Skip to main content

Cloudflare Access single sign-on

Cloudflare Access is referenced in Retrievy's plan feature matrix alongside Microsoft and Google as part of the SSO line item. That row covers the long-term direction. As of today the Configure Identity Provider wizard in Retrievy lists two tiles only: Microsoft Entra ID and Google Workspace. There is no Cloudflare tile, no Cloudflare callback route, and no way to paste Cloudflare Zero Trust credentials into the wizard. Anyone trying to add Cloudflare from the Single Sign-On page today will not find it.

This page documents the current state so you can plan around it, and it lays out the workaround Retrievy customers use when they want their team to authenticate through Cloudflare anyway.

Plan availability

Single sign-on is available on the Advanced and Build Your Own plans. The Cloudflare row in the plan feature matrix tracks future native support; the workaround below works on any plan because it sits outside Retrievy.

No UI on this page

There is no Retrievy screen for Cloudflare SSO yet. The screens for the supported providers live at Microsoft Entra ID single sign-on and Google Workspace single sign-on.

What is supported in the app today​

When you open Settings, then Single Sign-On, and click Setup SSO, the wizard's first step (CORE SELECTION) shows two provider tiles:

  • Microsoft Entra ID (Business Identity)
  • Google Workspace (Web Application)

Both run OIDC against the matching identity provider, fall back to email and password when SSO is not enforced, and respect the Enforce SSO Only toggle on the Single Sign-On page. The full setup walkthroughs are at Microsoft Entra ID single sign-on and Google Workspace single sign-on.

A direct Cloudflare Access provider is on the roadmap. This page will be replaced with a full setup guide once it ships. Until then, picking Cloudflare in the wizard is not an option.

The workaround: put Cloudflare Zero Trust in front of Retrievy​

If your security policy says everything internal must go through Cloudflare Zero Trust, you can still meet that requirement without native Retrievy support. The pattern customers use:

  1. Keep Microsoft or Google as the actual SSO provider inside Retrievy, configured through the wizard the normal way.
  2. Put your Retrievy workspace subdomain (for example acme-corp.retrievy.com) behind a Cloudflare Zero Trust application as an identity-aware proxy.
  3. Configure Cloudflare Zero Trust to authenticate users against your own IdP (the same Microsoft or Google directory you wired into Retrievy in step 1), and to enforce your device-posture, geo, or service-token policies before the request reaches Retrievy.
  4. The user signs in to Cloudflare Zero Trust first, the request is then forwarded to Retrievy, and Retrievy's own SSO completes the sign-in inside the app.

What this gives you:

  • Cloudflare policies run before Retrievy ever sees the request, so device posture, country, and IP allow-lists are enforced upstream.
  • The identity that ends up logged into Retrievy is still a Microsoft or Google identity, which is what the workspace's user records, role assignments, and audit trail are keyed on.
  • Offboarding still happens in your IdP. Disabling the user in Entra or in Google Workspace cuts both layers at once.

What it does not give you:

  • A Cloudflare-only login flow. Retrievy's user records are not provisioned from Cloudflare Access groups, and the Default User Role in the SSO wizard still applies based on the underlying Microsoft or Google identity.
  • A single-vendor sign-in. You are running two SSO layers stacked, not one Cloudflare-native one.

This is a tenant-side network configuration, not a Retrievy setting. The Retrievy side is unchanged from the standard Microsoft or Google setup.

Cloudflare as a data source, not as SSO​

The other place Cloudflare shows up in Retrievy is the cloud account onboarding wizard, where you connect a Cloudflare API token so the CSPM module audits your zones, DNS, WAF, access policies, and R2 buckets. That is a data source connection, not a sign-in mechanism, and it is fully supported today. The walkthrough is at Connect a Cloudflare account. Do not confuse the two: the API token in that flow grants Retrievy read access to your Cloudflare account, it does not grant your team a way to log into Retrievy.