{"slug":"setting-up-google-to-work-with-tailscale","title":"Setting up Google to work with Tailscale","tags":["tailscale","auth"],"agent_summary":"Last validated: Nov 12, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Setting up Google to work with Tailscale\r\n\r\nLast validated: Nov 12, 2025\r\n\r\n**You should be able to use your Google identity to log into Tailscale without additional configuration.**\r\n\r\nTo use Google as your identity provider with Tailscale, select **Sign up with Google** when [signing up for your Tailscale account](https://login.tailscale.com/start).\r\n\r\n![Select Google when signing up to Tailscale](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsign-up-google.521af295.png&w=1080&q=75)\r\n\r\n## [Allowlist Tailscale as a third-party app](https://tailscale.com/docs/integrations/identity/google-sso\\#allowlist-tailscale-as-a-third-party-app)\r\n\r\nIn some cases, your domain administrator may have [restricted third-party apps from being added to your domain without approval](https://support.google.com/a/answer/7281227). If you try to log in to Tailscale with Google, and you get the error message `Error 400: admin_policy_enforced`, Tailscale is blocked in your domain.\r\n\r\nIf you are the Google Workspace admin for your domain, allowlist Tailscale following [Google's instructions to manage access to apps](https://support.google.com/a/answer/7281227#zippy=%2Cmanage-access-to-google-services-restricted-or-unrestricted%2Cmanage-access-to-apps-trusted-limited-or-blocked):\r\n\r\n1. Log in to the [Google Admin console](https://admin.google.com/).\r\n2. From the Home page, go to **Security > API controls**.\r\n3. Under **App access control**, select **Manage third-party app access**.\r\n4. Search to find the Tailscale app in the list. Select **Add a filter** and enter \"Tailscale\" in the **App name** field, and select **Apply**.\r\n   - The Tailscale app's `client_id` is `674241127656-lmq9su4p8ni1tcpuh6eqidoornqtvmvi.apps.googleusercontent.com`\r\n   - The Tailscale app's `client_id` for Google group syncing is `923467998409-avhhsu3j9043drh8s798htd48jo27ki8.apps.googleusercontent.com`. This is only needed if you use System for Cross-domain Identity Management (SCIM) to sync Google Groups with Tailscale.\r\n   - The Tailscale Android authenticator's `client_id` is `744055068597-ppu003h5o04mln2dlou55msf9t4mup3c.apps.googleusercontent.com`\r\n5. Check the box for Tailscale and select **Change access**.\r\n6. Choose the **Limited** or **Trusted** option to allow access.\r\n7. Select **Change**.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Setting up Google to work with Tailscale</h1>\n<p>Last validated: Nov 12, 2025</p>\n<p><strong>You should be able to use your Google identity to log into Tailscale without additional configuration.</strong></p>\n<p>To use Google as your identity provider with Tailscale, select <strong>Sign up with Google</strong> when <a href=\"https://login.tailscale.com/start\">signing up for your Tailscale account</a>.</p>\n<p><img src=\"https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fsign-up-google.521af295.png&#x26;w=1080&#x26;q=75\" alt=\"Select Google when signing up to Tailscale\"></p>\n<h2><a href=\"https://tailscale.com/docs/integrations/identity/google-sso#allowlist-tailscale-as-a-third-party-app\">Allowlist Tailscale as a third-party app</a></h2>\n<p>In some cases, your domain administrator may have <a href=\"https://support.google.com/a/answer/7281227\">restricted third-party apps from being added to your domain without approval</a>. If you try to log in to Tailscale with Google, and you get the error message <code>Error 400: admin_policy_enforced</code>, Tailscale is blocked in your domain.</p>\n<p>If you are the Google Workspace admin for your domain, allowlist Tailscale following <a href=\"https://support.google.com/a/answer/7281227#zippy=%2Cmanage-access-to-google-services-restricted-or-unrestricted%2Cmanage-access-to-apps-trusted-limited-or-blocked\">Google's instructions to manage access to apps</a>:</p>\n<ol>\n<li>Log in to the <a href=\"https://admin.google.com/\">Google Admin console</a>.</li>\n<li>From the Home page, go to <strong>Security > API controls</strong>.</li>\n<li>Under <strong>App access control</strong>, select <strong>Manage third-party app access</strong>.</li>\n<li>Search to find the Tailscale app in the list. Select <strong>Add a filter</strong> and enter \"Tailscale\" in the <strong>App name</strong> field, and select <strong>Apply</strong>.\n<ul>\n<li>The Tailscale app's <code>client_id</code> is <code>674241127656-lmq9su4p8ni1tcpuh6eqidoornqtvmvi.apps.googleusercontent.com</code></li>\n<li>The Tailscale app's <code>client_id</code> for Google group syncing is <code>923467998409-avhhsu3j9043drh8s798htd48jo27ki8.apps.googleusercontent.com</code>. This is only needed if you use System for Cross-domain Identity Management (SCIM) to sync Google Groups with Tailscale.</li>\n<li>The Tailscale Android authenticator's <code>client_id</code> is <code>744055068597-ppu003h5o04mln2dlou55msf9t4mup3c.apps.googleusercontent.com</code></li>\n</ul>\n</li>\n<li>Check the box for Tailscale and select <strong>Change access</strong>.</li>\n<li>Choose the <strong>Limited</strong> or <strong>Trusted</strong> option to allow access.</li>\n<li>Select <strong>Change</strong>.</li>\n</ol>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}