What do I need before deploying Cloudflare WARP?

The WARP package, a Cloudflare Zero Trust organization with its team name configured, and the Mac already enrolled in Applivery.

Where do I find my Cloudflare team name?

In the Zero Trust dashboard Overview, shown as the team domain. If it reads `your-team.cloudflareaccess.com`, the value you need is just `your-team`.

Is the Cloudflare Free plan enough?

It covers up to 50 users, which is usually enough for a pilot or a small team. Check the seat count in Cloudflare before assuming it covers everyone.

Which service mode should I use?

Use `warp` for a full VPN tunnel. Only change it if your use case is different, such as `1dot1dot1dot1` for DNS-only.

Why keep the profile minimal?

Because Cloudflare recommends it. A minimal payload configures enrollment without overriding the settings you already manage from the Zero Trust dashboard.

Do I have to generate new UUIDs?

Yes. Every profile needs its own unique PayloadUUID values, both for the WARP payload and the root profile. Reusing the sample ones causes conflicts, especially with several variants.

Does the user have to do anything on the Mac?

No. The profile supplies the organization and service mode, so the client enrolls without user interaction.

Can I deploy this to Windows or Android Devices too?

This guide covers macOS. The configuration profile is an Apple mechanism and does not apply to other platforms.

Cloudflare WARP Deployment

Cloudflare WARP is the client behind Cloudflare Zero Trust: it routes device traffic through Cloudflare's network so policies, filtering and identity checks apply wherever the Mac is. Deploying it by hand means installing the client on each machine and typing the organization name into it, which does not scale and rarely survives contact with a real fleet.

With Applivery you push both halves from one Policy — the package and its configuration — so the client installs and enrolls itself with nobody touching the Mac.

Requirements

To deploy Cloudflare WARP on macOS through Applivery, make sure you have the following:

The Cloudflare WARP package. The macOS .pkg is available in the Applivery App Catalog.
A Cloudflare Zero Trust organization. Free, Standard or Enterprise. The Free plan covers up to 50 users, which is usually enough for a pilot or a small team — check the seat count in the Cloudflare dashboard before assuming it covers everyone.
Your Cloudflare team name. The unique identifier of your Zero Trust organization. It goes into the profile as organization, so it has to exist before you generate the profile.
Macs enrolled in Applivery. Through Apple Business and Automated Device Enrollment for a silent, zero-touch rollout, or through manual enrollment. Without enrollment there is no managed way to push the profile.

Get your values from Cloudflare

Everything the profile needs comes from the Cloudflare Zero Trust dashboard:

Value	Where to find it
Team name (`organization`)	In Overview, shown as the team domain in the form `your-team.cloudflareaccess.com`. The value you need is just `your-team`, without the domain.
Service mode (`service_mode`)	Your own choice: `warp` for a full tunnel, which is the usual option for a VPN, or `1dot1dot1dot1` for DNS-only.

Note

The team name is not a secret. Any parameter that forces behavior, though — disabling logout, forcing auto-connect — changes the end user's experience, so agree those with the team before rolling out to production.

Prepare the configuration profile

Cloudflare recommends keeping the payload minimal, so it configures enrollment without overriding what you already manage from the Zero Trust dashboard. If you would rather not write the XML by hand, iMazing Profile Editor generates it for you.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDisplayName</key>
            <string>Cloudflare WARP Client</string>
            <key>PayloadIdentifier</key>
            <string>com.example.profiles.warp-vpn.client</string>
            <key>PayloadType</key>
            <string>com.cloudflare.warp</string>
            <key>PayloadUUID</key>
            <string>GENERATE-A-UNIQUE-UUID-HERE</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>display_name</key>
            <string>Example-Corp-WARP</string>
            <key>organization</key>
            <string>example-corp</string>
            <key>service_mode</key>
            <string>warp</string>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Cloudflare WARP Configuration</string>
    <key>PayloadIdentifier</key>
    <string>com.example.profiles.warp-vpn</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>GENERATE-A-UNIQUE-UUID-HERE</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Before uploading it, adapt four things:

organization: your real Cloudflare team name, not the placeholder.
service_mode: warp for a full VPN tunnel. Change it only if your use case is different.
Both PayloadUUID values: generate fresh, unique UUIDs for every profile — the WARP payload's and the root profile's. Reusing them causes conflicts, especially if you keep several variants such as pilot and production.
PayloadIdentifier: use your own reverse-domain naming rather than whatever the editing tool generated.

You can also set display_name to whatever the end user should see in the WARP client. It is worth doing if you will end up managing more than one organization.

Add the WARP package

Once in the Applivery Dashboard, go to any of your Policies 1 or create a new one. From the left-hand menu, select the Apps 2 section and click the + Add App 3 button.

In the modal view, navigate to the Applivery tab. Set the platform to macOS, choose App Catalog as the App origin, and search for Cloudflare WARP. For the Build selection, choose Last to ensure the latest version is always deployed.

Import the configuration profile

Within the Policy, select + Add configuration from the left-hand menu, then choose + Import and upload your adapted .mobileconfig. This is the piece that actually sets organization and service_mode, and the reason no user interaction is needed.

Once done, make sure to Save changes to apply the configuration.