[SSL4SaaS, Access] secure-with-access setup review (#17722)

* Clarify provider and customer in different accounts and detail steps

* Process changes from PM review

* Adjust field validation warning to be consistent with updated prereq

* Apply suggestion from code review

Co-authored-by: Jun Lee <[email protected]>

---------

Co-authored-by: Jun Lee <[email protected]>

Author: RebeccaTamachiro

src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access.mdx

@@ -13,11 +13,18 @@ Cloudflare Access provides visibility and control over who has access to your [c
 
 ## Prerequisites
 
-* A custom hostname in a Standard, Apex Proxy or BYOIP configuration. For setup instructions, refer to [Configuring Cloudflare for SaaS](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/).
-* A Cloudflare Zero Trust plan in the same Cloudflare account as your custom hostname. Learn more about [getting started with Zero Trust](/cloudflare-one/setup/).
+* You must have an active custom hostname. For setup instructions, refer to [Configuring Cloudflare for SaaS](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/).
+* You must have a Cloudflare Zero Trust plan in your SaaS provider account. Learn more about [getting started with Zero Trust](/cloudflare-one/setup/).
+* You can only run Access on custom hostnames if they are managed externally to Cloudflare or in a separate Cloudflare account. If the custom hostname zone is in the same account as the SaaS zone, the Access application will not be applied.
 
 ## Setup
 
-1. In [Zero Trust](https://one.dash.cloudflare.com/), create an Access [self-hosted application](/cloudflare-one/applications/configure-apps/self-hosted-apps/). Access applications can only be configured for custom hostnames owned within the same account. Access applications cannot be configured in the SaaS provider's account at this time.
-2. In the **Domain** field, enter the custom hostname (for example, `mycustomhostname.com`). The custom hostname will not appear in the dropdown and must be manually entered.
-3. Follow the remaining self-hosted application creation steps to publish the application.
+1. At your SaaS provider account, select [Zero Trust](https://one.dash.cloudflare.com).
+2. Go to **Access** > **Applications**.
+3. Select **Add an application** and, for type of application, select **Self-hosted**.
+4. Enter a name for your Access application and, in **Session Duration**, choose how often the user's [application token](/cloudflare-one/identity/authorization-cookie/application-token/) should expire.
+5. In the **Domain** field, insert the custom hostname (for example, `mycustomhostname.com`) and press enter. The custom hostname will not appear in the dropdown and must be manually entered.
+    :::caution[Domain field validation]
+    Since the custom hostname zone must be managed externally to Cloudflare or in a separate Cloudflare account, it is expected that you find a validation warning `Zone is not associated with the current account`. You can proceed with the configuration despite this message.
+    :::
+6. Follow the remaining [self-hosted application creation steps](/cloudflare-one/applications/configure-apps/self-hosted-apps/) to publish the application.