Treat a Tailscale tag as a workload identity, not a label on an employee laptop

Tagging changes device identity and can keep a device present after its former user leaves.

Source facts

Tailscale documents tags as identities for non-user devices. Applying a tag replaces the device’s user-based identity; a device cannot hold both identities simultaneously. Removing a user does not remove a device managed through tags. A device with several tags receives the combination of their applicable access policies, rather than an intersection requiring every tag. Tags are defined through tagOwners, and designated owners can apply them. Tailscale explicitly advises against using tags to authenticate employee laptops or phones.

Source: Tailscale — Group devices with tags.

Applicability

This applies to Tailscale tag-based device identity and tailnet access policies. It does not describe inventory labels in a separate asset-management system or ordinary user-group membership.

DSE recommendation

DSE recommends identifying the service owner and intended communications before tagging a workload. Keep employee endpoints attached to their user identities. Review every assigned tag and each owner’s authority, including tags allowed to own other tags. Write a short permission table showing what each workload tag can reach and what can reach it. Treat adding another tag as an access change requiring review. Include tagged workloads in a separate retirement process so employee offboarding does not leave an unmanaged service device behind.

Verification

Use an approved test workload to compare effective access before and after tagging. Review both allowed and denied destinations. In a test offboarding exercise, confirm that the workload remains deliberately assigned to an accountable service owner rather than assuming user removal retires it.

Official reference

Tailscale — Group devices with tags. Reviewed October 15, 2026.