What you can do
Access group management
Add or remove users from Cloudflare Access groups, and check membership before granting more
access
Application catalog sync
Sync Zero Trust applications into your Ravenna application catalog
User sync
Sync users who have authenticated through Cloudflare Access, with seat and last-login data
Group-based provisioning
Map access levels to Cloudflare Access groups so approved requests provision automatically
Ticket-driven access
Grant access as a workflow step after an approval, and revoke it during offboarding
Foundry actions
Call any Cloudflare API from a Foundry action using the same connected token
What syncs
Sync runs every 24 hours by default. You can change the interval when you connect the integration or
at any time afterward.
User profile data
Ravenna stores the following Cloudflare fields on each synced user. They appear on the user profile and are available in workflow conditions, where they are named with acloudflareUser prefix.
How Access group membership works
Cloudflare Access groups do not hold a list of users. They hold include rules, and a rule can match an email address, an email domain, everyone, an IP range, or an identity from a connected provider such as Okta or Google Workspace. Ravenna reads and writes the email rules only:- A group’s membership in Ravenna is the set of email include rules on that group
- Adding a user appends an email include rule for that user’s email address
- Removing a user deletes the matching email include rule
Access provisioning
Cloudflare Access supports the group, manual, and workflow provisioning methods, so an access level on an application can map to a Cloudflare Access group. When a request is approved, Ravenna adds the user to the mapped group and Cloudflare’s policies grant access on the next login.Learn more about access provisioning
Next steps
Setup
Create an API token and connect your Cloudflare account
Workflows
Automate group membership and look up applications from tickets