A leading UAE driver education group unified four entities under one Zero Trust SASE stack.

The challenge

The group is a government-recognised driver education leader in the UAE. It operates four distinct entities across multiple sites, each with independent network environments, user domains, and on-premises application stacks hosted on Oracle Cloud Infrastructure (OCI).

This organic growth created compounding challenges:

• Fragmented multi-entity security perimeter. Four entities operating under separate domains with no unified security policy enforcement. Cross-entity access was managed through manual, ad-hoc network configurations.
• No identity-aware access control. Internal applications (ERP, DMS, HR systems, hospitality platforms) were accessible based on network location, not user identity. Insider threat, credential misuse, and overprivileged access were unmanaged risks.
• No internet filtering at branch locations. Branch users could freely access any internet destination without URL-level filtering, allowing potential data exfiltration and shadow IT.
• Multi-vendor DNS complexity. Internal DNS was split across multiple name servers across the four entities and two OCI regions. WARP-enrolled devices could not reliably resolve internal hostnames across all entities.

What Brixio deployed

12 Cloudflared Tunnels for secure application access

• Each tunnel mapped to specific applications per entity for segmentation.
• Internal applications accessible without public internet exposure.
• Replaced ad-hoc network access with structured, per-application connectivity.

31 Gateway rules for policy enforcement

• Branch locations restricted to approved URL lists.
• Corporate users retain full internet access with security filtering.
• Location-sensitive, identity-aware filtering architecture.

3 WARP profiles across entities

• All managed devices enrolled with encrypted, inspected traffic.
• Split tunneling configured to resolve internal DNS per entity.
• Device posture enforcement for corporate vs contractor devices.

Identity-aware access via Oracle IDCS SAML SSO

• SAML integration with Oracle Identity Cloud Service.
• Cloudflare One-Time PIN as fallback authentication.
• Access policies scoped to all five entity domains.
• Role-based access restricting users to entity-specific applications.

15 Gateway lists for granular control

• Approved URL lists per branch location.
• Blocked categories and known malicious domains.
• Entity-specific filtering policies.

Results

After phased rollout, the four entities operate under a unified Zero Trust posture with identity-driven access, branch-aware filtering, and reliable cross-entity DNS resolution.