Session Management using Cloudflare, Azure AD as idP

Pre-requisite to understand this

HTTP & HTTPS – Understand how secure web requests and responses work.
Cookies – Used to store session identifiers securely in the browser.
OAuth 2.0 – Authorization framework used for delegated access.
OpenID Connect (OIDC) – Identity layer built on OAuth 2.0.
JWT (JSON Web Token) – Token format used for identity/session validation.
Reverse Proxy – Intermediary that forwards client requests to backend servers.
Zero Trust Security – Never trust, always verify access model.
Azure AD (Microsoft Entra ID) [using as idP] – Cloud identity provider for authentication.

Introduction

Session management using Cloudflare with Microsoft Entra ID (formerly Azure AD) as the Identity Provider (IdP) enables secure, scalable, and globally distributed authentication. Cloudflare acts as a reverse proxy and policy enforcement point, while Microsoft Entra ID performs user authentication. After successful authentication, Cloudflare issues and manages a session token (usually a signed JWT stored in a secure cookie). This allows applications to remain protected without implementing complex authentication logic themselves. The session is validated at the edge, improving performance and reducing backend load.

What problem we can solve with this?

Modern applications need centralized authentication, secure session handling, and global scalability. Managing sessions directly in application servers increases complexity and security risks. When multiple applications exist, maintaining separate login mechanisms becomes inefficient. Integrating Cloudflare with Microsoft Entra ID enables centralized authentication with edge-enforced session validation. This reduces backend overhead and enhances Zero Trust security. It also prevents unauthorized access before traffic even reaches the origin server.

Problems Solved:

Centralized authentication across multiple applications
Eliminates custom session management logic in apps
Reduces backend server load
Prevents direct origin exposure
Enables Zero Trust access control
Supports global low-latency validation
Simplifies SSO integration

How to implement/use this?

To implement this setup, configure Cloudflare Access (Zero Trust) and integrate Microsoft Entra ID as an OIDC Identity Provider. Define an application in Microsoft Entra ID and configure redirect URIs to Cloudflare. In Cloudflare Zero Trust, register the application and connect it to Entra ID. When users attempt access, Cloudflare redirects them to Microsoft Entra ID for authentication. After successful login, Entra ID returns an ID token to Cloudflare. Cloudflare validates the token and issues its own signed session cookie. Subsequent requests are validated at the edge before reaching the backend.

Implementation Steps:

Register application in Microsoft Entra ID
Configure redirect URI to Cloudflare Access
Enable OIDC integration in Cloudflare Zero Trust
Define access policies (groups, emails, domains)
Configure session duration in Cloudflare
Protect application DNS through Cloudflare proxy
Test login and validate session cookies

Sequence Diagram

The sequence begins when a user attempts to access a protected application. Cloudflare intercepts the request and checks for a valid session cookie. If none exists, it redirects the user to Microsoft Entra ID for authentication. After successful login, Entra ID returns a signed JWT token to Cloudflare. Cloudflare validates the signature and claims. Once validated, it creates a session and issues its own secure cookie. Future requests include this cookie and are validated at the edge before being forwarded to the origin server.

Sequence Highlights:

Edge intercepts all traffic
Authentication happens at Entra ID
JWT token returned after login
Cloudflare validates token signature
Secure session cookie issued
Subsequent requests skip re-authentication
Origin only receives authenticated traffic

Component Diagram

The component diagram shows logical building blocks. The browser interacts only with Cloudflare Edge. Cloudflare redirects authentication to Microsoft Entra ID. After receiving the ID token, Cloudflare validates and creates a session. Cloudflare then forwards only authorized requests to the origin server. The origin does not directly communicate with Entra ID, reducing complexity. Cloudflare becomes the enforcement point. This clean separation enhances security and maintainability.

Component Flow Steps:

User requests application
Redirect to IdP for authentication
ID token returned
Session cookie generated
Authorized traffic forwarded

Deployment Diagram

The deployment diagram represents physical/logical infrastructure distribution. The user accesses the application over HTTPS. The traffic first reaches the Cloudflare Global Edge Network. If authentication is required, Cloudflare communicates with Microsoft Entra ID hosted in Microsoft Cloud. After successful authentication, Cloudflare forwards validated traffic to the origin infrastructure. The origin remains protected and is not directly exposed to the internet. Session validation happens at edge locations worldwide, ensuring performance and security.

Deployment Characteristics

Browser connects to Cloudflare edge POP
Authentication handled via Microsoft cloud
Origin not publicly exposed
Session validated globally
Zero Trust enforcement at edge
Reduced latency via distributed edge
Backend isolated from identity logic

Advantages

Centralized authentication using enterprise IdP
Edge-based session validation improves performance
Zero Trust security enforcement
Reduced backend authentication logic
Seamless Single Sign-On (SSO)
Protects origin from direct exposure
Scalable and globally distributed
Flexible access policies

Summary

Session management using Cloudflare with Microsoft Entra ID as the Identity Provider enables secure, scalable, and Zero Trust-based authentication for modern applications. Cloudflare acts as a global enforcement layer, validating identity tokens and managing session cookies at the edge. Microsoft Entra ID handles secure user authentication through OIDC. This separation of concerns simplifies backend applications, enhances security posture, and ensures high performance worldwide. The architecture ensures that only authenticated and authorized traffic reaches the origin, making it ideal for enterprise-grade deployments.