How Cloudflare built Organizations to help large enterprises manage Cloudflare

Cloudflare Organizations is a new feature that sits above enterprise environments scattered across multiple Cloudflare Accounts, letting users manage users, settings, and analytics all in one place. Large enterprises split accounts for team-level autonomy and permission separation, but this creates a bigger problem of distributed control and operations for administrators.

The core is the Org Super Administrator role. A user with this role manages the list of accounts at the organization level, and has Super Administrator permissions over all accounts even without belonging directly to each sub-account. It is not exposed in the per-account UI, and is managed only at the organization layer.

Cloudflare built this feature on top of its existing Tenant system. At the same time, it cleaned up legacy paths in the permission system and unified all authorization checks based on domain-scoped roles, adding about 133,000 lines of new code and removing about 32,000 lines of existing code in the process.

This structural improvement also boosted performance of permission enumeration calls, such as on paths like /accounts or /zones, by 27%. This significantly reduced the slowness that occurred particularly when handling users with access to thousands of accounts.

The main features are as follows.

• Account list: Manages all accounts onboarded to the organization as a flat list
• Org Super Administrators: Grants Super Admin permissions across the entire organization
• Analytics: A dashboard that aggregates HTTP traffic across all accounts and zones
• Shared configurations: Shares one account's WAF or Gateway policies with other accounts

Shared configurations also provide direct benefits for security operations. Users with permission to manage the configuration in the source account can update policy sets, allowing security analysts to centrally coordinate WAF rules across the organization.

The rollout begins as a public beta for enterprise customers first, with plans to expand to pay-as-you-go customers going forward. The future roadmap includes organization-level audit logs, billing reports, additional analytics reports, more organization roles, and self-serve account creation.

On the security side, to prevent privilege escalation, the design avoids automatic backfilling and allows each company to create only one organization. The rollout works by having an existing Super Administrator create the organization directly from the dashboard, then add accounts through a mutual approval process with other administrators.