{"slug":"user-approval","title":"User approval","tags":["tailscale","access-control"],"agent_summary":"Last validated: Sep 25, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# User approval\r\n\r\nLast validated: Sep 25, 2025\r\n\r\nUser approval is a feature that lets Tailscale network administrators to review and approve new\r\nusers before they can join your Tailscale network (known as a tailnet).\r\n\r\nThis featureis available for [all plans](https://tailscale.com/pricing).\r\n\r\nWhen user approval is enabled, the first time a new user logs in to a tailnet, the user's status\r\nis set to pending. While in a pending state, the user can connect their device to the Tailscale\r\ncoordination server, but cannot connect to other devices in the tailnet. An\r\n[Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles) of the tailnet can review the user information and set the\r\nuser status to approved, or remove the user.\r\n\r\nFor tailnets created May 22, 2025 or later, user approval is enabled by default. For tailnets created prior to May 22, 2025, user approval was disabled by default.\r\n\r\n## [Enable user approval for your network](https://tailscale.com/docs/features/access-control/user-approval\\#enable-user-approval-for-your-network)\r\n\r\nYou need to be an [Owner, Admin, or Network admin](https://tailscale.com/docs/reference/user-roles)\r\nof a tailnet to enable user approval.\r\n\r\nTo enable user approval, open the [User management](https://login.tailscale.com/admin/settings/user-management) page of the admin console and enable **User Approval**.\r\n\r\nOnce this setting is enabled, new users that access your network cannot send or receive traffic\r\nto other devices until they are approved. When a new user logs in, the user's device appears in the\r\n[Machines](https://login.tailscale.com/admin/machines) page of the admin console with the **User needs approval** badge. You can\r\n[use a filter](https://login.tailscale.com/admin/machines/?q=disabled%3Auser-needs-approval) to find all machines that have the **User needs approval** badge.\r\n\r\n## [Approve a pending user](https://tailscale.com/docs/features/access-control/user-approval\\#approve-a-pending-user)\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles)\r\nof a tailnet to approve a user.\r\n\r\nTo approve a user, open the [Users](https://login.tailscale.com/admin/users) page of the admin console. At the top of the list you will\r\nfind the user with a **Needs approval** badge beneath them. You can find the user by user name, and also the [`status:pending`](https://login.tailscale.com/admin/users?q=status%3Apending) filter.\r\n\r\nYou can review details about the user before deciding whether to approve the user. You can also change the role to assign the\r\nuser. For example, an Admin could change an unapproved user's role from Member to IT admin, before approving the user.\r\n\r\nWhen you're ready to approve the user, select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu and select **Approve** to allow the user to\r\nconnect to your network.\r\n\r\nAfter approval, the user will immediately be able to connect.\r\n\r\n## [Remove a pending user](https://tailscale.com/docs/features/access-control/user-approval\\#remove-a-pending-user)\r\n\r\nYou need to be an [Owner, Admin, or IT admin](https://tailscale.com/docs/reference/user-roles)\r\nof a tailnet to remove a user whose status is pending.\r\n\r\nTo remove a user, open the [Users](https://login.tailscale.com/admin/users) page of the admin console. At the top of the list you will\r\nfind the user with a **Needs approval** badge beneath them. You can find the user by user name, and also the [`status:pending`](https://login.tailscale.com/admin/users?q=status%3Apending) filter.\r\n\r\nFor the user that your want to remove, select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu and select **Remove**.\r\n\r\nNote that removing a pending user does not prevent them from trying to log in (to a pending state)\r\nagain.\r\n\r\n## [Disable user approval for your network](https://tailscale.com/docs/features/access-control/user-approval\\#disable-user-approval-for-your-network)\r\n\r\nYou need to be an [Owner, Admin, or Network admin](https://tailscale.com/docs/reference/user-roles)\r\nof a tailnet to disable user approval.\r\n\r\nTo disable user approval, open the [User management](https://login.tailscale.com/admin/settings/user-management) page of the admin console and disable **User Approval**.\r\n\r\n## [Impact on other features](https://tailscale.com/docs/features/access-control/user-approval\\#impact-on-other-features)\r\n\r\nIf you enable [User & group provisioning](https://tailscale.com/docs/features/user-group-provisioning) for your tailnet, you cannot enable user\r\napproval because both cannot be enabled. If user approval is enabled, and then you enable User and\r\ngroup provisioning, the user approval feature will be disabled—you will need to manually\r\napprove or remove any pending users.\r\n\r\n## [Limitations](https://tailscale.com/docs/features/access-control/user-approval\\#limitations)\r\n\r\nA tailnet can enable either user approval or [User & group provisioning](https://tailscale.com/docs/features/user-group-provisioning), but not\r\nboth.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

User approval

\n

Last validated: Sep 25, 2025

\n

User approval is a feature that lets Tailscale network administrators to review and approve new\r\nusers before they can join your Tailscale network (known as a tailnet).

\n

This featureis available for all plans.

\n

When user approval is enabled, the first time a new user logs in to a tailnet, the user's status\r\nis set to pending. While in a pending state, the user can connect their device to the Tailscale\r\ncoordination server, but cannot connect to other devices in the tailnet. An\r\nOwner, Admin, or IT admin of the tailnet can review the user information and set the\r\nuser status to approved, or remove the user.

\n

For tailnets created May 22, 2025 or later, user approval is enabled by default. For tailnets created prior to May 22, 2025, user approval was disabled by default.

\n

Enable user approval for your network

\n

You need to be an Owner, Admin, or Network admin\r\nof a tailnet to enable user approval.

\n

To enable user approval, open the User management page of the admin console and enable User Approval.

\n

Once this setting is enabled, new users that access your network cannot send or receive traffic\r\nto other devices until they are approved. When a new user logs in, the user's device appears in the\r\nMachines page of the admin console with the User needs approval badge. You can\r\nuse a filter to find all machines that have the User needs approval badge.

\n

Approve a pending user

\n

You need to be an Owner, Admin, or IT admin\r\nof a tailnet to approve a user.

\n

To approve a user, open the Users page of the admin console. At the top of the list you will\r\nfind the user with a Needs approval badge beneath them. You can find the user by user name, and also the status:pending filter.

\n

You can review details about the user before deciding whether to approve the user. You can also change the role to assign the\r\nuser. For example, an Admin could change an unapproved user's role from Member to IT admin, before approving the user.

\n

When you're ready to approve the user, select the \"ellipsis menu and select Approve to allow the user to\r\nconnect to your network.

\n

After approval, the user will immediately be able to connect.

\n

Remove a pending user

\n

You need to be an Owner, Admin, or IT admin\r\nof a tailnet to remove a user whose status is pending.

\n

To remove a user, open the Users page of the admin console. At the top of the list you will\r\nfind the user with a Needs approval badge beneath them. You can find the user by user name, and also the status:pending filter.

\n

For the user that your want to remove, select the \"ellipsis menu and select Remove.

\n

Note that removing a pending user does not prevent them from trying to log in (to a pending state)\r\nagain.

\n

Disable user approval for your network

\n

You need to be an Owner, Admin, or Network admin\r\nof a tailnet to disable user approval.

\n

To disable user approval, open the User management page of the admin console and disable User Approval.

\n

Impact on other features

\n

If you enable User & group provisioning for your tailnet, you cannot enable user\r\napproval because both cannot be enabled. If user approval is enabled, and then you enable User and\r\ngroup provisioning, the user approval feature will be disabled—you will need to manually\r\napprove or remove any pending users.

\n

Limitations

\n

A tailnet can enable either user approval or User & group provisioning, but not\r\nboth.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}