Tailscale (MAS)
io.tailscale.ipn.macos
Configure settings for the Mac App Store variant of the Tailscale client.
macOS
Configuration Keys (41)
Showing 41 of 41 keys
| Key | Type | Description | Default | Range |
|---|---|---|---|---|
PFC_SegmentedControl_0stringrequired | string | — | Default: — | Range: — |
Organization Details: Name | string | Specifies the name of the organization managing Tailscale, for instance “XYZ Corp, Inc.”. The value will be displayed in the Tailscale client, so that users can easily reach your internal support resources. | Default: — | Range: — |
ManagedByCaptionstringOrganization Details: Caption | string | Specifies a caption to be displayed in the Managed By view in the Tailscale client. Use this string value to provide your users with information on how to reach support resources for Tailscale in your organization. | Default: — | Range: — |
ManagedByURLstringOrganization Details: Support URL | string | Specifies a URL pointing to a help desk webpage, or other helpful resources for users in the organization. Clicking the Support button in the Tailscale UI will open this webpage. | Default: — | Range: — |
TailscaleStartOnLoginbooleanAutomatically start Tailscale when the user logs in | boolean | The first time the application is opened on a Mac, Tailscale installs a macOS login helper. This allows Tailscale to start automatically when the user logs into their account. This boolean controls whether the login helper should start Tailscale at login time. | Default: — | Range: — |
AlwaysOn.EnabledbooleanKeep Tailscale always connected | boolean | Prevents users from disconnecting from the tailnet or exiting the client. When this policy is enabled, you can also enable AlwaysOn.OverrideWithReason to require a reason for disconnecting, and ReconnectAfter to set how long the client can stay disconnected. | Default: false | Range: — |
AlwaysOn.OverrideWithReasonbooleanRequire a reason for disconnection | boolean | Requires users to submit a reason when disconnecting the Tailscale client. User-provided reasons display in the Configuration logs page of the admin console. On macOS, a user can provide a reason in the client UI dialog or with the CLI command tailscale down --reason "DNS issues". | Default: false | Range: — |
ReconnectAfterstringReconnection timer | string | Sets how long the client can remain disconnected from the tailnet before automatically reconnecting. Use a Go-style duration string, for example 24h or 5h25m30s. An empty string or a zero duration disables automatic reconnection. Can be used with or without AlwaysOn.Enabled. | Default: — | Range: — |
ForceEnabledbooleanForce Tailscale to always be running | boolean | When set to true, this boolean instructs Tailscale to always be connected and actively monitor the tunnel state for disconnections. The Disconnect toggle will be disabled, to prevent users from disabling the VPN themselves. An attempt to disconnect will present a banner informing the user the organization’s policy prevents Tailscale from being disconnected. If the client detects the VPN tunnel is down because the Tailscale VPN process was terminated, Tailscale will automatically restart it and reconnect. You might want to use this policy together with an always-on VPN configuration profile. | Default: false | Range: — |
HideDHCP121WarningsbooleanSuppress DHCP Option 121 warnings | boolean | By default, Tailscale v1.68 and later detect when DHCP Option 121 is being used, and the client will display a warning to the user in the UI when usage of this option is detected. You may set the HideDHCP121Warnings system policy to true to hide such warnings if you have a legitimate need to use Option 121. | Default: false | Range: — |
TailnetstringSuggested or required tailnet name | string | Specifies one or more tailnets to suggest or require during device registration. Set to a comma-separated list of tailnet IDs or organization IDs such as T123456CNTRL,o123456CNTRL. Prefix the value with required: to require one of those values and disallow registration in any other tailnet. | Default: — | Range: — |
LoginURLstringCustom control server URL | string | The LoginURL policy can be used to specify a custom control server URL. This should not be changed unless you are not using the standard Tailscale server. Use this policy if you’re deploying your own server, such as Headscale. | Default: — | Range: — |
AuthKeystringAuth key | string | Specifies an auth key used to authenticate managed devices without user interaction. Clients automatically try to use the auth key when launched unless already logged in. Use a one-off auth key tagged for the device, with access control policies that grant only necessary access. | Default: — | Range: — |
AuthBrowser.macosstringCustom browser for authentication | string | Controls the browser used to open authentication URLs. Set this to the bundle identifier of the preferred browser. If the specified bundle is not present, the user's default system browser is used. | Default: — | Range: — |
ExitNodeIDstringForced Exit Node ID | string | Forces the Tailscale client to always use the given exit node. This can be useful if you wish to route all Internet traffic through a node for inspection or logging purposes. Users won't be able to disable or choose another exit node when this policy is active unless ExitNode.AllowOverride is also enabled. The value should be the ID of an exit node device, or auto:any to require any regionally-routed exit node. You can optionally restrict permitted nodes with AllowedSuggestedExitNodes. If a forced exit node goes offline, Internet connectivity will be unavailable until it returns. | Default: — | Range: — |
ExitNode.AllowOverridebooleanAllow a different exit node when forced | boolean | Lets users select a different exit node when ExitNodeID is set to auto:any, which requires the use of an exit node. It does not allow disabling exit node usage entirely. | Default: false | Range: — |
Allowed suggested exit nodes | array | Controls which exit nodes are recommended in the Tailscale client and through tailscale exit-node suggest. When ExitNodeID is set to auto:any, this list specifies the allowed regionally-routed exit nodes. If unset, all exit nodes are allowed. If set but empty, no exit nodes are allowed. Other exit nodes not specified by this policy can still be used, but they will not be recommended. | Default: — | Range: — |
| string | The ID of an exit node device. You can find device IDs on the Machines page of the admin console or by using the Tailscale API. | Default: — | Range: — | |
AdvertiseExitNodestringAdvertise as exit node | string | Controls whether the device advertises itself as an exit node for use by other users and their devices. | Default: "user-decides" | Range: Always (always), Never (never), User Decides (user-decides) |
KeyExpirationNoticestringKey Expiration Notice Interval | string | The KeyExpirationNotice policy controls how long before key expiry should a notice be displayed. The default is 24 hours ("24h"). Use a Go-style Duration for this policy value, for instance "24h" or "5h25m30s". | Default: "24h" | Range: — |
ExitNodeAllowLANAccessstringAllow Local Network Access when an exit node is in use | string | Allow Local Network Access determines whether users can still access devices on the local network while using an exit node. | Default: "user-decides" | Range: Always (always), Never (never), User Decides (user-decides) |
UseTailscaleSubnetsstringUse Tailscale Subnets | string | Determines whether the client accepts subnets advertised by other nodes in your tailnet. | Default: "user-decides" | Range: Always (always), Never (never), User Decides (user-decides) |
HostnamestringSet whether device hostnames can be modified | string | The Hostname policy allows IT administrators to override the hostname configured in the operating system and reported to the coordination server. This can be particularly useful on mobile devices, where the hostname provided by the operating system usually only contains the device's manufacturer name and model. | Default: — | Range: — |
UseTailscaleDNSSettingsstringUse Tailscale DNS Settings | string | Determines whether to apply the DNS configuration provided by the coordination server when the tunnel is connected. | Default: "user-decides" | Range: Always (always), Never (never), User Decides (user-decides) |
AllowIncomingConnectionsstringAllow incoming connections | string | Determines whether Tailscale should allow incoming connections to the device. | Default: "user-decides" | Range: Always (always), Never (never), User Decides (user-decides) |
PostureCheckingstringGather device posture data | string | Enables gathering of device posture data. | Default: "user-decides" | Range: Always (always), Never (never), User Decides (user-decides) |
ExitNodesPickerstringShow/hide exit nodes picker | string | Shows or hides all UI items to choose an exit node in the Tailscale client. | Default: "show" | Range: Show (show), Hide (hide) |
ManageTailnetLockstringShow/hide tailnet lock settings | string | Shows or hides the "Manage Tailnet lock" menu item. | Default: "show" | Range: Show (show), Hide (hide) |
ResetToDefaultsstringShow/hide the "Reset to Defaults" menu item | string | Shows or hides the "Reset to Defaults" menu item. | Default: "show" | Range: Show (show), Hide (hide) |
RunExitNodestringShow/hide "Run as Exit Node" menu item | string | Shows or hides the "Run as Exit Node" menu item, controlling the user's ability to toggle this option. | Default: "show" | Range: Show (show), Hide (hide) |
StartOnLoginMenuItemstringShow/hide "Start on Login" menu item | string | Shows or hides the "Start on Login" menu item, controlling the user's ability to toggle this option. | Default: "show" | Range: Show (show), Hide (hide) |
TestMenustringShow/hide Debug menu | string | Shows or hides the debug menu in the Tailscale client. On macOS, this system policy will also hide any information displayed when holding down the Option key while clicking on the Tailscale menubar item. | Default: "show" | Range: Show (show), Hide (hide) |
UpdateMenustringShow/hide "Update Available" menu item | string | Shows or hides the "Update Available" menu item which appears when a newer version of Tailscale is available. | Default: "show" | Range: Show (show), Hide (hide) |
HiddenNetworkDevicesarrayHide categories of network devices | array | Can be used to hide one or more categories of network devices normally displayed in the Tailscale client. Administrators can choose to hide: devices owned by the current user; devices owned by other users; tagged devices. If all three options are chosen, the "Network Devices" menu item disappears entirely and users aren’t able to see any device on the tailnet. | Default: — | Range: — |
| string | — | Default: — | Range: Devices belonging to the current user (current-user), Devices belonging to other users (other-users), Tagged devices (tagged-devices) | |
Suppress IP Address Copied notifications | boolean | When you use the Tailscale menu bar item to copy to the Clipboard the IP address of a device, a notification displaying the IP address is presented. Use this to suppress this Copied IP address to clipboard notification. | Default: false | Range: — |
AppIntroShownbooleanSuppress the app window intro flow | boolean | Set to true to suppress the "Welcome to the Tailscale app" modal window introduction that appears when you log in to Tailscale on a device for the first time. | Default: false | Range: — |
HideDockIconbooleanHide the macOS dock icon after all windows close | boolean | The Tailscale dock icon on macOS appears whenever an application window exists. By default, Tailscale leaves an icon in the dock to support quickly reopening the main application window. Set this to true to hide the dock icon after all windows close. | Default: false | Range: — |
CLIIntegrationstringHide the CLI integration installer | string | When set to hide, the user will not be able to install the CLI helper, and will instead be told to contact their administrator. | Default: "hide" | Range: Show (show), Hide (hide) |
OnboardingFlowstringShow/hide the first launch onboarding flow | string | Shows or hides the client onboarding flow that appears the first time Tailscale starts on a device. Hide it if end-users are already familiar with the product. On macOS, typically deploy a VPN configuration profile when hiding the onboarding flow. | Default: "show" | Range: Show (show), Hide (hide) |
TailscaleOnboardingSeenbooleanSuppress the first launch onboarding flow | boolean | When you start Tailscale on your Mac for the first time, an onboarding flow is presented. It explains the Tailscale privacy policy, and guides the user in setting up the VPN configuration on their Mac. You might want to disable this onboarding flow if you are going to automatically set up the VPN configuration on the system by using a configuration profile. In order to do so, this boolean suppresses the onboarding flow when Tailscale launches for the first time and the value is set to true. | Default: false | Range: — |
VPNOnDemandSettingsstringHide the VPN On Demand menu item | string | The VPNOnDemandSettings policy can be used to show or hide the VPN On Demand menu item. You might want to use this setting if you're deploying your own VPN configuration profile for Tailscale, and you don't want your users to interact with the on-demand VPN configuration you set up for them. | Default: "show" | Range: Show (show), Hide (hide) |
VPNOnDemandIsUserConfiguredbooleanVPN On Demand is user-configured | boolean | Instructs Tailscale not to modify the VPN On Demand configuration, so that MDM-deployed OnDemandRules remain in effect. Deploy this together with VPNOnDemandSettings set to hide when providing your own VPN On Demand rules. | Default: false | Range: — |