cloudflareApr 6, 2026

How we built Organizations to help enterprises manage Cloudflare at scale (opens in new tab)

Cloudflare’s new Organizations feature helps enterprises centrally manage users, policies, accounts, and analytics across multiple Cloudflare Accounts. It preserves least-privilege access by allowing teams to remain separated while giving designated organization administrators broader oversight. Initially available in public beta for enterprise customers, Organizations is designed to reduce administrative complexity without granting unauthorized access. ## Why Enterprises Use Multiple Accounts - Separate accounts help teams manage their own resources and limit permissions. - Fine-grained RBAC can still be cumbersome when administrators must enumerate individual resources. - Central administrators currently need access to every account for reporting and policy management. - This setup is fragile because account-level administrators can remove those central administrators. ## Organization Structure and Account Management - Organizations add a management layer above individual Cloudflare Accounts. - The core feature is a flat list of accounts onboarded into the organization. - An account can be added only by someone who is a Super Administrator for that account. - Organizations are built on Cloudflare’s existing Tenant system, originally developed for partners. ## Organization Super Administrators - Org Super Administrators have Super Administrator permissions across every account in the organization. - They do not need memberships in child accounts and do not appear in account-level user interfaces. - The new role is the first of several planned organization-level roles. - Cloudflare consolidated legacy authorization paths into domain-scoped roles. - The permissions overhaul added approximately 133,000 lines of code and removed 32,000. - Permission checks for enumeration endpoints such as `/accounts` and `/zones` became 27% faster, especially for users with access to thousands of accounts. ## Organization-Wide Analytics - Org Super Administrators can view aggregated HTTP traffic analytics. - The dashboard combines data across all accounts and zones in the organization. - Cloudflare plans to add analytics for additional products over time. ## Shared Configurations - Organizations allow centrally managed policy sets to be shared across accounts. - Initial examples include WAF and Gateway policies. - Authorized users in the source account can update shared policies for the broader enterprise. - Security analysts can therefore manage enterprise-wide WAF rules without becoming organization or account administrators everywhere. ## Roadmap and Availability - The beta initially targets enterprise customers. - Cloudflare plans to expand access to pay-as-you-go and other customers, followed by the partner ecosystem. - Planned capabilities include: - Organization-level audit logs - Billing reports - More analytics dashboards - Additional organization user roles - Self-service account creation ## Security-First Rollout - Cloudflare will not automatically create organizations through account backfilling. - A self-service invitation process ensures that no user gains access without approval from a relevant Super Administrator. - The first eligible Super Administrator to claim the company’s organization can add other accounts where they also hold Super Administrator access. - If another employee has already claimed the organization, administrators must coordinate invitations or account-level approval. - Cloudflare Support will not configure organizations on customers’ behalf. Enterprise customers can claim an organization from the Cloudflare Dashboard’s Organizations tab at no additional cost. Companies should coordinate internally with their Super Administrators to ensure all relevant accounts are added securely.

role-based-access-controldatabase-designcloudflareweb-application-firewall+4

discordJun 25, 2025

How to Set Up Your Server’s Roles for Members, Mods & Admins (opens in new tab)

Discord recommends organizing server permissions into three tiers: members, moderators, and administrators. Members receive essential communication and activity permissions, moderators get tools to manage conversations and users, and admins receive powerful server-management capabilities. Permissions should be tailored to each community and granted selectively, especially at the administrative level. ## Permissions for Server Members Members need permissions that support ordinary participation: - **General:** View channels, send messages, create public threads, send messages in threads, create invites, and change their own nickname. - **Voice:** Connect, speak, use video for webcams or screen sharing, use external sounds, use voice activity, and set voice-channel statuses. - **Apps:** Use application commands, Activities, and external apps. These permissions enable text chat, voice communication, streaming, games, and app-based interactions. ## Permissions for Moderators Moderators receive tools for keeping discussions and community activity orderly. - **Message and thread management:** Manage messages and threads, including deleting content, pinning messages, and archiving or renaming threads. - **Community management:** Create custom expressions, use broad mentions such as `@everyone`, kick or approve/reject members, ban members, apply timeouts, and manage other users’ nicknames. - **Oversight:** View the audit log to review actions taken on the server. - **Voice moderation:** Use Priority Speaker, mute or deafen members, and move participants between voice channels. - **Events:** Create, edit, manage, and delete community events. Most moderator actions can be reversed, though bans and large-scale mentions require particular care. ## Advanced Permissions for Server Administrators Administrative permissions affect major parts of the server, including messages, emojis, channels, and server settings. - Admin permissions should be enabled only when they are relevant to the community. - They should be assigned to a very limited group of trusted users. - **Manage Server** allows administrators to change core server settings, including the server name. The post’s main recommendation is to use the least amount of access necessary for each role, scaling permissions as the server grows and carefully restricting the most powerful controls.

role-based-access-controldiscordvoice-chatslash-commands+2