Switch identity provider

You can use the Tailscale admin console to switch the identity provider (IdP) for the following IdPs:

• Google Workspace (G Suite)
• Microsoft, including Microsoft Accounts, Office 365, Active Directory, and Microsoft Entra ID when a custom domain is used.
• Okta
• OneLogin
• OpenID Connect (OIDC)

For other identity providers, contact Tailscale Support when you need to switch to a different IdP.

Switch to a different identity provider

You need to be an Owner to switch the identity provider for your tailnet.

To switch to another IdP:

1. Open the User management page of the Tailscale admin console.

2. Under the Identity Provider section, select the menu and then select Switch identity provider.

3. Select the IdP that you want to use for your tailnet.

4. Authenticate to the new IdP. This step varies depending on which IdP you selected.

   GoogleMicrosoftOkta or OneLoginOIDC

   1. Under the Authenticate section, select Sign in to Google.
   2. Log in with the email you use for Tailscale.

5. Select Switch identity provider.

Your chosen identity provider is now ready to use.

Limitations

• You cannot change the tailnet's primary domain name while changing the IdP unless you contact Tailscale Support. For example, you cannot change your IdP from Entra ID, using example.com as the primary domain, to Okta using example.org as the primary domain.
• If you are using a shared domain tailnet, such as those created with a Gmail addresses, you cannot switch your IdP unless you contact Tailscale Support.