User & group provisioning for Google Workspace

Tailscale supports synchronizing Google Workspace users and groups for use in Tailscale access controls.

• With group sync, you can refer to a group from Google in your tailnet policy file, with a human-readable name.
• With user sync, you can onboard and offboard users easily to Tailscale. For related information, see Offboarding when using user & group provisioning.

Prerequisites

• You need a Google Workspace account.
• You need a Tailscale network (known as a tailnet).
• Your tailnet's identity provider needs to be Google.

Set up Google User & Group sync

You need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.

1. Open the Tailscale User management page.
2. In the Google Sync section, select Enable.
3. In the https://login.tailscale.com/googlesync/auth page, select Authorize with Google.
4. In the Choose an account page, select your Google Workspace super user account.
5. In the Sign in page, select Continue.
6. When prompted to allow access to your tailnet, select Allow.

When you enable Google Sync for the very first time, no users or groups will be added unless you specify groups explicitly or select the Sync All Users option.

Sync all users

By default, Google Sync only adds users from groups you selected. But if you'd like to mirror all of your Google Workspace users, then you can enable the Sync all users option which will immediately start provisioning users to your tailnet.

Manage groups

By default, a group and its members does not sync into your tailnet unless you explicitly select it.

You need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.

1. Open the Tailscale User management page.
2. In the Google Sync section, select the menu and then select Manage groups.

Unsync unassigned users

After adding groups and their members to your tailnet, if you want to remove the users whom you previously added using the Sync all users option who are not part of the groups you added, you can use the option Unsync unassigned users.

You need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.

1. Open the Tailscale User management page.
2. In the Google Sync section, select the menu and then select Unsync unassigned users.

Force a sync

You need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.

1. Open the Tailscale User management page.
2. In the Google Sync section, select the menu and then select Force sync.

Disable Google User & Group sync

You need to be an Owner, Admin, or IT admin in Tailscale to complete these steps.

1. Open the Tailscale User management page.
2. In the Google Sync section, select the menu and then select Disable.
3. Follow the prompts to confirm and disable Google User & Group sync.

Limitations

• The maximum number of groups that can be synced is 100.
• After a new group is created in Google Workspace, a Tailscale Owner, Admin, or IT admin must open the Google Group Sync page and select the group to allow syncing of the group.
• Users that do not share the same domain as the tailnet's domain are skipped.
• Google-synced groups don't work with Mullvad exit node access control policies.