Comment by xyzzy_plugh

> they can't be part of our tailnet without buying them logins

I'm pretty sure you can use Cloud Identity Free accounts to do this. I've done something similar with OIDC and it didn't cost anything.