Skip to content
Cloudflare Docs

Application Granular Controls

Application Granular Controls enables you to control specific user actions within supported SaaS applications. This allows you to give users access to an application while restricting the actions that they can take within the application.

Create a Gateway policy with Application Granular Controls

To create an HTTP policy with Application Granular Controls:

  1. In Zero Trust ↗, go to Gateway > Firewall policies. Select HTTP.
  2. Select Add a policy.
  3. Give your policy a name (for example, "Block Google Drive Uploads”) and a description.
  4. In the expression builder, define the scope of your policy. In the Traffic section, add a condition and specify the Application selector.
  5. Select the “is” Operator (application granular controls are specific to an application so the condition must reference a single application using the is operator).
  6. In the Value field, the applications that support granular controls are grouped in the categories at the top of the list for example “File Sharing (with Granular Controls)”. Select the required application (for example Google Drive).
  7. A fourth Controls field will appear, allowing you to select one or more Application Controls or individual Operations (see below for an explanation of these terms).
  8. Complete your policy expression with any other conditions, select an Action and configure any desired policy settings.
  9. Select Create policy to save and activate your policy.

The policy will appear in the list of HTTP policies. Here, the order of precedence can be changed and the policy can be disabled or enabled.

Application Controls vs Operations

Application Granular Controls can be defined at two levels of granularity:

  • Application Controls are pre-defined controls which represent user intent for example Upload or Download. They are defined by Cloudflare and consist of a set of operations (see below) that have been deemed to be related to that intent. Using application controls within a policy is a quick way of enforcing common controls. For the mapping of operations to application controls, see Application Controls.
  • Operations: These are the individual API-level actions that an app uses. Defining controls at operation level allows for more fine-grained policies to support advanced use cases for example block only certain types of downloads, or to define controls where there is not an existing application control that covers the required intent for example block comments. However, because each SaaS application uses a unique set of operations each of which has its own scope, nuances and behaviors, the use of operation level controls often requires analysis to determine applicability for the desired use case. Operation-level controls can also be used in cases where variations to the Cloudflare-defined application controls are needed for example to include or exclude certain operations.

Operation Groups are groupings of operations that are defined by the application vendor. Typically these are based on a categorization of the application's capabilities - different functional areas of the application for example signature requests - or the entities that the application defines for example files or folders. These definitions vary by application. In the Gateway policy builder, operations are shown grouped into these operation groups to facilitate correlating the operations with available vendor API documentation.

The Contains Payload column in Application Controls indicates whether a given operation is likely to contain content that is suitable for DLP scanning. This includes operations that contain the content of uploaded or downloaded files, or AI prompts. When a user performs a file upload for example, a sequence of API operations may result, for example setting up the file metadata, uploading the file content, and then finalizing the upload. From a DLP perspective, it can be advantageous to specifically target the operation that contains the file content; the contains payload column identifies which operation that is.

Application APIs

SaaS applications typically provide multiple APIs to interact with. For each application, we may support the following API types:

  • Web Application API: these APIs are consumed by the web application that users interact with through their browser.
  • Platform API: these APIs are exposed to users to allow for programmatic interaction with the SaaS application. These are typically used by automations, scripts, or even other applications.

When building your HTTP rules using Operations, if both API types are available, you should select Operations that align to the API being used, or include both for greater coverage.

Application controls include Operations for both API types.

Compatible applications

With Application Granular Controls, you can choose specific actions and operations to match application traffic.

AI

ChatGPT (app ID 1199)
Operation nameOperation IDApplication Control nameApplication Control IDContains payloadOperation GroupOperation Group ID
SendPrompt8004Prompt1652✅Chat1650
UploadFile8008Upload1653—Chat1650
UploadFilePayload8013Upload1653✅Chat1650
ShareResponse8006Share1654—Chat1650
ShareCanvas8007Share1654—Chat1650
TranscribeVoice8011Voice1655—Chat1650
EnableVoiceMode8003Voice1655—Chat1650
AllowTraining8009—Settings1651
AllowVoiceTraining8010—Settings1651
AllowVideoTraining8016—Settings1651
ExportData8020—Settings1651

Google Gemini (app ID 1340)
Operation nameOperation IDApplication Control nameApplication Control IDContains payloadOperation GroupOperation Group ID
SendPrompt8021Prompt1657✅Chat1656
UploadFile8022Upload1658—Chat1656
UploadFilePayload8023Upload1658✅Chat1656
TranscribeVoice8025Voice1659—Chat1656

Perplexity (app ID 1937)
Operation nameOperation IDApplication Control nameApplication Control IDContains payloadOperation GroupOperation Group ID
SendPrompt11947Prompt2598✅Chat2596
ClarifyingPrompt11951Prompt2598✅Chat2596
CreateUploadUrl11948Upload2599—Chat2596
UploadFile11955Upload2599✅Chat2596
UploadOrganizationFile11950Upload2599—Settings2597
ShareChat11952Share2600—Chat2596
VoiceTranscription11953Voice2601—Chat2596
ExportChat11949—Chat2596
DeleteThread11954—Chat2596
DeleteOrganizationFile11956—Settings2597

Claude (app ID 2430)
Operation nameOperation IDApplication Control nameApplication Control IDContains payloadOperation GroupOperation Group ID
SendPrompt10048Prompt2127✅Chat2126
PromptCompletion10050Prompt2127✅Chat2126
RetryPromptCompletion10040Prompt2127✅Chat2126
UploadFile10039Upload2128✅Chat2126
ConvertDocument10041Upload2128✅Chat2126
ShareConversation10043Share2129—Chat2126
GetShares10052Share2129—Chat2126
CreateConversation10038—Chat2126
GetConversation10046—Chat2126
UpdateConversation10047—Chat2126
DeleteConversation10045—Chat2126
UpdateAccount10036—Settings2125
InitiateDataExport10037—Settings2125
GiveFeedback10042—Chat2126
SetConversationTitle10044—Chat2126
GetOrganisation10049—Settings2125
GetFilePreview10051—Chat2126

File sharing

placeholder