Hey folks. We've been running Cloudflare One for about a year now, and one of the first operational hurdles was giving our junior network engineers the visibility they needed without the risk of them accidentally changing a critical firewall rule or Gateway policy.
The "Read-only" role in the Cloudflare dashboard is a good start, but it's too broad. They couldn't see Zero Trust network or DNS policies at all. Here's the custom role we built to give them a safe, useful view.
We call it "Network Observer." The goal was to grant read access to:
* All Zero Trust sections (Gateway, Access, Tunnel)
* DNS (Zone level)
* Network Analytics
* Magic Firewall
Here’s the Admin Role configuration we used in the Cloudflare dashboard (under **Manage Account** > **Administration Roles**):
**Role Name:** Network Observer
**Description:** Read-only access to network & security configs for troubleshooting and monitoring.
**Permissions:**
- **Zero Trust** > Select all > Read
- **DNS** > Zone Read
- **Analytics** > Select all > Read
- **Magic Firewall** > Read
A few things to note:
- This doesn't include any "Edit" permissions, so they can't export logs or modify lists.
- They can see the full configuration of Access policies, Gateway HTTP/Network filters, and Active Tunnels, which is perfect for first-line diagnostics.
- We paired this with a "Guest" login method (SCIM) so their access can be easily provisioned and revoked.
It’s worked really well for us. The juniors can independently verify configurations and understand traffic flows without a senior having to screenshare. They also learn the setup by seeing it in production.
Has anyone else set up a similar role? I'm curious if you included any additional read permissions for things like Logpush or DDoS settings.
Solid approach. We did something similar but added "Audit Log" read permissions to ours. Lets them see *who* made a change, not just what changed, which cuts down on "was this you?" Slack messages at 3am. 😅
One watchout: double-check if "Zone Read" on DNS includes the newish DNS Analytics tab. For us it didn't, and that was a whole thing. Had to tweak it.
Ever run into a section they need to see but that isn't covered by a tidy permission? Our team kept hitting dead ends in the Speed section until we realized it was a separate permission group entirely.
Good detail on the permissions. Did you consider splitting DNS into "Zone Read" and "Zone Analytics Read"? I found they're separate, and the analytics piece is often what they actually need.
How do you handle the Network Maps feature? I couldn't find a clear permission for that under Analytics.
> They couldn't see Zero Trust network or DNS policies at all.
Why not just use the built-in Read-only role and pair it with a separate free monitoring tool? You're paying for Cloudflare One, then paying more engineer hours to recreate basic read access.
Seems like a lot of work to fix a dashboard limitation. Set up a read-only Grafana dashboard with the Cloudflare API. It's free, shows everything they need, and you get zero risk of them touching anything. No custom roles needed.
linux is free