Before anything else: if you’re setting this up today, the client itself has a new name. Cloudflare’s own documentation now calls it the Cloudflare One Client (formerly WARP) for Zero Trust use, WARP itself still exists, but as the separate consumer product (1.1.1.1 with WARP), not the enterprise Zero Trust client. Older guides, including many still ranking for this exact search, use the two names interchangeably in a way that’s no longer accurate. This guide uses current terminology throughout and flags it clearly whenever the naming actually matters.
With that said, here’s the complete, current process for setting up Cloudflare Zero Trust from an empty account to enrolled devices, based on Cloudflare’s own official setup documentation.
What Cloudflare Zero Trust Actually Does
Cloudflare Zero Trust replaces the old “trust everything inside the corporate network” model with a system that verifies every user and device on every connection, regardless of location. Instead of a traditional VPN that grants broad network access once you’re connected, Zero Trust applies identity-based and device-based policies to each specific request, a legitimately different security model, not just a rebranded VPN.
The Cloudflare One Client is the piece that runs on each user’s device, routing traffic through Cloudflare’s network where your security policies actually get enforced. It uses WireGuard, a modern, fast VPN protocol, for the connection between the device and Cloudflare’s edge.
Before You Start: What You’ll Need
- A Cloudflare account (free tier is sufficient to start)
- A domain, or willingness to use Cloudflare’s provided team domain
- Decision on a login method: one-time PIN (simplest to start with) or an existing identity provider (Google Workspace, Microsoft Entra ID, Okta) if you want centralized authentication
- Admin access to install software and certificates on the devices you’re enrolling
 
Â
Step 1: Create Your Cloudflare Zero Trust Account and Team Name
Sign in to the Cloudflare dashboard and navigate to the Zero Trust section. You’ll be prompted to choose a team name, this becomes part of the URL your users authenticate through (your-team-name.cloudflareaccess.com), so pick something stable; changing it later means reconfiguring client connections. The Zero Trust dashboard becomes your central place for device visibility, policy creation, and monitoring going forward.
Step 2: Set Up a Login Method
Configure how users will authenticate when enrolling a device. For a first setup, a one-time PIN sent by email is the fastest path, no external identity provider required. For anything beyond a small team, connecting a real identity provider (Google Workspace, Microsoft Entra ID, Okta, or similar) is worth the extra setup time, since it lets you manage access centrally rather than tracking individual email-based logins.
Step 3: Define Device Enrollment Rules
Before anyone can connect a device, you need enrollment rules specifying who’s allowed to enroll and which login method applies to them. This is also where you decide scope, enrolling your whole organization at once versus starting with a pilot group of a few devices is a reasonable, lower-risk way to validate your configuration before a full rollout. For regulated industries specifically, these access rules aren’t just a security nicety, they’re often the literal control an auditor checks for, whether that’s PCI-DSS and open banking compliance or HIPAA-required access controls over systems touching patient data.
Step 4: Install the Cloudflare Root Certificate
If you plan to use HTTP traffic inspection (a common Zero Trust feature for filtering and logging web traffic), each device needs the Cloudflare root certificate installed and trusted. This step is what lets Cloudflare’s Secure Web Gateway inspect encrypted traffic without every site throwing a certificate warning. For manual installs, this needs to happen on every device individually; larger organizations typically push this through existing device management (MDM) tooling instead.
Step 5: Download and Deploy the Cloudflare One Client
With the account, login method, and enrollment rules in place, download the Cloudflare One Client for each platform you need to support, Windows, macOS, Linux, iOS, Android, and ChromeOS are all supported. On first launch, users enter your team name, authenticate using the login method you configured, and the client connects, applying whatever Gateway and Access policies you’ve set.
On Windows and macOS specifically: install the application, proceed through the initial screens to the main WARP toggle screen, open preferences, and select “Login with Cloudflare Zero Trust” rather than the default consumer mode, this is the step most commonly missed by people who’ve used consumer WARP before and don’t realize Zero Trust mode is a separate login path within the same app.
Setting Up a Cloudflare Tunnel (Connecting Private Resources)
If you need to expose an internal service, an application, a server, an internal tool, without opening it to the public internet, Cloudflare Tunnel is the piece that connects it into your Zero Trust setup:
- Install cloudflared on the machine hosting the service.
- Authenticate: cloudflared tunnel login
- Create the tunnel: cloudflared tunnel create your-tunnel-name
- Configure a config.yml file mapping a hostname to the local service address.
- Route DNS: cloudflared tunnel route dns your-tunnel-name your-hostname
- Run the tunnel: cloudflared tunnel run your-tunnel-name
Once running, that internal resource becomes reachable only through Cloudflare’s Zero Trust policies, no public-facing port, no traditional VPN required for your team to reach it.
Common Setup Mistakes
Confusing consumer WARP mode with Zero Trust mode: The same application handles both; logging in with a personal Cloudflare account instead of your team’s Zero Trust login connects you to the wrong mode entirely.
Skipping the root certificate step, then troubleshooting broken HTTPS sites for hours: If HTTP inspection is enabled but the certificate isn’t trusted on a device, users hit constant certificate warnings, this is one of the most common Zero Trust support tickets, and it traces back to this one missed step almost every time.
Enrolling the entire organization on day one: A pilot group surfaces configuration problems, policy conflicts, DNS issues, unexpected app breakage, while the blast radius is still small.
Treating enrollment as a one-time task instead of an ongoing one: Devices get replaced, employees leave, policies need tuning as usage patterns emerge, continuous monitoring of who’s actually connected and how policies are performing catches drift that a “set it up once” mentality misses entirely.
Forgetting split tunneling exists: Without configuration, all traffic routes through Cloudflare by default, which can break latency-sensitive local network access (printers, local file shares) unless those destinations are explicitly excluded.
The Bottom Line
Setting up Cloudflare Zero Trust from scratch is a five-step process, account and team name, login method, enrollment rules, certificate installation, and client deployment, that’s genuinely more approachable than it looks once broken into that order. The most common trip-up isn’t technical difficulty, it’s confusing the consumer WARP login with the Zero Trust login inside the same application, or skipping the root certificate step and spending an afternoon debugging certificate warnings that trace back to it. Start with a pilot group, confirm policies work as expected, then roll out organization-wide.
Setting This Up for a Real Organization
A pilot setup for a handful of devices is straightforward to do yourself. Rolling this out correctly across an entire organization, with proper identity provider integration, device posture policies, and MDM-managed certificate deployment, is real security and compliance engineering, not a weekend project. If you want that done right the first time, that’s the kind of work we do.
Frequently Asked Questions
Is WARP the same as Cloudflare Zero Trust?Â
Not exactly anymore. WARP is now Cloudflare’s consumer product. The Zero Trust client has been renamed Cloudflare One Client, though it’s the same underlying application with a different login mode.
Do I need a paid Cloudflare plan for Zero Trust?Â
No, Cloudflare Zero Trust has a free tier sufficient for small teams to get started, with paid tiers adding higher user limits and additional features as you scale.
What is a Cloudflare Tunnel used for?Â
It securely exposes an internal service or private network resource through Cloudflare’s edge without opening a public-facing port, integrating that resource directly into your Zero Trust access policies.
Why do I need to install a root certificate?Â
The root certificate is required specifically for HTTP traffic inspection, without it, Cloudflare can’t inspect encrypted HTTPS traffic for filtering or logging without triggering certificate warnings on every site.
Can I use Cloudflare Zero Trust without an identity provider?Â
Yes, a one-time PIN login method works without connecting an external identity provider, though centralized identity management becomes more valuable as your team grows.
What operating systems does the Cloudflare One Client support?Â
Windows, macOS, Linux, iOS, Android, and ChromeOS are all supported, notably, Windows Server is explicitly not supported for client installation.