{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/tailscale-tags-replace-user-identity/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/",
        "slug": "tailscale-tags-replace-user-identity",
        "url": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/tailscale-tags-replace-user-identity/"
        },
        "title": "Treat a Tailscale tag as a workload identity, not a label on an employee laptop",
        "summary": "Tagging changes device identity and can keep a device present after its former user leaves.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "identity-cloud",
            "label": "Identity & cloud",
            "alt": "Governed cloud identity system with connected service and lifecycle nodes.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T13:33:13+00:00",
        "modified_at": "2026-10-15T13:36:16+00:00",
        "reviewed_on": "2026-10-15",
        "reading_minutes": 2,
        "word_count": 266,
        "potentially_affected": "This applies to Tailscale tag-based device identity and tailnet access policies. It does not describe inventory labels in a separate asset-management system or ordinary user-group membership.",
        "dse_recommendation": "DSE recommends identifying the service owner and intended communications before tagging a workload.",
        "primary_source": {
            "name": "Tailscale — Group devices with tags",
            "url": "https://tailscale.com/docs/features/tags",
            "published_on": null,
            "authority": "tailscale.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Tagging changes device identity and can keep a device present after its former user leaves.</p>\n<h2>Source facts</h2>\n<p>Tailscale documents tags as identities for non-user devices. Applying a tag replaces the device’s user-based identity; a device cannot hold both identities simultaneously. Removing a user does not remove a device managed through tags. A device with several tags receives the combination of their applicable access policies, rather than an intersection requiring every tag. Tags are defined through tagOwners, and designated owners can apply them. Tailscale explicitly advises against using tags to authenticate employee laptops or phones.</p>\n<p>Source: <a href=\"https://tailscale.com/docs/features/tags\">Tailscale — Group devices with tags</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to Tailscale tag-based device identity and tailnet access policies. It does not describe inventory labels in a separate asset-management system or ordinary user-group membership.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends identifying the service owner and intended communications before tagging a workload. Keep employee endpoints attached to their user identities. Review every assigned tag and each owner’s authority, including tags allowed to own other tags. Write a short permission table showing what each workload tag can reach and what can reach it. Treat adding another tag as an access change requiring review. Include tagged workloads in a separate retirement process so employee offboarding does not leave an unmanaged service device behind.</p>\n<h2>Verification</h2>\n<p>Use an approved test workload to compare effective access before and after tagging. Review both allowed and denied destinations. In a test offboarding exercise, confirm that the workload remains deliberately assigned to an accountable service owner rather than assuming user removal retires it.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://tailscale.com/docs/features/tags\">Tailscale — Group devices with tags</a>. Reviewed October 15, 2026.</p>",
        "content_text": "Tagging changes device identity and can keep a device present after its former user leaves.\nSource facts\nTailscale documents tags as identities for non-user devices. Applying a tag replaces the device’s user-based identity; a device cannot hold both identities simultaneously. Removing a user does not remove a device managed through tags. A device with several tags receives the combination of their applicable access policies, rather than an intersection requiring every tag. Tags are defined through tagOwners, and designated owners can apply them. Tailscale explicitly advises against using tags to authenticate employee laptops or phones.\nSource: Tailscale — Group devices with tags.\nApplicability\nThis applies to Tailscale tag-based device identity and tailnet access policies. It does not describe inventory labels in a separate asset-management system or ordinary user-group membership.\nDSE recommendation\nDSE recommends identifying the service owner and intended communications before tagging a workload. Keep employee endpoints attached to their user identities. Review every assigned tag and each owner’s authority, including tags allowed to own other tags. Write a short permission table showing what each workload tag can reach and what can reach it. Treat adding another tag as an access change requiring review. Include tagged workloads in a separate retirement process so employee offboarding does not leave an unmanaged service device behind.\nVerification\nUse an approved test workload to compare effective access before and after tagging. Review both allowed and denied destinations. In a test offboarding exercise, confirm that the workload remains deliberately assigned to an accountable service owner rather than assuming user removal retires it.\nOfficial reference\nTailscale — Group devices with tags. Reviewed October 15, 2026.",
        "content_markdown": "Tagging changes device identity and can keep a device present after its former user leaves.\n\n## Source facts\n\nTailscale documents tags as identities for non-user devices. Applying a tag replaces the device’s user-based identity; a device cannot hold both identities simultaneously. Removing a user does not remove a device managed through tags. A device with several tags receives the combination of their applicable access policies, rather than an intersection requiring every tag. Tags are defined through tagOwners, and designated owners can apply them. Tailscale explicitly advises against using tags to authenticate employee laptops or phones.\n\nSource: [Tailscale — Group devices with tags](https://tailscale.com/docs/features/tags).\n\n## Applicability\n\nThis applies to Tailscale tag-based device identity and tailnet access policies. It does not describe inventory labels in a separate asset-management system or ordinary user-group membership.\n\n## DSE recommendation\n\nDSE recommends identifying the service owner and intended communications before tagging a workload. Keep employee endpoints attached to their user identities. Review every assigned tag and each owner’s authority, including tags allowed to own other tags. Write a short permission table showing what each workload tag can reach and what can reach it. Treat adding another tag as an access change requiring review. Include tagged workloads in a separate retirement process so employee offboarding does not leave an unmanaged service device behind.\n\n## Verification\n\nUse an approved test workload to compare effective access before and after tagging. Review both allowed and denied destinations. In a test offboarding exercise, confirm that the workload remains deliberately assigned to an accountable service owner rather than assuming user removal retires it.\n\n## Official reference\n\n[Tailscale — Group devices with tags](https://tailscale.com/docs/features/tags). Reviewed October 15, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/",
                "url": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-15"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Treat a Tailscale tag as a workload identity, not a label on an employee laptop",
                        "item": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/#article",
                "identifier": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/",
                "url": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/",
                "headline": "Treat a Tailscale tag as a workload identity, not a label on an employee laptop",
                "description": "Tagging changes device identity and can keep a device present after its former user leaves.",
                "abstract": "Tagging changes device identity and can keep a device present after its former user leaves.",
                "articleBody": "Tagging changes device identity and can keep a device present after its former user leaves.\nSource facts\nTailscale documents tags as identities for non-user devices. Applying a tag replaces the device’s user-based identity; a device cannot hold both identities simultaneously. Removing a user does not remove a device managed through tags. A device with several tags receives the combination of their applicable access policies, rather than an intersection requiring every tag. Tags are defined through tagOwners, and designated owners can apply them. Tailscale explicitly advises against using tags to authenticate employee laptops or phones.\nSource: Tailscale — Group devices with tags.\nApplicability\nThis applies to Tailscale tag-based device identity and tailnet access policies. It does not describe inventory labels in a separate asset-management system or ordinary user-group membership.\nDSE recommendation\nDSE recommends identifying the service owner and intended communications before tagging a workload. Keep employee endpoints attached to their user identities. Review every assigned tag and each owner’s authority, including tags allowed to own other tags. Write a short permission table showing what each workload tag can reach and what can reach it. Treat adding another tag as an access change requiring review. Include tagged workloads in a separate retirement process so employee offboarding does not leave an unmanaged service device behind.\nVerification\nUse an approved test workload to compare effective access before and after tagging. Review both allowed and denied destinations. In a test offboarding exercise, confirm that the workload remains deliberately assigned to an accountable service owner rather than assuming user removal retires it.\nOfficial reference\nTailscale — Group devices with tags. Reviewed October 15, 2026.",
                "datePublished": "2026-10-15T13:33:13+00:00",
                "dateModified": "2026-10-15T13:36:16+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/tailscale-tags-replace-user-identity/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Treat a Tailscale tag as a workload identity, not a label on an employee laptop"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 266,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Tailscale — Group devices with tags",
                    "url": "https://tailscale.com/docs/features/tags"
                }
            }
        ]
    }
}