Tailscale
A set of policies that enforces particular settings in the Tailscale Windows client.
Tailscale
Tailscale version 1.22.0 and later
Tailscale version 1.26.0 and later
Tailscale version 1.50.0 and later
Tailscale version 1.52.0 and later
Tailscale version 1.56.0 and later
Tailscale version 1.56.0 and later (full support), some earlier versions (partial support)
Tailscale version 1.58.0 and later
Tailscale version 1.62.0 and later
Tailscale version 1.74.0 and later
Tailscale version 1.78.0 and later
Tailscale version 1.80.0 and later
Tailscale version 1.82.0 and later
Tailscale version 1.84.0 and later
Tailscale version 1.86.0 and later
Tailscale version 1.90.0 and later
Tailscale
UI customization
Settings
Allowed
Allowed (with audit)
Not Allowed
Require using a specific Tailscale coordination server
This policy can be used to require the use of a particular Tailscale coordination server.

If you enable this policy, set it to the URL of your coordination server, beginning with https:// and ending with no trailing slash. If blank or "https://controlplane.tailscale.com", the default coordination server will be required.

If you disable or do not configure this policy, the Tailscale SaaS coordination server will be used by default, but a non-standard Tailscale coordination server can be configured using the CLI.

See https://tailscale.com/kb/1315/mdm-keys#set-a-custom-control-server-url for more details.
Require using a specific Tailscale log server
This policy can be used to require the use of a non-standard log server. Please note that using a non-standard log server will limit Tailscale Support's ability to diagnose problems.

If you configure this policy, set it to the URL of your log server, beginning with https:// and ending with no trailing slash. If blank or "https://log.tailscale.com", the default log server will be used.

If you disable this policy, the Tailscale standard log server will be used by default, but a non-standard Tailscale log server can be configured using the TS_LOG_TARGET environment variable.
Specify which Tailnet should be used for Login
This policy can be used to suggest or require a specific tailnet when opening the login page.

To suggest a tailnet at login time, set this to the name of the tailnet, as shown in the top-left of the admin panel, such as "example.com". That tailnet's SSO button will be shown prominently, along with the option to select a different tailnet.

To require logging in to a particular tailnet, add the "required:" prefix, such as "required:example.com". The result is similar to the suggested tailnet but there will be no option to choose a different tailnet.

If you enable this policy, set it to the name of the tailnet, possibly with the "required:" prefix, as described above.

If you disable or do not configure this policy, the standard login page will be used.

See https://tailscale.com/kb/1315/mdm-keys#set-a-suggested-or-required-tailnet for more details.
Specify the auth key to authenticate devices without user interaction
This policy allows specifying the default auth key to be used when registering new devices without requiring sign-in via a web browser, unless the user specifies a different auth key via the CLI.

Managing authentication keys via Group Policy and MDM solutions poses significant security risks. Group Policy is not designed to store and deploy secrets, and by default, Group Policy settings can be read by all domain-authenticated users and devices, regardless of their privilege level or whether the policy setting applies to them.

While MDM solutions tend to offer better control over who can access the policy setting values, they can still be compromised. Additionally, with both Group Policy and MDM solutions, the auth key is always readable by all users who have access to the device where this policy setting applies, as well as by all applications running on the device. A compromised auth key can potentially be used by a malicious actor to gain or elevate access to the target network.

Only consider this option after carefully reviewing the organization's security posture. For example, ensure you configure the auth keys specifically for the tag of the device and that access control policies only grant necessary access between the tailnet and the tagged device. Additionally, consider using short-lived auth keys, one-time auth keys (with one GPO/MDM configuration per device), Device Approval, and/or Tailnet Lock to minimize risk. If you suspect an auth key has been compromised, revoke the auth key immediately.

If you enable this policy setting and specify an auth key, it will be used to authenticate the device unless the device is already logged in or an auth key is explicitly specified via the CLI.

If you disable or do not configure this policy setting, an interactive user login will be required..

See https://tailscale.com/kb/1315/mdm-keys#set-an-auth-key for more details.
Require using a specific Exit Node
This policy can be used to require always using the specified Exit Node whenever the Tailscale client is connected.

If you enable this policy, set it to the ID of an exit node. The ID is visible on the Machines page of the admin console, or can be queried using the Tailscale API. If the specified exit node is unavailable, this device will have no Internet access unless Tailscale is disconnected. Alternatively, you can set it to "auto:any" (without quotes), which allows the Tailscale client to automatically select the most suitable exit node. Optionally, you can allow users to temporarily override the exit node by selecting a different one from the Exit Node submenu in the Tailscale menu or via the CLI, without allowing them to disable exit node usage entirely.

If you disable this policy or supply an empty exit node ID, then usage of exit nodes will be disallowed.

If you do not configure this policy, no exit node will be used by default but an exit node (if one is available and permitted by ACLs) can be chosen by the user if desired.

See https://tailscale.com/kb/1315/mdm-keys#force-an-exit-node-to-always-be-used and https://tailscale.com/kb/1103/exit-nodes for more details.
Limit automated Exit Node suggestions to specific nodes
This policy setting allows configuring a pool of exit nodes from which the Tailscale client will automatically select the most suitable suggested exit node when required. The suggested exit node is displayed in the GUI and CLI and is automatically selected and enforced when the "Require using a specific Exit Node" policy setting is enabled and set to "auto:any".

If you enable this policy setting, suggestions will be limited to exit nodes with the specified IDs. The IDs are visible on the Machines page of the admin console, or can be queried using the Tailscale API.

If you disable or do not configure this policy setting, no limitations will apply, and all available exit nodes will be considered when selecting the most suitable suggested node.

See https://tailscale.com/kb/1315/mdm-keys#suggest-allowed-forced-exit-nodes and https://tailscale.com/kb/1103/exit-nodes for more details.
Allow incoming connections
This policy can be used to require that the Allow Incoming Connections setting is configured a certain way.

If you enable this policy, then Allow Incoming Connections is always enabled and the menu option is hidden.

If you disable this policy, then Allow Incoming Connections is always disabled and the menu option is hidden.

If you do not configure this policy, then Allow Incoming Connections depends on what is selected in the Preferences submenu.

See https://tailscale.com/kb/1315/mdm-keys#set-whether-to-allow-incoming-connections and https://tailscale.com/kb/1072/client-preferences#allow-incoming-connections for more details.
Run Tailscale in Unattended Mode
This policy can be used to require that the Run Unattended setting is configured a certain way.

If you enable this policy, then Run Unattended is always enabled and the menu option is hidden.

If you disable this policy, then Run Unattended is always disabled and the menu option is hidden.

If you do not configure this policy, then Run Unattended depends on what is selected in the Preferences submenu.

See https://tailscale.com/kb/1315/mdm-keys#set-unattended-mode and https://tailscale.com/kb/1088/run-unattended for more details.
Restrict users from disconnecting Tailscale (always-on mode)
This policy setting controls whether a user can disconnect Tailscale.

If you enable this policy setting, users will not be allowed to disconnect Tailscale, and it will remain in a connected state as long as they are logged in, even if they close or terminate the GUI. Optionally, you can allow users to temporarily disconnect Tailscale by requiring them to provide a reason, which will be logged for auditing purposes.

If necessary, it can be used along with Unattended Mode to keep Tailscale connected regardless of whether a user is logged in. This can be used to facilitate remote access to a device or ensure connectivity to a Domain Controller before a user logs in.

If you disable or don't configure this policy setting, users will be allowed to disconnect Tailscale at their will.
Configure automatic reconnect delay
This policy setting controls when Tailscale will attempt to reconnect automatically after a user disconnects it. It helps users remain connected most of the time and retain access to corporate resources without preventing them from temporarily disconnecting Tailscale. To configure whether and when Tailscale can be disconnected, see the "Restrict users from disconnecting Tailscale (always-on mode)" policy setting.

If you enable this policy setting, you can specify how long Tailscale will wait before attempting to reconnect after a user disconnects. The value should be specified as a Go duration: for example, 30s, 5m, or 1h30m. If the value is left blank, or if the specified duration is zero, Tailscale will not attempt to reconnect automatically.

If you disable or don't configure this policy setting, Tailscale will only reconnect if a user chooses to or if required by a different policy setting.

Refer to https://pkg.go.dev/time#ParseDuration for information about the supported duration strings.
Allow users to restart tailscaled
This policy setting controls whether users are allowed to fully reset the connection by restarting tailscaled. This can be useful for troubleshooting certain connectivity issues.

If you enable this policy setting, the "Restart Connection" menu item will be shown in the Tailscale menu.

If you disable this policy setting, the "Restart Connection" menu item is hidden and restarting tailscaled isn't allowed.

If you do not configure this policy setting, the behavior may vary depending on the Tailscale version and other factors, such as user access rights on the device.
Allow Local Network Access when an Exit Node is in use
This policy can be used to require that the Allow Local Network Access setting is configured a certain way.

If you enable this policy, then Allow Local Network Access is always enabled and the menu option is hidden.

If you disable this policy, then Allow Local Network Access is always disabled and the menu option is hidden.

If you do not configure this policy, then Allow Local Network Access depends on what is selected in the Exit Node submenu.

See https://tailscale.com/kb/1315/mdm-keys#toggle-local-network-access-when-an-exit-node-is-in-use and https://tailscale.com/kb/1103/exit-nodes#step-4-use-the-exit-node for more details.
Use Tailscale DNS Settings
This policy can be used to require that Use Tailscale DNS is configured a certain way.

If you enable this policy, then Use Tailscale DNS is always enabled and the menu option is hidden.

If you disable this policy, then Use Tailscale DNS is always disabled and the menu option is hidden.

If you do not configure this policy, then Use Tailscale DNS depends on what is selected in the Preferences submenu.

See https://tailscale.com/kb/1315/mdm-keys#set-whether-the-device-uses-tailscale-dns-settings for more details.
Use Tailscale Subnets
This policy can be used to require that Use Tailscale Subnets is configured a certain way.

If you enable this policy, then Use Tailscale Subnets is always enabled and the menu option is hidden.

If you disable this policy, then Use Tailscale Subnets is always disabled and the menu option is hidden.

If you do not configure this policy, then Use Tailscale Subnets depends on what is selected in the Preferences submenu.

See https://tailscale.com/kb/1315/mdm-keys#set-whether-the-device-accepts-tailscale-subnets or https://tailscale.com/kb/1019/subnets for more details.
Always register
Use adapter properties
Register Tailscale IP addresses in DNS
This policy setting controls whether Tailscale IP addresses are registered in DNS and whether dynamic DNS updates are enabled for the Tailscale interface.

If you enable this policy, you can specify whether Tailscale IP addresses should always be registered in DNS or allow the settings to be changed in the network adapter's properties (admin rights required). The "Always" option is recommended in Active Directory domain environments where all devices, including Domain Controllers, have Tailscale installed and are reachable via their Tailscale IP addresses.

If you disable or do not configure this policy, Tailscale IP addresses will not be registered in DNS, and dynamic DNS updates will be disabled for the Tailscale interface. It can be used on non-domain-joined devices or in environments that primarily rely on subnet routers.
Automatically install updates
This policy can be used to require that Automatically Install Updates is configured a certain way.

If you enable this policy, then Automatically Install Updates is always enabled and the menu option is hidden.

If you disable this policy, then Automatically Install Updates is always disabled and the menu option is hidden.

If you do not configure this policy, then Automatically Install Updates depends on what is selected in the Preferences submenu.

See https://tailscale.com/kb/1067/update#auto-updates for more details.
Run Tailscale as an Exit Node
This policy can be used to require that Run Exit Node is configured a certain way.

If you enable this policy, then Run Exit Node is always enabled and the menu option is hidden.

If you disable this policy, then Run Exit Node is always disabled and the menu option is hidden.

If you do not configure this policy, then Run Exit Node depends on what is selected in the Exit Node submenu.

See https://tailscale.com/kb/1103/exit-nodes for more details.
Show the "Admin Console" menu item
This policy can be used to show or hide the Admin Console item in the Tailscale Menu.

If you enable or don't configure this policy, the Admin Console item will be shown in the Tailscale menu when available.

If you disable this policy, the Admin Console item will always be hidden from the Tailscale menu.
Show the "Network Devices" submenu
This policy can be used to show or hide the Network Devices submenu in the Tailscale Menu.

If you enable or don't configure this policy, the Network Devices submenu will be shown in the Tailscale menu.

If you disable this policy, the Network Devices submenu will be hidden from the Tailscale menu. This does not affect other devices' visibility in the CLI.
Show the "Debug" submenu
This policy can be used to show or hide the Debug submenu of the Tailscale menu.

If you enable or don't configure this policy, the Debug submenu will be shown in the Tailscale menu when opened while holding Ctrl.

If you disable this policy, the Debug submenu will be hidden from the Tailscale menu.

See https://tailscale.com/kb/1315/mdm-keys#hide-the-debug-menu for more details.
Show the "Update Available" menu item
This policy can be used to show or hide the Update Available item in the Tailscale Menu.

If you enable or don't configure this policy, the Update Available item will be shown in the Tailscale menu when there is an update.

If you disable this policy, the Update Available item will be hidden from the Tailscale menu.

See https://tailscale.com/kb/1315/mdm-keys#hide-the-update-menu for more details.
Show the "Run Exit Node" menu item
This policy can be used to show or hide the Run Exit Node item in the Exit Node submenu. This does not affect using the CLI to enable or disable advertising an exit node. If you wish to enable or disable this feature, see the Run Exit Node policy in the Settings category.

If you enable or don't configure this policy, the Run Exit Node item will be shown in the Exit Node submenu.

If you disable this policy, the Run Exit Node item will be hidden from the Exit Node submenu.

See https://tailscale.com/kb/1315/mdm-keys#hide-the-run-as-exit-node-menu-item for more details.
Show the "Preferences" submenu
This policy can be used to show or hide the Preferences submenu of the Tailscale menu. This does not affect using the CLI to modify that menu's preferences. If you wish to control those, look at the policies in the Settings category.

If you enable or don't configure this policy, the Preferences submenu will be shown in the Tailscale menu.

If you disable this policy, the Preferences submenu will be hidden from the Tailscale menu.

See https://tailscale.com/kb/1315/mdm-keys#hide-the-preferences-menu for more details.
Show the "Exit Node" submenu
This policy can be used to show or hide the Exit Node submenu of the Tailscale menu. This does not affect using the CLI to select or stop using an exit node. If you wish to control exit node usage, look at the "Require using a specific Exit Node" policy in the Settings category.

If you enable or don't configure this policy, the Exit Node submenu will be shown in the Tailscale menu.

If you disable this policy, the Exit Node submenu will be hidden from the Tailscale menu.

See https://tailscale.com/kb/1315/mdm-keys#hide-the-exit-node-picker for more details.
Specify a custom key expiration notification time
This policy can be used to configure how soon the notification appears before key expiry.

If you enable this policy and supply a valid time interval, the key expiry notification will begin to display when the current key has less than that amount of time remaining.

If you disable or don't configure this policy, the default time period will be used (as of Tailscale 1.56, this is 24 hours).

See https://tailscale.com/kb/1315/mdm-keys#set-the-key-expiration-notice-period for more details.
Log extra details about service events
This policy can be used to enable additional logging related to Service Control Manager for debugging purposes. This should only be enabled if recommended by Tailscale Support.

If you enable this policy, additional logging will be enabled for SCM events.

If you disable or don't configure this policy, the normal amount of logging occurs.
Flush the DNS cache on session unlock
This policy can be used to enable additional DNS cache flushing for debugging purposes. This should only be enabled if recommended by Tailscale Support.

If you enable this policy, the DNS cache will be flushed on session unlock in addition to when the DNS cache would normally be flushed.

If you disable or don't configure this policy, the DNS cache is managed normally.
Collect data for posture checking
This policy can be used to require that the Posture Checking setting is configured a certain way.

If you enable this policy, then data collection is always enabled.

If you disable this policy, then data collection is always disabled.

If you do not configure this policy, then data collection depends on if it has been enabled from the CLI (as of Tailscale 1.56), it may be present in the GUI in later versions.

See https://tailscale.com/kb/1315/mdm-keys#enable-gathering-device-posture-data and https://tailscale.com/kb/1326/device-identity for more details.
Show the "Managed By {Organization}" menu item
Use this policy to configure the “Managed By {Organization}” item in the Tailscale Menu.

If you enable this policy, the menu item will be displayed indicating the organization name. For instance, “Managed By XYZ Corp, Inc.”. Optionally, you can provide a custom message to be displayed when a user clicks on the “Managed By” menu item, and a URL pointing to a help desk webpage or other helpful resources for users in the organization.

If you disable this policy or do not configure it, the corresponding menu item will be hidden.

See https://tailscale.com/kb/1315/mdm-keys#set-your-organization-name for more details.
Show the onboarding flow
This policy can be used to show or hide the onboarding flow displayed by the GUI.

If you enable or don't configure this policy, the onboarding flow will be shown to new users who have not yet signed in to a Tailscale account.

If you disable this policy, the onboarding flow will never be shown.
Encrypt client state file stored on disk
This policy configures encryption of the Tailscale client state file on disk.

If you enable this policy, the state file will be encrypted using the local TPM device. If a local TPM device is not present or not accessible, Tailscale will fail to start.

If you disable this policy, the state file is stored in plaintext.

If the policy is unconfigured, state encryption will be enabled on newer client versions when the device has a properly-configured TPM.
Coordination server:
Log server:
Tailnet:
Auth Key:
The options below allow configuring exceptions where disconnecting Tailscale is permitted.
Disconnects with reason:
The delay must be a valid Go duration string, such as 30s, 5m, or 1h30m, all without spaces or any other symbols.
Reconnect after:
Exit Node:
User override:
Registration mode:
Target IDs:
Organization Name:
Custom Message:
Support URL:
Key expiration notice period:
Time intervals must be specified as a Go Duration: for example, 24h, 5h25m30s. Time units larger than hours are unsupported.