{"slug":"deploy-tailscale-on-macos-using-mdm","title":"Deploy Tailscale on macOS using MDM","tags":["tailscale"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Deploy Tailscale on macOS using MDM\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nThis page contains technical information which you might find useful if you are a system administrator deploying Tailscale for macOS in a corporate environment using MDM solutions such as [Microsoft Intune](https://tailscale.com/docs/integrations/mdm/microsoft-intune), [Jamf Pro](https://tailscale.com/docs/integrations/mdm/jamf), [JumpCloud](https://tailscale.com/docs/integrations/mdm/jumpcloud), [Iru](https://tailscale.com/docs/integrations/mdm/kandji) (formerly Kandji), or [SimpleMDM](https://tailscale.com/docs/integrations/mdm/simplemdm).\r\n\r\nWe are always working on providing more options for system administrators to programmatically manage their Tailscale deployments. If you are deploying Tailscale and feel the need for a specific configuration option that is currently missing on this page, contact our support team.\r\n\r\nThe examples listed on this page use the bundle identifier for the Mac App Store variant of Tailscale, `io.tailscale.ipn.macos`. If you are configuring the Standalone variant of the app, replace it with the `io.tailscale.ipn.macsys` bundle identifier.\r\n\r\nIf you're looking to configure system policies on the Tailscale clients for iOS and tvOS, refer to the [dedicated topic](https://tailscale.com/docs/integrations/mdm/ios).\r\n\r\n## [Configuration profiles](https://tailscale.com/docs/integrations/mdm/mac\\#configuration-profiles)\r\n\r\nIf you are deploying Tailscale for macOS using MDM, you can use configuration profiles to automate parts of the setup process, reducing prompt fatigue for the user. You can also use configuration profiles to enforce specific system policies or set up automatic updates.\r\n\r\n### [Deploying system policies in a configuration profile](https://tailscale.com/docs/integrations/mdm/mac\\#deploying-system-policies-in-a-configuration-profile)\r\n\r\nConfiguration profiles can be used to specify user defaults for Tailscale. The Tailscale client will read its user defaults every time it launches, and apply any system policies it finds in the user defaults. Deploying a configuration profile containing user defaults by using your MDM solution can let you configure specific settings of the Tailscale client on behalf of the user, providing an easier setup process.\r\n\r\nRefer to our [full list of system policies](https://tailscale.com/docs/features/tailscale-system-policies) to discover all settings you can configure.\r\n\r\nThis is an example of a configuration profile to set the [**ManagedByOrganizationName**](https://tailscale.com/docs/features/tailscale-system-policies#set-your-organization-name) and [**IPAddressCopiedAlertSuppressed**](https://tailscale.com/docs/features/tailscale-system-policies#suppress-ip-address-copied-notifications) system policy values:\r\n\r\n```xml\r\n\r\n\r\n\r\n \r\n PayloadDisplayName\r\n Tailscale: System Policy Configuration Profile\r\n PayloadType\r\n Configuration\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n io.tailscale.ipn.macos.mdm.797d4461-837c-4f5a-b18e-7e300b057018\r\n PayloadUUID\r\n 0f451881-7ac4-4171-80ed-b55251053231\r\n PayloadContent\r\n \r\n \r\n PayloadDisplayName\r\n System Policies\r\n PayloadType\r\n io.tailscale.ipn.macos\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n io.tailscale.ipn.macos.f4806335-6703-4680-8f41-f40e6f281c71\r\n PayloadUUID\r\n 3e44f9b0-d309-48d3-b055-6dc683d438c8\r\n ManagedByOrganizationName\r\n Tailscale, Inc.\r\n IPAddressCopiedAlertSuppressed\r\n \r\n \r\n \r\n \r\n\r\n```\r\n\r\nThe above configuration profile is equivalent to the following two instances of the `defaults` CLI tool.\r\n\r\nFor the \\[Mac App Store\\] variant use the bundle identifier.\r\n\r\n```shell\r\ndefaults write io.tailscale.ipn.macos ManagedByOrganizationName \"Tailscale, Inc.\"\r\ndefaults write io.tailscale.ipn.macos IPAddressCopiedAlertSuppressed -bool true\r\n```\r\n\r\nFor the \\[Standalone\\] variant specify the explicit Property List (`.plist`) path.\r\n\r\n```shell\r\ndefaults write ~/Library/Preferences/io.tailscale.ipn.macsys.plist ManagedByOrganizationName \"Tailscale, Inc.\"\r\ndefaults write ~/Library/Preferences/io.tailscale.ipn.macsys.plist IPAddressCopiedAlertSuppressed -bool true\r\n```\r\n\r\nUsing this technique of writing directly to the application preferences can be used to test the effects of various MDM configurations without the need to set up a full MDM environment. Some settings will not be applied until the client and network extension are restarted.\r\n\r\nInstalling the configuration profile above, or running the commands will display **Managed by Tailscale, Inc.** in the app menu and suppress the notification banner when an IP address is copied to the Clipboard.\r\n\r\nRefer to the [list of system policies](https://tailscale.com/docs/features/tailscale-system-policies) for other values you can configure on behalf of the user.\r\n\r\n#### [Using the Tailscale profile manifest](https://tailscale.com/docs/integrations/mdm/mac\\#using-the-tailscale-profile-manifest)\r\n\r\nTailscale maintains configuration profile manifests for both the [Mac App Store](https://github.com/ProfileCreator/ProfileManifests/blob/master/Manifests/ManagedPreferencesApplications/io.tailscale.ipn.macos.plist) and [Standalone](https://github.com/ProfileCreator/ProfileManifests/blob/master/Manifests/ManagedPreferencesApplications/io.tailscale.ipn.macsys.plist) variants of the client.\r\n\r\nProfile manifests contain a machine-readable description of all available system policies and their possible values. Apps such as [iMazing Profile Editor](https://imazing.com/profile-editor) or [ProfileCreator](https://github.com/ProfileCreator/ProfileCreator) automatically fetch these manifests, and can provide you with a user-friendly GUI to create a configuration profile.\r\n\r\nTo get started, download either iMazing Profile Editor or ProfileCreator. Both Tailscale variants will appear in the sidebar among the applications you can configure, as shown in the screenshot below.\r\n\r\n![The iMazing Profile Editor configuring Tailscale system policies.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fimazing-profile-editor-tailscale.4e97d7f7.png&w=3840&q=75)\r\n\r\n### [Allow push notifications automatically](https://tailscale.com/docs/integrations/mdm/mac\\#allow-push-notifications-automatically)\r\n\r\nTailscale for macOS may sometimes use system notifications to inform the user. For instance, you will receive a notification when:\r\n\r\n- the device key is about to expire\r\n- a file was received using Taildrop\r\n- an IP address was copied to the clipboard\r\n\r\nThis is an example of a configuration profile payload to automatically allow notifications for Tailscale.\r\n\r\nMake sure you replace the bundle identifier `io.tailscale.ipn.macos` with `io.tailscale.ipn.macsys` if you are creating a configuration profile for the Standalone variant of Tailscale for macOS.\r\n\r\n```xml\r\n\r\n NotificationSettings\r\n \r\n \r\n AlertType\r\n 1\r\n BadgesEnabled\r\n \r\n BundleIdentifier\r\n io.tailscale.ipn.macos\r\n CriticalAlertEnabled\r\n \r\n NotificationsEnabled\r\n \r\n ShowInNotificationCenter\r\n \r\n \r\n \r\n PayloadDisplayName\r\n Allow Tailscale Notifications\r\n PayloadIdentifier\r\n b3dc3535-1b06-4f2d-a684-4518a6589dff\r\n PayloadOrganization\r\n Tailscale Inc.\r\n PayloadType\r\n com.apple.notificationsettings\r\n PayloadUUID\r\n 056ec734-91b7-45a3-8787-98ebf2e84024\r\n PayloadVersion\r\n 1\r\n\r\n```\r\n\r\n### [Install the Tailscale VPN configuration](https://tailscale.com/docs/integrations/mdm/mac\\#install-the-tailscale-vpn-configuration)\r\n\r\nOn the first time it launches on a Mac, the Tailscale app will install a NetworkExtension VPN configuration. You can choose to skip this step by providing a configuration profile which will configure the VPN configuration _before_ the app launches. During the first launch, the Tailscale app will detect the pre-existing configuration and skip the installation step.\r\n\r\nThe following is a valid `.mobileconfig` Property List (`.plist`) file to set up such a VPN configuration.\r\n\r\nMake sure you replace `io.tailscale.ipn.macos` with `io.tailscale.ipn.macsys`, and `io.tailscale.ipn.macos.network-extension` with `io.tailscale.ipn.macsys.network-extension` if you are creating a configuration profile for the Standalone variant of Tailscale for macOS.\r\n\r\n```xml\r\n\r\n\r\n\r\n\r\n PayloadDisplayName\r\n Tailscale VPN Configuration Profile\r\n PayloadType\r\n Configuration\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n com.your-company-name.tailscale.797d4461-837c-4f5a-b18e-7e300a057018\r\n PayloadUUID\r\n 0f451881-7ac4-4171-80fd-b55251053231\r\n PayloadContent\r\n \r\n \r\n PayloadDisplayName\r\n Tailscale VPN Configuration\r\n PayloadType\r\n com.apple.vpn.managed\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n com.your-company-name.tailscale-tunnel\r\n PayloadUUID\r\n 7ec957e2-b165-4d1f-9946-3a7a16ae0f9b\r\n UserDefinedName\r\n Tailscale MobileConfig\r\n VPNType\r\n VPN\r\n VPNSubType\r\n io.tailscale.ipn.macos\r\n VPN\r\n \r\n RemoteAddress\r\n Tailscale Mesh\r\n AuthenticationMethod\r\n Password\r\n ProviderBundleIdentifier\r\n io.tailscale.ipn.macos.network-extension\r\n \r\n \r\n \r\n\r\n\r\n```\r\n\r\n### [Approve the Tailscale system extension automatically](https://tailscale.com/docs/integrations/mdm/mac\\#approve-the-tailscale-system-extension-automatically)\r\n\r\nThis section exclusively applies to the Standalone variant of Tailscale for macOS. The variant of Tailscale distributed in the Mac App Store does not use a system extension, and only requires installing a VPN configuration.\r\n\r\nThe section above explained how you can create a configuration profile to pre-install the Tailscale VPN configuration. However, when starting the Standalone variant of Tailscale for the first time, the app will also attempt to install a system extension. By default, macOS blocks this, and requires the user to manually approve Tailscale in the System Settings app:\r\n\r\n![The warning for 'System Extension Blocked' in macOS. There are two prompts for 'OK' and 'Open System Settings'.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsystem-extension-warning.84bfc54e.png&w=1080&q=75)\r\n\r\nYou can allow the system extension by default by adding a system extension policy to the configuration profile. The first thing to do is to set the scope of your configuration profile payload to `System`, as system extensions affect all users on a Mac. Add the following at the top level of your configuration file:\r\n\r\n```xml\r\nPayloadScope\r\nSystem\r\n```\r\n\r\nThen, add the system extension policy inside the `PayloadContent` array of the configuration file:\r\n\r\n```xml\r\n\r\n PayloadUUID\r\n 1d08bf7d-7898-43b3-88e3-76cfb74a7c33\r\n PayloadType\r\n com.apple.system-extension-policy\r\n PayloadOrganization\r\n Tailscale\r\n PayloadIdentifier\r\n 8a790b57-16da-4371-8baf-d6f65e7b50ee\r\n PayloadDisplayName\r\n Allows system extensions signed by Tailscale to run without user approval.\r\n PayloadDescription\r\n \r\n PayloadVersion\r\n 1\r\n PayloadEnabled\r\n \r\n AllowedTeamIdentifiers\r\n \r\n W5364U7YZB\r\n \r\n\r\n```\r\n\r\nNote that macOS enforces that a payload with system scope can only by deployed by a MDM server. This means that users won't be able to install the configuration profile you just created by themselves: your organization will need to push it using the MDM server.\r\n\r\n### [Deploy a VPN On Demand Configuration using MDM](https://tailscale.com/docs/integrations/mdm/mac\\#deploy-a-vpn-on-demand-configuration-using-mdm)\r\n\r\nThis is an advanced deployment option. Misconfigured VPN On Demand settings may prevent your users from connecting to their tailnet. Exercise caution when deploying VPN On Demand rules, especially if you're using any rule to disconnect the VPN on certain networks.\r\n\r\nIf you are deploying your own VPN configuration (by following the steps in Install the Tailscale VPN configuration), Apple configuration profiles give you the ability to deploy a predefined VPN On Demand configuration to your users. This will automatically connect or disconnect Tailscale, depending\r\non the rules you configure. Refer to [VPN On Demand](https://tailscale.com/docs/features/client/ios-vpn-on-demand) for more information about this feature.\r\n\r\nVPN On Demand through configuration profiles for Tailscale is configured in two separate steps. First, you need to deploy two system policy keys. Then, use the `OnDemandRules` key in the VPN payload of your VPN configuration profile to define the rules. Rules can be used to do things like:\r\n\r\n- Detect when the iOS/macOS device is connected to your enterprise Wi-Fi network, so connecting to Tailscale is not required.\r\n- Detect when an unfamiliar Wi-Fi network is being used, so the Tailscale tunnel should be established.\r\n\r\n#### [Configure the required system policy keys](https://tailscale.com/docs/integrations/mdm/mac\\#configure-the-required-system-policy-keys)\r\n\r\nBefore adding the `OnDemandRules` object to your VPN configuration profile, deploy the following two system policies as part of the configuration profile you use to configure Tailscale:\r\n\r\n1. `VPNOnDemandIsUserConfigured`=`true`\r\n2. `VPNOnDemandSettings`=`hide`\r\n\r\nThe combination of these policies instructs Tailscale to not modify the on demand configuration to ensure automatic restarts of the client, and hides the VPN On Demand configuration UI from the user.\r\n\r\nAs an example, deploy this configuration profile:\r\n\r\n```xml\r\n\r\n\r\n\r\n \r\n PayloadDisplayName\r\n Tailscale: System Policy Configuration Profile\r\n PayloadType\r\n Configuration\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n io.tailscale.ipn.macos.mdm.797d4461-837c-4f5a-b18e-7e300b057018\r\n PayloadUUID\r\n 0f451881-7ac4-4171-80ed-b55251053231\r\n PayloadContent\r\n \r\n \r\n PayloadDisplayName\r\n System Policies\r\n PayloadType\r\n io.tailscale.ipn.macos\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n io.tailscale.ipn.macos.f4806335-6703-4680-8f41-f40e6f281c71\r\n PayloadUUID\r\n 3e44f9b0-d309-48d3-b055-6dc683d438c8\r\n ManagedByOrganizationName\r\n Tail and Scales, Inc.\r\n VPNOnDemandIsUserConfigured\r\n \r\n VPNOnDemandSettings\r\n hide\r\n \r\n \r\n \r\n\r\n```\r\n\r\n#### [Configure the OnDemandRules dictionary](https://tailscale.com/docs/integrations/mdm/mac\\#configure-the-ondemandrules-dictionary)\r\n\r\nOnce the above two system policies have been deployed, you can configure the `OnDemandRules` dictionary on the VPN configuration. Refer to the [Apple Configuration Profile Reference](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) for the appropriate rules you can configure.\r\n\r\nAs an example of a common configuration, this profile will automatically connect Tailscale on any Wi-Fi or Cellular network, but disconnect on any Wi-Fi network matching the `TailAndScales` SSID:\r\n\r\n```xml\r\n\r\n\r\n\r\n\r\n PayloadDisplayName\r\n Tailscale VPN Configuration Profile\r\n PayloadType\r\n Configuration\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n com.your-company-name.tailscale.797d4461-837c-4f5a-b18e-7e300a057018\r\n PayloadUUID\r\n 0f451881-7ac4-4171-80fd-b55251053231\r\n PayloadContent\r\n \r\n \r\n PayloadDisplayName\r\n Tailscale VPN Configuration\r\n PayloadType\r\n com.apple.vpn.managed\r\n PayloadVersion\r\n 1\r\n PayloadIdentifier\r\n com.your-company-name.tailscale-tunnel\r\n PayloadUUID\r\n 7ec957e2-b165-4d1f-9946-3a7a16ae0f9b\r\n UserDefinedName\r\n Tailscale MobileConfig\r\n VPNType\r\n VPN\r\n VPNSubType\r\n io.tailscale.ipn.macos\r\n VPN\r\n \r\n RemoteAddress\r\n Tailscale Mesh\r\n AuthenticationMethod\r\n Password\r\n ProviderBundleIdentifier\r\n io.tailscale.ipn.macos.network-extension\r\n \r\n OnDemandEnabled\r\n 1\r\n \r\n OnDemandRules\r\n \r\n \r\n \r\n InterfaceTypeMatch\r\n WiFi\r\n SSIDMatch\r\n TailAndScales\r\n Action\r\n Disconnect\r\n \r\n \r\n \r\n InterfaceTypeMatch\r\n WiFi\r\n Action\r\n Connect\r\n \r\n \r\n \r\n InterfaceTypeMatch\r\n Cellular\r\n Action\r\n Connect\r\n \r\n \r\n \r\n \r\n \r\n\r\n\r\n```\r\n\r\n#### [MDM install ordering recommendations](https://tailscale.com/docs/integrations/mdm/mac\\#mdm-install-ordering-recommendations)\r\n\r\nIf you are experiencing issues when deploying both the Tailscale `.pkg` installer and a set of configuration profiles at the same time, make sure your MDM solution is configured according to these rules:\r\n\r\n- The MDM solution should reboot the Mac after successfully running the `.pkg` installer and deploying the configuration profiles. Rebooting your Mac ensures all caches are updated, preventing errors during the first launch.\r\n- If you are unable to reboot the Mac as part of the deployment process, the MDM solution should run the `.pkg` installer and clear the LaunchServices cache before deploying the VPN configuration profile. Refer to the following section.\r\n\r\n##### [Workarounds for macOS NetworkExtension framework bugs](https://tailscale.com/docs/integrations/mdm/mac\\#workarounds-for-macos-networkextension-framework-bugs)\r\n\r\nLong-standing bugs on macOS may cause issues when a VPN app is deployed simultaneously with a VPN configuration profile. These problems arise if the VPN configuration profile is applied before the app is fully installed and registered in the LaunchServices database, which tracks installed applications and extensions on macOS.\r\n\r\nSpecifically, if the VPN configuration profile is deployed before the application is fully installed, macOS may fail to start the VPN network extension when the Tailscale GUI asks the system to do so, or [VPN On Demand](https://tailscale.com/docs/features/client/ios-vpn-on-demand) rules are triggered. The `nesessionmanager` process may print one of the following errors to the system log:\r\n\r\n- `The VPN app used by the VPN configuration is not installed`\r\n- `status changed to disconnected, last stop reason Plugin was disabled`\r\n\r\nA reboot of the Mac will generally solve any issues, so we recommend that you reboot the Mac after deploying Tailscale.\r\n\r\nIf you're unable to reboot your managed Macs (for instance, because you want to provide a button to install Tailscale by using the **Jamf Self-Service** app) and you observe the symptoms above, configure your MDM solution to do the following upon triggering the installer:\r\n\r\n1. Deploy the `.pkg` installer and ensure the installer has finished running.\r\n2. After running the installer, run a shell script on the Mac that will clear the LaunchServices caches (with some delays to ensure no timing issues will occur):\r\n\r\n```bash\r\n#!/bin/bash\r\n\r\necho \"Tailscale was installed, sleeping for 10 seconds before clearing the LaunchServices cache\" | logger\r\nsleep 10\r\necho \"Clearing the LaunchServices cache\" | logger\r\n/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister \\\r\n -kill -r -domain local -domain system -domain user\r\necho \"LaunchServices cache cleared successfully, sleeping another 10 seconds\" | logger\r\nsleep 10\r\n```\r\n\r\nConfigure your MDM to deploy the VPN configuration profile only after executing the shell script. macOS should then allow the network extension to start correctly.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Deploy Tailscale on macOS using MDM

Last validated: Jan 5, 2026

This page contains technical information which you might find useful if you are a system administrator deploying Tailscale for macOS in a corporate environment using MDM solutions such as Microsoft Intune, Jamf Pro, JumpCloud, Iru (formerly Kandji), or SimpleMDM.

We are always working on providing more options for system administrators to programmatically manage their Tailscale deployments. If you are deploying Tailscale and feel the need for a specific configuration option that is currently missing on this page, contact our support team.

The examples listed on this page use the bundle identifier for the Mac App Store variant of Tailscale, io.tailscale.ipn.macos. If you are configuring the Standalone variant of the app, replace it with the io.tailscale.ipn.macsys bundle identifier.

If you're looking to configure system policies on the Tailscale clients for iOS and tvOS, refer to the dedicated topic.

Configuration profiles

If you are deploying Tailscale for macOS using MDM, you can use configuration profiles to automate parts of the setup process, reducing prompt fatigue for the user. You can also use configuration profiles to enforce specific system policies or set up automatic updates.

Deploying system policies in a configuration profile

Configuration profiles can be used to specify user defaults for Tailscale. The Tailscale client will read its user defaults every time it launches, and apply any system policies it finds in the user defaults. Deploying a configuration profile containing user defaults by using your MDM solution can let you configure specific settings of the Tailscale client on behalf of the user, providing an easier setup process.

Refer to our full list of system policies to discover all settings you can configure.

This is an example of a configuration profile to set the ManagedByOrganizationName and IPAddressCopiedAlertSuppressed system policy values:

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\r\n<plist version=\"1.0\">\r\n    <dict>\r\n        <key>PayloadDisplayName</key>\r\n        <string>Tailscale: System Policy Configuration Profile</string>\r\n        <key>PayloadType</key>\r\n        <string>Configuration</string>\r\n        <key>PayloadVersion</key>\r\n        <integer>1</integer>\r\n        <key>PayloadIdentifier</key>\r\n        <string>io.tailscale.ipn.macos.mdm.797d4461-837c-4f5a-b18e-7e300b057018</string>\r\n        <key>PayloadUUID</key>\r\n        <string>0f451881-7ac4-4171-80ed-b55251053231</string>\r\n        <key>PayloadContent</key>\r\n        <array>\r\n            <dict>\r\n                <key>PayloadDisplayName</key>\r\n                <string>System Policies</string>\r\n                <key>PayloadType</key>\r\n                <string>io.tailscale.ipn.macos</string>\r\n                <key>PayloadVersion</key>\r\n                <integer>1</integer>\r\n                <key>PayloadIdentifier</key>\r\n                <string>io.tailscale.ipn.macos.f4806335-6703-4680-8f41-f40e6f281c71</string>\r\n                <key>PayloadUUID</key>\r\n                <string>3e44f9b0-d309-48d3-b055-6dc683d438c8</string>\r\n                <key>ManagedByOrganizationName</key>\r\n                <string>Tailscale, Inc.</string>\r\n                <key>IPAddressCopiedAlertSuppressed</key>\r\n                <true/>\r\n            </dict>\r\n        </array>\r\n    </dict>\r\n</plist>\n

The above configuration profile is equivalent to the following two instances of the defaults CLI tool.

For the [Mac App Store] variant use the bundle identifier.

defaults write io.tailscale.ipn.macos ManagedByOrganizationName \"Tailscale, Inc.\"\r\ndefaults write io.tailscale.ipn.macos IPAddressCopiedAlertSuppressed -bool true\n

For the [Standalone] variant specify the explicit Property List (.plist) path.

defaults write ~/Library/Preferences/io.tailscale.ipn.macsys.plist ManagedByOrganizationName \"Tailscale, Inc.\"\r\ndefaults write ~/Library/Preferences/io.tailscale.ipn.macsys.plist IPAddressCopiedAlertSuppressed -bool true\n

Using this technique of writing directly to the application preferences can be used to test the effects of various MDM configurations without the need to set up a full MDM environment. Some settings will not be applied until the client and network extension are restarted.

Installing the configuration profile above, or running the commands will display Managed by Tailscale, Inc. in the app menu and suppress the notification banner when an IP address is copied to the Clipboard.

Refer to the list of system policies for other values you can configure on behalf of the user.

Using the Tailscale profile manifest

Tailscale maintains configuration profile manifests for both the Mac App Store and Standalone variants of the client.

Profile manifests contain a machine-readable description of all available system policies and their possible values. Apps such as iMazing Profile Editor or ProfileCreator automatically fetch these manifests, and can provide you with a user-friendly GUI to create a configuration profile.

To get started, download either iMazing Profile Editor or ProfileCreator. Both Tailscale variants will appear in the sidebar among the applications you can configure, as shown in the screenshot below.

$\"The$

Allow push notifications automatically

Tailscale for macOS may sometimes use system notifications to inform the user. For instance, you will receive a notification when:

the device key is about to expire
a file was received using Taildrop
an IP address was copied to the clipboard

This is an example of a configuration profile payload to automatically allow notifications for Tailscale.

Make sure you replace the bundle identifier io.tailscale.ipn.macos with io.tailscale.ipn.macsys if you are creating a configuration profile for the Standalone variant of Tailscale for macOS.

<dict>\r\n  <key>NotificationSettings</key>\r\n  <array>\r\n    <dict>\r\n      <key>AlertType</key>\r\n      <integer>1</integer>\r\n      <key>BadgesEnabled</key>\r\n      <true/>\r\n      <key>BundleIdentifier</key>\r\n      <string>io.tailscale.ipn.macos</string>\r\n      <key>CriticalAlertEnabled</key>\r\n      <true/>\r\n      <key>NotificationsEnabled</key>\r\n      <true/>\r\n      <key>ShowInNotificationCenter</key>\r\n      <true/>\r\n    </dict>\r\n  </array>\r\n  <key>PayloadDisplayName</key>\r\n  <string>Allow Tailscale Notifications</string>\r\n  <key>PayloadIdentifier</key>\r\n  <string>b3dc3535-1b06-4f2d-a684-4518a6589dff</string>\r\n  <key>PayloadOrganization</key>\r\n  <string>Tailscale Inc.</string>\r\n  <key>PayloadType</key>\r\n  <string>com.apple.notificationsettings</string>\r\n  <key>PayloadUUID</key>\r\n  <string>056ec734-91b7-45a3-8787-98ebf2e84024</string>\r\n  <key>PayloadVersion</key>\r\n  <integer>1</integer>\r\n</dict>\n

Install the Tailscale VPN configuration

On the first time it launches on a Mac, the Tailscale app will install a NetworkExtension VPN configuration. You can choose to skip this step by providing a configuration profile which will configure the VPN configuration before the app launches. During the first launch, the Tailscale app will detect the pre-existing configuration and skip the installation step.

The following is a valid .mobileconfig Property List (.plist) file to set up such a VPN configuration.

Make sure you replace io.tailscale.ipn.macos with io.tailscale.ipn.macsys, and io.tailscale.ipn.macos.network-extension with io.tailscale.ipn.macsys.network-extension if you are creating a configuration profile for the Standalone variant of Tailscale for macOS.

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\r\n<plist version=\"1.0\">\r\n<dict>\r\n  <key>PayloadDisplayName</key>\r\n  <string>Tailscale VPN Configuration Profile</string>\r\n  <key>PayloadType</key>\r\n  <string>Configuration</string>\r\n  <key>PayloadVersion</key>\r\n  <integer>1</integer>\r\n  <key>PayloadIdentifier</key>\r\n  <string>com.your-company-name.tailscale.797d4461-837c-4f5a-b18e-7e300a057018</string>\r\n  <key>PayloadUUID</key>\r\n  <string>0f451881-7ac4-4171-80fd-b55251053231</string>\r\n  <key>PayloadContent</key>\r\n  <array>\r\n        <dict>\r\n        <key>PayloadDisplayName</key>\r\n        <string>Tailscale VPN Configuration</string>\r\n        <key>PayloadType</key>\r\n        <string>com.apple.vpn.managed</string>\r\n        <key>PayloadVersion</key>\r\n        <integer>1</integer>\r\n        <key>PayloadIdentifier</key>\r\n        <string>com.your-company-name.tailscale-tunnel</string>\r\n        <key>PayloadUUID</key>\r\n        <string>7ec957e2-b165-4d1f-9946-3a7a16ae0f9b</string>\r\n        <key>UserDefinedName</key>\r\n        <string>Tailscale MobileConfig</string>\r\n        <key>VPNType</key>\r\n        <string>VPN</string>\r\n        <key>VPNSubType</key>\r\n        <string>io.tailscale.ipn.macos</string>\r\n        <key>VPN</key>\r\n         <dict>\r\n            <key>RemoteAddress</key>\r\n            <string>Tailscale Mesh</string>\r\n            <key>AuthenticationMethod</key>\r\n            <string>Password</string>\r\n            <key>ProviderBundleIdentifier</key>\r\n            <string>io.tailscale.ipn.macos.network-extension</string>\r\n        </dict>\r\n    </dict>\r\n  </array>\r\n</dict>\r\n</plist>\n

Approve the Tailscale system extension automatically

This section exclusively applies to the Standalone variant of Tailscale for macOS. The variant of Tailscale distributed in the Mac App Store does not use a system extension, and only requires installing a VPN configuration.

The section above explained how you can create a configuration profile to pre-install the Tailscale VPN configuration. However, when starting the Standalone variant of Tailscale for the first time, the app will also attempt to install a system extension. By default, macOS blocks this, and requires the user to manually approve Tailscale in the System Settings app:

$\"The$

You can allow the system extension by default by adding a system extension policy to the configuration profile. The first thing to do is to set the scope of your configuration profile payload to System, as system extensions affect all users on a Mac. Add the following at the top level of your configuration file:

<key>PayloadScope</key>\r\n<string>System</string>\n

Then, add the system extension policy inside the PayloadContent array of the configuration file:

<dict>\r\n  <key>PayloadUUID</key>\r\n  <string>1d08bf7d-7898-43b3-88e3-76cfb74a7c33</string>\r\n  <key>PayloadType</key>\r\n  <string>com.apple.system-extension-policy</string>\r\n  <key>PayloadOrganization</key>\r\n  <string>Tailscale</string>\r\n  <key>PayloadIdentifier</key>\r\n  <string>8a790b57-16da-4371-8baf-d6f65e7b50ee</string>\r\n  <key>PayloadDisplayName</key>\r\n  <string>Allows system extensions signed by Tailscale to run without user approval.</string>\r\n  <key>PayloadDescription</key>\r\n  <string/>\r\n  <key>PayloadVersion</key>\r\n  <integer>1</integer>\r\n  <key>PayloadEnabled</key>\r\n  <true/>\r\n  <key>AllowedTeamIdentifiers</key>\r\n  <array>\r\n    <string>W5364U7YZB</string>\r\n  </array>\r\n</dict>\n

Note that macOS enforces that a payload with system scope can only by deployed by a MDM server. This means that users won't be able to install the configuration profile you just created by themselves: your organization will need to push it using the MDM server.

Deploy a VPN On Demand Configuration using MDM

This is an advanced deployment option. Misconfigured VPN On Demand settings may prevent your users from connecting to their tailnet. Exercise caution when deploying VPN On Demand rules, especially if you're using any rule to disconnect the VPN on certain networks.

If you are deploying your own VPN configuration (by following the steps in Install the Tailscale VPN configuration), Apple configuration profiles give you the ability to deploy a predefined VPN On Demand configuration to your users. This will automatically connect or disconnect Tailscale, depending\r\non the rules you configure. Refer to VPN On Demand for more information about this feature.

VPN On Demand through configuration profiles for Tailscale is configured in two separate steps. First, you need to deploy two system policy keys. Then, use the OnDemandRules key in the VPN payload of your VPN configuration profile to define the rules. Rules can be used to do things like:

Detect when the iOS/macOS device is connected to your enterprise Wi-Fi network, so connecting to Tailscale is not required.
Detect when an unfamiliar Wi-Fi network is being used, so the Tailscale tunnel should be established.

Configure the required system policy keys

Before adding the OnDemandRules object to your VPN configuration profile, deploy the following two system policies as part of the configuration profile you use to configure Tailscale:

VPNOnDemandIsUserConfigured=true
VPNOnDemandSettings=hide

The combination of these policies instructs Tailscale to not modify the on demand configuration to ensure automatic restarts of the client, and hides the VPN On Demand configuration UI from the user.

As an example, deploy this configuration profile:

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\r\n<plist version=\"1.0\">\r\n    <dict>\r\n        <key>PayloadDisplayName</key>\r\n        <string>Tailscale: System Policy Configuration Profile</string>\r\n        <key>PayloadType</key>\r\n        <string>Configuration</string>\r\n        <key>PayloadVersion</key>\r\n        <integer>1</integer>\r\n        <key>PayloadIdentifier</key>\r\n        <string>io.tailscale.ipn.macos.mdm.797d4461-837c-4f5a-b18e-7e300b057018</string>\r\n        <key>PayloadUUID</key>\r\n        <string>0f451881-7ac4-4171-80ed-b55251053231</string>\r\n        <key>PayloadContent</key>\r\n        <array>\r\n            <dict>\r\n                <key>PayloadDisplayName</key>\r\n                <string>System Policies</string>\r\n                <key>PayloadType</key>\r\n                <string>io.tailscale.ipn.macos</string>\r\n                <key>PayloadVersion</key>\r\n                <integer>1</integer>\r\n                <key>PayloadIdentifier</key>\r\n                <string>io.tailscale.ipn.macos.f4806335-6703-4680-8f41-f40e6f281c71</string>\r\n                <key>PayloadUUID</key>\r\n                <string>3e44f9b0-d309-48d3-b055-6dc683d438c8</string>\r\n                <key>ManagedByOrganizationName</key>\r\n                <string>Tail and Scales, Inc.</string>\r\n                <key>VPNOnDemandIsUserConfigured</key>\r\n                <true/>\r\n                <key>VPNOnDemandSettings</key>\r\n                <string>hide</string>\r\n            </dict>\r\n        </array>\r\n    </dict>\r\n</plist>\n

Configure the OnDemandRules dictionary

Once the above two system policies have been deployed, you can configure the OnDemandRules dictionary on the VPN configuration. Refer to the Apple Configuration Profile Reference for the appropriate rules you can configure.

As an example of a common configuration, this profile will automatically connect Tailscale on any Wi-Fi or Cellular network, but disconnect on any Wi-Fi network matching the TailAndScales SSID:

<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\r\n<plist version=\"1.0\">\r\n<dict>\r\n  <key>PayloadDisplayName</key>\r\n  <string>Tailscale VPN Configuration Profile</string>\r\n  <key>PayloadType</key>\r\n  <string>Configuration</string>\r\n  <key>PayloadVersion</key>\r\n  <integer>1</integer>\r\n  <key>PayloadIdentifier</key>\r\n  <string>com.your-company-name.tailscale.797d4461-837c-4f5a-b18e-7e300a057018</string>\r\n  <key>PayloadUUID</key>\r\n  <string>0f451881-7ac4-4171-80fd-b55251053231</string>\r\n  <key>PayloadContent</key>\r\n  <array>\r\n        <dict>\r\n        <key>PayloadDisplayName</key>\r\n        <string>Tailscale VPN Configuration</string>\r\n        <key>PayloadType</key>\r\n        <string>com.apple.vpn.managed</string>\r\n        <key>PayloadVersion</key>\r\n        <integer>1</integer>\r\n        <key>PayloadIdentifier</key>\r\n        <string>com.your-company-name.tailscale-tunnel</string>\r\n        <key>PayloadUUID</key>\r\n        <string>7ec957e2-b165-4d1f-9946-3a7a16ae0f9b</string>\r\n        <key>UserDefinedName</key>\r\n        <string>Tailscale MobileConfig</string>\r\n        <key>VPNType</key>\r\n        <string>VPN</string>\r\n        <key>VPNSubType</key>\r\n        <string>io.tailscale.ipn.macos</string>\r\n        <key>VPN</key>\r\n         <dict>\r\n            <key>RemoteAddress</key>\r\n            <string>Tailscale Mesh</string>\r\n            <key>AuthenticationMethod</key>\r\n            <string>Password</string>\r\n            <key>ProviderBundleIdentifier</key>\r\n            <string>io.tailscale.ipn.macos.network-extension</string>\r\n            <!-- Instruct the system to enable VPN On Demand -->\r\n            <key>OnDemandEnabled</key>\r\n            <integer>1</integer>\r\n            <!-- The actual on-demand configuration rules: -->\r\n            <key>OnDemandRules</key>\r\n            <array>\r\n              <!-- Disconnect on the 'TailAndScales' Wi-Fi network... -->\r\n              <dict>\r\n                <key>InterfaceTypeMatch</key>\r\n                <string>WiFi</string>\r\n                <key>SSIDMatch</key>\r\n                <string>TailAndScales</string>\r\n                <key>Action</key>\r\n                <string>Disconnect</string>\r\n              </dict>\r\n              <!-- ... but connect on any other Wi-Fi... -->\r\n              <dict>\r\n                <key>InterfaceTypeMatch</key>\r\n                <string>WiFi</string>\r\n                <key>Action</key>\r\n                <string>Connect</string>\r\n              </dict>\r\n              <!-- ... or any Cellular network. -->\r\n              <dict>\r\n                <key>InterfaceTypeMatch</key>\r\n                <string>Cellular</string>\r\n                <key>Action</key>\r\n                <string>Connect</string>\r\n              </dict>\r\n            </array>\r\n        </dict>\r\n    </dict>\r\n  </array>\r\n</dict>\r\n</plist>\n

MDM install ordering recommendations

If you are experiencing issues when deploying both the Tailscale .pkg installer and a set of configuration profiles at the same time, make sure your MDM solution is configured according to these rules:

The MDM solution should reboot the Mac after successfully running the .pkg installer and deploying the configuration profiles. Rebooting your Mac ensures all caches are updated, preventing errors during the first launch.
If you are unable to reboot the Mac as part of the deployment process, the MDM solution should run the .pkg installer and clear the LaunchServices cache before deploying the VPN configuration profile. Refer to the following section.

Workarounds for macOS NetworkExtension framework bugs

Long-standing bugs on macOS may cause issues when a VPN app is deployed simultaneously with a VPN configuration profile. These problems arise if the VPN configuration profile is applied before the app is fully installed and registered in the LaunchServices database, which tracks installed applications and extensions on macOS.

Specifically, if the VPN configuration profile is deployed before the application is fully installed, macOS may fail to start the VPN network extension when the Tailscale GUI asks the system to do so, or VPN On Demand rules are triggered. The nesessionmanager process may print one of the following errors to the system log:

The VPN app used by the VPN configuration is not installed
status changed to disconnected, last stop reason Plugin was disabled

A reboot of the Mac will generally solve any issues, so we recommend that you reboot the Mac after deploying Tailscale.

If you're unable to reboot your managed Macs (for instance, because you want to provide a button to install Tailscale by using the Jamf Self-Service app) and you observe the symptoms above, configure your MDM solution to do the following upon triggering the installer:

Deploy the .pkg installer and ensure the installer has finished running.
After running the installer, run a shell script on the Mac that will clear the LaunchServices caches (with some delays to ensure no timing issues will occur):

#!/bin/bash\r\n\r\necho \"Tailscale was installed, sleeping for 10 seconds before clearing the LaunchServices cache\" | logger\r\nsleep 10\r\necho \"Clearing the LaunchServices cache\" | logger\r\n/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister \\\r\n  -kill -r -domain local -domain system -domain user\r\necho \"LaunchServices cache cleared successfully, sleeping another 10 seconds\"  | logger\r\nsleep 10\n

Configure your MDM to deploy the VPN configuration profile only after executing the shell script. macOS should then allow the network extension to start correctly.

$\"Project$

Ask AI

reCAPTCHA

Recaptcha requires verification.

protected by reCAPTCHA

\n"}