Organizations for MSSP and Distributors

Organizations provides a multi-tier structure for MSSP (Managed Security Service Provider) and Distributor partners to manage customer accounts and create child partner Organizations.

Who is this for?

Organizations for MSSP and Distributors is designed for:

Distributors managing multiple MSSP partner Organizations
MSSPs managing multiple end-customer accounts
Channel partners providing managed Cloudflare services

Looking for Enterprise documentation? Refer to Organizations for Enterprise.

Hierarchy structure

MSSP/Distributor Organizations use a multi-tier structure:

Distributor Organization
├── MSSP Organization A
│   ├── Customer Account 1
│   │   ├── Zone A
│   │   └── Zone B
│   └── Customer Account 2
│       └── Zone C
├── MSSP Organization B
│   ├── Customer Account 3
│   │   └── Zone D
│   └── Customer Account 4
│       ├── Zone E
│       └── Zone F
└── MSSP Organization C
    └── Customer Account 5
        └── Zone G

Key characteristics:

Distributors create and manage child MSSP Organizations
Each MSSP Organization manages its own customer accounts
MSSP Organization members have implicit access to their customer accounts
Accounts can be moved between MSSP Organizations
Maximum: 500 accounts and 5,000 zones per Organization

Example: Distributor A

Distributor A is a Cloudflare channel partner with 15 MSSP partners:

Each MSSP partner manages 5-50 end-customer accounts
Total: 15 MSSP Organizations, 300+ customer accounts

Distributor A's structure:

Distributor A Organization
├── Security MSSP
│   ├── Retail Customer 1 (10 zones)
│   ├── Healthcare Customer 2 (25 zones)
│   └── Finance Customer 3 (40 zones)
├── Web Performance MSSP
│   ├── E-commerce Customer 4 (15 zones)
│   └── Media Customer 5 (30 zones)
└── [13 more MSSP Organizations...]

What Distributor A can do:

Create new MSSP Organizations for new partners
Create customer accounts within each MSSP Organization
Move customer accounts between MSSP Organizations if ownership changes
View aggregate analytics across all MSSP Organizations
Share security policies across MSSP Organizations

What each MSSP can do:

Manage their own customer accounts
Create new customer accounts for new clients
Invite MSSP team members with implicit access to all customer accounts
Share WAF and Gateway policies across their customer accounts
View aggregate analytics across their customer accounts

Set up your Organization

MSSP/Distributor Organizations cannot be self-serve created by customers. To get started:

Contact your Cloudflare account team to request an MSSP or Distributor Organization.
Cloudflare will create your Organization and assign the initial Organization Super Administrator.
The initial Organization Super Administrator must have two-factor authentication (2FA) or single sign-on (SSO) enabled on their Cloudflare user account.
Once created, the Organization Super Administrator can begin managing the Organization from the Cloudflare dashboard ↗.

Create child MSSP Organizations

Distributors can create child MSSP partner Organizations. Each MSSP Organization operates independently and manages its own customer accounts.

Create new accounts

MSSP Organizations can self-serve create new customer accounts within their Organization. This is a key difference from Enterprise Organizations, which cannot self-serve create accounts.

Move accounts between Organizations

Move customer accounts from one MSSP Organization to another when ownership changes or customers switch providers.

Manage members

Organization Super Administrator

When your Organization is created, the initial user becomes the Organization Super Administrator. This role provides implicit access to all accounts in your Organization and allows you to manage memberships at the Organization level.

Implicit access

Organization members receive implicit access to all accounts in the Organization. Implicit access means:

You do not need explicit membership on each individual account.
When you go to any account within your Organization, you automatically have Super Administrator permissions on that account.
Implicit access is granted at the Organization level — you cannot grant implicit access to a subset of accounts.
Implicit access is equivalent to Super Administrator. There is no read-only implicit access today.
For Distributor Organizations, implicit access applies within each tier — Distributor admins access all child MSSP Organizations and their accounts.

Implicit access is separate from any existing per-account membership. If a user was already an explicit member of an account before it was added to the Organization, that existing membership is unaffected.

Invite members

You can invite additional members to your Organization. Invited members receive implicit Super Administrator access to all accounts in the Organization.

From the Organization overview, select Members.
Select Invite member.
Enter the email address.
Select Send invitation.

The user receives an email invitation. After accepting, they have implicit access to all accounts in the Organization.

Member authentication requirements

All users who will be Organization members must have two-factor authentication (2FA) or single sign-on (SSO) enabled on their Cloudflare user account before they can accept an Organization invitation. This is a per-user requirement, not an account-level setting.

If a user does not have 2FA or SSO enabled, they will not be able to accept the invitation.
Ask the user to enable 2FA or SSO first, then resend the invitation.
For instructions on enabling 2FA, refer to Set up 2FA.
For SSO configuration, refer to Dashboard SSO.

Organizations allows you to share WAF custom rulesets and Zero Trust Gateway policies (DNS, Network, HTTP, Resolver) across accounts in your Organization. Shared policies are read-only in receiving accounts and automatically stay in sync when updated in the source account.

For Distributor Organizations, policies can be shared across MSSP Organization boundaries within the same Distributor Organization.

For detailed instructions, refer to Policy sharing.

View aggregate analytics

You can view, filter, and download aggregate HTTP analytics across all accounts in your Organization:

From the Organization overview, select Analytics & Logs.
Use filters to narrow results by date range, account, domain, or other criteria.
To export data, select Download.

The data includes traffic for proxied hostnames and may be based on a sample. This data does not reflect billable usage.

Manage your Organization

Rename your Organization

Go to Organizations > Manage Organization.
Next to Organization name, select Rename.
Enter the new name.
Select Rename.

Edit customer identification data

Go to Organizations > Manage Organization.
Next to Customer identification data, select Edit.
Update the information.
Select Save.

View audit logs

Organization audit logs capture user-initiated actions performed by Organization Super Administrators through Organization-level APIs and the dashboard. These logs are separate from account-level audit logs — actions performed within a specific account continue to appear in that account's audit logs.

To view Organization audit logs in the dashboard:

Go to Organizations > Manage Organization.
Select Audit Logs.

You can also retrieve Organization audit logs via the API:

GET https://api.cloudflare.com/client/v4/organizations/{organization_id}/logs/audit

If you are viewing account-level audit logs and the account belongs to an Organization where you are an Organization Super Administrator, you can select View Organization Audit Logs to go to the parent Organization's audit logs.

For more details on audit log structure, filtering, and retention, refer to Audit Logs — Organization Activity Logs.

API

You can manage Organizations programmatically using the Cloudflare Organizations API. The API supports creating, updating, deleting Organizations, managing members, and assigning accounts.

Terraform

You can manage Organizations using the Cloudflare Terraform provider ↗.

If you encounter errors during setup or management, refer to Troubleshooting.

What you cannot do (today)

Assign existing accounts

MSSP/Distributor Organizations cannot assign existing accounts. Use account creation to add new accounts to your Organization.

Create nested sub-organizations

MSSP Organizations cannot create their own child Organizations. The hierarchy is limited to two tiers: Distributor → MSSP Organizations.