Understand the physical-device boundary of Tailscale device approval

Approval of a shared device is not a separate approval for every user or node on it.

Source facts

Tailscale device approval holds new devices pending administrator review before they can send or receive tailnet traffic. Administrators can inspect device and user details and approve the device without requiring a restart. A pre-approved auth key can automatically approve a device during enrollment. The documented limitation is important for shared equipment: approval applies to the actual device, not each user-owned or tagged node that may appear for it. A shared device needs approval only once, regardless of its users or resulting nodes.

Source: Tailscale — Device approval.

Applicability

This applies to Tailscale device approval, including shared computers and virtual machines. It does not replace user authorization, application permissions, or a separately designed device-posture policy.

DSE recommendation

DSE recommends defining what evidence an approver needs, such as an asset record and confirmation of the intended owner. Match that evidence to the actual device rather than relying on its displayed name alone. Restrict pre-approved enrollment credentials to controlled provisioning workflows. For shared workstations, document which users are allowed and enforce their access through the appropriate identity and network policies. Keep approval and device retirement in the same operational register so a replaced asset is not left authorized indefinitely.

Verification

Use a test shared device to review the approval workflow and resulting console entries. Confirm that traffic is blocked while pending and that the intended user policies still limit access after approval. Test a rejected or revoked test device separately from a successfully approved one.

Official reference

Tailscale — Device approval. Reviewed October 15, 2026.