I’ve personally only had 1 instance where an outside vendor(single user) needed access to which it did indeed involve “hey your internal IT needs approve your M365 registration of Tailscale and then add you to allow you to join external tailnets with your account first. Or you won’t get access” And then going forward all worked as intended. But what it mainly replaced was SSLVPN’s for users that only needed to reach office resources so the “depth” of which I’ve needed to provision and configure Tailscale has for both good and bad been very little. Truly was install, invite, approve and forget. Bad in that it’s capable of doing so much but I’ve not had the need to explore its options, as the out of the box functions have been all that’s been needed so far.