From Red Team to Zero Trust: Building an Enterprise SASE Lab with Cloudflare and Entra ID

For the past seven years, I have lived in the "assumed breach" world. My day-to-day involved emulating threat actors, chaining IAM misconfigurations, bypassing legacy network perimeters, and proving exactly why traditional VPNs are an attacker's best friend. But identifying the flaws in a flat network is only half the battle. The real challenge — and the future of enterprise security — is engineering the architectures that neutralize these attacks by design.

Enter Secure Access Service Edge (SASE) and Zero Trust Network Access (ZTNA).

Modern SASE platforms like Netskope, Zscaler, and Palo Alto Prisma are rapidly replacing legacy VPNs, shifting security enforcement out to the cloud edge and tying access explicitly to continuous identity verification. However, for security engineers looking to get hands-on experience building these architectures, there is a significant barrier to entry: these enterprise platforms rarely offer community editions or accessible home lab licenses.

To bridge this gap and transition my offensive mindset into practical, defensive infrastructure engineering, I decided to build a functional, enterprise-grade SASE architecture from scratch.

In this walkthrough, I will show you how to replicate a modern Zero Trust environment using tools accessible to any researcher. We will bypass the limitations of enterprise gatekeeping by leveraging Cloudflare Zero Trust (Free Tier) and Microsoft Entra ID. In this first phase, we will cover:

• Why bypassing standard SAML gallery apps for a custom OpenID Connect (OIDC) integration is critical for granular control.
• Wiring up Microsoft Entra ID as our authoritative Identity Provider (IdP).
• Validating the authorization code flow and identity claim handoffs at the cloud edge.

If you are a penetration tester looking to understand how modern defensive perimeters are built, or a network engineer pivoting into cloud security, this lab will give you the exact blueprint. Let's dive into

Phase 1: Identity Integration.

Step 1: Create a Custom App Registration in Entra ID

In the Microsoft Entra admin center, do not go to "Enterprise applications." Instead, navigate to Entra Id > App registrations > New registration

a. Enter a name like Cloudflare ZTNA Lab.

b. Supported account types: Choose single tenant only

c. Redirect URI:

• Select Web from the dropdown.
• Enter your Cloudflare Access callback URL: https://<your-team-name>[.cloudflareaccess.com/cdn-cgi/access/callback](https://.cloudflareaccess.com/cdn-cgi/access/callback) (replace <your-team-name> with your actual Cloudflare Zero Trust team name).

d. Click Register

https://sparkling-tree-45ba.cloudflareaccess.com/cdn-cgi/access/callback

https://sparkling-tree-45ba.cloudflareaccess.com/cdn-cgi/access/callback

Optional Read:

Here is the technical breakdown of exactly what happens and why that specific path is required:

• The Authentication Handoff (The Redirect):_ When a user attempts to access your protected ZTNA lab, Cloudflare intercepts the request and redirects them to Entra ID to log in. Once the user successfully authenticates, Entra ID must send them back to Cloudflare along with a cryptographic token (a SAML assertion or OIDC token) proving their identity._
• The Callback URL Requirement: Entra ID will not simply send this sensitive token to the root of your domain (e.g., your-team.cloudflareaccess.com). It requires a highly specific, pre-approved destination to prevent token interception or misdirection.
• The /cdn-cgi/ Directory: This is a hidden, reserved directory that exists on all domains proxied by Cloudflare. Traffic sent to /cdn-cgi/ does not get routed to an origin web server; instead, it is intercepted directly by Cloudflare's edge compute nodes.
• The /access/callback Listener: This is the dedicated script running on Cloudflare's edge. When Entra ID redirects the user to this path, the script consumes the token, validates its digital signature against the keys you configured earlier, and issues the user a CF_Authorization session cookie.

Step 2: Generate the Keys

1. On the app overview page that appears, copy and save the Application (client) ID and the Directory (tenant) ID. You will need both.
2. In the left menu under Manage, click Certificates & secrets.
3. Click New client secret. Give it a description and an expiry (e.g., 6 months), then click Add.

CRITICAL: Immediately copy the string in the Value column (not the Secret ID). This value will disappear once you leave the page.

Step 3: Grant API Permissions (Optional but Recommended for Groups)

If you want to restrict SASE access based on Entra ID security groups (which looks great in an interview):

1. In the left menu, click API permissions.
2. Click Add a permission -> Microsoft Graph -> Delegated permissions.
3. Search for and check GroupMember.Read.All, Directory.Read.All, and User.Read.
4. Click Add permissions, then click the Grant admin consent for [Your Tenant] button directly above the list to authorise it.

Optional Read:

If you skip the "Grant API Permissions" step entirely during the App Registration process, Microsoft Entra ID assigns one default permission to the application automatically:

• Microsoft Graph -> User.Read (Delegated).

What does this default permission do?

The User.Read permission allows the application (in this case, Cloudflare) to sign the user in and read their basic profile data from Entra ID. This is the bare minimum requirement for any application to facilitate a Single Sign-On (SSO) authentication flow.

In the context of SASE lab, if you skip granting explicit API permissions:

1. The authentication will still work: Cloudflare will still be able to successfully redirect users to Entra ID, authenticate them, and log them into your Zero Trust environment because User.Read is sufficient for a basic login.
2. Group-based policies will fail: You will not be able to restrict access based on Entra ID Security Groups. If you try to create a Cloudflare Zero Trust policy that says "Only allow the IT Admins Group to access this web server," it will not work. Cloudflare needs the GroupMember.Read.All and Directory.Read.All permissions to query Entra ID and check which groups the logging-in user belongs to.

Step 4: Connect Cloudflare Zero Trust

1. Log in to your Cloudflare Zero Trust dashboard.
2. Navigate to Integrations -> Identity providers -> Add an Identity Provider
3. Input your Application (client) ID, the Client secret (Value), and the Directory (tenant) ID you generated in Azure.
4. Enable Support Groups option as we have already configured additional permissions for that in Step 3.
5. Click Save.

That confirms entrat ID users can access resources gated via cloudflare services.

Thank you for reading!