Demo library › Chapter 4
Contractor access without a company laptop
A contractor signs in from her own machine, and a guest with nothing but an email address signs in with a one-time PIN. Both use the wiki in a remote browser with copy, paste, download and print turned off.
The problem
Ramona Flatley is a contractor and needs the wiki. Shipping her a laptop is slow and expensive, and letting her own machine onto the network is worse. Whatever she can read, she can also copy and keep.
Lands with: IT and security teams who onboard third parties
Before you start
- A browser without the Cloudflare One client, in a private window.
- Ramona's sign-in:
, passwordSavetheinternet!1. - For the guest: your own email address, or one from the audience, and a phone or laptop that can read it.
Run it
A policy for contractors
| Do | Say |
|---|---|
| Zero Trust → Access controls → Applications → the wiki's application → policies. | Two policies: employees, and Contractors (isolated). The Contractors group comes from the identity provider, and contractors only get in through a remote browser. |
| As Ramona, open Nexus. | She signs in and the wiki loads. It runs in a browser on Cloudflare's network, so nothing reaches her machine. |
| Try to copy some text, then print or download a page. | None of it works. The Gateway rule Contractors: read-only wiki in isolation turns those off for contractors. Employees are unaffected. |
| As Ramona, open WorkWeek. | Refused. She was given the wiki and nothing else. |
Whybackground, if you are asked
Shipping a contractor a managed laptop is slow and expensive, and letting a personal machine onto the network is worse. In a remote browser nothing runs on her machine, there is no network access, and nothing is left behind when she closes the tab.
Ramona is a contractor because the identity provider says so: the Contractors group comes from HR's employment type. Upload is turned off too, alongside copy, paste, download and print.
A guest with only an email address
| Do | Say |
|---|---|
| In a new private window, open Nexus and choose One-time PIN. Enter your own email address - or ask someone in the audience for theirs. | No account anywhere in the company. Access emails a code, and the code is the sign-in. |
| Enter the code from the email. | The wiki opens in a remote browser, read-only, exactly as it did for Ramona. The Gateway rule Guests: read-only wiki in isolation applies to anyone who is not on the company's roster. |
Whybackground, if you are asked
Not every outside user is in the company's identity provider. A one-time PIN proves only that the person controls that inbox, so the policy gives them the least: one app, in isolation, with nothing coming out. Any email address is accepted here so anyone in the room can try it; a real deployment would list the partner's domains.
What the audience should see
- The wiki working in Ramona's browser with no client installed.
- Copy, download and print refused.
- A guest signing in with an emailed code to the same read-only wiki.
- WorkWeek refused.
Where the evidence is
Access authentication logs: Ramona allowed by Contractors (isolated), and the guest by Guests (isolated, one-time PIN) under their own email address. Gateway HTTP logs: her wiki requests with the Isolate action.
Known limitations
- One-time PIN accepts any email address in this lab, so anyone who finds the wiki's address can read its fictional content in isolation.
- With two login methods, the wiki now asks which one to use. Employees with the client on are signed in without seeing it.
- Needs Browser Isolation on the account.
Part of: Secure web gateway and data protection · The full tour