Create the Zero Trust organization

Everything in this module lives inside one container: the Zero Trust organization. Devices enroll into it, tunnels belong to it, policies apply within it. Creating it carefully now saves confusion later.

Create a Cloudflare account, then open the Zero Trust dashboard at one.dash.cloudflare.com and follow the onboarding. You will pick a plan along the way. The free plan may still ask for payment details even when the selected plan costs nothing — expected, not a dark pattern you triggered by mistake.

During onboarding you choose the team name. Record it. It becomes your organization’s identity, visible in the enrollment domain, and remote devices use it when they log in through the Cloudflare One Client. Pick something short you can type on a phone keyboard.

team name         flavio-lab
org login domain  flavio-lab.cloudflareaccess.com
enrollment rule   allow only [email protected]

If you lose the team name later, it is in the dashboard settings — but the client login screen asks for it before anything else, so keeping it written down avoids a silly roadblock.

Next, before enrolling anything, open the device enrollment permissions and allow only the email identity you will use for the lab. The default One-time PIN login method emails a code to the address a rule allows, so you do not need to configure an identity provider for this exercise.

Verify the boundary works by visiting your enrollment domain in a browser:

open https://flavio-lab.cloudflareaccess.com
# the login page should offer a one-time PIN for your email

An email outside your rule should fail to get in. That failed attempt is a test worth running on purpose.

Do not use an Everyone rule for a real deployment. Enrollment is the front door to your organization, and the team name is not a secret — it appears in login URLs and can be guessed. An Everyone rule means anyone who learns the name can join a device to your organization and start knocking on your policies from the inside.