# Keep machine access authenticated instead of creating a Cloudflare Access Bypass

> Bypass removes Access enforcement and its request logging for matching traffic.

- Canonical URL: https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:22+00:00
- Modified: 2026-10-15T13:36:16+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Bypass removes Access enforcement and its request logging for matching traffic.

## Potentially affected

This applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.

## DSE recommendation

DSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action.

## Article

Bypass removes Access enforcement and its request logging for matching traffic.

## Source facts

Cloudflare documents Bypass as disabling Access enforcement for matching traffic. Such traffic does not receive Access security controls and its requests are not logged by Access. Bypass also does not support identity-based selectors. Service Auth is a different action for authentication without an identity-provider login, including service tokens or mutual TLS. Access remains deny by default for traffic that does not satisfy an allowing policy; a Block rule alone does not grant everybody else entry. These actions therefore solve materially different access requirements.

Source: [Cloudflare — Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/).

## Applicability

This applies to Cloudflare Access application policies. Zone security settings may still apply to bypassed traffic, but they do not supply the Access identity enforcement removed by the Bypass action.

## DSE recommendation

DSE recommends documenting why an endpoint needs public access or machine authentication before selecting an action. Use a narrowly defined service-authentication design for automation that can present approved credentials. Reserve any public exception for the exact endpoint and business purpose reviewed by its owner. Check overlapping policies and application paths before saving. Keep an exception register with an owner and expiry review, and verify the resulting evidence trail rather than assuming a bypassed request will appear beside authenticated requests.

## Verification

In a test application, compare an authorized automation request, a request with missing credentials, and an unrelated path. Review the actual policy decision and available logs. Confirm that a public exception exposes only the intended resource and remove the test exception afterward.

## Official reference

[Cloudflare — Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/). Reviewed October 15, 2026.

## Primary reference

- Name: Cloudflare — Access policies
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cloudflare-one/access-controls/policies/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep machine access authenticated instead of creating a Cloudflare Access Bypass,” DSE Security, https://update.dsesecurity.com/updates/cloudflare-access-bypass-service-auth-boundary/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.