Device profiles

import { Render, TabItem, Tabs, APIRequest } from "~/components";

Create a new profile

1. In the Cloudflare dashboard, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.
2. Select Create new profile. This will make a copy of the Default profile.
3. Enter any name for the profile.
4. Create rules to define the devices that will use this profile. Learn more about the available Selectors, Operators, and Values.
5. Configure device client settings for these devices.

:::note

At this time, Split Tunnels and Local Domain Fallback can only be modified after you save the profile. :::

6. Select Create profile.

Your profile will appear in the Profile settings list. You can rearrange the profiles in the list according to your desired order of precedence.

Send a POST request to the Devices API:

<APIRequest path="/accounts/{account_id}/devices/policy" method="POST" json={{ allow_mode_switch: false, allow_updates: false, allowed_to_leave: false, auto_connect: 600, captive_portal: 180, description: "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/", disable_auto_fallback: true, enabled: true, exclude_office_ips: false, match: 'identity.email in {"jdoe@example.com"} or any(identity.groups.name[*] in {"developers" "admin"}) and os.name == "windows"', name: "Example device profile", precedence: 101, service_mode_v2: { mode: "warp", }, support_url: "https://support.example.com", switch_locked: true, }} />

1. Add the following permission to your cloudflare_api_token:

   • Zero Trust Write

2. Create a new profile using the cloudflare_zero_trust_device_custom_profile resource:

   resource "cloudflare_zero_trust_device_custom_profile" "example" {
   	account_id            = var.cloudflare_account_id
   	name                  = "Example device profile"
   	description           = "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/"
   	allow_mode_switch     = false
   	allow_updates         = false
   	allowed_to_leave      = false
   	auto_connect          = 600
   	captive_portal        = 180
   	disable_auto_fallback = true
   	enabled               = true
   	exclude_office_ips    = false
   	precedence            = 101
   	service_mode_v2       = {mode = "warp"}
   	support_url           = "https://support.example.com"
   	switch_locked         = true
   	tunnel_protocol       = "wireguard"
   
   	match = trimspace(replace(<<-EOT
   		identity.email in {"jdoe@example.com"}
   		or any(identity.groups.name[*] in {"developers" "admin"})
   		and os.name == "windows"
   	EOT
   	, "\n", " "))
   }
   

Edit profile settings

Verify device profile

Via the dashboard

To verify the last active device profile for a specific device:

1. In the Cloudflare dashboard, go to Zero Trust > Team & Resources > Devices.
2. Under devices, find your device.
3. Review the device profile under Last active device profile.

To verify the last active device profile for a user's devices:

1. In the Cloudflare dashboard, go to Zero Trust > Team & Resources > Users.
2. Under User name, find the user you would like to investigate.
3. Select Devices to see all devices used by the user.
4. Find the device you want to investigate and verify the last active device profile for that device under the Device profile column.

Alternatively, you can use DEX remote captures to collect client diagnostic logs. The device profile UUID is shown in your detection report under Profile ID.

Via the CLI

To check which device profile and profile settings are currently on a device, open a terminal and run:

warp-cli settings

The device profile UUID is shown in the Profile ID field.

Selectors

You can configure device profiles to match against the following selectors, or criteria. Identity-based selectors are only available if the user enrolled the device by logging in to an identity provider (IdP).

User email

Apply a device profile based on the user's email.

<Render file="gateway/selectors/user-email" product="cloudflare-one" params={{ UIname: "User email" }} />

User group emails

Apply a device profile based on an IdP group email address of which the user is configured as a member in the IdP.

<Render file="gateway/selectors/user-group-email" product="cloudflare-one" params={{ UIname: "User group emails" }} />

User group IDs

Apply a device profile based on an IdP group ID of which the user is configured as a member in the IdP.

<Render file="gateway/selectors/user-group-ids" product="cloudflare-one" params={{ UIname: "User group IDs" }} />

User group names

Apply a device profile based on an IdP group name of which the user is configured as a member in the IdP.

<Render file="gateway/selectors/user-group-names" product="cloudflare-one" params={{ UIname: "User group names" }} />

Operating system

Apply a device profile based on the operating system of the device.

Operating system version

Apply a device profile based on the OS version of the device.

Managed network

Apply a device profile based on the managed network that the device is connected to.

SAML attributes

Apply a device profile based on an attribute name and value from a SAML IdP.

Service token

Apply a device profile based on the service token used to enroll the device.

Comparison operators

Comparison operators determine how device profiles match a selector.

Logical operators

To evaluate multiple conditions in an expression, select a logical operator:

Order of precedence