Giving SAML users access to particular tunnel

Hi there,
I have a service in which users provision VMs for themselves to use and I basically want to start a tunnel on each VM and then use Cloudflare to give only the user that created that VM access to particular services running on the VM in the browser.
So far, I’ve setup a zero-trust tunnel and application and authenticated access using a SAML Auth0 connection. I need to find a way to basically extend this into a way of programmatically giving users access to each VM when they create it.
My current idea is that via the cloudflared cli, a tunnel can be created and then I somehow need to make that tunnel only accessible to that particular SAML user.
Many thanks in advance for the help :slight_smile: