You can use the Microsoft Intune mobile device management (MDM) solution to deploy Tailscale in your organization. You can configure a number of system policies, and you can then use Microsoft Intune to deploy these policies across devices in your organization. Tailscale system policies via Microsoft Intune are supported on Windows, macOS, iOS, tvOS, and Android.
If you need help deploying Tailscale using Microsoft Intune, or would like to suggest any feature enhancements, contact our support or sales teams.
Follow the steps in this document to get started. On macOS and iOS, you'll learn how to create a configuration profile containing a system policy that displays the name of your organization in the Tailscale client as an example. You'll then deploy it to a set of devices already enrolled in Microsoft Intune. On Android, you'll learn how to distribute Tailscale and enforce restrictions already available in the Tailscale app by defining a custom configuration.
Create, upload, and deploy a Tailscale configuration profile for macOS/iOS/iPadOS
To get started with Tailscale and Microsoft Intune, you'll first need to determine which system policies you wish to impose on your devices. Once you know which system policies to impose and the value for each, you'll then need to create an Apple configuration profile (.mobileconfig file) to define them, and upload the profile to the Microsoft Intune admin center.
Paste the contents of our configuration profile template, which provides preset values for the ManagedByOrganizationName and IPAddressCopiedAlertSuppressed policies into a new XML file called Tailscale.mobileconfig. This XML file with the .mobileconfig extension will become your configuration profile.
In the sidebar, select Devices, then choose Configuration profiles under the Policy section.
A list of currently configured profiles will appear. Select the Create menu item, then choose New Policy from the dropdown menu that will appear.
Select the platform you're looking to configure using the Platform dropdown menu. This will be either macOS or iOS/iPadOS.
Choose Templates as the Profile type.
Select the Custom template, and confirm with the Create button at the bottom of the templates list.
Set a descriptive name and an optional description for the policy. For instance, Tailscale macOS system policies.
In the following Configuration settings step, enter a name for the policy that will be displayed to users, and upload the .mobileconfig previously created. Use the Device deployment channel if asked. Select Next to continue.
Select the correct assignments in the Assignments tab. You can use the Add all users shortcut if you wish to deploy the configuration profile to all users and groups in your organization. Alternatively, select users and groups to deploy the policies to.
Select Next to continue to the Review step. If everything checks out, select Create to deploy the policy.
The steps above are valid for both macOS and iOS deployments. If you have both macOS and iOS devices in your organization, you'll simply have to follow the instructions twice. Creating two separate .mobileconfig files using the proper application bundle identifier for each platform, and then choose the right platform when asked by the Intune admin center.
Once you have followed these steps, Microsoft Intune will begin deploying the profile to all the users and groups you selected. After rebooting the device, each enrolled client should display the organization name in the Tailscale client menu as set in the sample configuration profile used.
Create, upload, and deploy a Tailscale configuration profile for Windows
To get started with Tailscale and Microsoft Intune, you'll first need to determine which system policies you wish to impose on your devices. Once you know which system policies to impose and the value for each, we recommend using the provided Tailscale ADMX file to import policies for a Tailscale configuration profile to be used with Microsoft Intune. ADMX files are a way to define group policies in Windows.
In the sidebar, select Devices, then choose Configuration profiles under the Policy section.
First, import the Tailscale ADMX file. Select Import ADMX, then click the Import button.
Upload the Tailscale ADMX and Tailscale ADML file. Click Next, then Create. You can click Refresh to check the status of the upload and template's availability.
Navigate back to Policies. A list of currently configured profiles will appear. Select the Create menu item, then choose New Policy from the dropdown menu that will appear.
Select Windows 10 and later using the Platform dropdown menu.
Set a descriptive name and an optional description for the policy. For instance, Tailscale windows policies.
Now you will see the Tailscale setting available for configuration.
When you click the Tailscale settings, you can browse through policies that you can use and set their values.
Once you set a policy's value, the state of the policy should be shown in the Tailscale settings.
Once you configure the policies you want to use, click Next to the Scope Tags section. You can assign a tag for the configuration profile if you have one. If you don't have any tags, select the Default option.
Choose Next, and select your assignments in the Assignments tab. You can choose Add all users to deploy the configuration profile to all users, or select specific users or groups of users.
Click Next and review your profile settings before selecting Create.
Once you have followed these steps, Microsoft Intune will begin deploying the profile to all the users and groups you selected. After rebooting the device, each enrolled client should display the organization name in the Tailscale client menu as per the sample configuration profile used. For more documentation on importing ADMX files, check the Microsoft Intune documentation.
Deploy Tailscale for Android using Microsoft Intune
Configuring Microsoft Intune to deploy Tailscale is done in two steps. You'll begin by adding the Tailscale app as a Managed Google Play application. Then, you can optionally decide to deploy system policies using an Android managed configuration. This will allow you to configure the Tailscale Android client to fit the needs of your organization.
Before continuing, ensure that all Android devices you wish to deploy Tailscale to are already properly enrolled in Intune. Because we are going to add Tailscale as a Managed Google Play app, you will also need to connect your Intune account to your Managed Google Play account. For more details on the account connection process, refer to the documentation published by Microsoft in Connect your Intune account to your Managed Google Play account.
Once Tailscale has been configured as a deployed app in Intune, you can optionally configure a set of system policies that will be enforced on the enrolled Android devices.
Pick a descriptive name for the policy, such as Tailscale System Policies. Choose Android as the platform.
Select Associated app to display a list of configured applications. If you followed the previous steps, this list should include Tailscale. Select it to continue.
Choose Configuration settings, then Use configuration designer, and then click on Add to pick from the list of available system policies.
