Do not equate Cloudflare’s WARP posture check with enrollment in your organization

The documented WARP check also accepts the consumer client.

Source facts

Cloudflare’s Require WARP documentation says that this posture attribute checks all versions of WARP, including the consumer version. Administrators must enable the WARP posture check and add the corresponding selector to an Access policy before the application evaluates it. The setup also requires the documented Gateway proxy setting and a supported deployed client. The resulting check establishes that the client is running; it should not be interpreted as a statement that the device belongs to a particular organization’s managed fleet.

Source: Cloudflare — Require WARP.

Applicability

This applies specifically to the Access WARP posture selector. Other Cloudflare posture checks, enrollment controls, and organization-specific signals have separate definitions and prerequisites.

DSE recommendation

DSE recommends naming posture requirements according to the evidence they actually provide. If an application requires a company-managed endpoint, document that requirement separately and choose appropriate organization or management signals after reviewing their vendor documentation. Avoid a policy description such as “corporate devices only” when its sole device condition is this WARP attribute. Review whether the selector belongs in Include or Require alongside identity conditions, and keep the intended admission matrix with the application owner’s approval.

Verification

In a controlled test, compare the intended organization client with other eligible client states where permitted. Record the actual policy outcome without assuming a running client proves asset ownership. Review the complete Access policy and verify that every required management condition is represented by an appropriate check.

Official reference

Cloudflare — Require WARP. Reviewed October 15, 2026.