Supported SSO identity providers
Tailscale works on top of the identity provider (IdP) or single sign-on (SSO) provider that you already use.
When you activate your domain name with Tailscale for the first time, you must choose which identity provider you want to use.
You need to be an Owner of a tailnet in order to set up an identity provider.
Tailscale natively supports the following identity providers:
- Google, including Gmail and Google Workspace (G Suite)
- Microsoft, including Microsoft Accounts, Office365, Active Directory, and Microsoft Entra ID
In addition to the natively supported identity providers, Tailscale also allows you to authenticate with custom OpenID Connect (OIDC) providers. Tailscale has successfully tested several custom identity providers, including:
- AWS Cognito
- GitLab and GitLab self-managed
- Ory Network and Ory self-hosted
- Ping Identity
- ZITADEL Cloud and ZITADEL Open Source
Tailscale supports the use of passkey authentication for any tailnet that you are authorized to join.
Tailscale does not support sign-up with email addresses. By design, Tailscale is not an identity provider—there are no Tailscale passwords.
Using an identity provider is not only more secure than email and password, but it allows us to automatically rotate connection encryption keys, follow security policies set by your team (e.g., MFA), and more.
Tailscale supports two-factor and multi-factor authentication.
Tailscale does not handle authentication itself. Instead, you can enable 2FA and MFA features in your single sign-on identity provider, and they will apply to all your apps, including Tailscale.
You need to be an Owner, Admin, or IT admin of a tailnet in order to change the identity provider configuration.
If you need to change identity providers, contact support.
Tailscale uses OpenID Connect (OIDC) for authentication.
Tailscale requests the minimum access needed to function. When authenticating to Tailscale, you must share information about users’ emails and their name. Some providers also share a user photo; in this case, Tailscale stores the photo URL but not the photo itself.
Tailscale only uses your organization’s team membership to ensure users can join the tailnet for their organization. With the GitHub identity provider, Tailscale requests the minimum set of permissions needed to get team membership, which includes access to your repositories and project boards. Tailscale does not use any content in your repositories or project boards.
|Standard identity provider integrations||Advanced identity provider integrations|
|Available on all plans||Available on the Free, Premium, and Enterprise plans|