Back to OC hub

Security Recommendation

Protect OC with Microsoft 365 sign-in

The clean model is Cloudflare Access in front of oc.handiproducts.com, using Microsoft 365 / Entra ID to verify who the employee is before the OC tools load.

Recommended: Entra group access Fallback only: One-Time PIN Reject: shared password

High-Level Access Flow

Cloudflare Access and Microsoft 365 Entra ID flow for OC tools An employee requests oc.handiproducts.com. Cloudflare Access checks Microsoft 365 Entra ID. Entra verifies identity and group membership, then Cloudflare either allows access to OC tools or blocks the request. What happens when an employee opens OC Microsoft handles identity. Cloudflare enforces the front-door rule. OC tools stay behind the gate. Employee side Cloudflare Access Company identity and protected tools Employee Customer Service, Sales, Ops, or approved staff Browser Request Opens oc.handiproducts.com Cloudflare Access Shows login gate before the OC hub or tools load Access Policy Allow only approved Microsoft 365 group members Microsoft 365 / Entra ID Verifies the person using their normal work login, MFA, and company rules Entra Security Group Customer Service / Sales / approved staff are managed by Microsoft group membership OC Tools Order Lookup, Inventory, Zoho helper, dashboards Blocked Path Unknown people never reach the OC application pages Protect every public doorway The policy must cover oc.handiproducts.com, handiproducts-oc.pages.dev, and preview URLs like *.handiproducts-oc.pages.dev.

Plain-English Explanation

Microsoft 365 / Entra ID is the employee identity system

Entra ID is the Microsoft directory behind work accounts. It already knows who employees are, whether they use MFA, and which security groups they belong to.

Cloudflare Access is the front door

Cloudflare sits in front of OC. Before the page loads, it asks Microsoft whether this person is signed in and belongs to the approved group.

Admins manage access in one place

When someone joins, leaves, or changes roles, Paul or the M365 admin updates the Microsoft group. Cloudflare follows that group automatically.

Shared passwords are the wrong model

A shared password cannot prove who used it, is painful to revoke, spreads over time, and usually survives employee offboarding. It is cheap until it matters.

One-Time PIN is useful, but limited

OTP can help for break-glass access or a specific outside user. It should not be the primary company-wide access model because access becomes another manual list.

OC stays browser-only for employees

People use normal browser login. Deploy automation still uses Cloudflare credentials, and future machine access should use scoped service tokens.

Rollout Sequence

  1. Enable or confirm Cloudflare Zero Trust. This gives Cloudflare the Access feature that can protect the OC host before users reach the page.
  2. Connect Microsoft 365 / Entra ID. Cloudflare redirects employees to their normal Microsoft login and receives only the access decision it needs.
  3. Select the approved Entra group. Use an existing Customer Service / Sales / employee group if one exists, or create a specific OC access group.
  4. Apply the policy to every OC entry point. Protect the custom domain, the production pages.dev URL, and preview deployments so there is no public side door.
  5. Validate allowed and blocked access. Test an approved employee, a non-member, GitHub deploys, and the public HandiProducts site to confirm only OC access changed.