# Restrict device access with Fleet

Last validated Jan 29, 2026

> **Note:** This integration is available for [the Standard, Premium, and Enterprise plans](/pricing).

[Fleet Device Management][xt-fleet] collects a series of signals from its agent installed on each device that can be used to determine the security posture of a device.

Tailscale can fetch these signals from Fleet and use them as device posture attributes in access rules, which can then be used by organizations to grant access to sensitive resources only to devices that have a high level of trust.

You can achieve this with Tailscale's [device posture management][kb-device-posture] features:

* [Device Identity Collection][kb-device-identity-collection], which collects identifiers (for example, serial numbers), used to match devices in Tailscale to devices in Fleet.
* Fleet posture integration, which synchronizes signals from Fleet to device posture attributes in Tailscale.
* [Posture conditions in access rules][kb-device-posture-postures-and-conditions], which lets you configure access restrictions based on device attributes.

This guide explains how to enable Device Identity collection for your Tailscale network (tailnet) and configure Fleet posture integration.

## What is Fleet posture integration?

The Fleet integration syncs data between Fleet and Tailscale on a recurring schedule.
During each sync, Tailscale performs the following actions:

1. Fetches a list of hosts and their reported data from your Fleet account.
2. Matches Fleet devices to devices in your tailnet based on serial numbers.
3. Writes the Fleet data to device posture attributes on each matched device.

The integration writes the following device posture attributes to matched devices:

\[Missing snippet: attributes-fleet.mdx]

## Prerequisites

Before you can set up the Fleet integration, make sure you have:

* [Device Identity Collection][kb-device-identity-collection] enabled, and devices in your tailnet are reporting identifiers.
* A Fleet account for which you have permission to create an API token.

## Create Fleet API token

To authenticate your Fleet account with Tailscale, you'll need to create a Fleet API-only user and API token.
The Fleet integration uses these to fetch a list of devices and their data from Fleet.

You can find instructions for creating a Fleet API-only user and API token [in the Fleet documentation][xt-fleet-api-only-user].

## Create Fleet policies

[Fleet policies][xt-fleet-policies] let you monitor whether your devices meet specific security and compliance criteria.
These policies are specific to your Fleet account.

The Fleet integration can add [node attributes][kb-node-attributes] to devices that are passing Fleet policies.

To enable adding these node attributes, add the string `Tailscale: fleetPolicy:{attributeName}` to your Fleet policy description.

* For each Fleet policy a device passes, the Fleet integration will add a `fleetPolicy:{attributeName} = true` node attribute to that device.
* For each Fleet policy a device fails, the Fleet integration will add a `fleetPolicy:{attributeName} = false` node attribute to that device.
* If multiple Fleet policies have the same `Tailscale: fleetPolicy:{attributeName}` string in their policy description, the node attribute will be `true` if any of the matching policies are passing, otherwise false.

You can check for the presence of a given Fleet policy in a device's node attributes in access rules, then adjust its access accordingly.

![The Fleet configuration panel showing a policy which includes \`Tailscale: fleetPolicy:builtinAntivirus\` to set a \`fleetPolicy:builtinAntivirus\` node attribute on passing devices.](integrations/fleet/fleet-policy-example.png)

## Configure Fleet posture integration

To configure Tailscale to fetch data about devices from Fleet:

1. Open the [Device management](https://login.tailscale.com/admin/settings/device-management) page of the Tailscale admin console.

2. Under the **Device Posture Integrations** section, locate the Fleet integration, then select **Connect**.

3. Enter your **Fleet URL** and **API Token**.

   ![The configuration screen for connecting to Fleet from the Tailscale admin console.](integrations/fleet/configure-integration.png)

4. Select **Connect to Fleet**.

## Review the integration status

Next, check to ensure the Fleet integration has run successfully.

1. Go to the **Device Posture Integrations** section of the [Device management](https://login.tailscale.com/admin/settings/device-management) page.
2. Locate the Fleet integration under the **Integrations** section.

After the Fleet integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.

![Integrations: Fleet: Last sync 4 minutes ago, 1 match between 2 Tailscale devices with identifies and 4 Fleet hosts](integrations/fleet/integration-status.png)

## Check node attributes

After you set up the Fleet integration, you can confirm that Tailscale is writing the new node attributes for your Fleet devices from the Tailscale admin console.

1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the Tailscale admin console.
2. Select a device to inspect.
3. Check the node attributes for the device in the **Machine Details** section. This section should include the set of `fleet:` and `fleetPolicy:` attributes listed previously.

![View of the machine attributes in the Machines page.](integrations/fleet/machine-attributes.png)

> **Tip:**
>
> You can also check device attributes using the [Tailscale API][co-device-posture-get-via-api].

## Adjust Tailscale access rules

After you set up the Fleet posture integration, and your devices have device posture attributes that reflect their signals as reported by Fleet, you can use those device posture attributes as part of your posture rules.

For example, to only permit access to `tag:production` from devices that are managed by Fleet, you can create a new posture and use it as part of a corresponding access rule:

```json
"postures": {
  "posture:managed": [
    "fleet:present",
  ],
},
"grants": [
  {
    "src": ["autogroup:member"],
    "dst": ["tag:production"],
    "ip": ["*"],
    "srcPosture": ["posture:managed"]
  }
]
```

\[Missing snippet: visual\_policy\_editor.mdx]

\[Missing snippet: sync-schedule.mdx]

\[Missing snippet: auditlogs-integrations.mdx]

[co-device-posture-get-via-api]: /api#tag/devices/GET/device/{deviceId}/attributes

[kb-device-identity-collection]: /docs/features/access-control/device-management/how-to/manage-identity

[kb-device-posture]: /docs/features/device-posture

[kb-device-posture-postures-and-conditions]: /docs/features/device-posture#device-posture-conditions

[kb-node-attributes]: /docs/reference/syntax/policy-file#nodeattrs

[xt-fleet]: https://fleetdm.com/

[xt-fleet-api-only-user]: https://fleetdm.com/guides/fleetctl#using-fleetctl-with-an-api-only-user

[xt-fleet-policies]: https://fleetdm.com/securing/what-are-fleet-policies