cloudflare-one

Private destination apps require the WARP device client or another network on-ramp plus routes and DNS resolution, not just an Access application. Retrieve the self-hosted private app docs, then configure tunnel routes, split tunnel entries, resolver policies, and an Allow policy since Access is default-deny.

Use Include mode for VPN replacement only, routing just private CIDRs through the client. Use Exclude mode for secure web gateway deployments where all traffic goes through Cloudflare except specific exclusions. Mode is per-profile and cannot be mixed within one profile.

Yes, HTTP inspection and DLP for encrypted web traffic require TLS inspection with the Cloudflare root CA deployed to managed devices. Certificate-pinned applications need Do Not Inspect exceptions configured before enabling broad inspection.

Access policies are default-deny, so a private app with routes but no Allow policy blocks everyone. Group-based rules also fail if IdP group claims or SCIM sync are missing or stale; troubleshoot using the user's last authenticated identity and Access audit logs.

API CASB is out-of-band and periodic, so it does not provide real-time inline enforcement. For inline control of specific actions in SaaS applications, use Gateway granular application controls instead.

Start from Gateway activity logs, filtering by rule name, user identity, destination, action, and time range to find the failing decision. Then trace back to the responsible rule, checking rule type, evaluation phase, referenced lists, and order of enforcement.