Use Device Identity Collection

Device Identity Collection collects identifiers such as serial numbers and MAC addresses from devices in your Tailscale network (known as a tailnet). It is required for device posture integrations like CrowdStrike Falcon, and can be useful for correlating your devices between Tailscale and other systems.

This document provides instructions on:

• How to enable Device Identity Collection for your tailnet.
• How to enable Device Identity Collection on machines in your tailnet.

Prerequisites

To configure the machines in your tailnet you will need either:

• access to the machine to run the tailscale CLI; or
• a Mobile Device Management (MDM) system.

Enabling Device Identity Collection for your tailnet

1. Open the Device management page of the Tailscale admin console.
2. Under the Device Posture Integrations section, select the toggle under Device Identity Collection.

Enabling Device Identity Collection for devices in your tailnet

Devices in your tailnet need to be individually opted-in to reporting their identity.

There are two ways to opt-in a device to reporting its identity: by setting a system policy (for example, via an MDM), or via CLI.

Enabling Device Identity Collection via system policies

You can opt a device in to identity reporting by setting the policy key PostureChecking to always. This lets you opt-in devices using an MDM or configuration management system. Note that the Tailscale client needs to be restarted for this change to take effect. For more information on setting system policies, refer to Customize Tailscale using system policies.

Using system policies is the recommended way to enable device identity collection on macOS and Windows. It takes priority over configuration set via CLI.

Enabling Device Identity Collection via the CLI

You can also opt-in a device by running the tailscale set CLI command on it and then reconnecting the client:

sudo tailscale set --posture-checking=true
sudo tailscale down
sudo tailscale up

Using the CLI command is the only way to opt-in a Linux device to identity collection.

View collection progress

In the Device Posture section of the Device management page, you will see a summary of serial number collection.

You can select Inspect to view which machines have a particular status, for example, to see machines that have not been opted in yet.

Check device identifiers

You can view identifiers for your devices on the Machine page of the admin console.

1. Open the Machines page of the admin console.
2. Select a machine you want to inspect.
3. View the device identity and collection status in the Machine Details section.

Device identity is also available from the device API.

By default, Device Identity Collection fetches device serial numbers. Some posture integrations, like CrowdStrike Falcon, can also use MAC addresses for device matching, which will be collected if required by such an integration.