[red0point]

Doesn‘t tailscale force you to bring your own SSO / IdP already?

So it‘s not part of what Tailscale brings, it just adds another layer of indirection between the SSO / IdP you have already and the app, plus requires some custom library integration work, further enhancing lock-in.