{"slug":"jit-access-with-conductorone","title":"JIT access with ConductorOne","tags":["tailscale","access-control"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# JIT access with ConductorOne\r\n\r\nLast validated: Jan 5, 2026\r\n\r\n[ConductorOne](https://www.conductorone.com/) is a security platform that lets you manage access requests for your Tailscale entitlements.\r\n\r\nOn-demand access to Tailscale resources can be provisioned using ConductorOne. This works by adding and removing members from [groups](https://tailscale.com/docs/reference/syntax/policy-file#groups), [access rules](https://tailscale.com/docs/reference/syntax/policy-file#acls), and [SSH access rules](https://tailscale.com/docs/reference/syntax/policy-file#ssh) defined in Tailscale [access control policies](https://tailscale.com/docs/features/access-control).\r\n\r\nYou can use ConductorOne with [user & group provisioning](https://tailscale.com/docs/features/user-group-provisioning) to update [SCIM-integrated](https://tailscale.com/learn/what-is-scim) group membership in groups used in\r\nTailscale access control policies. Likewise, you can use ConductorOne to assign a user to the Tailscale application, with the user synced through SCIM to your Tailscale network.\r\n\r\nYou can connect multiple tailnets to ConductorOne simultaneously.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/jit-conductorone\\#prerequisites)\r\n\r\nBefore you begin this guide, you'll need a tailnet and a ConductorOne account.\r\n\r\n- For information about creating a tailnet, refer to the [Tailscale quickstart](https://tailscale.com/docs/how-to/quickstart).\r\n\r\n- For information about creating a ConductorOne account, refer to [ConductorOne](https://www.conductorone.com/).\r\n\r\n\r\n## [Integration](https://tailscale.com/docs/integrations/jit-conductorone\\#integration)\r\n\r\nReview the full instructions in ConductorOne's [blog post](https://www.conductorone.com/blog/implementing-least-privilege-access-tailscale-conductorone) for setting up an integration with Tailscale.\r\n\r\nTo use ConductorOne with Tailscale, you'll need to:\r\n\r\n1. Generate a Tailscale [API access token](https://tailscale.com/docs/reference/tailscale-api) from the [Keys](https://login.tailscale.com/admin/settings/keys) page of the admin console.\r\n2. In ConductorOne, select the **Tailscale** integration and then select **Add Connector**.\r\n1. Choose the option to **Create a new app**.\r\n2. Set the **Tailscale API key** to the Tailscale API access token you generated.\r\n3. Set the **Tailnet** to your tailnet ID. You can find your tailnet ID in the [General](https://login.tailscale.com/admin/settings/general) page of the admin console.\r\n\r\nConductorOne will automatically identify all the users in the tailnet and parse existing [access rules](https://tailscale.com/docs/reference/syntax/policy-file#acls) in Tailscale\r\naccess control policies, including [SSH access rules](https://tailscale.com/docs/reference/syntax/policy-file#ssh), as entitlements in ConductorOne. The application owner in ConductorOne can specify for each\r\nentitlement, such as group membership or another SSH access rule, whether to restrict access by time, and whether to\r\nuse the default application grant policy.\r\n\r\nNow a user can request access to a specific Tailscale entitlement through the **Request access** page of ConductorOne and through Slack. ConductorOne will update the [tailnet policy file](https://tailscale.com/docs/features/tailnet-policy-file) to allow the temporary access.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

JIT access with ConductorOne

\n

Last validated: Jan 5, 2026

\n

ConductorOne is a security platform that lets you manage access requests for your Tailscale entitlements.

\n

On-demand access to Tailscale resources can be provisioned using ConductorOne. This works by adding and removing members from groups, access rules, and SSH access rules defined in Tailscale access control policies.

\n

You can use ConductorOne with user & group provisioning to update SCIM-integrated group membership in groups used in\r\nTailscale access control policies. Likewise, you can use ConductorOne to assign a user to the Tailscale application, with the user synced through SCIM to your Tailscale network.

\n

You can connect multiple tailnets to ConductorOne simultaneously.

\n

Prerequisites

\n

Before you begin this guide, you'll need a tailnet and a ConductorOne account.

\n\n

Integration

\n

Review the full instructions in ConductorOne's blog post for setting up an integration with Tailscale.

\n

To use ConductorOne with Tailscale, you'll need to:

\n
    \n
  1. Generate a Tailscale API access token from the Keys page of the admin console.
    2. \n
  2. In ConductorOne, select the Tailscale integration and then select Add Connector.
    3. \n
  3. Choose the option to Create a new app.
    4. \n
  4. Set the Tailscale API key to the Tailscale API access token you generated.
    5. \n
  5. Set the Tailnet to your tailnet ID. You can find your tailnet ID in the General page of the admin console.
    6. \n
\n

ConductorOne will automatically identify all the users in the tailnet and parse existing access rules in Tailscale\r\naccess control policies, including SSH access rules, as entitlements in ConductorOne. The application owner in ConductorOne can specify for each\r\nentitlement, such as group membership or another SSH access rule, whether to restrict access by time, and whether to\r\nuse the default application grant policy.

\n

Now a user can request access to a specific Tailscale entitlement through the Request access page of ConductorOne and through Slack. ConductorOne will update the tailnet policy file to allow the temporary access.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}