A device profile defines Cloudflare One Client settings for a specific set of devices in your organization. You can create multiple profiles and apply different settings based on the user's identity, the device's location, and other criteria.
For example, users in one identity provider group (signifying a specific office location) might have different routes that need to be excluded from their WARP tunnel, or some device types (like Linux) might need different DNS settings to accommodate local development services.
- In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.
- Select Create new profile. This will make a copy of the Default profile.
- Enter any name for the profile.
- Create rules to define the devices that will use this profile. Learn more about the available Selectors, Operators, and Values.
- Configure device client settings for these devices.
- Select Create profile.
Your profile will appear in the Profile settings list. You can rearrange the profiles in the list according to your desired order of precedence.
Send a POST request to the Devices API:
Required API token permissions
At least one of the following token permissions is required:Zero Trust Write
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/devices/policy" \
--request POST \
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
--json '{
"allow_mode_switch": false,
"allow_updates": false,
"allowed_to_leave": false,
"auto_connect": 600,
"captive_portal": 180,
"description": "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/",
"disable_auto_fallback": true,
"enabled": true,
"exclude_office_ips": false,
"match": "identity.email in {\"jdoe@example.com\"} or any(identity.groups.name[*] in {\"developers\" \"admin\"}) and os.name == \"windows\"",
"name": "Example device profile",
"precedence": 101,
"service_mode_v2": {
"mode": "warp"
},
"support_url": "https://support.example.com",
"switch_locked": true
}'-
Add the following permission to your
cloudflare_api_token↗:Zero Trust Write
-
Create a new profile using the
cloudflare_zero_trust_device_custom_profile↗ resource:resource "cloudflare_zero_trust_device_custom_profile" "example" { account_id = var.cloudflare_account_id name = "Example device profile" description = "Example device profile recommended in the implementation documentation. For details, refer to https://developers.cloudflare.com/learning-paths/replace-vpn/configure-device-agent/device-profiles/" allow_mode_switch = false allow_updates = false allowed_to_leave = false auto_connect = 600 captive_portal = 180 disable_auto_fallback = true enabled = true exclude_office_ips = false precedence = 101 service_mode_v2 = {mode = "warp"} support_url = "https://support.example.com" switch_locked = true tunnel_protocol = "wireguard" match = trimspace(replace(<<-EOT identity.email in {"jdoe@example.com"} or any(identity.groups.name[*] in {"developers" "admin"}) and os.name == "windows" EOT , "\n", " ")) }
-
In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices > Device profiles > General profiles.
-
Locate the device profile you would like to update and select Configure.
-
Use selectors to add or adjust match rules, and modify device client settings for this profile as needed.
-
Select Save profile.
It may take up to 10 minutes for newly updated settings to propagate to devices.
To verify the last active device profile for a specific device:
- In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Devices.
- Under devices, find your device.
- Review the device profile under Last active device profile.
To verify the last active device profile for a user's devices:
- In the Cloudflare dashboard ↗, go to Zero Trust > Team & Resources > Users.
- Under User name, find the user you would like to investigate.
- Select Devices to see all devices used by the user.
- Find the device you want to investigate and verify the last active device profile for that device under the Device profile column.
Alternatively, you can use DEX remote captures to collect client diagnostic logs. The device profile UUID is shown in your detection report under Profile ID.
To check which device profile and profile settings are currently on a device, open a terminal and run:
warp-cli settingsThe device profile UUID is shown in the Profile ID field.
You can configure device profiles to match against the following selectors, or criteria. Identity-based selectors are only available if the user enrolled the device by logging in to an identity provider (IdP).
Apply a device profile based on the user's email.
| UI name | API example value |
|---|---|
| User email | identity.email == "user-name@company.com" |
Apply a device profile based on an IdP group email address of which the user is configured as a member in the IdP.
| UI name | API example |
|---|---|
| User group emails | identity.groups.email == "contractors@company.com" |
Apply a device profile based on an IdP group ID of which the user is configured as a member in the IdP.
| UI name | API example |
|---|---|
| User group IDs | identity.groups.id == "12jf495bhjd7893ml09o" |
Apply a device profile based on an IdP group name of which the user is configured as a member in the IdP.
| UI name | API example |
|---|---|
| User group names | identity.groups.name == "\"finance\"" |
Apply a device profile based on the operating system of the device.
| UI name | API example |
|---|---|
| Operating system | os.name in {\"windows\" \"mac\"} |
Apply a device profile based on the OS version of the device.
| UI name | API example |
|---|---|
| Operating system version | os.version == \"1.2.0\" |
Apply a device profile based on the managed network that the device is connected to.
| UI name | API example |
|---|---|
| Managed network | network == \"Austin office\" |
Apply a device profile based on an attribute name and value from a SAML IdP.
| UI name | API example |
|---|---|
| SAML Attributes | identity.saml_attributes == "\"group=finance\"" |
Apply a device profile based on the service token used to enroll the device.
| UI name | API example |
|---|---|
| Service Token | identity.service_token_uuid == \"f174e90a-fafe-4643-bbbc-4a0ed4fc8415\" |
Comparison operators determine how device profiles match a selector.
| Operator | Meaning |
|---|---|
| is | equals the defined value |
| in | matches at least one of the defined values |
To evaluate multiple conditions in an expression, select a logical operator:
| Operator | Meaning |
|---|---|
| And | match all of the conditions in the expression |
| Or | match any of the conditions in the expression |
The Cloudflare One Client evaluates device profiles dynamically based on a hierarchy. When a device connects, the client checks the profiles from top to bottom as they appear in the dashboard. The client follows the first match principle — once a device matches a profile, the client stops evaluating and no subsequent profiles can override the decision.
The Default profile is always at the bottom of the list. It will only be applied if the device does not meet the criteria of any profile listed above it. If you make another custom profile the default, all settings will be copied over into the Default profile.
Administrators can create multiple profiles to apply different settings based on specific criteria such as user identity, location, or operating system. Understanding this top-to-bottom evaluation order is crucial for ensuring that the correct policies are applied to devices.