Skip to content

Commit 635cce4

Browse files
ranbelranbel
authored
[ZT] Windows multi-user support (#18645)
* alphabetize parameters * remove limitation * new multi-user page * update section title * update configs MDM example * add MDM parameters * update flowchart * break out top-level parameters * add beta * clarify mode switch behavior * Update src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser.mdx * simplify flowchart
1 parent 41fe2de commit 635cce4

File tree

4 files changed

+268
-125
lines changed

4 files changed

+268
-125
lines changed

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters.mdx‎

Lines changed: 97 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -42,60 +42,36 @@ Instructs the client to direct all DNS queries to a specific [Gateway DNS locati
4242

4343
**Value:** Your <GlossaryTooltip term="DoH subdomain">DoH subdomain</GlossaryTooltip>.
4444

45-
## Optional fields
45+
## Organization parameters
4646

47-
### `service_mode`
48-
49-
Allows you to choose the operational mode of the client.
50-
51-
**Value Type:** `string`
52-
53-
**Value:**
54-
55-
* `warp` — (default) [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default).
56-
* `1dot1` — [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh).
57-
* `proxy` — [Proxy mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#proxy-mode). Use the `proxy_port` parameter to specify the localhost SOCKS proxy port (between `0`-`66535`). For example,
58-
```xml
59-
<key>service_mode</key>
60-
<string>proxy</string>
61-
<key>proxy_port</key>
62-
<integer>44444</integer>
63-
```
64-
* `postureonly` — [Device Information Only](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#device-information-only).
47+
You can use the following parameters to configure a specific Zero Trust organization.
6548

66-
The service mode [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) is not currently supported as a value and must be configured in Zero Trust.
67-
68-
### `onboarding`
69-
70-
Controls the visibility of the onboarding screens that ask the user to review the privacy policy during an application's first launch.
71-
72-
**Value Type:** `boolean`
73-
74-
**Value:**
75-
76-
* `false` — Screens hidden.
77-
* `true` — (default) Screens visible.
78-
79-
### `switch_locked`
80-
81-
Allows the user to turn off the WARP switch and disconnect the client.
49+
### `auth_client_id`
8250

83-
**Value Type:** `boolean`
51+
Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token).
52+
Requires the `auth_client_secret` parameter.
8453

85-
**Value:**
54+
**Value Type:** `string`
8655

87-
* `false` — (default) The user is able to turn the switch on/off at their discretion. When the switch is off, the user will not have the ability to reach sites protected by Access that leverage certain device posture checks.
88-
* `true` — The user is prevented from turning off the switch. The WARP client will automatically start in the connected state.
56+
**Value:** Client ID of the service token.
8957

90-
On new deployments, you must also include the `auto_connect` parameter with at least a value of `0`. This will prevent clients from being deployed in the off state without a way for users to manually enable them.
58+
Example configuration:
9159

92-
:::note
60+
```xml
61+
<key>auth_client_id</key>
62+
<string>88bf3b6d86161464f6509f7219099e57.access</string>
63+
<key>auth_client_secret</key>
64+
<string>bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5</string>
65+
```
9366

67+
### `auth_client_secret`
9468

95-
This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
69+
Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token).
70+
Requires the `auth_client_id` parameter.
9671

72+
**Value Type:** `string`
9773

98-
:::
74+
**Value:** Client Secret of the service token.
9975

10076
### `auto_connect`
10177

@@ -113,16 +89,25 @@ If switch has been turned off by user, the client will automatically turn itself
11389
This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
11490
:::
11591

116-
### `support_url`
11792

118-
When the WARP client is deployed via MDM, the in-app **Send Feedback** button is disabled by default. This parameter allows you to re-enable the button and direct feedback towards your organization.
93+
### `display_name`
94+
95+
Identifies a Zero Trust organization in the WARP GUI when WARP is deployed with [multiple organizations](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations/). Required if the `organization` parameter is specified within a [`configs` array](#configs).
11996

12097
**Value Type:** `string`
12198

99+
**Value:** Organization nickname shown to users in the WARP GUI (for example, `Test environment`).
100+
101+
### `onboarding`
102+
103+
Controls the visibility of the onboarding screens that ask the user to review the privacy policy during an application's first launch.
104+
105+
**Value Type:** `boolean`
106+
122107
**Value:**
123108

124-
* `https://<support.example.com>` — Use an `https://` link to open your company's internal help site.
125-
* `mailto:<[email protected]>` — Use a `mailto:` link to open your default mail client.
109+
* `false` — Screens hidden.
110+
* `true` — (default) Screens visible.
126111

127112
### `override_api_endpoint`
128113

@@ -160,45 +145,88 @@ This functionality is intended for use with a Cloudflare China local network par
160145

161146
The string must be a valid IPv4 or IPv6 socket address (containing the IP address and port number), otherwise the WARP client will fail to parse the entire MDM file.
162147

163-
### `unique_client_id`
148+
### `service_mode`
164149

165-
Assigns a unique identifier to the device for the [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid).
150+
Allows you to choose the operational mode of the client.
166151

167152
**Value Type:** `string`
168153

169-
**Value:** UUID for the device (for example, `496c6124-db89-4735-bc4e-7f759109a6f1`).
154+
**Value:**
170155

171-
### `auth_client_id`
156+
* `warp` — (default) [Gateway with WARP](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-warp-default).
157+
* `1dot1` — [Gateway with DoH](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#gateway-with-doh).
158+
* `proxy` — [Proxy mode](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#proxy-mode). Use the `proxy_port` parameter to specify the localhost SOCKS proxy port (between `0`-`66535`). For example,
159+
```xml
160+
<key>service_mode</key>
161+
<string>proxy</string>
162+
<key>proxy_port</key>
163+
<integer>44444</integer>
164+
```
165+
* `postureonly` — [Device Information Only](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#device-information-only).
172166

173-
Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token).
174-
Requires the `auth_client_secret` parameter.
167+
The service mode [Secure Web Gateway without DNS filtering](/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-modes/#secure-web-gateway-without-dns-filtering) is not currently supported as a value and must be configured in Zero Trust.
168+
169+
170+
### `support_url`
171+
172+
When the WARP client is deployed via MDM, the in-app **Send Feedback** button is disabled by default. This parameter allows you to re-enable the button and direct feedback towards your organization.
175173

176174
**Value Type:** `string`
177175

178-
**Value:** Client ID of the service token.
176+
**Value:**
179177

180-
Example configuration:
178+
* `https://<support.example.com>` — Use an `https://` link to open your company's internal help site.
179+
* `mailto:<[email protected]>` — Use a `mailto:` link to open your default mail client.
181180

182-
```xml
183-
<key>auth_client_id</key>
184-
<string>88bf3b6d86161464f6509f7219099e57.access</string>
185-
<key>auth_client_secret</key>
186-
<string>bdd31cbc4dec990953e39163fbbb194c93313ca9f0a6e420346af9d326b1d2a5</string>
187-
```
188181

189-
### `auth_client_secret`
182+
### `switch_locked`
190183

191-
Enrolls the device in your Zero Trust organization using a [service token](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#check-for-service-token).
192-
Requires the `auth_client_id` parameter.
184+
Allows the user to turn off the WARP switch and disconnect the client.
193185

194-
**Value Type:** `string`
186+
**Value Type:** `boolean`
195187

196-
**Value:** Client Secret of the service token.
188+
**Value:**
197189

198-
### `display_name`
190+
* `false` — (default) The user is able to turn the switch on/off at their discretion. When the switch is off, the user will not have the ability to reach sites protected by Access that leverage certain device posture checks.
191+
* `true` — The user is prevented from turning off the switch. The WARP client will automatically start in the connected state.
192+
193+
On new deployments, you must also include the `auto_connect` parameter with at least a value of `0`. This will prevent clients from being deployed in the off state without a way for users to manually enable them.
194+
195+
:::note
196+
This parameter replaces the old `enabled` property, which can no longer be used in conjunction with the new `switch_locked` and `auto_connect`. If you want to use these parameters, you must remove `enabled`.
197+
:::
198+
199+
### `unique_client_id`
199200

200-
When WARP is deployed with [multiple organizations or configurations](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations/), this parameter is used to identify each configuration in the GUI.
201+
Assigns a unique identifier to the device for the [device UUID posture check](/cloudflare-one/identity/devices/warp-client-checks/device-uuid).
201202

202203
**Value Type:** `string`
203204

204-
**Value:** Configuration name shown in the GUI (for example, `Test environment`).
205+
**Value:** UUID for the device (for example, `496c6124-db89-4735-bc4e-7f759109a6f1`).
206+
207+
## Top-level parameters
208+
209+
Top-level parameters determine how WARP manages device registrations.
210+
211+
### `configs`
212+
213+
Allows a user to [switch between Zero Trust organizations](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations/) in the WARP client GUI. The `configs` array is also required when using another [top-level parameter](#top-level-parameters) such as `multi_user` or `pre_login`, even if only one organization is specified.
214+
215+
**Value Type:** `array`
216+
217+
**Value:** An array containing one or more Zero Trust organizations.
218+
219+
### `multi_user`
220+
221+
Enables multiple user registrations on a Windows device.
222+
223+
**Value Type:** `boolean`
224+
225+
**Value:**
226+
227+
* `false` — (default) Only one WARP registration is stored per device. After a user logs in to WARP, their settings and identity will apply to all traffic from the device.
228+
* `true` — Each Windows user has their own WARP registration. For more information, refer to [Multiple users on a Windows device](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-multiuser/).
229+
230+
### `pre_login`
231+
232+
Allows WARP to connect with a service token before a user completes the initial Windows login. For more information, refer to [Connect WARP before Windows login](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/windows-prelogin/).

‎src/content/docs/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/switch-organizations.mdx‎

Lines changed: 58 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -44,32 +44,35 @@ An MDM file supports a maximum of 25 configurations. The following example inclu
4444
<TabItem label="Windows">
4545

4646
```xml
47-
<array>
48-
<dict>
49-
<key>organization</key>
50-
<string>mycompany</string>
51-
<key>display_name</key>
52-
<string>Production environment</string>
53-
</dict>
54-
<dict>
55-
<key>organization</key>
56-
<string>mycompany</string>
57-
<key>override_api_endpoint</key>
58-
<string>203.0.113.0</string>
59-
<key>override_doh_endpoint</key>
60-
<string>203.0.113.0</string>
61-
<key>override_warp_endpoint</key>
62-
<string>203.0.113.0:2408</string>
63-
<key>display_name</key>
64-
<string>Cloudflare China network</string>
65-
</dict>
66-
<dict>
67-
<key>organization</key>
68-
<string>test-org</string>
69-
<key>display_name</key>
70-
<string>Test environment</string>
71-
</dict>
72-
</array>
47+
<dict>
48+
<key>configs</key>
49+
<array>
50+
<dict>
51+
<key>organization</key>
52+
<string>mycompany</string>
53+
<key>display_name</key>
54+
<string>Production environment</string>
55+
</dict>
56+
<dict>
57+
<key>organization</key>
58+
<string>mycompany</string>
59+
<key>override_api_endpoint</key>
60+
<string>203.0.113.0</string>
61+
<key>override_doh_endpoint</key>
62+
<string>203.0.113.0</string>
63+
<key>override_warp_endpoint</key>
64+
<string>203.0.113.0:2408</string>
65+
<key>display_name</key>
66+
<string>Cloudflare China network</string>
67+
</dict>
68+
<dict>
69+
<key>organization</key>
70+
<string>test-org</string>
71+
<key>display_name</key>
72+
<string>Test environment</string>
73+
</dict>
74+
</array>
75+
</dict>
7376
```
7477

7578
</TabItem>
@@ -89,32 +92,35 @@ An MDM file supports a maximum of 25 configurations. The following example inclu
8992
<TabItem label="Linux">
9093

9194
```xml
92-
<array>
93-
<dict>
94-
<key>organization</key>
95-
<string>mycompany</string>
96-
<key>display_name</key>
97-
<string>Production environment</string>
98-
</dict>
99-
<dict>
100-
<key>organization</key>
101-
<string>mycompany</string>
102-
<key>override_api_endpoint</key>
103-
<string>203.0.113.0</string>
104-
<key>override_doh_endpoint</key>
105-
<string>203.0.113.0</string>
106-
<key>override_warp_endpoint</key>
107-
<string>203.0.113.0:2408</string>
108-
<key>display_name</key>
109-
<string>Cloudflare China network</string>
110-
</dict>
111-
<dict>
112-
<key>organization</key>
113-
<string>test-org</string>
114-
<key>display_name</key>
115-
<string>Test environment</string>
116-
</dict>
117-
</array>
95+
<dict>
96+
<key>configs</key>
97+
<array>
98+
<dict>
99+
<key>organization</key>
100+
<string>mycompany</string>
101+
<key>display_name</key>
102+
<string>Production environment</string>
103+
</dict>
104+
<dict>
105+
<key>organization</key>
106+
<string>mycompany</string>
107+
<key>override_api_endpoint</key>
108+
<string>203.0.113.0</string>
109+
<key>override_doh_endpoint</key>
110+
<string>203.0.113.0</string>
111+
<key>override_warp_endpoint</key>
112+
<string>203.0.113.0:2408</string>
113+
<key>display_name</key>
114+
<string>Cloudflare China network</string>
115+
</dict>
116+
<dict>
117+
<key>organization</key>
118+
<string>test-org</string>
119+
<key>display_name</key>
120+
<string>Test environment</string>
121+
</dict>
122+
</array>
123+
</dict>
118124
```
119125

120126
</TabItem> </Tabs>

0 commit comments

Comments
 (0)