{"slug":"setting-up-okta-to-work-with-tailscale","title":"Setting up Okta to work with Tailscale","tags":["tailscale"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Setting up Okta to work with Tailscale\r\n\r\nLast validated: Jan 5, 2026\r\n\r\nTo activate Okta for your domain, follow the instructions below.\r\n\r\n## [Contents](https://tailscale.com/docs/integrations/identity/okta\\#contents)\r\n\r\n- [Supported Features](https://tailscale.com/docs/integrations/identity/okta#features)\r\n- [Requirements](https://tailscale.com/docs/integrations/identity/okta#requirements)\r\n- [Configuration Steps](https://tailscale.com/docs/integrations/identity/okta#steps)\r\n- [Notes](https://tailscale.com/docs/integrations/identity/okta#notes)\r\n- [Okta Initiated Login](https://tailscale.com/docs/integrations/identity/okta#workaround)\r\n\r\n## [Supported Features](https://tailscale.com/docs/integrations/identity/okta\\#supported-features)\r\n\r\n- Single Sign-On (OpenID Connect) initiated by Okta\r\n\r\n## [Requirements](https://tailscale.com/docs/integrations/identity/okta\\#requirements)\r\n\r\n- Install the Tailscale app from the\r\n[Okta Integration Network](https://www.okta.com/integrations)\r\n\r\n## [Configuration Steps](https://tailscale.com/docs/integrations/identity/okta\\#configuration-steps)\r\n\r\nWe are actively working to make this process more automated. In the meantime,\r\nhere are the steps you'll need to take to enable your domain for Okta\r\nauthentication.\r\n\r\n1. On the Okta admin page, select the Tailscale application and select the\r\nSign On tab.\r\n1. Copy the values of Client ID and Client secret.\r\n2. Copy the issuer published in the OpenID Provider Metadata. Typically, this is the Okta URL. To find this URL, select **OpenID Provider Metadata**, look for a line that contains `\"issuer:\"`, and then copy the URL listed on that line (without the quotes). For example, it will look like `https://dev-123456.okta.com` or similar.\r\n2. Fill out the [Identity provider configuration or change](https://tailscale.com/contact/support?type=sso) section of the\r\nsupport form using the OpenID Connect details saved in the previous step. Note that the\r\ndomain name used to log into Tailscale should match the email addresses of\r\nusers assigned to this app\r\n\r\nIf this is the initial setup for your domain, after you submit this information, we will send you a custom link to\r\nfinish activation. This may take up to two business days.\r\n\r\nIn the meantime, give users and/or groups access to the Tailscale app:\r\n\r\n![Assign access to users and/or groups.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fokta-assignments.4a83939e.png&w=1920&q=75)\r\n\r\nNote that if you make changes to a domain already activated for Okta, or when you migrate an existing tailnet from\r\nanother identity provider to Okta, no custom link is sent—your activation finishes without requiring this step.\r\n\r\nIf your organization has defined\r\n[custom access policies](https://developer.okta.com/docs/guides/customize-authz-server/create-access-policies),\r\nverify that the Tailscale app is authorized for the `openid`, `email`,\r\nand `profile` [scopes](https://developer.okta.com/docs/guides/customize-authz-server/create-scopes).\r\n\r\n## [Notes](https://tailscale.com/docs/integrations/identity/okta\\#notes)\r\n\r\nAfter activation, check out our [getting started guide](https://tailscale.com/docs/how-to/quickstart).\r\n\r\nFor information about provisioning users and groups in Okta, refer to [User & group provisioning in Okta](https://tailscale.com/docs/integrations/identity/okta/okta-scim).\r\n\r\n## [Okta initiated login](https://tailscale.com/docs/integrations/identity/okta\\#okta-initiated-login)\r\n\r\nTailscale is currently not compatible with Identity Provider initiated login, and only provides service provider initiated\r\nlogin. This means users must start authentication from Tailscale's login page, rather than from inside their Okta instance.\r\nAs a workaround, users who are interested in initializing login from the Okta instance can create a Tailscale Login\r\nbookmark chiclet by following the below steps.\r\n\r\n1. Open the Tailscale App in Okta, select the **General** tab, then select **Edit**.\r\n2. Check **Do not display application icon to users** and save.\r\n3. Open the [Okta Integration Network](https://www.okta.com/integrations), search for **Bookmark App**, and select it. Choose **Add integration**.\r\n4. Fill out the application label name as **Tailscale Login**, and set `https://login.tailscale.com` as the URL.\r\n5. Leave the **Application Visibility** setting unchecked, and choose **Done**.\r\n6. Choose **Applications**, and assign the new bookmark app to Tailscale users.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Setting up Okta to work with Tailscale

\n

Last validated: Jan 5, 2026

\n

To activate Okta for your domain, follow the instructions below.

\n

Contents

\n\n

Supported Features

\n\n

Requirements

\n\n

Configuration Steps

\n

We are actively working to make this process more automated. In the meantime,\r\nhere are the steps you'll need to take to enable your domain for Okta\r\nauthentication.

\n
    \n
  1. On the Okta admin page, select the Tailscale application and select the\r\nSign On tab.
    2. \n
  2. Copy the values of Client ID and Client secret.
    3. \n
  3. Copy the issuer published in the OpenID Provider Metadata. Typically, this is the Okta URL. To find this URL, select OpenID Provider Metadata, look for a line that contains \"issuer:\", and then copy the URL listed on that line (without the quotes). For example, it will look like https://dev-123456.okta.com or similar.
    4. \n
  4. Fill out the Identity provider configuration or change section of the\r\nsupport form using the OpenID Connect details saved in the previous step. Note that the\r\ndomain name used to log into Tailscale should match the email addresses of\r\nusers assigned to this app
    5. \n
\n

If this is the initial setup for your domain, after you submit this information, we will send you a custom link to\r\nfinish activation. This may take up to two business days.

\n

In the meantime, give users and/or groups access to the Tailscale app:

\n

\"Assign

\n

Note that if you make changes to a domain already activated for Okta, or when you migrate an existing tailnet from\r\nanother identity provider to Okta, no custom link is sent—your activation finishes without requiring this step.

\n

If your organization has defined\r\ncustom access policies,\r\nverify that the Tailscale app is authorized for the openid, email,\r\nand profile scopes.

\n

Notes

\n

After activation, check out our getting started guide.

\n

For information about provisioning users and groups in Okta, refer to User & group provisioning in Okta.

\n

Okta initiated login

\n

Tailscale is currently not compatible with Identity Provider initiated login, and only provides service provider initiated\r\nlogin. This means users must start authentication from Tailscale's login page, rather than from inside their Okta instance.\r\nAs a workaround, users who are interested in initializing login from the Okta instance can create a Tailscale Login\r\nbookmark chiclet by following the below steps.

\n
    \n
  1. Open the Tailscale App in Okta, select the General tab, then select Edit.
    2. \n
  2. Check Do not display application icon to users and save.
    3. \n
  3. Open the Okta Integration Network, search for Bookmark App, and select it. Choose Add integration.
    4. \n
  4. Fill out the application label name as Tailscale Login, and set https://login.tailscale.com as the URL.
    5. \n
  5. Leave the Application Visibility setting unchecked, and choose Done.
    6. \n
  6. Choose Applications, and assign the new bookmark app to Tailscale users.
    7. \n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}