[Workers] Add Cloudflare Access for Workers changelog

src/content/changelog/workers/2026-06-28-workers-access.mdx

@@ -0,0 +1,47 @@
+---
+title: You can now enable Access on a Worker or all Workers at once
+description: Two new ways to protect Workers with Cloudflare Access. Apply a policy to a single Worker across all its domains, or set a default policy for every Worker in your account.
+products:
+  - workers
+date: 2026-06-28
+---
+
+import { Width } from "~/components";
+import { Image } from "astro:assets";
+import protectAllWorkers from "~/assets/images/changelog/workers/protect-all-workers.png";
+import protectOneWorker from "~/assets/images/changelog/workers/protect-one-worker.png";
+import makeWorkerPublic from "~/assets/images/changelog/workers/make-worker-public.png";
+import chooseWhoCanSignIn from "~/assets/images/changelog/workers/choose-who-can-sign-in.png";
+import accessPolicies from "~/assets/images/changelog/workers/access-policies.png";
+
+You now have two new ways to protect your Workers with Cloudflare Access. With these you can:
+
+- Set an Access policy on preview deployments only, or on both preview and production deployments.
+- Control who can sign in by Cloudflare account membership, email address, or email domain.
+<Width size="medium">
+<Image src={chooseWhoCanSignIn} alt="Access policy configuration for controlling who can sign in" />
+</Width>
+
+**Protect a single Worker across all its domains at once**
+
+Until now, if a Worker was reachable on a route, a Custom Domain, and a `workers.dev` URL, you had to create a separate Access application for each one. Now you apply one Access policy to the Worker itself. You can choose to apply it to all preview URLs associated with the Worker, or to both previews and production.
+<Image src={protectOneWorker} alt="Access setting for protecting a single Worker" />
+
+**Protect all new and existing Workers by default**
+
+Instead of configuring Access one Worker at a time, you can turn on account-wide protection and require sign-in for all Workers at once.
+<Image src={protectAllWorkers} alt="Account-wide Access setting that protects all Workers" />
+
+If you turn on account-wide protection but a specific Worker should remain publicly accessible, you can add a Worker-level bypass to exempt it.
+<Image src={makeWorkerPublic} alt="Make a Worker public when all Workers are protected" />
+
+**View all of your policies**
+
+You can view and manage all of your Access policies in the **Access** tab of the Workers & Pages section in the dashboard.
+<Image src={accessPolicies} alt="Access tab showing all configured Access policies" />
+
+**API and programmatic access**
+
+You can also set up these policies through the Workers API instead of the dashboard.
+
+For setup instructions, refer to [Cloudflare Access for Workers](/workers/configuration/cloudflare-access/).