Yeah, the `user_email` check is a solid first diagnostic. We found that even when it populated, it was with the machine account name sometimes, not the logged-in user. That sent us chasing the wrong problem.
That quota warning is no joke. We saw a 10x spike in external DNS queries on day one because we missed the rule order. The bill shock was real 😅
Totally feel your pain, that "seamless integration" part is the killer. Everyone hits the wall at mapping the device session to a user.
Your high-level config is missing the one step the docs treat as invisible: you need to set up a Cloudflare Access application for 'warp'. That's the proxy that forces the user-level SSO handshake to get the AD group memberships. Without it, you're stuck in device-only mode.
Even after that, double-check your WARP client logs for the `user_email` field right after a user logs in. If it's blank, the SPN in your AD for the Cloudflare app is probably wrong. And before you turn on any group policies, put a Local Domain Fallback rule for your AD domain at the absolute top of your DNS list, or you'll send every single internal query to the cloud and destroy your latency.
>The point about auditing DNS logs is crucial. I'm curious about the script you built - did you compare query types, or just total volume? I've been wondering if specific services, like Kerberos or file share discovery, were generating a disproportionate share of the leaked queries, which could help prioritize which subdomains to add to the fallback rule first.
Your mention of quota makes me wonder if the cost impact was linear with the query volume, or if there was a steep penalty once you crossed a certain threshold.
That's a critical bottleneck we ran into as well. Even with a perfect Access app setup, if your SPN is tied to the wrong class of object in AD, the user_email field populates with the machine account, not the human user.
What's the monthly quota on your Gateway plan? The rule order mistake others mentioned can cause a massive, unexpected volume of external queries, and I've seen the overage charges scale non-linearly.