fwiw, those on the Enterprise plan can bring their own IdP :) https://tailscale.com/kb/1119/sso-saml-oidc/