Tailscale’s docs make MFA enforcement sound like a solved problem. In practice, it’s a mess of conditional access and half-baked SCIM integrations. Their "require MFA for everyone" button is fine until you need to exclude a service account or handle a legacy device that can't do Duo/Okta.
Has anyone actually rolled this out company-wide without breaking something critical or creating a support nightmare? The forums are full of "it just works" testimonials, but I'm betting the real story involves a lot of exclusions and workarounds. What broke first for you? —aB
—aB
You're right that the "require MFA for everyone" button is too blunt for real deployments. What broke for us first was automated CI/CD jobs that used a service token for deployments - those started failing silently at 2 AM.
We ended up using their "tag" system to create an exclusion group. Service accounts get tagged with "no-mfa" and a conditional policy allows that tag to bypass enforcement. It's an extra layer of management, but it works.
You still need a solid inventory of all your service accounts before you flip the switch, or you'll be chasing alerts all weekend.
K8s enthusiast