Tailscale device approval alerts in Slack

PromptCreate

Run this workflow from a Tailscale webhook. In the Tailscale admin console, create a webhook endpoint pointing at this workflow and subscribe it to the Tailnet Management events nodeNeedsApproval (a node needs approval) and nodeCreated (a node was created). Tailscale delivers these within a few seconds of the event occurring. A single delivery can contain more than one event, so treat the payload as a list and process every event in it.

For each event, read the device or node identifier out of the event payload and call the Tailscale Get a device operation to load the full device record. From that record pick up the device name, the owner (the user the device belongs to), the operating system, the tags applied to it, the addresses it was assigned, and the time it was created.

Post one message per event to a Slack security channel using the Slack Bot Send a Message operation. Format it so a reader can tell at a glance who is asking, from what machine, and when. Lead with whether this is a device waiting for approval or simply a new device that joined, then list the device name, the owner, the operating system, the tags, and the assigned addresses, and finish with the event timestamp. Use Slack mrkdwn formatting (single asterisks for bold) and keep the field labels consistent so the messages are easy to scan in a busy channel.

In the same run, append one row per event to a Google Sheets device approval log using the Append Values operation. The columns are the event timestamp, the device name, the owner, the operating system, the tags, and the event type (nodeNeedsApproval or nodeCreated). Append rather than overwrite, so the sheet builds a permanent history of every join request whether or not it was ever approved.

Build this as a code workflow: every step is deterministic, with one event in, one enrichment lookup, one fixed-format message, and one appended row. Note that device approval is an opt-in Tailscale setting. Tailnets with it enabled will see nodeNeedsApproval events for machines waiting in the queue, while tailnets without it will only ever see nodeCreated, which still gives useful visibility of every new machine joining the network. Make the workflow tolerant of a device lookup that fails or returns partial data: still post the alert and still write the log row using whatever the event payload itself provided, so a lookup error never causes a join request to go unrecorded.

What does this prompt do?

Fires the moment Tailscale reports a new machine joining or waiting for approval, so requests do not sit unseen in the admin console.
Looks up the full device record so the alert names the owner, the machine, its operating system, its tags, and the addresses it was given.
Posts a formatted message to your security channel showing who is asking, from what machine, and when.
Appends a row to a device approval log spreadsheet for every request, approved or not, so you keep a permanent audit trail.

What do I need to use this?

A Tailscale account with admin access to your network, so you can set up the notification and read device details.
A Slack workspace and a channel where security alerts should land.
A Google account and a spreadsheet to use as your device approval log.
Device approval turned on in Tailscale if you want alerts for machines waiting in the approval queue. Without it you still get an alert every time a new machine joins.

How can I customize it?

Choose which events you want: approval requests only, every new machine, or both.
Point the alert at a different channel, or a private one only your security team can see.
Add or remove columns in the log, for example the network addresses assigned to each device.

FAQs

Do I need device approval turned on in Tailscale for this to work?

No. Device approval is an optional Tailscale setting. If you have it switched on, you get an alert for every machine sitting in the approval queue waiting on a decision. If you do not, you still get an alert every time a new machine joins your network, which is useful visibility on its own.

How quickly will the alert reach Slack?

Tailscale sends these notifications within a few seconds of the event happening, so the message usually lands in your channel almost immediately after someone tries to add a machine.

If a request is denied or nobody ever acts on it, is it still logged?

Yes. A row is written to the spreadsheet for every join request as it arrives, independent of what happens next. That is the point of the log: you get a permanent record of everything that asked to join, not just the machines that made it onto the network.

Does this approve devices automatically?

No. It only notifies and records. Approving or denying a machine stays a human decision in the Tailscale admin console, which is what you want for an access control step.

Can I send the alerts to a private Slack channel?

Yes. You can point it at any channel your team uses, public or private, which is usually the right choice for security alerts that name people and machines.

Related templates

Build a credential rotation checklist when someone leaves

When someone leaves, we check which shared passwords they used in their final months and post a ranked rotation list to your security channel.

+1

Agentic Task

Weekly Amazon S3 bucket security audit posted to Slack

Every Monday, check every S3 bucket for public exposure, missing encryption and weak backup settings, then get the risks ranked in Slack.

Agentic Task

Log Agorapulse social conversations to HubSpot contacts

Twice every weekday, the conversations from your social inbox land on the right HubSpot contact timelines, with a Slack recap for sales.

Agentic Task

Turn procurement portal tenders into CRM deals each morning

Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.