# Switch identity provider

Last validated Jun 29, 2026

You can use the Tailscale admin console to switch the identity provider (IdP) for the following IdPs:

* [Google Workspace (G Suite)][kb-sso-google]
* [Microsoft][kb-sso-microsoft], including Microsoft Accounts, Office 365, Active Directory, and Microsoft Entra ID when a custom domain is used.
* [Okta][kb-sso-okta]
* [OneLogin][kb-sso-onelogin]
* [OpenID Connect][kb-custom-oidc] (OIDC)

> **Note:** Switching identity provider is currently in beta.

For other identity providers, contact [Tailscale Support][co-contact-support-sso] when you need to switch to a different IdP.

## Switch to a different identity provider

You need to be an [Owner](/docs/reference/user-roles/) to switch the identity provider for your tailnet.

To switch to another IdP:

1. Open the [User management](https://login.tailscale.com/admin/settings/user-management) page of the Tailscale admin console.

2. Under the **Identity Provider** section, select the  menu and then select **Switch identity provider**.

3. Select the IdP that you want to use for your tailnet.

4. Authenticate to the new IdP. This step varies depending on which IdP you selected.

   #### Google

   1. Under the **Authenticate** section, select **Sign in to Google**.
   2. Log in with the email you use for Tailscale.

   #### Microsoft

   1. Under the **Authenticate** section, select **Sign in to Microsoft**.
   2. Log in with the email you use for Tailscale.

   > **Note:**
   >
   > If you are using a Microsoft 365 Government Community Cloud (GCC) High account, contact [Tailscale Support][co-contact-support-sso] to change your identity provider.

   #### Okta or OneLogin

   1. Under the **Authenticate** section, enter values for the following:

      * SSO issuer
      * Client ID
      * Client secret

      You can retrieve this information from your identity provider.

   2. Select **Authenticate**.

   #### OIDC

   1. Under the **Authenticate** section, enter values for the following:

      * Client ID
      * Client secret

      The [WebFinger][kb-webfinger] URL is pre-filled and must be available at the displayed URL. You can retrieve the Client ID and Client secret information from your identity provider.

   2. (Optional) Configure custom OIDC prompts for this provider.

   3. Select **Authenticate**.

5. Select **Switch identity provider**.

Your chosen identity provider is now ready to use.

## Limitations

* You cannot change the tailnet's primary domain name while changing the IdP unless you contact [Tailscale Support][co-contact-support-sso]. For example, you cannot change your IdP from Entra ID, using `example.com` as the primary domain, to Okta using `example.org` as the primary domain.
* If you are using a shared domain tailnet, such as those created with a Gmail addresses, you cannot switch your IdP unless you contact [Tailscale Support][co-contact-support-sso].

[co-contact-support-sso]: /contact/support/?type=sso

[kb-custom-oidc]: /docs/integrations/identity/custom-oidc

[kb-sso-google]: /docs/integrations/identity/google-sso

[kb-sso-microsoft]: /docs/integrations/identity/entra

[kb-sso-okta]: /docs/integrations/identity/okta

[kb-sso-onelogin]: /docs/integrations/identity/onelogin

[kb-webfinger]: /docs/integrations/identity/custom-oidc#webfinger-setup