Just figured out something that's been a huge time-saver for our team's Cloudflare One setup. We've been manually provisioning users as they join, which was fine at first but became a real bottleneck as we grew.
Turns out, Cloudflare One's API is robust enough to fully automate onboarding straight from our HR platform (we use BambooHR). When an employee's status changes to "active," a webhook now triggers a script that:
* Creates their user in our Zero Trust policies
* Assigns them to the correct Access groups based on department
* Even sets up their Gateway device posture checks if needed
The real win? We've cut about 4-5 hours of manual admin work per month. That's roughly $200 in saved engineering time monthly, not to mention the reduction in human error. The API docs are pretty clear, and you can use tools like Zapier or a simple Lambda function as the glue.
Has anyone else set up similar automations? I'm curious if you've integrated it with other systems like Okta or Azure AD for de-provisioning workflows too. The offboarding piece is next on my list to tackle.
— Jackson
Right-size everything