What's new 
A managed Mac is blocking Tailscale with the error OSSystemExtensionErrorForbiddenBySystemPolicy. The device already has Hexnode policies associated successfully, but I do not see any existing Tailscale or System Extensions configuration in the applied macOS policy. What needs to be added in Hexnode to allow Tailscale?
25 Views
Replies (1)
Marked SolutionPending Review
Hexnode Expert
3 weeks ago
Sep 04, 2026
Marked SolutionPending Review
Hi @clauss,
This error usually appears when macOS detects that an app is trying to load a system extension that has not been pre-approved by MDM.
For Tailscale, add a System Extensions configuration to the macOS policy applied to the device:
- Go to Policies and open the macOS policy applied to the device.
- Click Manage > Modify.
- Navigate to macOS > Configurations > System Extensions.
- Click Configure.
- Under Team Identifiers, add Tailscale’s Developer Team ID:
64623E42YA
- Under System Extensions, add:
- Team ID:
64623E42YA - Bundle Identifier:
io.tailscale.ipn.macos.network-extension
- Team ID:
You can also leave the bundle identifier blank if you want to trust all system extensions from that developer team, but using the specific bundle identifier is more restrictive.
After saving the policy, Hexnode will deploy the updated configuration to devices associated with that policy. Once the policy association completes successfully, restart the Mac or relaunch Tailscale so the system extension can register.
Regards,
Sienna Carter
Hexnode UEM
Save