![\"Project](\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\")
Last validated: Jan 5, 2026
\nTailscale works on top of the identity provider (IdP) or single sign-on (SSO) provider that you already use.
\nWhen you activate your domain name with Tailscale for the first time, you must choose which identity provider you want to use.
\nYou need to be an Owner of a tailnet to set up an identity provider.
\nTailscale natively supports the following identity providers:
\nIn addition to the natively supported identity providers, Tailscale also lets you authenticate with custom OpenID Connect (OIDC) providers. For the list of custom identity providers that Tailscale has successfully tested, refer to Additional provider configurations.
\nTailscale supports the use of passkey authentication for any tailnet that you are authorized to join.
\nTailscale does not support sign-up with email addresses. By design, Tailscale is not an identity provider—there are no Tailscale passwords.
\nIdentity providers build robust infrastructure to handle identity and authentication, which are core and complex aspects of security. Tailscale delegates user authentication to identity providers because of their expertise, which lets Tailscale focus on areas like secure networking.
\nUsing an identity provider is not only more secure than email and password, but it lets us automatically rotate connection encryption keys, follow security policies set by your team such as multifactor authentication (MFA), and more.
\nFor more information about why Tailscale is not an identity provider, refer to the Tailscale doesn't want your password and SSO tax, cut blog posts.
\nTailscale supports two-factor and multifactor authentication.
\nTailscale does not handle authentication itself. Instead, you can enable MFA features in your single sign-on identity provider, and they will apply to all your apps, including Tailscale.
\nYou need to be an Owner, Admin, or IT admin of a tailnet to change the identity provider configuration.
\nIf you need to change identity providers, contact support.
\nUnfortunately, we cannot migrate your tailnet from/to GitHub or Apple as an identity provider.
\nTailscale uses OpenID Connect (OIDC) for authentication.
\nTailscale requests the minimum access needed to function. When authenticating to Tailscale, you must share information about users' emails and their name. Some providers also share a user photo; in this case, Tailscale stores the photo URL but not the photo itself.
\nTailscale only uses your organization's team membership to ensure users can join the tailnet for their organization. With the GitHub identity provider, Tailscale requests the minimum set of permissions needed to get team membership, which includes access to your repositories and project boards. Tailscale does not use any content in your repositories or project boards.
\nTailscale requests the minimum number scopes required to operate, and the information on how we use your data can be found in our privacy policy.
\nAsk AI
\nreCAPTCHA
\nRecaptcha requires verification.
\nprotected by reCAPTCHA
\n"}