Coverage
Every Cloudflare One capability this environment can show, the chapter that shows it, and whether it can be run today. Then everything it cannot, and why.
In this environment
| Capability | Chapter | Status | Note |
|---|---|---|---|
| Access: self-hosted applications | 1. Identity and per-application access | Shown | Five web apps, one policy each |
| Access: identity provider over OIDC, directory over SCIM | 1. Identity and per-application access | Shown | FlareID |
| Access: groups from identity provider claims | 1. Identity and per-application access | Shown | All Employees is a dynamic group |
| Access: App Launcher | 1. Identity and per-application access | Shown | |
| Cloudflare Tunnel, outbound only | 2. VPN replacement for an internal app | Shown | |
| Private network routes | 2. VPN replacement for an internal app | Shown | One /32, not a subnet |
| Split tunnels | 2. VPN replacement for an internal app | Shown | The lab's 10/8 network stays outside the tunnel |
| Internal DNS zones and resolver policies | 2. VPN replacement for an internal app | Shown | corp.internal, answered by Cloudflare |
| Access: private-network applications | 2. VPN replacement for an internal app | Shown | Per port on one server |
| Access for Infrastructure: SSH with short-lived certificates | 3. Privileged SSH and database access | Shown | |
| Access: purpose justification | 3. Privileged SSH and database access | Shown | pgAdmin |
| Access for SaaS (OIDC) to an off-the-shelf app | 3. Privileged SSH and database access | Shown | pgAdmin's own login |
| SSH command logging | 3. Privileged SSH and database access | Shown | Decrypted with a key Cloudflare does not hold |
| Gateway network (L4) policies | 3. Privileged SSH and database access | Shown | Postgres closed to all but the IT Admins |
| Clientless Browser Isolation | 4. Clientless isolated access for contractors | Planned | |
| One-time PIN for external users | 4. Clientless isolated access for contractors | Planned | |
| Gateway DNS policies and DNS locations | 5. DNS filtering for office networks | Planned | |
| Block page branding | 5. DNS filtering for office networks | Planned | |
| Gateway HTTP policies and TLS inspection | 8. Shadow AI, and the sanctioned path | Shown | |
| DLP: custom and predefined profiles | 6. DLP on uploads and on internal apps | Shown | |
| Gateway application types | 6. DLP on uploads and on internal apps | Shown | Every file sharing service in one selector |
| DLP on an internal application | 6. DLP on uploads and on internal apps | Shown | Backlog's tickets are the test data |
| Antivirus scanning on upload and download | 6. DLP on uploads and on internal apps | Shown | The EICAR test file |
| Device posture and device profiles | 7. Device posture for sensitive applications | Planned | |
| Digital Experience Monitoring | 7. Device posture for sensitive applications | Planned | |
| Application Library review statuses | 8. Shadow AI, and the sanctioned path | Shown | |
| Browser Isolation from a Gateway policy | 8. Shadow AI, and the sanctioned path | Shown | Gemini, clipboard off |
| AI prompt logging | 8. Shadow AI, and the sanctioned path | Shown | |
| MCP server portal | 9. Securing MCP and agent access | Shown | |
| Gateway DLP on MCP tool traffic | 9. Securing MCP and agent access | Shown | |
| AI Gateway DLP and guardrails | 9. Securing MCP and agent access | Shown | |
| Access and Gateway logs | 10. Evidence: logs, decrypted payloads, prompts | Shown, partly | |
| Payload and prompt log decryption | 10. Evidence: logs, decrypted payloads, prompts | Shown, partly | |
| User risk scoring | 10. Evidence: logs, decrypted payloads, prompts | Not configured yet | Not configured yet |
Out of scope
Each of these is a real Cloudflare One capability that this environment does not attempt, almost always because it needs something a self-deploying lab cannot create: a branch appliance, a third-party subscription, a Windows host, or an entitlement the lab account does not carry. Say so when it comes up rather than improvising.
| Capability | Why not here |
|---|---|
| Cloudflare WAN, IPsec and GRE, branch connectors | Needs a physical or virtual branch appliance per site. |
| Cloudflare Network Firewall and IDS | Sits on Cloudflare WAN, above. |
| Third-party device posture (CrowdStrike, Intune, SentinelOne) | Needs a subscription to each. Native posture checks are chapter 7. |
| Windows RDP and VNC targets | The lab's private estate is a Linux VM. |
| Dedicated egress IPs | Not entitled on the lab account. |
| SaaS tenant control | Needs a real Google or Microsoft tenant to control. |
| CASB | Needs third-party SaaS tenants to scan. |
| Email security | Needs a mail flow to inspect. |
| File sandboxing | Not provisioned in the lab account; chapter 6 shows antivirus scanning instead. |
| Logpush | Not provisioned in the lab; named as the production path in chapter 10. |