{"slug":"restrict-device-access-with-huntress","title":"Restrict device access with Huntress","tags":["tailscale","access-control","devices"],"agent_summary":"Last validated: Feb 2, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Restrict device access with Huntress\r\n\r\nLast validated: Feb 2, 2026\r\n\r\nThis integrationis available for [the Standard, Premium, and Enterprise plans](https://tailscale.com/pricing).\r\n\r\n[Huntress Managed EDR](https://www.huntress.com/platform/managed-edr) is a cybersecurity solution that collects signals from enrolled devices (from its agent installed on each device).\r\n\r\nTailscale can fetch these signals from Huntress and use them as device posture attributes in access rules, which you can then use to only grant access to sensitive resources based on each device's level of trust.\r\n\r\nYou can achieve this Tailscale's [device posture management](https://tailscale.com/docs/features/device-posture) features:\r\n\r\n- [Device Identity Collection](https://tailscale.com/docs/features/access-control/device-management/how-to/manage-identity), which collects identifiers (for example, serial numbers), used to match devices in Tailscale to devices in Huntress.\r\n- Huntress posture integration, which synchronizes signals from Huntress to device posture attributes in Tailscale.\r\n- [Posture conditions in access rules](https://tailscale.com/docs/features/device-posture#device-posture-conditions), which lets you configure access restrictions based on device attributes.\r\n\r\nThis guide explains how to enable Device Identity collection for your tailnet and configure Huntress posture integration.\r\n\r\n## [What is Huntress posture integration?](https://tailscale.com/docs/integrations/huntress\\#what-is-huntress-posture-integration)\r\n\r\nThe integration syncs data between Huntress and Tailscale on a recurring schedule.\r\nDuring each sync, Tailscale performs the following actions:\r\n\r\n1. Fetches a list of agents and their reported data from your Huntress account.\r\n2. Matches Huntress devices to devices in your tailnet based on serial numbers.\r\n3. Writes the Huntress data to device posture attributes on each matched device.\r\n\r\nThe integration writes the following device posture attributes to matched devices:\r\n\r\n| **Attribute key** | **Description** | **Allowed values** |\r\n| --- | --- | --- |\r\n| `huntress:defenderStatus` | Status of Microsoft Defender AV | `Incompatible`, `Unhealthy`, `Protected`, `Unmanaged` |\r\n| `huntress:defenderPolicyStatus` | Policy status of Microsoft Defender AV | `Unknown`, `Non Compliant`, `Compliant`, `Pending`, `Gpo Conflict` |\r\n| `huntress:firewallStatus` | Whether the firewall is enabled | `Disabled`, `Enabled`, `Pending Isolation`, `Isolated`, `Pending Release` |\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/huntress\\#prerequisites)\r\n\r\nBefore you can set up the Huntress integration, make sure you have:\r\n\r\n- [Device Identity Collection](https://tailscale.com/docs/features/access-control/device-management/how-to/manage-identity) is enabled, and devices in your tailnet are reporting identifiers\r\n- A Huntress account for which you have permission to create an API key and secret.\r\n\r\n## [Create Huntress API key and API secret](https://tailscale.com/docs/integrations/huntress\\#create-huntress-api-key-and-api-secret)\r\n\r\nTo authenticate your Huntress account with Tailscale, you'll need to create a Huntress API key and secret. The Huntress integration uses these to fetch a list of agents and their data from Huntress.\r\n\r\nTo create a Huntress API key and secret:\r\n\r\n1. Go to the Huntress website and log in to your account.\r\n\r\n2. In the top right-hand menu, select **API Credentials**.\r\n\r\n3. Under **User API Credentials**, select **\\+ Add**.\r\n\r\n4. Under **User**, select a user who has permission to access all your Huntress agents, and select **Create**. Tailscale recommends using a dedicated read-only user for your Tailscale API key.\r\n\r\n5. Make sure to copy the **API Key** and **API Secret**. You need these to configure the Huntress integration in the Tailscale admin console.\r\n\r\n\r\n## [Find your Huntress Organization ID](https://tailscale.com/docs/integrations/huntress\\#find-your-huntress-organization-id)\r\n\r\nYou can specify a Huntress Organization ID to limit the integration to a specific organization associated with your Huntress account.You might consider doing this if you have multiple organizations within Huntress, but only need to connect one of them to Tailscale.\r\n\r\nTo find your Huntress organization ID:\r\n\r\n1. Go to the Huntress website and log in to your account.\r\n2. In the top right-hand menu, select **Organizations**.\r\n3. In the list of organizations, select the organization you plan to use with Tailscale.\r\n4. In the URL, look for the number after `/org/`. For example, if the URL is `https://example.huntress.io/org/123456`, the Organization ID is `123456`.\r\n5. Save this ID so you can use it when you configure the Huntress integration in Tailscale.\r\n\r\n## [Configure Huntress posture integration](https://tailscale.com/docs/integrations/huntress\\#configure-huntress-posture-integration)\r\n\r\nTo configure Tailscale to fetch data about devices from Huntress:\r\n\r\n1. Open the [Device management](https://login.tailscale.com/admin/settings/device-management) page of the Tailscale admin console.\r\n2. Under the **Device Posture Integrations** section, locate the Huntress integration, then select **Connect**.\r\n3. Enter your **API Key** and **API Secret**.\r\n4. (Optional) Enter your [**Organization ID**](https://tailscale.com/docs/integrations/huntress#find-your-huntress-organization-id) to limit the integration to a specific organization associated with your Huntress account.\r\n5. Select **Connect to Huntress**.\r\n\r\n## [Check the integration status](https://tailscale.com/docs/integrations/huntress\\#check-the-integration-status)\r\n\r\nNext, check to ensure the Huntress integration has run successfully.\r\n\r\n1. Go to the **Device Posture Integrations** section of the [Device management](https://login.tailscale.com/admin/settings/device-management) page.\r\n2. Locate the Huntress integration under the **Integrations** section.\r\n\r\nAfter the Huntress integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.\r\n\r\n![Integrations: Huntress: Last sync 4 minutes ago, 1 match between 2 Tailscale devices with identities and 3 Huntress agents.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fintegration-status.64801efb.png&w=1200&q=75)\r\n\r\n## [Check node attributes](https://tailscale.com/docs/integrations/huntress\\#check-node-attributes)\r\n\r\nAfter you set up the Huntress integration, you can confirm that Tailscale is writing the new node attributes for your Huntress devices from the Tailscale admin console.\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the Tailscale admin console.\r\n2. Select a device to inspect.\r\n3. The node attributes for the device are in the **Machine Details** section. This should include the set of `huntress:` attributes listed previously.\r\n\r\n![View of the machine attributes in the Machines page.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmachine-attributes.0bdedafa.png&w=640&q=75)\r\n\r\nYou can also check device attributes using the [Tailscale API](https://tailscale.com/api#tag/devices/GET/device/%7BdeviceId%7D/attributes).\r\n\r\n## [Adjust Tailscale access rules](https://tailscale.com/docs/integrations/huntress\\#adjust-tailscale-access-rules)\r\n\r\nAfter you configure Huntress posture integration, and your devices have device posture attributes that reflect their signals as reported by Huntress, you can use those device posture attributes as part of your posture rules.\r\n\r\nFor example, to only permit access to `tag:production` from devices that have antivirus (AV) scanning and firewall enabled, you can create a new posture and use it as part of a corresponding access rule:\r\n\r\n```json\r\n\"postures\": {\r\n \"posture:trusted\": [\\\r\n \"huntress:defenderStatus == 'Healthy'\",\\\r\n \"huntress:firewallStatus == 'Enabled'\",\\\r\n ],\r\n},\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"autogroup:member\"],\\\r\n \"dst\": [\"tag:production\"],\\\r\n \"ip\": [\"*\"],\\\r\n \"srcPosture\": [\"posture:trusted\"]\\\r\n }\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n## [Schedule](https://tailscale.com/docs/integrations/huntress\\#schedule)\r\n\r\nFor each configured integration, Tailscale will aim to sync device posture\r\nattributes every 15 minutes, with a few exceptions:\r\n\r\n- Adding a new integration, or changing configuration of an existing one,\r\nwill trigger an out-of-schedule sync.\r\n- If an integration fails due to authentication error (usually caused by invalid\r\ncredentials), it will be paused for up to 24 hours.\r\n\r\n## [Audit log events](https://tailscale.com/docs/integrations/huntress\\#audit-log-events)\r\n\r\nThe following [audit log events](https://tailscale.com/docs/features/logging/audit-logging#events) are added for device posture.\r\n\r\n| **Target** | **Action** | **Description** |\r\n| --- | --- | --- |\r\n| Integration | Create posture integration | A new posture integration was created |\r\n| Integration | Update posture integration | A posture integration was updated |\r\n| Integration | Removed posture integration | A posture integration was removed |\r\n| Node | Update node attribute | Device posture attributes for a node were changed |\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Restrict device access with Huntress

\n

Last validated: Feb 2, 2026

\n

This integrationis available for the Standard, Premium, and Enterprise plans.

\n

Huntress Managed EDR is a cybersecurity solution that collects signals from enrolled devices (from its agent installed on each device).

\n

Tailscale can fetch these signals from Huntress and use them as device posture attributes in access rules, which you can then use to only grant access to sensitive resources based on each device's level of trust.

\n

You can achieve this Tailscale's device posture management features:

\n\n

This guide explains how to enable Device Identity collection for your tailnet and configure Huntress posture integration.

\n

What is Huntress posture integration?

\n

The integration syncs data between Huntress and Tailscale on a recurring schedule.\r\nDuring each sync, Tailscale performs the following actions:

\n
    \n
  1. Fetches a list of agents and their reported data from your Huntress account.
    2. \n
  2. Matches Huntress devices to devices in your tailnet based on serial numbers.
    3. \n
  3. Writes the Huntress data to device posture attributes on each matched device.
    4. \n
\n

The integration writes the following device posture attributes to matched devices:

\n

| Attribute key | Description | Allowed values |\r\n| --- | --- | --- |\r\n| huntress:defenderStatus | Status of Microsoft Defender AV | Incompatible, Unhealthy, Protected, Unmanaged |\r\n| huntress:defenderPolicyStatus | Policy status of Microsoft Defender AV | Unknown, Non Compliant, Compliant, Pending, Gpo Conflict |\r\n| huntress:firewallStatus | Whether the firewall is enabled | Disabled, Enabled, Pending Isolation, Isolated, Pending Release |

\n

Prerequisites

\n

Before you can set up the Huntress integration, make sure you have:

\n\n

Create Huntress API key and API secret

\n

To authenticate your Huntress account with Tailscale, you'll need to create a Huntress API key and secret. The Huntress integration uses these to fetch a list of agents and their data from Huntress.

\n

To create a Huntress API key and secret:

\n
    \n
  1. \n

    Go to the Huntress website and log in to your account.

    \n
    2. \n
  2. \n

    In the top right-hand menu, select API Credentials.

    \n
    3. \n
  3. \n

    Under User API Credentials, select + Add.

    \n
    4. \n
  4. \n

    Under User, select a user who has permission to access all your Huntress agents, and select Create. Tailscale recommends using a dedicated read-only user for your Tailscale API key.

    \n
    5. \n
  5. \n

    Make sure to copy the API Key and API Secret. You need these to configure the Huntress integration in the Tailscale admin console.

    \n
    6. \n
\n

Find your Huntress Organization ID

\n

You can specify a Huntress Organization ID to limit the integration to a specific organization associated with your Huntress account.You might consider doing this if you have multiple organizations within Huntress, but only need to connect one of them to Tailscale.

\n

To find your Huntress organization ID:

\n
    \n
  1. Go to the Huntress website and log in to your account.
    2. \n
  2. In the top right-hand menu, select Organizations.
    3. \n
  3. In the list of organizations, select the organization you plan to use with Tailscale.
    4. \n
  4. In the URL, look for the number after /org/. For example, if the URL is https://example.huntress.io/org/123456, the Organization ID is 123456.
    5. \n
  5. Save this ID so you can use it when you configure the Huntress integration in Tailscale.
    6. \n
\n

Configure Huntress posture integration

\n

To configure Tailscale to fetch data about devices from Huntress:

\n
    \n
  1. Open the Device management page of the Tailscale admin console.
    2. \n
  2. Under the Device Posture Integrations section, locate the Huntress integration, then select Connect.
    3. \n
  3. Enter your API Key and API Secret.
    4. \n
  4. (Optional) Enter your Organization ID to limit the integration to a specific organization associated with your Huntress account.
    5. \n
  5. Select Connect to Huntress.
    6. \n
\n

Check the integration status

\n

Next, check to ensure the Huntress integration has run successfully.

\n
    \n
  1. Go to the Device Posture Integrations section of the Device management page.
    2. \n
  2. Locate the Huntress integration under the Integrations section.
    3. \n
\n

After the Huntress integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.

\n

\"Integrations:

\n

Check node attributes

\n

After you set up the Huntress integration, you can confirm that Tailscale is writing the new node attributes for your Huntress devices from the Tailscale admin console.

\n
    \n
  1. Open the Machines page of the Tailscale admin console.
    2. \n
  2. Select a device to inspect.
    3. \n
  3. The node attributes for the device are in the Machine Details section. This should include the set of huntress: attributes listed previously.
    4. \n
\n

\"View

\n

You can also check device attributes using the Tailscale API.

\n

Adjust Tailscale access rules

\n

After you configure Huntress posture integration, and your devices have device posture attributes that reflect their signals as reported by Huntress, you can use those device posture attributes as part of your posture rules.

\n

For example, to only permit access to tag:production from devices that have antivirus (AV) scanning and firewall enabled, you can create a new posture and use it as part of a corresponding access rule:

\n
\"postures\": {\r\n  \"posture:trusted\": [\\\r\n    \"huntress:defenderStatus == 'Healthy'\",\\\r\n    \"huntress:firewallStatus == 'Enabled'\",\\\r\n  ],\r\n},\r\n\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"autogroup:member\"],\\\r\n    \"dst\": [\"tag:production\"],\\\r\n    \"ip\": [\"*\"],\\\r\n    \"srcPosture\": [\"posture:trusted\"]\\\r\n  }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Schedule

\n

For each configured integration, Tailscale will aim to sync device posture\r\nattributes every 15 minutes, with a few exceptions:

\n\n

Audit log events

\n

The following audit log events are added for device posture.

\n

| Target | Action | Description |\r\n| --- | --- | --- |\r\n| Integration | Create posture integration | A new posture integration was created |\r\n| Integration | Update posture integration | A posture integration was updated |\r\n| Integration | Removed posture integration | A posture integration was removed |\r\n| Node | Update node attribute | Device posture attributes for a node were changed |

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}