Temporary authentication
With Cloudflare Access, you can require that users obtain approval before they can access a specific application. The administrator will receive an email notification to approve or deny the request. Unlike a typical Allow policy, the user will have to request access at the end of each session. This allows you to define the users who should have persistent access and those who must request temporary access.
- In Zero Trust ↗, go to Access > Applications.
- Choose an application and select Edit.
- Choose the Allow policy you want to configure and select Edit.
- Under Additional settings, turn on Purpose justification.
- Turn on Temporary authentication.
- Enter the Email addresses of the approvers. (Note: your approvers must be authenticated by Access. If they do not have an active session, Access will verify their identity against your App Launcher Access policy.)
- Save the policy.
Temporary authentication is now enabled for users who match this policy. You can optionally add a second Allow policy for users who should have persistent access. Be sure the policy order is set to allow persistent users through.
When a user accesses the application, they will be prompted to enter a purpose justification and submit an access request. The request is automatically emailed to approvers. Alternatively, the user can manually present the approval link to approvers.
Approvers will receive a request similar to the example below. The approver can then grant access for a set amount of time, up to a maximum of 24 hours.
