⚠️ Tailscale Premium (CCF)
⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | TailscalePremiumCCF |
| Publisher | Community |
| Used in Solutions | Tailscale (CCF) |
| Collection Method | CCF |
| Connector Definition Files | TailscalePremium_ConnectorDefinition.json |
| DCR Definition Files | TailscalePremium_DCR.json |
| CCF Configuration | TailscalePremium_PollerConfig.json |
| CCF Capabilities | OAuth2 |
Comprehensive Tailscale telemetry for Premium and Enterprise tier tailnets. Polls every endpoint the Standard connector polls, plus Premium-only network flow logs and posture-integration inventory. Eleven endpoints in one Connect:
/logging/configuration- configuration audit events/logging/network- Premium network flow logs (per-node traffic with src/dst/protocol/bytes)/devices- device inventory/users- user inventory/keys?all=true- auth keys + API tokens + OAuth clients/webhooks- webhook configuration/dns/nameservers,/dns/preferences,/dns/searchpaths- DNS state (merged into singleTailscale_Dns_CLtable withConfigTypediscriminator)/settings- tailnet settings flags/posture/integrations- Premium MDM/EDR integration inventory (Jamf, Kandji, Intune, Kolide, Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne, etc.)
OAuth scopes required: logs:configuration:read, logs:network:read, devices:core:read, users:read, auth_keys:read, webhooks:read, dns:read, feature_settings:read (or the bundled all:read).
If your tailnet is Personal (Free) or Standard tier, install Tailscale Standard (CCF) instead - this Premium connector's network and posture pollers will return 403 on lower tiers.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
Tailscale_Audit_CL |
? | ✓ | ? |
Tailscale_Devices_CL |
? | ✓ | ? |
Tailscale_Dns_CL |
? | ✓ | ? |
Tailscale_Keys_CL |
? | ✓ | ? |
Tailscale_Network_CL |
? | ✓ | ? |
Tailscale_PostureIntegrations_CL |
? | ✓ | ? |
Tailscale_Settings_CL |
? | ✓ | ? |
Tailscale_Users_CL |
? | ✓ | ? |
Tailscale_Webhooks_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read/Write on the workspace
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect Tailscale (Premium)
Generate an OAuth client at https://login.tailscale.com/admin/settings/oauth with these Read scopes: Logs > Configuration, Logs > Network (Premium), General > DNS, General > Users, Devices > Core, Keys > Auth Keys, Keys > Webhooks, Settings > Feature Settings (or tick all:read). Find your tailnet name on the Keys page.
- Tailscale tailnet: tail-XXXX.ts.net
- OAuth Client ID: k...
- OAuth Client Secret: (password field)
- Click 'Connect' to establish connection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊