[Access] Provide explicit guidance for how to require MFA on every login for Access applications

[asamborski]

Summary

The MFA session duration section says you can "require users to complete MFA on each Access login" but never tells you how for non-SSH (web) applications. The only concrete instruction today is for SSH/infrastructure apps (0m for every SSH connection).

This adds a Require MFA on every login subsection under MFA session duration with:

• Dashboard steps at each level (organization, application, policy) — set Authentication duration to Require every login
• An API example using session_duration: "0m" in the mfa_config object
• A note clarifying that this only affects the login flow, not existing sessions

File changed: src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx

Screenshots (optional)

N/A

Documentation checklist

• The change adheres to the documentation style guide.

[cloudflare-docs-bot]

Review

⚠️ 1 warning found in commit 7e5799f.

Fix in your agent

Fix the following review findings in PR #32168 (https://github.com/cloudflare/cloudflare-docs/pull/32168).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, fix all legitimate findings. For any you decide to skip,
post a comment on this PR with the finding ID and your reasoning.

---

## Code Review

### Warnings (1)

#### CR-28598c20301a · Incomplete API request body
- **File:** `src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx` line 154
- **Issue:** The new application-level API example only sets `mfa_disabled` and `session_duration` in `mfa_config`, omitting `allowed_authenticators`. The page describes Custom MFA settings as configuring both allowed authenticators and session duration, and the org-level API examples require the field.
- **Fix:** Add `allowed_authenticators` (e.g. `["totp", "biometrics", "security_key"]`) to the `mfa_config` example so it matches the dashboard flow and the rest of the docs.

Code Review

This code review is in beta and may not always be helpful — use your judgment.

Warnings (1)

File

Issue

cloudflare-one/access-controls/policies/mfa-requirements.mdx line 154

Incomplete API request body — The new application-level API example only sets mfa_disabled and session_duration in mfa_config, omitting allowed_authenticators. The page describes Custom MFA settings as configuring both allowed authenticators and session duration, and the org-level API examples require the field. Fix: Add allowed_authenticators (e.g. ["totp", "biometrics", "security_key"]) to the mfa_config example so it matches the dashboard flow and the rest of the docs.

Conventions

_{No convention issues found.}

Style Guide Review

_{No style-guide issues found.}

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. Stops if there are conflicts and reports which files conflict.
/rebaseWithConflicts	Rebases against production and attempts to resolve conflicts automatically using AI. Stops with an explanation if confidence is not high enough.

[github-actions]

This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:

Pattern	Owners
/src/content/docs/cloudflare-one/access-controls/	@kennyj42, @asamborski, @ranbel, @cloudflare/cf1-reviewers, @elithrar, @cloudflare/product-owners

[asamborski]

just pushed update based on docs bot's suggestions

[github-actions]

Nimbus Preview URL: https://nimbus-7e5799ff.preview.developers.cloudflare.com
Nimbus Preview Branch URL: https://nimbus-asamborski-mfa-require-every-login.preview.developers.cloudflare.com

[github-actions]

Preview URL: https://7e5799ff.preview.developers.cloudflare.com
Preview Branch URL: https://asamborski-mfa-require-every-login.preview.developers.cloudflare.com

Files with changes (up to 15)

Original Link	Updated Link
https://developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/	https://asamborski-mfa-require-every-login.preview.developers.cloudflare.com/cloudflare-one/access-controls/policies/mfa-requirements/