Restrict device access with 1Password Extended Access Management (XAM)

1Password Extended Access Management (previously, Kolide) collects a series of signals from its agent installed on each device that can be used to determine the security posture of a device. Tailscale can fetch these signals from XAM and use them as device posture attributes in access rules, which can then be used by organizations to grant access to sensitive resources only to devices that have a high level of trust.

This can be achieved using Tailscale's device posture management features:

• Device Identity Collection, which collects identifiers (for example, serial numbers), used to match devices in Tailscale to devices in XAM.
• XAM posture integration, which synchronizes signals from XAM to device posture attributes in Tailscale.
• Posture conditions in access rules, which lets you configure access restrictions based on device attributes.

This guide explains how to enable Device Identity collection for your Tailscale network (tailnet) and configure XAM posture integration.

What is 1Password XAM (Kolide) posture integration?

The 1Password XAM (Kolide) integration syncs data between XAM and Tailscale on a recurring schedule. During each sync, Tailscale performs the following actions:

1. Fetches a list of hosts and their reported data from your XAM account.
2. Matches XAM devices to devices in your tailnet based on serial numbers.
3. Writes the XAM data to device posture attributes on each matched device.

The integration writes the following device posture attributes to matched devices:

Prerequisites

• Device Identity Collection is enabled, and devices in your tailnet are reporting identifiers
• 1Password XAM (Kolide) API Token

Create 1Password XAM (Kolide) API Key

To authenticate your 1Password XAM (Kolide) account with Tailscale, you'll need to create a 1Password XAM (Kolide) API Key. The 1Password XAM (Kolide) integration uses these to fetch a list of devices and their data from 1Password XAM (Kolide).

To create a 1Password XAM (Kolide) API Key:

1. Select your user avatar in the upper-right corner of the 1Password XAM (Kolide) UI.

2. In the dropdown menu, select Settings.

3. In the menu on the left, select Developers.

4. In the sub-menu that appears, select API Keys.

5. On the next screen, select Create New Key.

6. In the modal that appears, provide a name for the Key and the name of a XAM administrator who will be responsible for the API Key's usage, and select Save.

7. Once saved, the secret token is available in the table. Select the duplicate button to copy the token to your clipboard.

Configure 1Password XAM (Kolide) posture integration

To configure Tailscale to fetch data about devices from 1Password XAM (Kolide):

1. Open the Device management page of the Tailscale admin console.

2. Under the Device Posture Integrations section, locate the 1Password XAM (Kolide) integration, then select Connect.

3. Enter your API Key.

   

4. Select Connect to 1Password XAM (Kolide).

Review the integration status

After you set up the 1Password XAM (Kolide) integration, check to ensure the integration has run successfully. You can do so by visiting the Device Posture Integrations section of the Device management page. This page shows the configured integrations and their statuses under the Integrations section. For the 1Password XAM (Kolide) integration, it should have the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.

Check node attributes

After you configure 1Password XAM (Kolide) integration, you can confirm that Tailscale is writing the new attribute for your XAM devices on the Machines page of the admin console.

1. Open the Machines page of the Tailscale admin console.
2. Select a device to inspect.
3. The attributes for the device are in the Machine Details section. This should include the set of kolide: attributes listed previously.

You can also check device attributes using the Tailscale API.

Adjust Tailscale access rules

After you configure 1Password XAM (Kolide) posture integration, and your devices have device posture attributes that reflect their signals as reported by 1Password XAM (Kolide), you can use those device posture attributes as part of your posture rules.

For example, to only permit access to tag:production from devices that are reported as good by the 1Password XAM (Kolide) agent, you can create a new posture and use it as part of a corresponding access rule:

"postures": {
  "posture:trusted": [
    "kolide:authState != 'Blocked'",
  ],
},
"grants": [
  {
    "src": ["autogroup:member"],
    "dst": ["tag:production"],
    "ip": ["*"],
    "srcPosture": ["posture:trusted"]
  }
]

Schedule

For each configured integration, Tailscale will aim to sync device posture attributes every 15 minutes, with a few exceptions:

• Adding a new integration, or changing configuration of an existing one, will trigger an out-of-schedule sync.
• If an integration fails due to authentication error (usually caused by invalid credentials), it will be paused for up to 24 hours.

Audit log events

The following audit log events are added for device posture.