Automated Tailscale User Access Reviews
Every Monday, WebRun opens Tailscale, lists every user with their role, last seen date, devices, and any invite still pending, writes the full access review into Notion, and texts you the short list of accounts that should probably be closed.
How do I review who still has access to my Tailscale tailnet?
WebRun runs your tailnet access review every Monday. It opens Tailscale, captures every user with their role, last seen date, devices, and pending invites, writes the review into Notion, then texts you through Twilio the accounts that look like leavers, so nobody keeps access after their last day.
- Leavers are caught the Monday after their last day, not at the next audit
- Every user, role, and device count sits in one Notion review
- Pending invites older than a week get chased instead of lingering
Built for IT admins · security teams · startups · remote-first companies
What does WebRun do on every run?
The exact actions WebRun takes, in order - in plain language, so you can adjust anything.
-
WebRun signs in and gets to work
Opens
login.tailscale.comin a real browser with your saved login - no setup, no API keys. -
1
Tailscale - review users, roles and invites
tailscale.com
WebRun opens Tailscale to review users, roles and invites. - Open Tailscale and go to the users list for your tailnet
- Capture each user with their role, last seen date, and how many devices they own
- List every invite still pending and how long it has been outstanding
- Flag users with no activity since your review window and any account that no longer matches your staff list
- Never remove a user or revoke a device. WebRun only reads and reports
Done when Every tailnet user, role, device count, and pending invite is captured.
-
2
Notion - log the weekly access review
notion.so
WebRun opens Notion to log the weekly access review. - Open your access review page in Notion and add this week's entry
- Write the full user table with role, last seen, devices, and invite status
- Split it into joiners since the last review and accounts that look like leavers
- Carry over anything you marked for follow-up last week that is still open
Done when This week's access review is written into Notion with joiners and leavers separated.
-
3
Twilio - text you the accounts to close
twilio.com
WebRun opens Twilio to text you the accounts to close. - Send a short text to your own IT number with the count of users to review
- Name the accounts flagged as leavers and any invite older than a week
- Link back to the Notion review page for the full table
- Keep the text internal. WebRun never messages the flagged user
Done when You have this week's leavers list on your phone with a link to the full review.
How is each run configured?
Secure by default
Connect once, stays signed in
WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.
Every action is checked against this policy before it runs.
Questions, answered
Will it remove people from my tailnet?
No. WebRun only reads the Tailscale users list and reports. Removing a user, revoking a device, or cancelling an invite stays a manual click you make after reading the review.
How does it know who has left?
It flags accounts by last seen date, pending invites that were never accepted, and anyone who no longer appears on the staff list you point it at. You make the final call on each one.
Who gets the text?
Only your own IT number through Twilio. The flagged user is never contacted, and the full review sits in Notion for whoever runs your access reviews.
Related templates
Put this on autopilot.
Turn it on in minutes - or have our team set it up for you.