# Get started with Tailscale PAM

Last validated Jun 2, 2026

> **Note:** Tailscale PAM is currently in beta.

This guide walks you through enabling Tailscale PAM so you can begin to provide privileged access for your Tailscale network (known as a tailnet). To learn more about what Tailscale PAM does before you start, refer to [What is Tailscale PAM?][docs-pam-what-is-tailscale-pam].

## Prerequisites

Before you begin, confirm you have the following:

* A tailnet. If you do not have a tailnet, [sign up](https://login.tailscale.com/start).

* Tailscale PAM integration is enabled for your tailnet. If you want to try Tailscale PAM for free, [join the waitlist][co-pam-waitlist]. To learn more about Tailscale PAM for your organization, contact [Tailscale Sales][co-contact-sales-border0].

* A Tailscale account with [Owner, Admin, or IT admin](/docs/reference/user-roles/) permissions, so you can use the Tailscale admin console to enable Tailscale PAM for your tailnet.

* A device to use as a Tailscale PAM connector. This topic will show you how to configure this device as a Tailscale PAM connector. The device must satisfy one of the following options:

  * Linux
  * AWS EC2
  * Docker
  * Kubernetes

* A device to use when you want to access a privileged resource. This device must satisfy one of the following options:

  * A device with Tailscale installed and running so that you can use the Tailscale PAM connector to get privileged access to the resources on your tailnet. For information about installing Tailscale, refer to [Install Tailscale][docs-install-tailscale].
  * A device with a browser. This would let you access a resource protected by Tailscale PAM without installing the Tailscale client on the device.

## Step 1: Enable the Tailscale PAM integration for your tailnet

1. Open the [General](https://console.tailscale.com/admin/settings/general) settings page of the Tailscale admin console.
2. In the **Feature previews** section, enable **Privileged Access Management by Tailscale PAM (Beta)**.

## Step 2: Create a Tailscale PAM connector

1. Open the [Connectors](https://console.tailscale.com/admin/connectors) page of the admin console.
2. Select **Add New Connector**.
3. Select the platform that you want to use for the connector.
4. In the **Launch New Connector** section, follow the instructions and apply them to the device that you want to use as your connector.

The Tailscale PAM connector has Tailscale capability built into it and will automatically join your tailnet. For more information about Tailscale PAM connector installation, refer to [Installing a Tailscale PAM connector][docs-pam-connectors-install].

## Step 3: Secure a resource

You can now use Tailscale PAM to create secure access to resources in your tailnet. The resources that you secure are referred to as services in Tailscale PAM. Tailscale PAM treats services as the application-aware proxies that handle connections securely.

For examples, refer to the following guides.

* [Access an SSH server (or shell)][docs-pam-access-ssh]
* [Access to a database server][docs-pam-access-database]
* [Access an HTTP service][docs-pam-access-http-service]

## Step 4: Grant network access in your tailnet policy

Tailscale PAM controls *what* a user can do once they connect to a resource at the protocol level, such as which commands they can run or which databases and queries they can access. Your [tailnet policy file][docs-tailnet-policy-file] controls *whether* a user's device can reach that resource over the tailnet in the first place. Both layers apply, so after you secure a resource you must add a [grant][docs-grants] that permits network access to it. Enabling the integration alone is not enough.

When you secure a resource, Tailscale PAM exposes it as a Tailscale [service][docs-services] (`svc:<name>`) tagged `tag:border0-managed`. You write the grant against that tag or service. This grant lets every member of your tailnet reach all Tailscale PAM resources:

```json
// Allow everyone to access Tailscale PAM resources
{
    "src": ["autogroup:member"],
    "dst": ["tag:border0-managed"],
    "ip":  ["*"],
},
```

You do not have to allow everyone. Because Tailscale PAM already enforces fine-grained, per-protocol access, this grant only needs to be broad enough to reach the resources. You can scope `src` to a subset of users and `dst` to individual resources instead:

```json
// Allow a subset of users to reach specific Tailscale PAM resources
{
    "src": ["group:db-admins"],
    "dst": ["svc:prod-postgres", "svc:staging-postgres"],
    "ip":  ["*"],
},
```

## Step 5: Access a service

Once you create a service, members of your tailnet with the appropriate access have two ways to access the service.

* They can [download the Tailscale client][co-download] and join their device to your tailnet.
* They can use a browser by opening the Tailscale PAM [Border0 web client](https://my.tailscale.com). This is the web-based client for service access. When prompted, members of your tailnet can log in with the same account they use for Tailscale.

Once logged in to either the Tailscale client or the web-based client, members of your tailnet can access the services that you configured for them.

## Next steps

Explore the following resources on the Tailscale PAM site.

* [Understand the Tailscale PAM architecture and core concepts][docs-pam-architecture-and-concepts] to get the most out of Tailscale PAM.
* [Get full visibility][docs-pam-sessions] into Tailscale PAM connections. Not just IP addresses and ports, but the full context behind who did what and when.
* [Use secret stores][docs-pam-manage-secrets] to securely store your upstream credentials when configuring services.

[co-contact-sales-border0]: /contact/sales-border0

[co-download]: /download

[co-pam-waitlist]: /pam-selfserve-waitlist

[docs-grants]: /docs/features/access-control/grants

[docs-install-tailscale]: /docs/install

[docs-pam-access-database]: /docs/privileged-access-management/how-to/access-database

[docs-pam-access-http-service]: /docs/privileged-access-management/how-to/access-http-service

[docs-pam-access-ssh]: /docs/privileged-access-management/how-to/access-ssh

[docs-pam-architecture-and-concepts]: /docs/privileged-access-management/architecture-and-concepts

[docs-pam-connectors-install]: /docs/privileged-access-management/connectors/install

[docs-pam-manage-secrets]: /docs/privileged-access-management/how-to/manage-secrets

[docs-pam-sessions]: /docs/privileged-access-management/session-logs

[docs-pam-what-is-tailscale-pam]: /docs/privileged-access-management/what-is-tailscale-pam

[docs-services]: /docs/features/tailscale-services

[docs-tailnet-policy-file]: /docs/reference/syntax/policy-file