Document SAML ForceAuthn

src/content/changelog/access/2026-09-14-saml-force-authentication.mdx

@@ -0,0 +1,13 @@
+---
+title: Require fresh authentication for SAML identity providers
+description: Configure Cloudflare Access to request fresh identity provider authentication for each SAML login.
+date: 2026-09-14
+products:
+  - access
+---
+
+Cloudflare Access can now request fresh authentication from a SAML identity provider for every login. Turn on **Require reauthentication** in the Cloudflare dashboard, or set `force_authn` to `true` through the API. Access will then set `ForceAuthn` to `true` in signed and unsigned SAML authentication requests.
+
+This option is useful when an application requires users to reauthenticate at the identity provider instead of relying on an existing identity provider session. The default value is `false`.
+
+For configuration details, refer to [Require fresh authentication at the identity provider](/cloudflare-one/integrations/identity-providers/generic-saml/#require-fresh-authentication-at-the-identity-provider).

src/content/docs/cloudflare-one/integrations/identity-providers/generic-saml.mdx

@@ -187,6 +187,14 @@ If you rotate again before updating your IdP with the current certificate, the p
 
 This optional configuration signs the [Access JWT](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/) with the Cloudflare Access public key to ensure that the JWT is coming from a legitimate source. The Cloudflare public key can be obtained at `https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/certs`.
 
+### Require fresh authentication at the identity provider
+
+You can ask your identity provider to reauthenticate the user for every SAML authentication request. This option applies whether the request is signed or unsigned.
+
+This setting is available through the API. First, retrieve the identity provider's current configuration from the [Access identity provider endpoint](/api/resources/zero_trust/subresources/identity_providers/methods/get/). Then, send the complete configuration to the [update identity provider endpoint](/api/resources/zero_trust/subresources/identity_providers/methods/update/) with `force_authn` set to `true` in the `config` object. The default value is `false`.
+
+When this option is turned on, Access sets `ForceAuthn` to `true` in each SAML authentication request. Access may also set `ForceAuthn` to `true` when a security check requires the user to reauthenticate, even if `force_authn` is `false`.
+
 ### Email attribute name
 
 Many [Access policies](/cloudflare-one/access-controls/policies/) depend on a user's email address. Some identity providers have a different naming for the email address attribute (for example, `Email`, `e-mail`, `emailAddress`). This can typically be checked in the identity provider's SAML test option.