# Review required OIDC claims before connecting a SaaS application through Cloudflare Access

> A missing required claim can block authentication even after the user signs in successfully.

- Canonical URL: https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:30+00:00
- Modified: 2026-10-15T13:36:17+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Microsoft 365 & Identity
- Reading time: 2 minutes

## What you need to know

A missing required claim can block authentication even after the user signs in successfully.

## Potentially affected

This concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.

## DSE recommendation

DSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in.

## Article

A missing required claim can block authentication even after the user signs in successfully.

## Source facts

Cloudflare’s generic OIDC SaaS integration sends selected identity scopes and claims to the application. Administrators can remove an unnecessary groups scope, filter the groups passed onward, and map an identity-provider attribute to a named OIDC claim. If a mapped claim is marked required and the identity provider does not provide it, Cloudflare fails the authentication request. Where multiple identity providers are enabled, per-provider claim mappings can override the parent mapping. The application’s callback URL and Access policy are separate required integration settings.

Source: [Cloudflare — Generic OIDC SaaS](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/).

## Applicability

This concerns Cloudflare Access acting as an OIDC provider for a SaaS application. The SaaS vendor determines which claims and identifiers it requires and how it assigns permissions.

## DSE recommendation

DSE recommends getting the SaaS vendor’s exact claim contract before enabling production sign-in. Record claim name, source attribute, expected format, and whether absence should block entry. Review each allowed identity provider, especially where group names or employee identifiers differ. Share only attributes the application needs. Keep an approved recovery account or procedure available during the cutover, and document callback URLs independently of launcher URLs so a user-facing shortcut is not mistaken for the protocol endpoint.

## Verification

Use test identities with complete claims, a missing required attribute, and the permitted alternative identity provider. Confirm the expected rejection and successful mapping without exposing full tokens in tickets. Review application-side account matching and authorization as well as successful completion of the Access login screen.

## Official reference

[Cloudflare — Generic OIDC SaaS](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/). Reviewed October 15, 2026.

## Primary reference

- Name: Cloudflare — Generic OIDC SaaS
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/saas-apps/generic-oidc-saas/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review required OIDC claims before connecting a SaaS application through Cloudflare Access,” DSE Security, https://update.dsesecurity.com/updates/cloudflare-access-oidc-required-claim-mapping/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.