Create the Zero Trust organization

Everything in this module lives inside one container: the Zero Trust organization. Devices enroll into it, tunnels belong to it, policies apply within it. Creating it carefully now saves confusion later.

Create a Cloudflare account, then open the Zero Trust dashboard at one.dash.cloudflare.com and follow the onboarding. You will pick a plan along the way. The free plan may still ask for payment details even when the selected plan costs nothing. That is expected, not a dark pattern you triggered by mistake.

During onboarding you choose the team name. Write it down. It becomes your organization’s identity, it shows up in the enrollment domain, and remote devices type it when they log in through the Cloudflare One Client. Pick something short you can type on a phone keyboard.

Here is what I use for the lab:

team name         flavio-lab
org login domain  flavio-lab.cloudflareaccess.com
enrollment rule   allow only [email protected]

If you lose the team name later, it is in the dashboard settings. But the client login screen asks for it before anything else, so keeping it written down avoids a silly roadblock.

Next, before enrolling anything, open the device enrollment permissions and allow only the email identity you will use for the lab. The default One-time PIN login method emails a code to any address a rule allows. So you do not need to configure an identity provider for this exercise. Your inbox is the identity provider.

Now verify the boundary works. Visit your enrollment domain in a browser:

open https://flavio-lab.cloudflareaccess.com
# the login page should offer a one-time PIN for your email

Enter your allowed email, and a code arrives in your inbox within a minute. Enter it, and you are in.

Then test the other direction. Enter an email outside your rule. It should fail to get in, with a message that the account is not authorized. Run that failed attempt on purpose. A rule you have only seen succeed is a rule you have not tested.

Don’t use an Everyone rule for a real deployment. Enrollment is the front door to your organization, and the team name is not a secret. It appears in login URLs and can be guessed. An Everyone rule means anyone who learns the name can join a device to your organization and start knocking on your policies from the inside.

Try this before moving on: open the enrollment domain a second time and go through the one-time PIN flow again, start to finish. It is the same flow your remote device will use in two lessons, and you want to have seen it once already.