Devices
Device posture: make the initiating device part of the access decision.
A posture condition can restrict access based on the source device's operating system, Tailscale version or an external MDM/EDR attribute. Device approval separately prevents a device awaiting approval from sending or receiving tailnet traffic.
Separate controls
Registration, security state and key distribution are different decisions.
Device approval, available on all plans, determines whether a registered device can exchange tailnet traffic. Device posture evaluates attributes on the device initiating the connection. Tailnet Lock is an optional Personal- and Enterprise-plan control for customer-signed node-key distribution; it cannot be enabled together with device approval.
Important boundary
A posture match does not remediate a device or prove every endpoint control. Shared-node access also has distinct user and posture semantics, so sharing flows must be tested separately rather than assumed to inherit the same result.
Plan dependencies
The signal source determines the subscription requirement.
Default posture attributes are available on all plans. Third-party MDM/EDR attributes and geolocation require Standard, Premium or Enterprise; custom posture attributes require Premium or Enterprise.
Default attributes — all plans
- operating system and version
- Tailscale version and update state
- node and platform attributes
Integrated and custom signals
- MDM/EDR and geolocation: Standard or higher
- custom attributes: Premium or Enterprise
- source quality and stale-data handling
Lifecycle
- approval of a new device
- removal of ageing devices
- webhook and API automation
AIM model
Posture does not replace endpoint management.
Advice selects useful signals and failure behaviour. Integrate connects integrations and tests allowed, denied, missing and stale-attribute states. Manage monitors the lifecycle of conditions, integrations and devices as agreed.
