Use Device Identity Collection

Device Identity Collection collects identifiers (currently serial numbers) from devices in your Tailscale network (known as a tailnet). It is required for device posture integrations like CrowdStrike Falcon, and can be useful for correlating your devices between Tailscale and other systems.

This document provides instructions on:

• How to enable Device Identity Collection for your tailnet.
• How to enable Device Identity Collection on machines in your tailnet.

Prerequisites

To configure the machines on your tailnet you will need either:

• access to the machine to run the tailscale CLI; or
• a Mobile Device Management (MDM) system.

Enabling Device Identity Collection for your tailnet

1. Open the Device management page of the Tailscale admin console.
2. Under the Device Posture Integrations section, click the toggle under Device Identity Collection.

Enabling Device Identity Collection for devices on your tailnet

Devices on your tailnet need to be individually opted-in to reporting their identity.

There are two ways to opt-in a device to reporting its identity: by setting a system policy (for example, via an MDM), or via CLI.

Enabling Device Identity Collection via system policies

You can opt a device in to identity reporting by setting the policy key PostureChecking to always. This lets you opt-in devices using an MDM or configuration management system. Note that the Tailscale client needs to be restarted for this change to take effect. For more information on setting system policies, refer to Customize Tailscale using system policies.

Using system policies is the recommended way to enable device identity collection on macOS and Windows. It takes priority over configuration set via CLI.

Enabling Device Identity Collection via the CLI

You can also opt-in a device by running the tailscale set CLI command on it and then reconnecting the client:

sudo tailscale set --posture-checking=true
sudo tailscale down
sudo tailscale up

Using the CLI command is the only way to opt-in a Linux device to identity collection.

View collection progress

In the Device Posture section of the Device management page, you will see a summary of serial number collection.

You can click Inspect to view which machines have a particular status, for example, to see machines that have not been opted in yet.

Check serial numbers

You can view serial numbers and identity collection status for your devices on the Machine page of the admin console.

1. Open the Machines page of the admin console.
2. Select a machine you want to inspect.
3. View the serial number and collection status in the Machine Details section.

Serial numbers are also available via the device API.