Comment by stryan

You can't do just an email address, but if you're running your own domain you can do your own OIDC with it. My tailnet auths against my self-hosted KanIDM server.