.
Users enroll their authenticators through the App Launcher. To help with onboarding, administrators can share a direct enrollment link: .cloudflareaccess.com/AddMfaDevice.
To get started with Independent MFA, refer to Independent MFA.
Fetched April 16, 2026