Managed deployment

---

• Prerequisites
• Windows
• Install the Cloudflare One Client
• Supported properties
• Uninstall the Cloudflare One Client
• Update MDM parameters
• Authenticate in embedded browser
• macOS
• Prepare file for MDM deployment
• plist file
• mobileconfig file
• Place an unmanaged mdm.xml file
• Linux
• iOS
• Android / ChromeOS

---

import { Render, GlossaryTooltip } from "~/components";

This page provides generic instructions for an automated deployment. If you want to deploy the Cloudflare One Client manually, refer to the instructions for manual deployment.

:::caution

:::

Prerequisites

• Refer to the Download page to review system requirements and download the installer for your operating system.

Windows

The Cloudflare One Client for Windows allows for an automated install via tools like Intune, AD, or any script or management tool that can execute a .msi file.

Install the Cloudflare One Client

To install the Cloudflare One Client, run the following command:

msiexec /i "Cloudflare_WARP_<VERSION>.msi" /qn ORGANIZATION="your-team-name" SUPPORT_URL="http://support.example.com"

Supported properties

The Cloudflare One Client MSI installer supports the following public properties:

• ORGANIZATION
• GATEWAY_UNIQUE_ID
• AUTH_CLIENT_ID
• AUTH_CLIENT_SECRET
• ONBOARDING
• OVERRIDE_API_ENDPOINT
• OVERRIDE_DOH_ENDPOINT
• OVERRIDE_WARP_ENDPOINT
• SERVICE_MODE
• SUPPORT_URL
• SWITCH_LOCKED

Refer to deployment parameters for a description of each property.

Uninstall the Cloudflare One Client

To uninstall the Cloudflare One Client:

1. First, locate the .msi package with the following PowerShell command:

Get-WmiObject Win32_Product | Where-Object { $_.Name -match "Cloudflare One Client" } | Sort-Object -Property Name | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize

IdentifyingNumber                      Name                  LocalPackage
-----------------                      ----                  ------------
{9949770E-B807-4610-9A96-8CD4997A736A} Cloudflare One Client C:\WINDOWS\Installer\cd8edd0.msi

2. You can then use the LocalPackage output in the uninstall command. For example,

msiexec /x "<LOCAL_PACKAGE_PATH>" /quiet

:::note If uninstall protection is turned on, add UNINSTALL_TOKEN="<ACCOUNT_WIDE_UNINSTALL_TOKEN>" to the command. Silent uninstalls, upgrades, and downgrades fail without a valid token. :::

Update MDM parameters

The on-disk configuration of the Windows client can be changed at any time by modifying or replacing the contents of C:\ProgramData\Cloudflare\mdm.xml. The format of this file is as follows:

<dict>
  <key>organization</key>
  <string>your-team-name</string>
	<key>onboarding</key>
	<false/>
</dict>

:::note If uninstall protection is turned on, the client blocks changes to mdm.xml. Unlock the client with warp-cli uninstall-protection unlock first. :::

Changes to this file are processed immediately by the Cloudflare One Client.

Authenticate in embedded browser

By default the Cloudflare One Client will use the user's default browser to perform registration. You can override the default setting to instead authenticate users in an embedded browser. The embedded browser will work around any protocol handler issues that may prevent the default browser from launching.

To use an embedded browser:

1. Download and install WebView2 by following the Microsoft instructions.
2. Add a registry key with the following command:

   REG ADD HKLM\SOFTWARE\Cloudflare\CloudflareWARP /f /v UseWebView2 /t REG_SZ /d y
   

The Cloudflare One Client will now launch WebView2 when the user is registering their device with Zero Trust.

macOS

The Cloudflare One Client for macOS allows for an automated install via tools like Jamf, Intune, Kandji, or JumpCloud or any script or management tool that can place a com.cloudflare.warp.plist file in /Library/Managed Preferences. The plist can also be wrapped in a .mobileconfig.

If you do not wish to use a management tool, you can manually place an mdm.xml file in /Library/Application Support/Cloudflare.

Prepare file for MDM deployment

plist file

1. Download an example com.cloudflare.warp.plist file.
2. Replace your-team-name with your Cloudflare One team name.
3. Modify the file with your desired deployment parameters.

mobileconfig file

1. Download an example .mobileconfig file.
2. Replace your-team-name with your Cloudflare One team name.
3. Run uuidgen from your macOS Terminal. This will generate a value for PayloadUUID, which you can use to replace the default value used for PayloadUUID.
4. Modify the file with your desired deployment parameters.

Place an unmanaged mdm.xml file

You can configure Cloudflare One Client deployment parameters on macOS by manually placing an mdm.xml file in /Library/Application Support/Cloudflare. This deployment method is an alternative to pushing a plist or mobileconfig using an MDM tool.

The format of /Library/Application Support/Cloudflare/mdm.xml is as follows:

<dict>
  <key>organization</key>
  <string>your-team-name</string>
</dict>

Linux

The Cloudflare One Client for Linux allows for an automated install via the presence of an mdm.xml file in /var/lib/cloudflare-warp. The format of /var/lib/cloudflare-warp/mdm.xml is as follows:

<dict>
  <key>organization</key>
  <string>your-team-name</string>
</dict>

Refer to deployment parameters for a list of accepted arguments.

To learn how to automate Cloudflare One Client deployment on headless servers, refer to our tutorial.

iOS

:::note[Migrate from 1.1.1.1]

The legacy iOS client, 1.1.1.1: Faster Internet, has been replaced by the Cloudflare One Agent. Learn more in our migration guide. :::

The Cloudflare One Client for iOS, known in the App Store as Cloudflare One Agent, allows for an automated install via tools like Jamf, Intune, or SimpleMDM.

To proceed with the installation, here is an example of the XML code you will need:

<dict>
    <key>organization</key>
    <string>your-team-name</string>
    <key>auto_connect</key>
    <integer>1</integer>
    <key>switch_locked</key>
    <false />
    <key>service_mode</key>
    <string>warp</string>
    <key>support_url</key>
    <string>https://support.example.com</string>
</dict>

Refer to deployment parameters for a description of each argument.

Android / ChromeOS

:::note[Migrate from 1.1.1.1]

The legacy Android client, 1.1.1.1 + WARP: Safer Internet, has been replaced by the Cloudflare One Agent. Learn more in our migration guide. :::

The Cloudflare One Client for Android, known in the Google Play store as Cloudflare One Agent, allows for an automated install via tools like Intune, Google Endpoint Manager, and others.

To proceed with the installation, here is an example of the XML code you will need:

<key>organization</key>
<string>your-team-name</string>
<key>switch_locked</key>
<true />
<key>auto_connect</key>
<integer>0</integer>
<key>gateway_unique_id</key>
<string>your_gateway_doh_subdomain</string>
<key>service_mode</key>
<string>warp</string>
<key>support_url</key>
<string>https://support.example.com</string>

If your MDM tool does not support XML, you may need to convert the XML to JSON. Here is an example below:

{
	"organization": "your-team-name",
	"gateway_unique_id": "your_gateway_doh_subdomain",
	"onboarding": true,
	"switch_locked": true,
	"auto_connect": 0,
	"service_mode": "warp",
	"support_url": "https://support.example.com"
}

Refer to deployment parameters for a description of each value.