diff --git a/public/__redirects b/public/__redirects
index 40c933e8be6dddc..1aaf7d55bb5d017 100644
--- a/public/__redirects
+++ b/public/__redirects
@@ -2382,6 +2382,10 @@
# Cloudflare One nav revamp
/cloudflare-one/connections/ /cloudflare-one/ 301
+/cloudflare-one/identity/users/ /cloudflare-one/team-and-resources/users/ 301
+/cloudflare-one/identity/users/session-management/ /cloudflare-one/team-and-resources/users/session-management/ 301
+/cloudflare-one/identity/users/seat-management/ /cloudflare-one/team-and-resources/users/seat-management/ 301
+/cloudflare-one/identity/users/scim/ /cloudflare-one/team-and-resources/users/scim/ 301
/cloudflare-one/connections/connect-devices/* /cloudflare-one/team-and-resources/devices/:splat 301
/cloudflare-one/connections/connect-networks/* /cloudflare-one/networks/connectors/cloudflare-tunnel/:splat 301
/cloudflare-one/policies/gateway/* /cloudflare-one/traffic-policies/:splat 301
@@ -2391,7 +2395,7 @@
/cloudflare-one/identity/one-time-pin/ /cloudflare-one/integrations/identity-providers/one-time-pin/ 301
/cloudflare-one/identity/idp-integration/* /cloudflare-one/integrations/identity-providers/:splat 301
/cloudflare-one/identity/devices/service-providers/* /cloudflare-one/integrations/service-providers/:splat 301
-/cloudflare-one/applications/configure-apps/* /cloudflare-one/access-controls/applications/configure-apps/:splat 301
+/cloudflare-one/applications/configure-apps/* /cloudflare-one/access-controls/applications/http-apps/:splat 301
/cloudflare-one/applications/non-http/* /cloudflare-one/access-controls/applications/non-http/:splat 301
# Learning paths
diff --git a/src/content/changelog/access/2025-03-03-saml-oidc-fields-saml-transformations.mdx b/src/content/changelog/access/2025-03-03-saml-oidc-fields-saml-transformations.mdx
index dfc6ba3cca6a23f..9bab43a83bfcec1 100644
--- a/src/content/changelog/access/2025-03-03-saml-oidc-fields-saml-transformations.mdx
+++ b/src/content/changelog/access/2025-03-03-saml-oidc-fields-saml-transformations.mdx
@@ -6,7 +6,7 @@ products:
- access
---
-[Access for SaaS applications](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/) now include more configuration options to support a wider array of SaaS applications.
+[Access for SaaS applications](/cloudflare-one/access-controls/applications/http-apps/saas-apps/) now include more configuration options to support a wider array of SaaS applications.
**SAML and OIDC Field Additions**
diff --git a/src/content/changelog/access/2025-04-09-SCIM-provisioning-logs.mdx b/src/content/changelog/access/2025-04-09-SCIM-provisioning-logs.mdx
index 3ddf64ca8720659..1df3162291f0c79 100644
--- a/src/content/changelog/access/2025-04-09-SCIM-provisioning-logs.mdx
+++ b/src/content/changelog/access/2025-04-09-SCIM-provisioning-logs.mdx
@@ -6,7 +6,7 @@ products:
- access
---
-[Cloudflare Zero Trust SCIM provisioning](/cloudflare-one/identity/users/scim) now has a full audit log of all create, update and delete event from any SCIM Enabled IdP. The [SCIM logs](/cloudflare-one/insights/logs/scim-logs/) support filtering by IdP, Event type, Result and many more fields. This will help with debugging user and group update issues and questions.
+[Cloudflare Zero Trust SCIM provisioning](/cloudflare-one/team-and-resources/users/scim) now has a full audit log of all create, update and delete event from any SCIM Enabled IdP. The [SCIM logs](/cloudflare-one/insights/logs/scim-logs/) support filtering by IdP, Event type, Result and many more fields. This will help with debugging user and group update issues and questions.
SCIM logs can be found on the Zero Trust Dashboard under **Logs** -> **SCIM provisioning**.
diff --git a/src/content/changelog/access/2025-08-26-access-mcp-oauth.mdx b/src/content/changelog/access/2025-08-26-access-mcp-oauth.mdx
index ac854ff0b5c970b..609ae0082925797 100644
--- a/src/content/changelog/access/2025-08-26-access-mcp-oauth.mdx
+++ b/src/content/changelog/access/2025-08-26-access-mcp-oauth.mdx
@@ -8,6 +8,6 @@ products:
You can now control who within your organization has access to internal MCP servers, by putting internal MCP servers behind [Cloudflare Access](/cloudflare-one/access-controls/policies/).
-[Self-hosted applications](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/linked-apps/) in Cloudflare Access now support OAuth for MCP server authentication. This allows Cloudflare to delegate access from any self-hosted application to an MCP server via OAuth. The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the authorized user, using that user's specific permissions and scopes.
+[Self-hosted applications](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/linked-apps/) in Cloudflare Access now support OAuth for MCP server authentication. This allows Cloudflare to delegate access from any self-hosted application to an MCP server via OAuth. The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the authorized user, using that user's specific permissions and scopes.
For example, if you have an MCP server designed for internal use within your organization, you can configure Access policies to ensure that only authorized users can access it, regardless of which MCP client they use. Support for internal, self-hosted MCP servers also works with MCP server portals, allowing you to provide a single MCP endpoint for multiple MCP servers. For more on MCP server portals, read the [blog post](https://blog.cloudflare.com/zero-trust-mcp-server-portals/) on the Cloudflare Blog.
diff --git a/src/content/changelog/access/2025-08-26-mcp-server-portals.mdx b/src/content/changelog/access/2025-08-26-mcp-server-portals.mdx
index 8e86f8a344fbd24..659564bf3d6ff7f 100644
--- a/src/content/changelog/access/2025-08-26-mcp-server-portals.mdx
+++ b/src/content/changelog/access/2025-08-26-mcp-server-portals.mdx
@@ -8,7 +8,7 @@ products:
-An [MCP server portal](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/mcp-portals/) centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint. Key benefits include:
+An [MCP server portal](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals/) centralizes multiple Model Context Protocol (MCP) servers onto a single HTTP endpoint. Key benefits include:
- **Streamlined access to multiple MCP servers**: MCP server portals support both unauthenticated MCP servers as well as MCP servers secured using any third-party or custom OAuth provider. Users log in to the portal URL through Cloudflare Access and are prompted to authenticate separately to each server that requires OAuth.
- **Customized tools per portal**: Admins can tailor an MCP portal to a particular use case by choosing the specific tools and prompt templates that they want to make available to users through the portal. This allows users to access a curated set of tools and prompts — the less external context exposed to the AI model, the better the AI responses tend to be.
diff --git a/src/content/docs/agents/model-context-protocol/authorization.mdx b/src/content/docs/agents/model-context-protocol/authorization.mdx
index 642f75182f95c4e..a58a9abf8d1adf4 100644
--- a/src/content/docs/agents/model-context-protocol/authorization.mdx
+++ b/src/content/docs/agents/model-context-protocol/authorization.mdx
@@ -81,7 +81,7 @@ Remember — [authentication is different from authorization](https://www.cloud
You can use Cloudflare Access as a Single Sign-On (SSO) provider to authorize users to your MCP server. Users log in using a [configured identity provider](/cloudflare-one/integrations/identity-providers/) or a [one-time PIN](/cloudflare-one/integrations/identity-providers/one-time-pin/), and they are only granted access if their identity matches your [Access policies](/cloudflare-one/access-controls/policies/).
-To deploy an [example MCP server](https://github.com/cloudflare/ai/tree/main/demos/remote-mcp-cf-access) with Cloudflare Access as the OAuth provider, refer to [Secure MCP servers with Access for SaaS](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp/).
+To deploy an [example MCP server](https://github.com/cloudflare/ai/tree/main/demos/remote-mcp-cf-access) with Cloudflare Access as the OAuth provider, refer to [Secure MCP servers with Access for SaaS](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp/).
### (3) Third-party OAuth Provider
diff --git a/src/content/docs/agents/model-context-protocol/mcp-portal.mdx b/src/content/docs/agents/model-context-protocol/mcp-portal.mdx
index 5459fdc6089f3cd..8f9b31dc6ba439b 100644
--- a/src/content/docs/agents/model-context-protocol/mcp-portal.mdx
+++ b/src/content/docs/agents/model-context-protocol/mcp-portal.mdx
@@ -5,7 +5,7 @@ tags:
- MCP
sidebar:
order: 101
-external_link: /cloudflare-one/access-controls/applications/configure-apps/mcp-servers/mcp-portals/
+external_link: /cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals/
description: Centralize multiple MCP servers onto a single endpoint and customize the tools, prompts, and resources available to users.
---
diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access.mdx
index ec1d926bd0a9790..37af35adc58c146 100644
--- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access.mdx
+++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/secure-with-access.mdx
@@ -25,4 +25,4 @@ Cloudflare Access provides visibility and control over who has access to your [c
5. Select **Add public hostname**.
6. For **Input method**, select _Custom_.
7. In **Hostname**, enter your custom hostname (for example, `mycustomhostname.com`).
-8. Follow the remaining [self-hosted application creation steps](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/) to publish the application.
+8. Follow the remaining [self-hosted application creation steps](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to publish the application.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/index.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/index.mdx
similarity index 67%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/index.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/index.mdx
index 0b530ad5e94822c..3c87b0fc8a94b8f 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/index.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/index.mdx
@@ -13,12 +13,12 @@ Cloudflare Access allows you to secure your web applications by acting as an ide
You can protect the following types of web applications:
-- [**SaaS applications**](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/) consist of applications your team relies on that are not hosted by your organization. Examples include Salesforce and Workday. To secure SaaS applications, you must integrate Cloudflare Access with the SaaS application's SSO configuration.
+- [**SaaS applications**](/cloudflare-one/access-controls/applications/http-apps/saas-apps/) consist of applications your team relies on that are not hosted by your organization. Examples include Salesforce and Workday. To secure SaaS applications, you must integrate Cloudflare Access with the SaaS application's SSO configuration.
- **Self-hosted applications** consist of internal applications that you host in your own environment. These can be the data center versions of tools like the Atlassian suite or applications created by your own team. Setup requirements for a self-hosted application depend on whether the application is publicly accessible on the Internet or restricted to users on a private network.
- - [**Public hostname applications**](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/) are web applications that have public DNS records. Anyone on the Internet can access the application by entering the URL in their browser and authenticating through Cloudflare Access. Securing access to a public website requires a Cloudflare DNS [full setup](/dns/zone-setups/full-setup/) or [partial CNAME setup](/dns/zone-setups/partial-setup/).
+ - [**Public hostname applications**](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) are web applications that have public DNS records. Anyone on the Internet can access the application by entering the URL in their browser and authenticating through Cloudflare Access. Securing access to a public website requires a Cloudflare DNS [full setup](/dns/zone-setups/full-setup/) or [partial CNAME setup](/dns/zone-setups/partial-setup/).
- [**Private network applications**](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) do not have public DNS records, meaning they are not reachable from the public Internet. To connect using a private IP or private hostname, the user's traffic must route through Cloudflare Gateway. The preferred method is to install the WARP client on the user's device, but you could also forward device traffic from a [network location](/magic-wan/) or use an agentless option such as [PAC files](/cloudflare-one/team-and-resources/devices/agentless/pac-files/) or [Clientless Web Isolation](/cloudflare-one/remote-browser-isolation/setup/clientless-browser-isolation/).
-- [**Model Context Protocol (MCP) servers**](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/) are web applications that enable generative AI tools to read and write data within your business applications. For example, Salesforce provides an [MCP server](https://github.com/salesforcecli/mcp) for developers to interact with resources in their Salesforce tenant using GitHub Copilot or other AI code editors.
+- [**Model Context Protocol (MCP) servers**](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/) are web applications that enable generative AI tools to read and write data within your business applications. For example, Salesforce provides an [MCP server](https://github.com/salesforcecli/mcp) for developers to interact with resources in their Salesforce tenant using GitHub Copilot or other AI code editors.
- [**Cloudflare Dashboard SSO**](/fundamentals/manage-members/dashboard-sso/) is a special type of SaaS application that manages SSO settings for the Cloudflare dashboard and has limited permissions for administrator edits.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/index.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/index.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/index.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/index.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/linked-apps.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/linked-apps.mdx
similarity index 89%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/linked-apps.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/linked-apps.mdx
index 78ca51f016ae532..14470bd309008a4 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/linked-apps.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/linked-apps.mdx
@@ -10,7 +10,7 @@ sidebar:
import { Render, GlossaryTooltip, APIRequest } from "~/components";
-Cloudflare Access can delegate access from any [self-hosted application](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/) to an [Access for SaaS MCP server](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp/) via [OAuth](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization). The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the user, using the user's specific permissions and scopes.
+Cloudflare Access can delegate access from any [self-hosted application](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) to an [Access for SaaS MCP server](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp/) via [OAuth](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization). The OAuth access token authorizes the MCP server to make requests to your self-hosted applications on behalf of the user, using the user's specific permissions and scopes.
For example, your organization may wish to deploy an MCP server that helps employees interact with internal applications. You can configure [Access policies](/cloudflare-one/access-controls/policies/#selectors) to ensure that only authorized users can access those applications, either directly or by using an MCP client.
@@ -40,11 +40,11 @@ This guide covers how to use the Cloudflare API to link a self-hosted applicatio
## Prerequisites
-- A [self-hosted Access application](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/)
+- A [self-hosted Access application](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/)
## 1. Secure the MCP server with Access for SaaS
-The first step is to add the MCP server to Cloudflare Access as an OIDC-based SaaS application. For step-by-step instructions on how to add an MCP server, refer to [Secure MCP servers with Access for SaaS](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp/).
+The first step is to add the MCP server to Cloudflare Access as an OIDC-based SaaS application. For step-by-step instructions on how to add an MCP server, refer to [Secure MCP servers with Access for SaaS](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp/).
## 2. Get the SaaS application ID
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/mcp-portals.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx
similarity index 99%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/mcp-portals.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx
index f4e341466e7a4b4..95d537ef3cf5dcb 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/mcp-portals.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/mcp-portals.mdx
@@ -41,7 +41,7 @@ To add an MCP server:
7. Add [Access policies](/cloudflare-one/access-controls/policies/) to show or hide the server in an [MCP server portal](#create-a-portal). The MCP server link will only appear in the portal for users who match an Allow policy. Users who do not pass an Allow policy will not see this server through any portals.
:::caution
- Blocked users can still connect to the server (and bypass your Access policies) by using its direct URL. If you want to enforce authentication through Cloudflare Access, [configure Access as the server's OAuth provider](/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp/).
+ Blocked users can still connect to the server (and bypass your Access policies) by using its direct URL. If you want to enforce authentication through Cloudflare Access, [configure Access as the server's OAuth provider](/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp/).
:::
8. Select **Save and connect server**.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp.mdx
similarity index 95%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp.mdx
index b91086885d1bb6a..44f42b8b4f95715 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/mcp-servers/saas-mcp.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/mcp-servers/saas-mcp.mdx
@@ -103,7 +103,7 @@ https://mcp-server-cf-access..workers.dev/callback
- **Authorization endpoint**
- **Key endpoint**
-8. (Optional) Under **Advanced settings**, turn on [**Refresh tokens**](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-oidc-saas/#advanced-settings) if you want to reduce the number of times a user needs to log in to the identity provider.
+8. (Optional) Under **Advanced settings**, turn on [**Refresh tokens**](/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/#advanced-settings) if you want to reduce the number of times a user needs to log in to the identity provider.
9. Configure [Access policies](/cloudflare-one/access-controls/policies/) to define the users who can access the MCP server.
10. Save the application.
@@ -134,7 +134,7 @@ https://mcp-server-cf-access..workers.dev/callback
/>
2. Copy the `client_id` and `client_secret` returned in the response.
-3. To determine the OAuth endpoint URLs for the SaaS application, refer to the [generic OIDC documentation](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-oidc-saas/#2-add-your-application-to-access).
+3. To determine the OAuth endpoint URLs for the SaaS application, refer to the [generic OIDC documentation](/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/#2-add-your-application-to-access).
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/adobe-sign-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/adobe-sign-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/adobe-sign-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/adobe-sign-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/area-1.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/area-1.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/area-1.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/area-1.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/asana-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/asana-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/asana-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/asana-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/atlassian-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/atlassian-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/atlassian-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/atlassian-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/aws-sso-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/aws-sso-saas.mdx
similarity index 98%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/aws-sso-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/aws-sso-saas.mdx
index aa0c0b3934b6825..4fe4c1775de6eee 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/aws-sso-saas.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/aws-sso-saas.mdx
@@ -54,7 +54,7 @@ Next, we will obtain **Identity provider metadata** from Zero Trust.
:::caution[Important]
-Access for SaaS does not currently support [SCIM provisioning](/cloudflare-one/identity/users/scim/). Make sure that:
+Access for SaaS does not currently support [SCIM provisioning](/cloudflare-one/team-and-resources/users/scim/). Make sure that:
1. Users are created in both your identity provider and AWS.
2. Users have matching usernames in your identity provider and AWS.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/braintree-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/braintree-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/braintree-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/braintree-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/coupa-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/coupa-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/coupa-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/coupa-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/digicert-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/digicert-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/digicert-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/digicert-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/docusign-access.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/docusign-access.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/docusign-access.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/docusign-access.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/dropbox-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/dropbox-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/dropbox-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/dropbox-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-oidc-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas.mdx
similarity index 98%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-oidc-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas.mdx
index 89fbd3553283bae..1b44964f412470e 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-oidc-saas.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas.mdx
@@ -103,7 +103,7 @@ To add additional OIDC claims onto the ID token sent to your SaaS application, c
### Access token lifetime
-The OIDC Access token authorizes users to connect to the SaaS application through Cloudflare Access. You can set an **Access token lifetime** to determine the window in which the token can be used to establish authentication with the SaaS application — if it expires, the user must re-authenticate through Cloudflare Access. To balance security and user convenience, Cloudflare recommends configuring a short Access token lifetime in conjunction with a longer **Refresh token lifetime** (if supported by your application). When the access token expires, Cloudflare will use the refresh token to obtain a new access token after checking the user's identity against your Access policies. When the refresh token expires, the user will need to log back in to the identity provider. The refresh token lifetime should be less than your [global session duration](/cloudflare-one/identity/users/session-management/), otherwise the global session would take precedence.
+The OIDC Access token authorizes users to connect to the SaaS application through Cloudflare Access. You can set an **Access token lifetime** to determine the window in which the token can be used to establish authentication with the SaaS application — if it expires, the user must re-authenticate through Cloudflare Access. To balance security and user convenience, Cloudflare recommends configuring a short Access token lifetime in conjunction with a longer **Refresh token lifetime** (if supported by your application). When the access token expires, Cloudflare will use the refresh token to obtain a new access token after checking the user's identity against your Access policies. When the refresh token expires, the user will need to log back in to the identity provider. The refresh token lifetime should be less than your [global session duration](/cloudflare-one/team-and-resources/users/session-management/), otherwise the global session would take precedence.
:::note
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-saml-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-saml-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-saml-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-saml-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/github-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/github-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/github-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/github-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/google-cloud-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/google-cloud-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/google-cloud-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/google-cloud-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/google-workspace-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/google-workspace-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/google-workspace-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/google-workspace-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/grafana-cloud-saas-oidc.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/grafana-cloud-saas-oidc.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/grafana-cloud-saas-oidc.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/grafana-cloud-saas-oidc.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/grafana-saas-oidc.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/grafana-saas-oidc.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/grafana-saas-oidc.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/grafana-saas-oidc.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/greenhouse-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/greenhouse-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/greenhouse-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/greenhouse-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/hubspot-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/hubspot-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/hubspot-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/hubspot-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/index.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/index.mdx
similarity index 73%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/index.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/index.mdx
index 4933b0de0a3143a..8288d9c5c037db1 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/index.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/index.mdx
@@ -10,6 +10,6 @@ import { DirectoryListing } from "~/components"
Cloudflare Access allows you to add an additional authentication layer to your SaaS applications. When you integrate a SaaS application with Access, users log in to the application with Cloudflare as the Single Sign-On provider. The user is then redirected to the configured identity providers for that application and are only granted access if they pass your Access policies.
-Cloudflare integrates with the majority of SaaS applications that support the SAML or OIDC authentication protocol. If you do not see your application listed below, refer to our [generic SAML](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-saml-saas/) or [generic OIDC](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/generic-oidc-saas/) guide and consult your SaaS application's documentation.
+Cloudflare integrates with the majority of SaaS applications that support the SAML or OIDC authentication protocol. If you do not see your application listed below, refer to our [generic SAML](/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-saml-saas/) or [generic OIDC](/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/) guide and consult your SaaS application's documentation.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/ironclad-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/ironclad-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/ironclad-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/ironclad-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/jamf-pro-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/jamf-pro-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/jamf-pro-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/jamf-pro-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/miro-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/miro-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/miro-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/miro-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/pagerduty-saml-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/pagerduty-saml-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/pagerduty-saml-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/pagerduty-saml-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/pingboard-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/pingboard-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/pingboard-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/pingboard-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/salesforce-saas-oidc.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/salesforce-saas-oidc.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/salesforce-saas-oidc.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/salesforce-saas-oidc.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/salesforce-saas-saml.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/salesforce-saas-saml.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/salesforce-saas-saml.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/salesforce-saas-saml.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/servicenow-saas-oidc.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/servicenow-saas-oidc.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/servicenow-saas-oidc.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/servicenow-saas-oidc.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/servicenow-saas-saml.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/servicenow-saas-saml.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/servicenow-saas-saml.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/servicenow-saas-saml.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/slack-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/slack-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/slack-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/slack-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/smartsheet-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/smartsheet-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/smartsheet-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/smartsheet-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/sparkpost-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/sparkpost-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/sparkpost-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/sparkpost-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/tableau-saml-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/tableau-saml-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/tableau-saml-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/tableau-saml-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/workday-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/workday-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/workday-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/workday-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/zendesk-sso-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/zendesk-sso-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/zendesk-sso-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/zendesk-sso-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/zoom-saas.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/zoom-saas.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/saas-apps/zoom-saas.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/saas-apps/zoom-saas.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app.mdx b/src/content/docs/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app.mdx
similarity index 100%
rename from src/content/docs/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app.mdx
rename to src/content/docs/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app.mdx
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/browser-rendering.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/browser-rendering.mdx
index 5bdcbc6d2bdcd34..70bce452399e0b8 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/browser-rendering.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/browser-rendering.mdx
@@ -11,7 +11,7 @@ Cloudflare can render SSH, VNC, and RDP applications in a browser without the ne
## Limitations
-- Browser rendering is only supported for [self-hosted public applications](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/), not private IPs or hostnames.
+- Browser rendering is only supported for [self-hosted public applications](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/), not private IPs or hostnames.
- You can only render a browser-rendered terminal on domains and subdomains, not on specific paths.
-
- Cloudflare uses TLS to secure the egress RDP connection to your Windows server. We do not currently validate the chain of trust.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/infrastructure-apps.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/infrastructure-apps.mdx
index 2e344d9cbda5f83..1c2a00196619c52 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/infrastructure-apps.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/infrastructure-apps.mdx
@@ -102,7 +102,7 @@ To view all available filters, type `warp-cli target list --help`.
## Revoke a user's session
-To revoke a user's access to all infrastructure targets, you can either [revoke the user from Zero Trust](/cloudflare-one/identity/users/session-management/#per-user) or revoke their device. Cloudflare does not currently support revoking a user's session for a specific target.
+To revoke a user's access to all infrastructure targets, you can either [revoke the user from Zero Trust](/cloudflare-one/team-and-resources/users/session-management/#per-user) or revoke their device. Cloudflare does not currently support revoking a user's session for a specific target.
## Infrastructure policy selectors
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx
index 7026dc374600857..4fd00718078c34c 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app.mdx
@@ -66,7 +66,7 @@ Users can now connect to your private application after authenticating with Clou
### HTTPS applications
-If [Gateway TLS decryption](/cloudflare-one/traffic-policies/http-policies/tls-decryption/) is turned on and a user is accessing an HTTPS application on port `443`, Cloudflare Access will present a login page in the browser and issue an [application token](/cloudflare-one/identity/authorization-cookie/application-token/) to your origin. This is the same cookie-based authentication flow used by [self-hosted public apps](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/).
+If [Gateway TLS decryption](/cloudflare-one/traffic-policies/http-policies/tls-decryption/) is turned on and a user is accessing an HTTPS application on port `443`, Cloudflare Access will present a login page in the browser and issue an [application token](/cloudflare-one/identity/authorization-cookie/application-token/) to your origin. This is the same cookie-based authentication flow used by [self-hosted public apps](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/).
If [Gateway TLS decryption](/cloudflare-one/traffic-policies/http-policies/tls-decryption/) is turned off, session management is [handled in the WARP client](#non-https-applications) instead of in the browser.
diff --git a/src/content/docs/cloudflare-one/access-controls/applications/non-http/short-lived-certificates-legacy.mdx b/src/content/docs/cloudflare-one/access-controls/applications/non-http/short-lived-certificates-legacy.mdx
index 34ecb33ebe0a46f..c153859d4b8cc9a 100644
--- a/src/content/docs/cloudflare-one/access-controls/applications/non-http/short-lived-certificates-legacy.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/applications/non-http/short-lived-certificates-legacy.mdx
@@ -25,7 +25,7 @@ Cloudflare Access short-lived certificates can work with any modern SSH server,
To secure your server behind Cloudflare Access:
1. [Connect the server to Cloudflare](/cloudflare-one/networks/connectors/cloudflare-tunnel/get-started/create-remote-tunnel/) as a published application.
-2. Create a [self-hosted Access application](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/) for the server.
+2. Create a [self-hosted Access application](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) for the server.
:::note
If you do not wish to use Access, refer instead to our [SSH proxy instructions](/cloudflare-one/traffic-policies/network-policies/ssh-logging/).
diff --git a/src/content/docs/cloudflare-one/access-controls/policies/index.mdx b/src/content/docs/cloudflare-one/access-controls/policies/index.mdx
index 7461895e482ee19..8b64dcf64e423f0 100644
--- a/src/content/docs/cloudflare-one/access-controls/policies/index.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/policies/index.mdx
@@ -131,9 +131,9 @@ To require only one country and one email ending:
## Selectors
-When you add a rule to your policy, you will be asked to specify the criteria/attributes you want users to meet. These attributes are available for all Access application types, including [SaaS](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/), [self-hosted](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/), and [non-HTTP](/cloudflare-one/access-controls/applications/non-http/) applications.
+When you add a rule to your policy, you will be asked to specify the criteria/attributes you want users to meet. These attributes are available for all Access application types, including [SaaS](/cloudflare-one/access-controls/applications/http-apps/saas-apps/), [self-hosted](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/), and [non-HTTP](/cloudflare-one/access-controls/applications/non-http/) applications.
-Non-identity attributes are polled continuously, meaning they are-evaluated with each new HTTP request for changes during the [user session](/cloudflare-one/identity/users/session-management/). If you have configured [SCIM provisioning](/cloudflare-one/identity/users/scim/), you can force a user to re-attest all attributes with Access whenever you revoke the user in the IdP or update their IdP group membership.
+Non-identity attributes are polled continuously, meaning they are-evaluated with each new HTTP request for changes during the [user session](/cloudflare-one/team-and-resources/users/session-management/). If you have configured [SCIM provisioning](/cloudflare-one/team-and-resources/users/scim/), you can force a user to re-attest all attributes with Access whenever you revoke the user in the IdP or update their IdP group membership.
| Selector | Description | Checked at login | Checked continuously1 | Identity-based selector? |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | -------------------------------- | ------------------------ |
@@ -149,7 +149,7 @@ Non-identity attributes are polled continuously, meaning they are-evaluated with
| Any Access Service Token | The request will need to present the headers for any [service token](/cloudflare-one/identity/service-tokens/) created for this account. | ✅ | ✅ | ❌ |
| Login Methods | Checks the identity provider used at the time of login. | ✅ | ❌ | ✅ |
| Authentication Method | Checks the [multifactor authentication](/cloudflare-one/access-controls/policies/mfa-requirements/) method used by the user, if supported by the identity provider. | ✅ | ❌ | ✅ |
-| Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/identity/users/scim/). | ✅ | ❌ | ✅ |
+| Identity provider group | Checks the user groups configured with your identity provider (IdP). This selector only displays if you use Microsoft Entra ID, GitHub, Google, Okta, or an IdP that provisions groups with [SCIM](/cloudflare-one/team-and-resources/users/scim/). | ✅ | ❌ | ✅ |
| SAML Group | Checks a SAML attribute name / value pair. This selector only displays if you use a [generic SAML](/cloudflare-one/integrations/identity-providers/generic-saml/) identity provider. | ✅ | ❌ | ✅ |
| OIDC Claim | Checks an OIDC claim name / value pair. This selector only displays if you use a [generic OIDC](/cloudflare-one/integrations/identity-providers/generic-oidc/) identity provider. | ✅ | ❌ | ✅ |
| Device posture | Checks [device posture signals](/cloudflare-one/identity/devices/) from the WARP client or a third-party service provider. | ✅ | ✅ | ❌ |
diff --git a/src/content/docs/cloudflare-one/access-controls/policies/isolate-application.mdx b/src/content/docs/cloudflare-one/access-controls/policies/isolate-application.mdx
index af0b19c30575f61..7381ab78d7cd33b 100644
--- a/src/content/docs/cloudflare-one/access-controls/policies/isolate-application.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/policies/isolate-application.mdx
@@ -39,4 +39,4 @@ For example, if your application is hosted on `internal.site.com`, the following
## Product compatibility
-For a list of products that are incompatible with the **Isolate application** feature, refer to [Product Compatibility](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/#product-compatibility) .
+For a list of products that are incompatible with the **Isolate application** feature, refer to [Product Compatibility](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/#product-compatibility) .
diff --git a/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx b/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx
index 41efdabadc17224..eed7323491c19d8 100644
--- a/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx
@@ -20,7 +20,7 @@ To enforce an MFA requirement to an application:
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Access** > **Applications**.
-2. Find the application for which you want to enforce MFA and select **Configure**. Alternatively, [create a new application](/cloudflare-one/access-controls/applications/configure-apps/).
+2. Find the application for which you want to enforce MFA and select **Configure**. Alternatively, [create a new application](/cloudflare-one/access-controls/applications/http-apps/).
3. Go to **Policies**.
diff --git a/src/content/docs/cloudflare-one/access-controls/policies/policy-management.mdx b/src/content/docs/cloudflare-one/access-controls/policies/policy-management.mdx
index b2807d54672dcaf..913a3bf26be626b 100644
--- a/src/content/docs/cloudflare-one/access-controls/policies/policy-management.mdx
+++ b/src/content/docs/cloudflare-one/access-controls/policies/policy-management.mdx
@@ -17,7 +17,7 @@ To create a reusable Access policy:
2. Select **Add a policy**.
3. Enter a **Policy name**.
4. Choose an [**Action**](/cloudflare-one/access-controls/policies/#actions) for the policy.
-5. Choose a [**Session duration**](/cloudflare-one/identity/users/session-management/) for the policy.
+5. Choose a [**Session duration**](/cloudflare-one/team-and-resources/users/session-management/) for the policy.
6. Configure as many [**Rules**](/cloudflare-one/access-controls/policies/#rule-types) as needed.
7. (Optional) Configure additional settings for users who match this policy:
- [Isolate application](/cloudflare-one/access-controls/policies/isolate-application/).
diff --git a/src/content/docs/cloudflare-one/applications/app-library.mdx b/src/content/docs/cloudflare-one/applications/app-library.mdx
index 37f87bb43e8a3d6..8616be08861d85c 100644
--- a/src/content/docs/cloudflare-one/applications/app-library.mdx
+++ b/src/content/docs/cloudflare-one/applications/app-library.mdx
@@ -34,7 +34,7 @@ The **Findings** tab shows any connected [CASB integrations](/cloudflare-one/app
### Policies
-The **Policies** tab shows any [Gateway](/cloudflare-one/traffic-policies/) and [Access for SaaS](/cloudflare-one/access-controls/applications/configure-apps/saas-apps/) policies related to the selected application.
+The **Policies** tab shows any [Gateway](/cloudflare-one/traffic-policies/) and [Access for SaaS](/cloudflare-one/access-controls/applications/http-apps/saas-apps/) policies related to the selected application.
### Usage
diff --git a/src/content/docs/cloudflare-one/changelog/access.mdx b/src/content/docs/cloudflare-one/changelog/access.mdx
index 4cf509e0e424f9e..3237fb1dbc41bae 100644
--- a/src/content/docs/cloudflare-one/changelog/access.mdx
+++ b/src/content/docs/cloudflare-one/changelog/access.mdx
@@ -29,7 +29,7 @@ You can now filter Access policies by their action, selectors, rule groups, and
**Access Applications support private hostnames/IPs and reusable Access policies.**
-Cloudflare Access self-hosted applications can now be defined by [private IPs](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/), [private hostnames](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) (on port 443) and [public hostnames](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/). Additionally, we made Access policies into their own object which can be reused across multiple applications. These updates involved significant updates to the overall Access dashboard experience. The updates will be slowly rolled out to different customer cohorts. If you are an Enterprise customer and would like early access, reach out to your account team.
+Cloudflare Access self-hosted applications can now be defined by [private IPs](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/), [private hostnames](/cloudflare-one/access-controls/applications/non-http/self-hosted-private-app/) (on port 443) and [public hostnames](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/). Additionally, we made Access policies into their own object which can be reused across multiple applications. These updates involved significant updates to the overall Access dashboard experience. The updates will be slowly rolled out to different customer cohorts. If you are an Enterprise customer and would like early access, reach out to your account team.
## 2025-01-15
@@ -53,7 +53,7 @@ Admins can now use [Access for Infrastructure](/cloudflare-one/networks/connecto
**Reduce automatic seat deprovisioning minimum to 1 month, down from 2 months.**
-Admins can now configure Zero Trust seats to [automatically expire](/cloudflare-one/identity/users/seat-management/#enable-seat-expiration) after 1 month of user inactivity. The previous minimum was 2 months.
+Admins can now configure Zero Trust seats to [automatically expire](/cloudflare-one/team-and-resources/users/seat-management/#enable-seat-expiration) after 1 month of user inactivity. The previous minimum was 2 months.
## 2024-06-06
diff --git a/src/content/docs/cloudflare-one/faq/authentication-faq.mdx b/src/content/docs/cloudflare-one/faq/authentication-faq.mdx
index a3a7abcbf2e62cb..cd5a0d9798d49b1 100644
--- a/src/content/docs/cloudflare-one/faq/authentication-faq.mdx
+++ b/src/content/docs/cloudflare-one/faq/authentication-faq.mdx
@@ -33,4 +33,4 @@ To log out of an App Launcher session, go to:
`.cloudflareaccess.com/cdn-cgi/access/logout`
-For more information, refer to our [session management page](/cloudflare-one/identity/users/session-management/#log-out-as-a-user).
+For more information, refer to our [session management page](/cloudflare-one/team-and-resources/users/session-management/#log-out-as-a-user).
diff --git a/src/content/docs/cloudflare-one/identity/authorization-cookie/application-token.mdx b/src/content/docs/cloudflare-one/identity/authorization-cookie/application-token.mdx
index b89b47c4dc5f773..fafc8527875a5f0 100644
--- a/src/content/docs/cloudflare-one/identity/authorization-cookie/application-token.mdx
+++ b/src/content/docs/cloudflare-one/identity/authorization-cookie/application-token.mdx
@@ -63,7 +63,7 @@ The payload contains the actual claim and user information to pass to the applic
| iss | The Cloudflare Access domain URL for the application. |
| type | The type of Access token (`app` for application token or `org` for global session token). |
| identity_nonce | A cache key used to get the [user's identity](#user-identity). |
-| sub | The ID of the user. This value is unique to an email address per account. The user would get a different `sub` if they are [removed](/cloudflare-one/identity/users/seat-management/#remove-a-user) and re-added to your Zero Trust organization, or if they log into a different organization. |
+| sub | The ID of the user. This value is unique to an email address per account. The user would get a different `sub` if they are [removed](/cloudflare-one/team-and-resources/users/seat-management/#remove-a-user) and re-added to your Zero Trust organization, or if they log into a different organization. |
| country | The country where the user authenticated from. |
#### Custom SAML attributes and OIDC claims
diff --git a/src/content/docs/cloudflare-one/identity/authorization-cookie/cors.mdx b/src/content/docs/cloudflare-one/identity/authorization-cookie/cors.mdx
index abfd9ec2dd8e2bc..0c9aaf811db45c0 100644
--- a/src/content/docs/cloudflare-one/identity/authorization-cookie/cors.mdx
+++ b/src/content/docs/cloudflare-one/identity/authorization-cookie/cors.mdx
@@ -122,7 +122,7 @@ To avoid having to log in twice, you can create a Cloudflare Worker that automat
- [Workers account](/workers/get-started/guide/)
- `wrangler` installation
-- `example.com` and `api.mysite.com` domains [protected by Access](/cloudflare-one/access-controls/applications/configure-apps/)
+- `example.com` and `api.mysite.com` domains [protected by Access](/cloudflare-one/access-controls/applications/http-apps/)
### 1. Generate a service token
diff --git a/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx b/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx
index c60eb43beadaea2..e0e5852e7c1e22d 100644
--- a/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx
+++ b/src/content/docs/cloudflare-one/identity/authorization-cookie/index.mdx
@@ -22,7 +22,7 @@ Access generates two separate `CF_Authorization` tokens depending on the domain:
### Multi-domain applications
-Cloudflare Access allows you to protect and manage multiple domains in a single [self-hosted application](/cloudflare-one/access-controls/applications/configure-apps/self-hosted-public-app/). After a user has successfully authenticated to one domain, Access will automatically issue a `CF_Authorization` cookie when they go to another domain in the same Access application. This means that users only need to authenticate once to a multi-domain application.
+Cloudflare Access allows you to protect and manage multiple domains in a single [self-hosted application](/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/). After a user has successfully authenticated to one domain, Access will automatically issue a `CF_Authorization` cookie when they go to another domain in the same Access application. This means that users only need to authenticate once to a multi-domain application.
For Access applications with five or less domains, Access will preemptively set the cookie for all domains through a series of redirects. This allows single-page applications (SPAs) to retrieve data from other subdomains, even if the user has not explicitly visited those subdomains. Note that we cannot set cookies up-front for a wildcarded subdomain, because we do not know which concrete subdomain to redirect to (wildcarded paths are allowed).
@@ -36,19 +36,19 @@ The following Access cookies are essential to Access functionality. Cookies that
| Details | Expiration | HttpOnly | SameSite | Required? |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | -------- | --------- |
-| [JSON web token (JWT)](/cloudflare-one/identity/authorization-cookie/#access-jwts) set on the `cloudflareaccess.com` [team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name) that contains the user's identity and enables Access to perform single sign-on (SSO) | View
If set, adheres to [global session duration](/cloudflare-one/identity/users/session-management/#global-session-duration).
If not, adheres to [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).
If neither are set, defaults to 24 hours.View
If set, adheres to [global session duration](/cloudflare-one/team-and-resources/users/session-management/#global-session-duration).
If not, adheres to [application session duration](/cloudflare-one/team-and-resources/users/session-management/#application-session-duration).
If neither are set, defaults to 24 hours.View
If set, adheres to [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration).
If not, adheres to [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).
If neither are set, defaults to 24 hours.View
If set, adheres to [policy session duration](/cloudflare-one/team-and-resources/users/session-management/#policy-session-duration).
If not, adheres to [application session duration](/cloudflare-one/team-and-resources/users/session-management/#application-session-duration).
If neither are set, defaults to 24 hours.View
If set, adheres to [policy session duration](/cloudflare-one/identity/users/session-management/#policy-session-duration).
If not, adheres to [application session duration](/cloudflare-one/identity/users/session-management/#application-session-duration).
If neither are set, defaults to 24 hours.View
If set, adheres to [policy session duration](/cloudflare-one/team-and-resources/users/session-management/#policy-session-duration).
If not, adheres to [application session duration](/cloudflare-one/team-and-resources/users/session-management/#application-session-duration).
If neither are set, defaults to 24 hours.