---
title: Define device enrollment permissions · Cloudflare Learning Paths
description: Device enrollment permissions determine which users can connect new devices to your organization's Cloudflare Zero Trust instance. Once the user registers their device, the WARP client will store their identity token and use it to authenticate to services in your private network.
lastUpdated: 2024-08-13T19:56:56.000Z
source_url:
  html: https://a74404c8.preview.developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-enrollment-permissions/index.md
  md: https://a74404c8.preview.developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-enrollment-permissions/
---

Device enrollment permissions determine which users can connect new devices to your organization's Cloudflare Zero Trust instance. Once the user registers their device, the WARP client will store their identity token and use it to authenticate to services in your private network.

## Set device enrollment permissions

* Dashboard

  1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.

  2. In **Device enrollment permissions**, select **Manage**.

  3. In the **Rules** tab, configure one or more [Access policies](https://developers.cloudflare.com/cloudflare-one/policies/access/) to define who can join their device. For example, you could allow all users with a company email address:

     | Rule type | Selector | Value |
     | - | - | - |
     | Include | Emails ending in | `@company.com` |

  Note

  Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.

  1. In the **Authentication** tab, select the [identity providers](https://developers.cloudflare.com/cloudflare-one/identity/idp-integration/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/).
  2. Select **Save**.

* Terraform (v5)

  1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):

     * `Access: Apps and Policies Write`

  2. Create a reusable Access policy using the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_policy) resource:

     ```tf
     resource "cloudflare_zero_trust_access_policy" "allow_company_emails" {
       account_id   = var.cloudflare_account_id
       name         = "Allow company emails"
       decision     = "allow"
       include      = [
         {
           email_domain = {
             domain = "@example.com"
           }
         }
       ]
     }
     ```

  3. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_application) resource to create an application with type `warp`.

     ```tf
     resource "cloudflare_zero_trust_access_application" "device_enrollment" {
       account_id       = var.cloudflare_account_id
       type             = "warp"
       name             = "Warp device enrollment"
       allowed_idps              = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id]
       auto_redirect_to_identity = true
       app_launcher_visible      = false
       policies = [
         {
           id = cloudflare_zero_trust_access_policy.allow_company_emails.id
           precedence = 1
         }
       ]
     }
     ```

## Only allow corporate devices

Device posture evaluation happens after a device has already enrolled in your Zero Trust organization. If you want only specific devices to be able to enroll, we recommend adding a [mutual TLS authentication](https://developers.cloudflare.com/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) rule to your device enrollment policy. This rule will check for the presence of a specific client certificate on the enrolling devices.

Note

Mutual TLS authentication is only available on Enterprise plans.

To check for an mTLS certificate:

* Dashboard

  1. [Add an mTLS certificate](https://developers.cloudflare.com/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration) to your account. You can generate a sample certificate using the [Cloudflare PKI toolkit](https://developers.cloudflare.com/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-mtls-using-cloudflare-pki).

  2. In **Associated hostnames**, enter your Zero Trust team domain: `<team-name>.cloudflareaccess.com`

  3. In your [device enrollment permissions](#set-device-enrollment-permissions), add a *Common Name* or *Valid Certificate* rule. For example, the following policy requires a client certificate with a specific common name:

     | Action | Rule type | Selector | Value |
     | - | - | - | - |
     | Allow | Require | Common Name | `<CERT-COMMON-NAME>` |

  4. On your device, add the client certificate to the [system keychain](https://developers.cloudflare.com/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).

* Terraform (v5)

  1. Add the following permissions to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/api_token):

     * `Access: Mutual TLS Certificates Write`
     * `Access: Apps and Policies Write`

  2. Use the [`cloudflare_zero_trust_access_mtls_certificate`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/zero_trust_access_mtls_certificate) resource to add an mTLS certificate to your account:

     ```tf
     resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" {
       account_id     = var.cloudflare_account_id
       name           = "WARP enrollment mTLS cert"
       certificate    = <<EOT
       -----BEGIN CERTIFICATE-----
       xxxx
       xxxx
       -----END CERTIFICATE-----
       EOT
       associated_hostnames = ["your-team-name.cloudflareaccess.com"]
     }
     ```

  3. Create the following Access policy:

     ```tf
     resource "cloudflare_zero_trust_access_policy" "warp_enrollment_mtls" {
       account_id     = var.cloudflare_account_id
       name           = "Allow employees with mTLS cert"
       decision       = "allow"
       include = [
         {
           email_domain = {
             domain = "@example.com"
           }
         }
       ]


       require = [
         {
           common_name = {
             common_name = "Common name 1"
           }
         },
             {
           common_name = {
             common_name = "Common name 2"
           }
         }
       ]
     }
     ```

  4. Add the policy to your [`cloudflared_zero_trust_access_application` for WARP](https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions).

  5. On your device, add the client certificate to the [system keychain](https://developers.cloudflare.com/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).

## Best practices

Most businesses use a single identity provider as the source of truth for their user directory. You should use this source of truth to onboard your corporate users to Zero Trust, for example by requiring company email addresses to login with your primary identity provider. Later on, you can add other login methods or identity providers as necessary for any contractors, vendors, or acquired corporations who may need access to your network.
