Cloudflare Organizations GA: One Super Admin, Every Account

What became generally available, and what remains limited

The October 7 announcement describes Organizations as a container above accounts for centrally managing accounts, members, analytics and shared policies. Enterprise customers can use a single-tier Organization, while MSSP/Distributor partners can manage customer accounts through sub-organizations. An Organization is distinct from an account or zone, and their quotas count different resources.

The limitations page, updated October 9, gives a default maximum of 20,000 accounts and 200,000 zones per Organization for both Enterprise and MSSP/Distributor types. Larger enterprises and partners may obtain adjustments in some cases. GA also does not turn Organization Roles, which remains in beta, into a complete set of granular roles.

Enterprise: eligible accounts and restrictions on moving them

The user creating an Enterprise Organization must already be a Super Administrator of at least one Enterprise account. Existing accounts on any plan, including Free, can then be added if the person has Super Administrator access to the account and it does not already belong to another Organization. Having only a Free account does not meet the creation requirement.

Enterprise Organizations have a flat, single-tier structure without sub-organizations. Tags can distinguish business units, regions or environments. Accounts currently cannot move between Enterprise Organizations, so establish whether the company already has an Organization and where its accounts belong before planning consolidation.

An Organization Super Administrator can create up to five Free accounts within the Organization. The limitations page explicitly says API tokens and OAuth access tokens cannot create accounts inside an Organization. Do not carry over standalone Free-account creation behavior, or token support for creating the Organization itself, to this separate operation.

MSSP and Distributor structures follow different account rules

Cloudflare creates MSSP/Distributor Organizations; contact the account team for setup. Assigning existing accounts to these Organizations is currently unavailable. An MSSP can self-serve create new customer accounts within its Organization, which differs from the Enterprise model for adding existing accounts.

A Distributor can create child MSSP Organizations, with nesting up to five levels. Accounts can move between MSSP Organizations within the same Distributor Organization. This does not permit moves between arbitrary Organizations.

The Organization type, Enterprise or MSSP/Distributor, is fixed at creation. Changing types requires a new Organization. Evaluate the structure, the origin of customer accounts and future handover needs together, rather than assuming an Enterprise setup can later be converted in place.

Implicit access is convenient, but grants broad authority

An Organization Super Administrator can access every account in the Organization without joining each account separately. Both Enterprise and MSSP/Distributor Organizations currently offer only this Organization role. Read-only, billing and audit-log roles remain future capabilities, so granular access for ordinary viewers should not be promised.

As a planning measure, identify who actually needs management access across all accounts before deciding whom to invite. This is access-design advice, not a new mandatory process announced by Cloudflare. An Organization Super Administrator should not be treated as a read-only member simply to make centralized viewing easier.

Organization APIs: check user-token support for each operation

Listing Organizations supports a Global API key or a user API token with User Details Read or User Details Write. Creating an Organization supports a Global API key or a user token with User Details Write. The credential must belong to a user with the required access; using an accepted credential type does not itself satisfy the role requirements.

Reading, updating or deleting an Organization, listing its directly attached accounts, viewing or updating its profile, and managing its members currently require a Global API key in the core credential matrix. Accepting or rejecting an invitation supports a Global API key or the invited user's own API token, with no additional token permission required.

Organization audit logs, billing usage, account moves and other account-scoped operations sit outside this core matrix. Check each endpoint's Security and Accepted Permissions sections separately. The matrix neither says that every Cloudflare API requires a Global API key nor that any user token can manage an entire Organization.

Check Terraform credentials and exit paths before consolidation

The Terraform cloudflare_organization resource and its singular Organization data source require a Global API key and the user's registered email address. The plural cloudflare_organizations data source for listing Organizations also supports a user API token with User Details Read or User Details Write. The singular and plural names have different credential support.

Prefer user API tokens for operations where the matrix supports them. User tokens cannot currently receive the Organization-scoped permissions required by Global-API-key-only operations. A Global API key has full access to that user's Cloudflare resources and also requires the registered email address, so convenience alone is not a reason to broaden its use.

Both Organization types currently support deletion through the API, but not the dashboard. Removing an account requires Cloudflare Support rather than a self-service action. An account inventory, named administrators, required automation operations and a support contact provide a practical basis for assigning change and rollback responsibilities. The reviewed sources do not fully establish separate fees, contract terms or geographic availability; resolve those with the account team before procurement or consolidation.