Since April 2023 they support custom OIDC providers[1], and as of April 2024 that was extended to the free plan as well[2], so you can bring your own auth.

[1]: https://tailscale.com/kb/1240/sso-custom-oidc

[2]: https://tailscale.com/blog/sso-tax-cut