From 1368ba420355bf0e9f1c9e1ad36eaccc03138149 Mon Sep 17 00:00:00 2001 From: Kenneth Johnson Date: Thu, 10 Sep 2026 11:48:34 -0500 Subject: [PATCH] [Access] Clarify MFA session behavior --- .../access-settings/session-management.mdx | 17 ++++++++++++++++- .../policies/mfa-requirements.mdx | 2 ++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/src/content/docs/cloudflare-one/access-controls/access-settings/session-management.mdx b/src/content/docs/cloudflare-one/access-controls/access-settings/session-management.mdx index 5faa3f999c0..feb3a487f65 100644 --- a/src/content/docs/cloudflare-one/access-controls/access-settings/session-management.mdx +++ b/src/content/docs/cloudflare-one/access-controls/access-settings/session-management.mdx @@ -115,7 +115,22 @@ This account setting only applies to failed Cloudflare One Client authentication ### MFA session duration -If you use [independent multi-factor authentication (MFA)](/cloudflare-one/access-controls/access-settings/independent-mfa/), the MFA session duration determines how long a user can log in to Cloudflare Access without being prompted for MFA. The MFA session is independent of the global, policy, and application session durations. When logging in to an Access app with [MFA enabled](/cloudflare-one/access-controls/policies/mfa-requirements/#configure-independent-mfa-for-an-application), users must complete an MFA challenge if their last MFA authentication falls outside the configured session duration. After authenticating with their identity provider, users are prompted for MFA. The [`CF_Device` cookie](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#cf_device) ensures both authentication steps occur on the same device. MFA session durations do not affect how long a user has access to the application (that is controlled by the [application token](#session-durations)). +If you use [independent multi-factor authentication (MFA)](/cloudflare-one/access-controls/access-settings/independent-mfa/), the MFA session duration determines how long a user can log in to Cloudflare Access without another MFA prompt. The MFA session is independent of the global, policy, and application session durations. The [`CF_Device` cookie](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#cf_device) binds the MFA session to the device where the user completed the challenge. + +Access evaluates MFA only during the login flow. While the application session is active, Access does not check the MFA session or Authentication Method Reference (AMR) matching state. An expired MFA session does not interrupt access or expire the application token. When the application session becomes inactive, Access checks whether the MFA session is still valid. An application session can become inactive because it expired, the user logged out, or the user cleared their cookies. + +The following table shows how application and MFA session durations affect the user experience: + +| Application and MFA durations | Application session status | MFA session status | User experience | +| ----------------------------- | -------------------------- | ------------------ | --------------- | +| Application shorter than MFA (`1h` and `24h`) | Inactive | Active | Access login without an MFA prompt | +| Application shorter than MFA (`1h` and `24h`) | Active | Active or inactive | Direct access | +| Application equal to MFA (`24h` and `24h`) | Inactive | Inactive | Access login with an MFA prompt | +| Application equal to MFA (`24h` and `24h`) | Active | Active | Direct access | +| Application longer than MFA (`7d` and `1h`) | Active | Inactive | Direct access | +| Application longer than MFA (`7d` and `1h`) | Inactive | Inactive | Access login with an MFA prompt | + +If the application session is longer than the MFA session, it determines how long the user retains access. Access prompts for MFA again only after the application session becomes inactive and the user starts another login flow. ### Order of enforcement diff --git a/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx b/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx index d1d75cb5b4a..b12951d9119 100644 --- a/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx +++ b/src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx @@ -129,6 +129,8 @@ To configure MFA for an infrastructure application policy, refer to [Infrastruct The MFA session duration determines how long a successful MFA authentication remains valid. After the MFA session expires, the user must complete MFA again on their next Cloudflare Access login in addition to completing IdP authentication. You can require users to complete MFA on each Access login or set a custom duration. MFA session durations are only checked during the login flow and do not affect a user's existing session. +For examples, refer to [MFA session duration](/cloudflare-one/access-controls/access-settings/session-management/#mfa-session-duration). + Access checks MFA sessions from most specific to least specific: 1. **Policy MFA session duration** — If set, applies to users who match the policy.