It very much needs an identity provider, only they implement it themselves instead of outsourcing it to Google/MS.

On Tailscale you also need to whitelist machines in the web console. There's probably an automated way to do it as well but I haven't looked into it since I only use it for a few static hosts.

I've migrated from ZT to TS about a year ago because ZT was much slower (network bandwidth-wise) and CPU-intensive than Tailscale on my setup. YMMV.