Back to AI Work Hub

Senior management briefing

Secure OC tools with normal Microsoft 365 sign-in

The recommended access model keeps internal tools off the public internet while letting approved employees use the same Microsoft account they already use for company email and Office apps.

Recommendation

Cloudflare protects the site. Microsoft verifies the user.

Use Microsoft 365 / Entra ID

Employees sign in with their normal company Microsoft account. Entra ID confirms who they are, applies MFA/security rules, and reports group membership to Cloudflare.

Named users MFA ready

Put Cloudflare Access in front

Cloudflare blocks anonymous visitors before they reach the OC tools. Only approved users or approved service tokens get through.

Website gate Audit trail

Grant access by security group

Customer Service, Sales, management, and approved staff can be managed through one Microsoft group instead of one-off passwords.

Clean onboarding Clean removal

How sign-in works

Simple employee experience, controlled security underneath.

1

Open OC tools

The employee visits oc.handiproducts.com from work, home, or another normal browser location.

2

Cloudflare checks access

Cloudflare Access stops the request before the internal tool loads.

3

Microsoft verifies identity

The employee signs in with their company Microsoft 365 account. MFA can be required by policy.

4

Group membership decides

Entra ID confirms whether the user is in the approved Customer Service, Sales, or staff group.

5

Approved users continue

Cloudflare lets approved users into the OC tools and remembers the session for the configured period.

What users should expect

This should not feel like a new password system.

On the same computer and browser, users should not need to log in every time. Cloudflare Access can keep a browser session active for a defined period, commonly 30 days for low-risk internal tools. Microsoft may also recognize a trusted device and reduce repeat prompts.

Users may be asked to sign in again when the session expires, when they switch computers or browsers, after clearing cookies, after a security change, or when Microsoft decides MFA is needed. That is normal and desirable.

Why this beats the alternatives

Less friction than VPN-only, more control than shared passwords.

Recommended model

  • Named access: every sign-in belongs to a real employee account.
  • Offboarding works: remove the employee from Microsoft or the access group and access stops.
  • Remote work fits: employees can use the browser from normal home networks.
  • Security logs exist: management can see who accessed the system.

What we should avoid

  • Shared passwords: no clean user identity, weak audit trail, and poor offboarding.
  • VPN-only access: too much friction for a team that works remotely often.
  • One-Time PIN as primary: acceptable as a fallback, but clumsy for daily employee access.
  • Protecting only one URL: the custom domain and Pages preview domains all need coverage.

What must be protected

Do not leave a public alternate entrance.

!

The access policy should cover oc.handiproducts.com, handiproducts-oc.pages.dev, and preview URLs such as *.handiproducts-oc.pages.dev. If only the custom domain is protected, someone may still reach the same content through a Pages URL.