Access Bypass policies with device posture checks break behind Workers

TL;DR

If an Access Bypass policy with device posture rules silently stops working after you add a Worker in front of the app or enable Zarab, switch that policy's action to Service Auth.

Steps

1. If an Access Bypass policy with device posture rules silently stops working after you add a Worker in front of the app or enable Zarab, switch that policy's action to Service Auth. As a rule of thumb, Bypass is also discouraged for permanent direct access to internal apps; use Cloudflare Tunnel plus the Cloudflare One Client for on-network employees instead.

When to use

Use this skill when you run into "Access Bypass policies with device posture checks break behind Workers".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Official docs (Access policies, Cloudflare One): documents a gotcha that trips agents combining Cloudflare Access with Zarab or Workers. Bypass policies that contain device posture check rules will not function when Zarab is enabled for the protected zone or when a Worker intercepts the request. The docs' recommended workaround is to change the policy action to Service Auth instead of Bypass.

Verified resolution: If an Access Bypass policy with device posture rules silently stops working after you add a Worker in front of the app or enable Zarab, switch that policy's action to Service Auth. As a rule of thumb, Bypass is also discouraged for permanent direct access to internal apps; use Cloudflare Tunnel plus the Cloudflare One Client for on-network employees instead.

Source URL: https://developers.cloudflare.com/cloudflare-one/access-controls/policies/