1. Packages
  2. Packages
  3. Cloudflare Provider
  4. API Docs
  5. AccessOrganization
Viewing docs for Cloudflare v6.14.0
published on Thursday, Apr 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare

cloudflare.AccessOrganization

cloudflare logo
Viewing docs for Cloudflare v6.14.0
published on Thursday, Apr 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudflare
    Deprecated: cloudflare.index/accessorganization.AccessOrganization has been deprecated in favor of cloudflare.index/zerotrustorganization.ZeroTrustOrganization

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleZeroTrustOrganization = new cloudflare.ZeroTrustOrganization("example_zero_trust_organization", {
    zoneId: "zone_id",
    allowAuthenticateViaWarp: true,
    authDomain: "test.cloudflareaccess.com",
    autoRedirectToIdentity: true,
    customPages: {
        forbidden: "699d98642c564d2e855e9661899b7252",
        identityDenied: "699d98642c564d2e855e9661899b7252",
    },
    denyUnmatchedRequests: true,
    denyUnmatchedRequestsExemptedZoneNames: ["example.com"],
    isUiReadOnly: true,
    loginDesign: {
        backgroundColor: "#c5ed1b",
        footerText: "This is an example description.",
        headerText: "This is an example description.",
        logoPath: "https://example.com/logo.png",
        textColor: "#c5ed1b",
    },
    mfaConfig: {
        allowedAuthenticators: [
            "totp",
            "biometrics",
            "security_key",
        ],
        sessionDuration: "24h",
    },
    mfaConfigurationAllowed: true,
    mfaRequiredForAllApps: false,
    name: "Widget Corps Internal Applications",
    sessionDuration: "24h",
    uiReadOnlyToggleReason: "Temporarily turn off the UI read only lock to make a change via the UI",
    userSeatExpirationInactiveTime: "730h",
    warpAuthSessionDuration: "24h",
});

    import pulumi
import pulumi_cloudflare as cloudflare

example_zero_trust_organization = cloudflare.ZeroTrustOrganization("example_zero_trust_organization",
    zone_id="zone_id",
    allow_authenticate_via_warp=True,
    auth_domain="test.cloudflareaccess.com",
    auto_redirect_to_identity=True,
    custom_pages={
        "forbidden": "699d98642c564d2e855e9661899b7252",
        "identity_denied": "699d98642c564d2e855e9661899b7252",
    },
    deny_unmatched_requests=True,
    deny_unmatched_requests_exempted_zone_names=["example.com"],
    is_ui_read_only=True,
    login_design={
        "background_color": "#c5ed1b",
        "footer_text": "This is an example description.",
        "header_text": "This is an example description.",
        "logo_path": "https://example.com/logo.png",
        "text_color": "#c5ed1b",
    },
    mfa_config={
        "allowed_authenticators": [
            "totp",
            "biometrics",
            "security_key",
        ],
        "session_duration": "24h",
    },
    mfa_configuration_allowed=True,
    mfa_required_for_all_apps=False,
    name="Widget Corps Internal Applications",
    session_duration="24h",
    ui_read_only_toggle_reason="Temporarily turn off the UI read only lock to make a change via the UI",
    user_seat_expiration_inactive_time="730h",
    warp_auth_session_duration="24h")

    package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.NewZeroTrustOrganization(ctx, "example_zero_trust_organization", &cloudflare.ZeroTrustOrganizationArgs{
			ZoneId:                   pulumi.String("zone_id"),
			AllowAuthenticateViaWarp: pulumi.Bool(true),
			AuthDomain:               pulumi.String("test.cloudflareaccess.com"),
			AutoRedirectToIdentity:   pulumi.Bool(true),
			CustomPages: &cloudflare.ZeroTrustOrganizationCustomPagesArgs{
				Forbidden:      pulumi.String("699d98642c564d2e855e9661899b7252"),
				IdentityDenied: pulumi.String("699d98642c564d2e855e9661899b7252"),
			},
			DenyUnmatchedRequests: pulumi.Bool(true),
			DenyUnmatchedRequestsExemptedZoneNames: pulumi.StringArray{
				pulumi.String("example.com"),
			},
			IsUiReadOnly: pulumi.Bool(true),
			LoginDesign: &cloudflare.ZeroTrustOrganizationLoginDesignArgs{
				BackgroundColor: pulumi.String("#c5ed1b"),
				FooterText:      pulumi.String("This is an example description."),
				HeaderText:      pulumi.String("This is an example description."),
				LogoPath:        pulumi.String("https://example.com/logo.png"),
				TextColor:       pulumi.String("#c5ed1b"),
			},
			MfaConfig: &cloudflare.ZeroTrustOrganizationMfaConfigArgs{
				AllowedAuthenticators: pulumi.StringArray{
					pulumi.String("totp"),
					pulumi.String("biometrics"),
					pulumi.String("security_key"),
				},
				SessionDuration: pulumi.String("24h"),
			},
			MfaConfigurationAllowed:        pulumi.Bool(true),
			MfaRequiredForAllApps:          pulumi.Bool(false),
			Name:                           pulumi.String("Widget Corps Internal Applications"),
			SessionDuration:                pulumi.String("24h"),
			UiReadOnlyToggleReason:         pulumi.String("Temporarily turn off the UI read only lock to make a change via the UI"),
			UserSeatExpirationInactiveTime: pulumi.String("730h"),
			WarpAuthSessionDuration:        pulumi.String("24h"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleZeroTrustOrganization = new Cloudflare.ZeroTrustOrganization("example_zero_trust_organization", new()
    {
        ZoneId = "zone_id",
        AllowAuthenticateViaWarp = true,
        AuthDomain = "test.cloudflareaccess.com",
        AutoRedirectToIdentity = true,
        CustomPages = new Cloudflare.Inputs.ZeroTrustOrganizationCustomPagesArgs
        {
            Forbidden = "699d98642c564d2e855e9661899b7252",
            IdentityDenied = "699d98642c564d2e855e9661899b7252",
        },
        DenyUnmatchedRequests = true,
        DenyUnmatchedRequestsExemptedZoneNames = new[]
        {
            "example.com",
        },
        IsUiReadOnly = true,
        LoginDesign = new Cloudflare.Inputs.ZeroTrustOrganizationLoginDesignArgs
        {
            BackgroundColor = "#c5ed1b",
            FooterText = "This is an example description.",
            HeaderText = "This is an example description.",
            LogoPath = "https://example.com/logo.png",
            TextColor = "#c5ed1b",
        },
        MfaConfig = new Cloudflare.Inputs.ZeroTrustOrganizationMfaConfigArgs
        {
            AllowedAuthenticators = new[]
            {
                "totp",
                "biometrics",
                "security_key",
            },
            SessionDuration = "24h",
        },
        MfaConfigurationAllowed = true,
        MfaRequiredForAllApps = false,
        Name = "Widget Corps Internal Applications",
        SessionDuration = "24h",
        UiReadOnlyToggleReason = "Temporarily turn off the UI read only lock to make a change via the UI",
        UserSeatExpirationInactiveTime = "730h",
        WarpAuthSessionDuration = "24h",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.ZeroTrustOrganization;
import com.pulumi.cloudflare.ZeroTrustOrganizationArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustOrganizationCustomPagesArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustOrganizationLoginDesignArgs;
import com.pulumi.cloudflare.inputs.ZeroTrustOrganizationMfaConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleZeroTrustOrganization = new ZeroTrustOrganization("exampleZeroTrustOrganization", ZeroTrustOrganizationArgs.builder()
            .zoneId("zone_id")
            .allowAuthenticateViaWarp(true)
            .authDomain("test.cloudflareaccess.com")
            .autoRedirectToIdentity(true)
            .customPages(ZeroTrustOrganizationCustomPagesArgs.builder()
                .forbidden("699d98642c564d2e855e9661899b7252")
                .identityDenied("699d98642c564d2e855e9661899b7252")
                .build())
            .denyUnmatchedRequests(true)
            .denyUnmatchedRequestsExemptedZoneNames("example.com")
            .isUiReadOnly(true)
            .loginDesign(ZeroTrustOrganizationLoginDesignArgs.builder()
                .backgroundColor("#c5ed1b")
                .footerText("This is an example description.")
                .headerText("This is an example description.")
                .logoPath("https://example.com/logo.png")
                .textColor("#c5ed1b")
                .build())
            .mfaConfig(ZeroTrustOrganizationMfaConfigArgs.builder()
                .allowedAuthenticators(                
                    "totp",
                    "biometrics",
                    "security_key")
                .sessionDuration("24h")
                .build())
            .mfaConfigurationAllowed(true)
            .mfaRequiredForAllApps(false)
            .name("Widget Corps Internal Applications")
            .sessionDuration("24h")
            .uiReadOnlyToggleReason("Temporarily turn off the UI read only lock to make a change via the UI")
            .userSeatExpirationInactiveTime("730h")
            .warpAuthSessionDuration("24h")
            .build());

    }
}

    resources:
  exampleZeroTrustOrganization:
    type: cloudflare:ZeroTrustOrganization
    name: example_zero_trust_organization
    properties:
      zoneId: zone_id
      allowAuthenticateViaWarp: true
      authDomain: test.cloudflareaccess.com
      autoRedirectToIdentity: true
      customPages:
        forbidden: 699d98642c564d2e855e9661899b7252
        identityDenied: 699d98642c564d2e855e9661899b7252
      denyUnmatchedRequests: true
      denyUnmatchedRequestsExemptedZoneNames:
        - example.com
      isUiReadOnly: true
      loginDesign:
        backgroundColor: '#c5ed1b'
        footerText: This is an example description.
        headerText: This is an example description.
        logoPath: https://example.com/logo.png
        textColor: '#c5ed1b'
      mfaConfig:
        allowedAuthenticators:
          - totp
          - biometrics
          - security_key
        sessionDuration: 24h
      mfaConfigurationAllowed: true
      mfaRequiredForAllApps: false
      name: Widget Corps Internal Applications
      sessionDuration: 24h
      uiReadOnlyToggleReason: Temporarily turn off the UI read only lock to make a change via the UI
      userSeatExpirationInactiveTime: 730h
      warpAuthSessionDuration: 24h

    Create AccessOrganization Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AccessOrganization(name: string, args?: AccessOrganizationArgs, opts?: CustomResourceOptions);
    @overload
def AccessOrganization(resource_name: str,
                       args: Optional[AccessOrganizationArgs] = None,
                       opts: Optional[ResourceOptions] = None)

@overload
def AccessOrganization(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       account_id: Optional[str] = None,
                       allow_authenticate_via_warp: Optional[bool] = None,
                       auth_domain: Optional[str] = None,
                       auto_redirect_to_identity: Optional[bool] = None,
                       custom_pages: Optional[AccessOrganizationCustomPagesArgs] = None,
                       deny_unmatched_requests: Optional[bool] = None,
                       deny_unmatched_requests_exempted_zone_names: Optional[Sequence[str]] = None,
                       is_ui_read_only: Optional[bool] = None,
                       login_design: Optional[AccessOrganizationLoginDesignArgs] = None,
                       mfa_config: Optional[AccessOrganizationMfaConfigArgs] = None,
                       mfa_configuration_allowed: Optional[bool] = None,
                       mfa_required_for_all_apps: Optional[bool] = None,
                       name: Optional[str] = None,
                       session_duration: Optional[str] = None,
                       ui_read_only_toggle_reason: Optional[str] = None,
                       user_seat_expiration_inactive_time: Optional[str] = None,
                       warp_auth_session_duration: Optional[str] = None,
                       zone_id: Optional[str] = None)
    func NewAccessOrganization(ctx *Context, name string, args *AccessOrganizationArgs, opts ...ResourceOption) (*AccessOrganization, error)
    public AccessOrganization(string name, AccessOrganizationArgs? args = null, CustomResourceOptions? opts = null)
    public AccessOrganization(String name, AccessOrganizationArgs args)
public AccessOrganization(String name, AccessOrganizationArgs args, CustomResourceOptions options)

    type: cloudflare:AccessOrganization
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args AccessOrganizationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AccessOrganizationArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AccessOrganizationArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AccessOrganizationArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AccessOrganizationArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    AccessOrganization Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AccessOrganization resource accepts the following input properties:

    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    AllowAuthenticateViaWarp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    AuthDomain string
    The unique subdomain assigned to your Zero Trust organization.
    AutoRedirectToIdentity bool
    When set to true, users skip the identity provider selection step during login.
    CustomPages AccessOrganizationCustomPages
    DenyUnmatchedRequests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    DenyUnmatchedRequestsExemptedZoneNames List<string>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    IsUiReadOnly bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    LoginDesign AccessOrganizationLoginDesign
    MfaConfig AccessOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    MfaConfigurationAllowed bool
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    MfaRequiredForAllApps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    Name string
    The name of your Zero Trust organization.
    SessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    UiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    UserSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    WarpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    AllowAuthenticateViaWarp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    AuthDomain string
    The unique subdomain assigned to your Zero Trust organization.
    AutoRedirectToIdentity bool
    When set to true, users skip the identity provider selection step during login.
    CustomPages AccessOrganizationCustomPagesArgs
    DenyUnmatchedRequests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    DenyUnmatchedRequestsExemptedZoneNames []string
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    IsUiReadOnly bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    LoginDesign AccessOrganizationLoginDesignArgs
    MfaConfig AccessOrganizationMfaConfigArgs
    Configures multi-factor authentication (MFA) settings for an organization.
    MfaConfigurationAllowed bool
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    MfaRequiredForAllApps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    Name string
    The name of your Zero Trust organization.
    SessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    UiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    UserSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    WarpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allowAuthenticateViaWarp Boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain String
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity Boolean
    When set to true, users skip the identity provider selection step during login.
    customPages AccessOrganizationCustomPages
    denyUnmatchedRequests Boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames List<String>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    isUiReadOnly Boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign AccessOrganizationLoginDesign
    mfaConfig AccessOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaConfigurationAllowed Boolean
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfaRequiredForAllApps Boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name String
    The name of your Zero Trust organization.
    sessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason String
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime String
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allowAuthenticateViaWarp boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain string
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity boolean
    When set to true, users skip the identity provider selection step during login.
    customPages AccessOrganizationCustomPages
    denyUnmatchedRequests boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames string[]
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    isUiReadOnly boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign AccessOrganizationLoginDesign
    mfaConfig AccessOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaConfigurationAllowed boolean
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfaRequiredForAllApps boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name string
    The name of your Zero Trust organization.
    sessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allow_authenticate_via_warp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    auth_domain str
    The unique subdomain assigned to your Zero Trust organization.
    auto_redirect_to_identity bool
    When set to true, users skip the identity provider selection step during login.
    custom_pages AccessOrganizationCustomPagesArgs
    deny_unmatched_requests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    deny_unmatched_requests_exempted_zone_names Sequence[str]
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    is_ui_read_only bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    login_design AccessOrganizationLoginDesignArgs
    mfa_config AccessOrganizationMfaConfigArgs
    Configures multi-factor authentication (MFA) settings for an organization.
    mfa_configuration_allowed bool
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfa_required_for_all_apps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name str
    The name of your Zero Trust organization.
    session_duration str
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    ui_read_only_toggle_reason str
    A description of the reason why the UI read only field is being toggled.
    user_seat_expiration_inactive_time str
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warp_auth_session_duration str
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allowAuthenticateViaWarp Boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain String
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity Boolean
    When set to true, users skip the identity provider selection step during login.
    customPages Property Map
    denyUnmatchedRequests Boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames List<String>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    isUiReadOnly Boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign Property Map
    mfaConfig Property Map
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaConfigurationAllowed Boolean
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfaRequiredForAllApps Boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name String
    The name of your Zero Trust organization.
    sessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason String
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime String
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AccessOrganization resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AccessOrganization Resource

    Get an existing AccessOrganization resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AccessOrganizationState, opts?: CustomResourceOptions): AccessOrganization
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        allow_authenticate_via_warp: Optional[bool] = None,
        auth_domain: Optional[str] = None,
        auto_redirect_to_identity: Optional[bool] = None,
        custom_pages: Optional[AccessOrganizationCustomPagesArgs] = None,
        deny_unmatched_requests: Optional[bool] = None,
        deny_unmatched_requests_exempted_zone_names: Optional[Sequence[str]] = None,
        is_ui_read_only: Optional[bool] = None,
        login_design: Optional[AccessOrganizationLoginDesignArgs] = None,
        mfa_config: Optional[AccessOrganizationMfaConfigArgs] = None,
        mfa_configuration_allowed: Optional[bool] = None,
        mfa_required_for_all_apps: Optional[bool] = None,
        name: Optional[str] = None,
        session_duration: Optional[str] = None,
        ui_read_only_toggle_reason: Optional[str] = None,
        user_seat_expiration_inactive_time: Optional[str] = None,
        warp_auth_session_duration: Optional[str] = None,
        zone_id: Optional[str] = None) -> AccessOrganization
    func GetAccessOrganization(ctx *Context, name string, id IDInput, state *AccessOrganizationState, opts ...ResourceOption) (*AccessOrganization, error)
    public static AccessOrganization Get(string name, Input<string> id, AccessOrganizationState? state, CustomResourceOptions? opts = null)
    public static AccessOrganization get(String name, Output<String> id, AccessOrganizationState state, CustomResourceOptions options)
    resources:  _:    type: cloudflare:AccessOrganization    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    AllowAuthenticateViaWarp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    AuthDomain string
    The unique subdomain assigned to your Zero Trust organization.
    AutoRedirectToIdentity bool
    When set to true, users skip the identity provider selection step during login.
    CustomPages AccessOrganizationCustomPages
    DenyUnmatchedRequests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    DenyUnmatchedRequestsExemptedZoneNames List<string>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    IsUiReadOnly bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    LoginDesign AccessOrganizationLoginDesign
    MfaConfig AccessOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    MfaConfigurationAllowed bool
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    MfaRequiredForAllApps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    Name string
    The name of your Zero Trust organization.
    SessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    UiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    UserSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    WarpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    AccountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    AllowAuthenticateViaWarp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    AuthDomain string
    The unique subdomain assigned to your Zero Trust organization.
    AutoRedirectToIdentity bool
    When set to true, users skip the identity provider selection step during login.
    CustomPages AccessOrganizationCustomPagesArgs
    DenyUnmatchedRequests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    DenyUnmatchedRequestsExemptedZoneNames []string
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    IsUiReadOnly bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    LoginDesign AccessOrganizationLoginDesignArgs
    MfaConfig AccessOrganizationMfaConfigArgs
    Configures multi-factor authentication (MFA) settings for an organization.
    MfaConfigurationAllowed bool
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    MfaRequiredForAllApps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    Name string
    The name of your Zero Trust organization.
    SessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    UiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    UserSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    WarpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    ZoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allowAuthenticateViaWarp Boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain String
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity Boolean
    When set to true, users skip the identity provider selection step during login.
    customPages AccessOrganizationCustomPages
    denyUnmatchedRequests Boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames List<String>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    isUiReadOnly Boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign AccessOrganizationLoginDesign
    mfaConfig AccessOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaConfigurationAllowed Boolean
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfaRequiredForAllApps Boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name String
    The name of your Zero Trust organization.
    sessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason String
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime String
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId string
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allowAuthenticateViaWarp boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain string
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity boolean
    When set to true, users skip the identity provider selection step during login.
    customPages AccessOrganizationCustomPages
    denyUnmatchedRequests boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames string[]
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    isUiReadOnly boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign AccessOrganizationLoginDesign
    mfaConfig AccessOrganizationMfaConfig
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaConfigurationAllowed boolean
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfaRequiredForAllApps boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name string
    The name of your Zero Trust organization.
    sessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason string
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime string
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration string
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zoneId string
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    account_id str
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allow_authenticate_via_warp bool
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    auth_domain str
    The unique subdomain assigned to your Zero Trust organization.
    auto_redirect_to_identity bool
    When set to true, users skip the identity provider selection step during login.
    custom_pages AccessOrganizationCustomPagesArgs
    deny_unmatched_requests bool
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    deny_unmatched_requests_exempted_zone_names Sequence[str]
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    is_ui_read_only bool
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    login_design AccessOrganizationLoginDesignArgs
    mfa_config AccessOrganizationMfaConfigArgs
    Configures multi-factor authentication (MFA) settings for an organization.
    mfa_configuration_allowed bool
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfa_required_for_all_apps bool
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name str
    The name of your Zero Trust organization.
    session_duration str
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    ui_read_only_toggle_reason str
    A description of the reason why the UI read only field is being toggled.
    user_seat_expiration_inactive_time str
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warp_auth_session_duration str
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zone_id str
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.
    accountId String
    The Account ID to use for this endpoint. Mutually exclusive with the Zone ID.
    allowAuthenticateViaWarp Boolean
    When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
    authDomain String
    The unique subdomain assigned to your Zero Trust organization.
    autoRedirectToIdentity Boolean
    When set to true, users skip the identity provider selection step during login.
    customPages Property Map
    denyUnmatchedRequests Boolean
    Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the denyUnmatchedRequestsExemptedZoneNames array.
    denyUnmatchedRequestsExemptedZoneNames List<String>
    Contains zone names to exempt from the denyUnmatchedRequests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
    isUiReadOnly Boolean
    Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
    loginDesign Property Map
    mfaConfig Property Map
    Configures multi-factor authentication (MFA) settings for an organization.
    mfaConfigurationAllowed Boolean
    Indicates if this organization can enforce multi-factor authentication (MFA) requirements at the application and policy level.
    mfaRequiredForAllApps Boolean
    Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
    name String
    The name of your Zero Trust organization.
    sessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    uiReadOnlyToggleReason String
    A description of the reason why the UI read only field is being toggled.
    userSeatExpirationInactiveTime String
    The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
    warpAuthSessionDuration String
    The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
    zoneId String
    The Zone ID to use for this endpoint. Mutually exclusive with the Account ID.

    Supporting Types

    AccessOrganizationCustomPages, AccessOrganizationCustomPagesArgs

    Forbidden string
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    IdentityDenied string
    The uid of the custom page to use when a user is denied access.
    Forbidden string
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    IdentityDenied string
    The uid of the custom page to use when a user is denied access.
    forbidden String
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identityDenied String
    The uid of the custom page to use when a user is denied access.
    forbidden string
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identityDenied string
    The uid of the custom page to use when a user is denied access.
    forbidden str
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identity_denied str
    The uid of the custom page to use when a user is denied access.
    forbidden String
    The uid of the custom page to use when a user is denied access after failing a non-identity rule.
    identityDenied String
    The uid of the custom page to use when a user is denied access.

    AccessOrganizationLoginDesign, AccessOrganizationLoginDesignArgs

    BackgroundColor string
    The background color on your login page.
    FooterText string
    The text at the bottom of your login page.
    HeaderText string
    The text at the top of your login page.
    LogoPath string
    The URL of the logo on your login page.
    TextColor string
    The text color on your login page.
    BackgroundColor string
    The background color on your login page.
    FooterText string
    The text at the bottom of your login page.
    HeaderText string
    The text at the top of your login page.
    LogoPath string
    The URL of the logo on your login page.
    TextColor string
    The text color on your login page.
    backgroundColor String
    The background color on your login page.
    footerText String
    The text at the bottom of your login page.
    headerText String
    The text at the top of your login page.
    logoPath String
    The URL of the logo on your login page.
    textColor String
    The text color on your login page.
    backgroundColor string
    The background color on your login page.
    footerText string
    The text at the bottom of your login page.
    headerText string
    The text at the top of your login page.
    logoPath string
    The URL of the logo on your login page.
    textColor string
    The text color on your login page.
    background_color str
    The background color on your login page.
    footer_text str
    The text at the bottom of your login page.
    header_text str
    The text at the top of your login page.
    logo_path str
    The URL of the logo on your login page.
    text_color str
    The text color on your login page.
    backgroundColor String
    The background color on your login page.
    footerText String
    The text at the bottom of your login page.
    headerText String
    The text at the top of your login page.
    logoPath String
    The URL of the logo on your login page.
    textColor String
    The text color on your login page.

    AccessOrganizationMfaConfig, AccessOrganizationMfaConfigArgs

    AllowedAuthenticators List<string>
    Lists the MFA methods that users can authenticate with.
    SessionDuration string
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    AllowedAuthenticators []string
    Lists the MFA methods that users can authenticate with.
    SessionDuration string
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowedAuthenticators List<String>
    Lists the MFA methods that users can authenticate with.
    sessionDuration String
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowedAuthenticators string[]
    Lists the MFA methods that users can authenticate with.
    sessionDuration string
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowed_authenticators Sequence[str]
    Lists the MFA methods that users can authenticate with.
    session_duration str
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.
    allowedAuthenticators List<String>
    Lists the MFA methods that users can authenticate with.
    sessionDuration String
    Defines the duration of an MFA session. Must be in minutes (m) or hours (h). Minimum: 0m. Maximum: 720h (30 days). Examples:5m or 24h.

    Import

    This resource does not currently support pulumi import.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Cloudflare pulumi/pulumi-cloudflare
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudflare Terraform Provider.
    cloudflare logo
    Viewing docs for Cloudflare v6.14.0
    published on Thursday, Apr 2, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-cloudflare
      Try Pulumi Cloud free. Your team will thank you.