{"slug":"deleting-and-suspending-users","title":"Deleting and suspending users","tags":["tailscale"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Deleting and suspending users\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nYou can delete and suspend users who should no longer be on your Tailscale network (known as a tailnet) in the [Users](https://login.tailscale.com/admin/users) page of the admin console, to prevent them from using Tailscale without permanently deleting their devices.\r\n\r\n## [Deleting users](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#deleting-users)\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to delete a user.\r\n\r\n1. Open the [Users](https://login.tailscale.com/admin/users) page of the admin console.\r\n2. Find the row corresponding to the user you are interested in.\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu at the far right and select the **Delete user** option.\r\n4. Done. The user is deleted.\r\n\r\nWhen a user is deleted from your network:\r\n\r\n- User devices are deleted. The device keys are removed from the [coordination server](https://tailscale.com/blog/how-tailscale-works) so that\r\nany further requests from those devices to connect to the network are blocked.\r\n- API access tokens and auth keys for the user stop working\r\n- These actions usually happens within seconds\r\n\r\nTo delete a user with the Owner role, you must first [assign a different user as the tailnet Owner](https://tailscale.com/docs/reference/user-roles), then delete the desired user.\r\n\r\n### [When using user & group provisioning](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#when-using-user--group-provisioning)\r\n\r\nIf you have [user & group provisioning](https://tailscale.com/docs/features/user-group-provisioning) enabled in your tailnet, we recommend you use SCIM to automatically deprovision users.\r\n\r\n- If using [Okta](https://tailscale.com/docs/integrations/identity/okta/okta-scim), deactivate the user in Okta. This will automatically suspend the user in Tailscale. Then, you can delete the suspended user in Tailscale.\r\n- If using [Microsoft Entra ID](https://tailscale.com/docs/integrations/identity/entra/entra-id-scim), delete the user in Microsoft Entra ID. This will automatically suspend the user in Tailscale, and approximately 30 days later they are deleted in Tailscale.\r\n\r\n## [Suspending users](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#suspending-users)\r\n\r\nIf you don't want to delete a user from your network right away, but want to restrict them from using Tailscale, you can suspend the user.\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of a tailnet to suspend and restore a user.\r\n\r\n1. Go to the [Users](https://login.tailscale.com/admin/users) page of the admin console.\r\n\r\n2. Find the row corresponding to the user you are interested in.\r\n\r\n3. Select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu at the far right and select the **Suspend user** option.\r\n\r\nThe user is shown as **Suspended** in the users page.\r\n\r\n\r\nWhen a user is suspended, they cannot use Tailscale on this tailnet. That means:\r\n\r\n- Their devices are not able to connect to other devices in the tailnet, including other devices they own\r\n\r\n\r\n\r\nDevices belonging to a suspended user may appear connected, but they cannot exchange traffic with other devices in the tailnet until the suspension is lifted.\r\n\r\n- They cannot add new devices to the tailnet. If they try to sign in on a device, they will get an error that they are suspended\r\n\r\n- They cannot access the admin console\r\n\r\n- Their API access tokens and auth keys stop working\r\n\r\n\r\nIf someone else has access to their devices, they can re-authenticate or tag these devices and use them in the same tailnet.\r\n\r\n## [Pending users](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#pending-users)\r\n\r\nIf you have enabled [user approval](https://tailscale.com/docs/features/access-control/user-approval), new users are placed in a pending state. For\r\ninformation about removing a pending user, refer to [Remove a pending user](https://tailscale.com/docs/features/access-control/user-approval#remove-a-pending-user).\r\n\r\n## [Restoring users](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#restoring-users)\r\n\r\nYou can restore a user from the [Users](https://login.tailscale.com/admin/users) page of the admin console by choosing the **Restore user** option.\r\n\r\nWhen a user is restored, they regain access to Tailscale on this tailnet, including the devices they owned when they were restored. More specifically, restored users can do the following:\r\n\r\n- Reconnect to other devices in the tailnet, as allowed by [access control policies](https://tailscale.com/docs/features/access-control)\r\n- Add new devices to the tailnet\r\n- Access the admin console, if allowed based on their [role](https://tailscale.com/docs/reference/user-roles)\r\n- Use pre-existing API access tokens and auth keys, if they have not expired\r\n\r\n## [Managing user resources](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#managing-user-resources)\r\n\r\n- Machines for suspended users are suspended, and can be deleted or reassigned. Machines for deleted users are deleted. A machine can be re-assigned to a tag, or a new user can log into it. If new user logs into the machine, it's recognized as a new machine.\r\n- API keys for suspended users are suspended. API keys for deleted users are automatically revoked. They cannot be reassigned. You must create a new [API key](https://tailscale.com/docs/reference/tailscale-api#authentication) or an [OAuth](https://tailscale.com/docs/features/oauth-clients) client.\r\n- Auth keys for suspended users are suspended. Auth keys for deleted users are automatically revoked. They cannot be reassigned. You must create a new [auth key](https://tailscale.com/docs/features/access-control/auth-keys) or an [OAuth](https://tailscale.com/docs/features/oauth-clients) client.\r\n\r\n## [Managing idle users](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#managing-idle-users)\r\n\r\nIf a user is not the Owner and has not signed in or used Tailscale for more than 7 days, they are shown as **Idle** in the [Users](https://login.tailscale.com/admin/users) page of the admin console.\r\n\r\n## [Leaving a tailnet](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#leaving-a-tailnet)\r\n\r\nYou cannot delete yourself from a network or leave a network. Ask your administrator to remove your account. You can, however, delete your account by [contacting support](https://tailscale.com/contact/support?type=accountdeletion).\r\n\r\n## [Deleting a tailnet](https://tailscale.com/docs/features/sharing/how-to/remove-team-members\\#deleting-a-tailnet)\r\n\r\nIf you decide you want to delete your entire tailnet, refer to the [Deleting your tailnet](https://tailscale.com/docs/account/delete-tailnet) topic.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Deleting and suspending users

\n

Last validated: Jan 5, 2026

\n

You can delete and suspend users who should no longer be on your Tailscale network (known as a tailnet) in the Users page of the admin console, to prevent them from using Tailscale without permanently deleting their devices.

\n

Deleting users

\n

You need to be an Owner, Admin, or IT admin of a tailnet to delete a user.

\n
    \n
  1. Open the Users page of the admin console.
    2. \n
  2. Find the row corresponding to the user you are interested in.
    3. \n
  3. Select the \"ellipsis menu at the far right and select the Delete user option.
    4. \n
  4. Done. The user is deleted.
    5. \n
\n

When a user is deleted from your network:

\n\n

To delete a user with the Owner role, you must first assign a different user as the tailnet Owner, then delete the desired user.

\n

When using user & group provisioning

\n

If you have user & group provisioning enabled in your tailnet, we recommend you use SCIM to automatically deprovision users.

\n\n

Suspending users

\n

If you don't want to delete a user from your network right away, but want to restrict them from using Tailscale, you can suspend the user.

\n

You need to be an Owner, Admin, or IT admin of a tailnet to suspend and restore a user.

\n
    \n
  1. \n

    Go to the Users page of the admin console.

    \n
    2. \n
  2. \n

    Find the row corresponding to the user you are interested in.

    \n
    3. \n
  3. \n

    Select the \"ellipsis menu at the far right and select the Suspend user option.

    \n
    4. \n
\n

The user is shown as Suspended in the users page.

\n

When a user is suspended, they cannot use Tailscale on this tailnet. That means:

\n\n

Devices belonging to a suspended user may appear connected, but they cannot exchange traffic with other devices in the tailnet until the suspension is lifted.

\n\n

If someone else has access to their devices, they can re-authenticate or tag these devices and use them in the same tailnet.

\n

Pending users

\n

If you have enabled user approval, new users are placed in a pending state. For\r\ninformation about removing a pending user, refer to Remove a pending user.

\n

Restoring users

\n

You can restore a user from the Users page of the admin console by choosing the Restore user option.

\n

When a user is restored, they regain access to Tailscale on this tailnet, including the devices they owned when they were restored. More specifically, restored users can do the following:

\n\n

Managing user resources

\n\n

Managing idle users

\n

If a user is not the Owner and has not signed in or used Tailscale for more than 7 days, they are shown as Idle in the Users page of the admin console.

\n

Leaving a tailnet

\n

You cannot delete yourself from a network or leave a network. Ask your administrator to remove your account. You can, however, delete your account by contacting support.

\n

Deleting a tailnet

\n

If you decide you want to delete your entire tailnet, refer to the Deleting your tailnet topic.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}