diff --git a/src/assets/images/cloudflare-one/connections/intune/intune-reorder-included-apps.gif b/src/assets/images/cloudflare-one/connections/intune/intune-reorder-included-apps.gif new file mode 100644 index 00000000000..9436eef8925 Binary files /dev/null and b/src/assets/images/cloudflare-one/connections/intune/intune-reorder-included-apps.gif differ diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/intune.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/intune.mdx index acf3a70e8b7..a9e65d7202d 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/intune.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/partners/intune.mdx @@ -341,6 +341,10 @@ Complete Step 4 at least one hour after steps 1, 2, and 3 so clients have enough By completing this step, you deliver the Cloudflare One Client to targeted macOS devices, either automatically (assignment scope set as **Required**) or on-demand (assignment scope as **Available**) through your company portal. +:::caution +On versions 2026.3.566.1 and later, before 2026.6.865.0, Intune may repeatedly reinstall the Cloudflare One Client after you upload the `.pkg`, restarting the client and dropping the WARP connection. To fix this, reorder the app's **Included apps** detection list so that `com.cloudflare.1dot1dot1dot1.macos` is the primary app, and reapply the reorder each time you upload a new package. Version 2026.6.865.0 and later resolve this automatically. Refer to [Repeated reinstalls on macOS with Microsoft Intune](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#repeated-reinstalls-on-macos-with-microsoft-intune). +::: + ## iOS The following steps outline how to deploy the Cloudflare One Agent (Cloudflare One Client) on iOS using Microsoft Intune and preconfigure it with MDM parameters. diff --git a/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations.mdx b/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations.mdx index a6817c59137..1ea7aa1cd88 100644 --- a/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations.mdx +++ b/src/content/docs/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations.mdx @@ -248,6 +248,29 @@ To work around this issue, you can disable Lockdown mode while keeping Always-On 2. Use the [`auto_connect`](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#auto_connect) and [`switch_locked`](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#switch_locked) parameters in the managed configuration for seamless connectivity. 3. Instruct users to launch the Cloudflare One agent app and complete the one-time registration manually. +## Repeated reinstalls on macOS with Microsoft Intune + +When you deploy the Cloudflare One Client `.pkg` to macOS with Microsoft Intune, Intune may repeatedly reinstall the package. Each reinstall restarts the client and briefly drops the WARP connection, and you may see multiple reinstalls within a single Intune evaluation cycle. + +This affects Cloudflare One Client versions from 2026.3.566.1 — the first release with the redesigned client interface (the new client UI) — up to 2026.6.865.0, which resolves it. Version 2026.6.865.0 and later package the installer so that Intune detects the client automatically, and do not require this workaround. If you deploy an affected version through Intune, apply the following workaround. + +This happens because of how Intune detects whether a macOS `.pkg` app is already installed. When you upload the package, Intune automatically populates the app's **Included apps** detection list from the bundles inside the package, and uses the app listed first as the primary app for detection. For the Cloudflare One Client, Intune lists a nested framework bundle (`io.flutter.flutter-macos`) first instead of the client's own bundle identifier (`com.cloudflare.1dot1dot1dot1.macos`). Because the primary detection bundle never matches an installed receipt on the device, Intune concludes that the app is missing and reinstalls it on every evaluation. + +This is fundamentally a limitation in how Intune selects the primary detection app. A macOS `.pkg` already declares which bundle is the actual application through standard identifiers that every macOS packaging tool sets. Intune ignores these and instead picks whichever bundle happens to appear first inside the installer archive — an internal packaging detail that carries no meaning about which bundle is the real app and can vary between builds. The client's own bundle identifier is present in the detection list the entire time. Intune simply does not select it. Cloudflare has reported this behavior to Microsoft. On versions before 2026.6.865.0, use the following workaround to point Intune's detection at the correct bundle. + +To work around this issue, reorder the **Included apps** list so that the Cloudflare One Client bundle identifier is the primary detection app: + +1. In the [Microsoft Intune admin center](https://intune.microsoft.com), go to **Apps** > **macOS** and select the Cloudflare One Client app. +2. Go to **Properties** and, next to **Detection rules**, select **Edit**. +3. In the **Included apps** list, move `com.cloudflare.1dot1dot1dot1.macos` to the top so that it is the first (primary) app. +4. Select **Review + save** to apply the change. + +![Reordering the Included apps list in Intune so that the Cloudflare One Client bundle identifier is the primary app](~/assets/images/cloudflare-one/connections/intune/intune-reorder-included-apps.gif) + +:::note +On affected versions (2026.3.566.1 and later, before 2026.6.865.0), Intune repopulates the **Included apps** list every time you upload the `.pkg`, listing the nested framework bundle first again, so reapply this reorder on each upload. Upgrading your deployment to 2026.6.865.0 or later resolves the issue without the workaround. +::: + ## Windows 11 24H2 performance issues For Windows 11 24H2 users, Microsoft has confirmed a regression that may lead to performance issues like mouse lag, audio cracking, or other slowdowns. Cloudflare recommends users experiencing these issues upgrade to a minimum [Windows 11 24H2 version KB5062553](https://support.microsoft.com/en-us/topic/july-8-2025-kb5062553-os-build-26100-4652-523e69cb-051b-43c6-8376-6a76d6caeefd) or higher for resolution. diff --git a/src/content/warp-releases/macos/ga/2026.6.822.0.yaml b/src/content/warp-releases/macos/ga/2026.6.822.0.yaml index d2ad9df6147..be7fd976316 100644 --- a/src/content/warp-releases/macos/ga/2026.6.822.0.yaml +++ b/src/content/warp-releases/macos/ga/2026.6.822.0.yaml @@ -33,6 +33,7 @@ releaseNotes: |- - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. + - When deploying with Microsoft Intune, the client may be repeatedly reinstalled because Intune keys its install detection on a nested framework bundle instead of the client's own bundle identifier. See [Repeated reinstalls on macOS with Microsoft Intune](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/known-limitations/#repeated-reinstalls-on-macos-with-microsoft-intune) for the workaround. version: 2026.6.822.0 releaseDate: 2026-06-29T20:05:45.037Z packageURL: https://downloads.cloudflareclient.com/v1/download/macos/version/2026.6.822.0 diff --git a/src/content/warp-releases/macos/ga/2026.6.865.0.yaml b/src/content/warp-releases/macos/ga/2026.6.865.0.yaml new file mode 100644 index 00000000000..e01b46bea03 --- /dev/null +++ b/src/content/warp-releases/macos/ga/2026.6.865.0.yaml @@ -0,0 +1,39 @@ +releaseNotes: |- + This release introduces multiple features from our previous beta release into stable release, including: + + - The client now applies DNS search suffixes configured in your [device profile](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/device-profiles) / [network policy](/cloudflare-one/traffic-policies/network-policies). Administrators can push a list of DNS search domains that the client appends to single-label queries, alongside any system-configured suffixes. See [DNS search suffixes](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/settings/#dns-search-suffixes) for details. + - Upgraded security of device registration to be hardware-backed. Registration tokens can now be generated in the Secure Enclave whenever available to provide stronger protection against device impersonation. See [Hardware-backed registration](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/hardware-backed-registration/) for details. + - Added a local-file signal source for Emergency Disconnect. In addition to the existing HTTPS polling mechanism, administrators can now configure WARP to monitor for a file on disk; the presence of the file triggers an emergency disconnect even if both Cloudflare and your own infrastructure are unreachable. Either signal being asserted triggers disconnect; both must be cleared for normal operation to resume. + - Added new warp-cli debug commands for interactive connection diagnosis. See [Extra debug logging](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/troubleshooting/diagnostic-logs/#extra-debug-logging) for details. + - The local DNS proxy now supports DNSSEC passthrough. DNSSEC-signed responses are forwarded to the application intact (including DO/AD bits and RRSIG records), so applications that validate DNSSEC locally — including resolvers and the dig/drill tooling — work correctly through the client. + - Added a new MDM format for organization-wide settings, including a cleaner way to configure the compliance environment (e.g. FedRAMP). The previous per-configuration approach still works, but the new format is now recommended. See the updated [Cloudflare One MDM documentation](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/parameters/#organization_configs) for details. + - Added support for dashboard-managed client version deployments. Administrators can now upgrade or downgrade the client version on enrolled devices directly from the Zero Trust dashboard. See [Client version assignments](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/client-version-assignments/) for details. + + **Additional Changes and improvements** + + + - Client Certificate device-posture checks now support template variables (e.g. `${serial_number}`, `${device_uuid}`) in the Subject Alternative Name field. Previously only the Common Name field accepted variables, which broke posture rules that pinned identity to a SAN entry. + - Improved accessibility by using high contrast colors and more defined color boundaries when high contrast is enabled in the macOS Display settings. + - Path MTU Discovery (PMTUD) is now enabled by default. + - Fixed the in-client captive-portal browser rendering a blank "Success" page on some airline Wi-Fi networks. The browser now more consistently loads the airline's real portal page so users can complete sign-in from inside the client instead of having to open a separate browser. + - Fixed an issue in proxy mode where hostnames containing underscores (e.g. ai_app.com) were rejected, breaking apps that depend on such hostnames (notably ChatGPT sandbox apps). The local proxy now accepts underscore-containing hostnames in CONNECT requests. + - Fixed an issue where DNS queries would fail after the connection was idle, requiring users to retry. + - Users can now register with team names in any case format without errors. + - New UI fixes + - Fixed an issue where users with invalid MDM configurations were returned to the onboarding screen after successful authentication. + - Added a re-auth button and banner to the home screen so users don't miss it when their session expires. + - Added clear error messaging when the Cloudflare certificate needs to be installed. + - Brought back support for pausing the tunnel when connected to user-specified Wi-Fi networks for consumer users. + - New client UI now surfaces Split tunnel configuration and Local Domain Fallback configuration. + - Added ability to configure proxy mode for consumer users. + - Added back the option to quit for consumer users. + + **Known issues** + + + - Registration may hang at "Checking your organization configuration" due to IPC errors. A system reboot should resolve the error, allowing registration to proceed. +version: 2026.6.865.0 +releaseDate: 2026-07-16T14:59:49.865Z +packageURL: https://downloads.cloudflareclient.com/v1/download/macos/version/2026.6.865.0 +packageSize: 151629352 +platformName: macOS