Docs v4.71.0 (#31200)
Documentation changes for 4.71.0 --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Ian Littman <iansltx@gmail.com>
This commit is contained in:
Rachael Shaw
co-authored by
Noah Talerman
Jordan Montgomery
Marko Lisica
Lucas Manuel Rodriguez
Ian Littman
Noah Talerman
Jordan Montgomery
Marko Lisica
Lucas Manuel Rodriguez
Ian Littman
parent
4fc07c7738
commit
0d8c099cf9
@@ -24,6 +24,25 @@ Fleet UI:
|
||||
|
||||
Fleet API: Use the [Add custom OS setting (configuration profile) endpoint](https://fleetdm.com/docs/rest-api/rest-api#add-custom-os-setting-configuration-profile) in the Fleet API.
|
||||
|
||||
#### User channel for configuration profiles on macOS
|
||||
|
||||
Before version 4.71.0, Fleet didn't support sending configuration profiles (`.mobileconfig`) to the macOS user channel (aka "Payload Scope" in iMazing Profile Creator). Profiles with `PayloadScope` set to `User` were delivered to the device channel by default. From Fleet 4.71.0 onward, both device and user channels are supported.
|
||||
|
||||
User-scoped profile is delivered to the user that turned on MDM on the host (installed fleetd or enrolled host via automatic enrollment (ADE)). Hosts enrolled before version 4.71.0, won't have user channel enabled. Currently, you can:
|
||||
1. Turn off MDM on manually enrolled Mac and ask end user to [turn on MDM](https://fleetdm.com/guides/mdm-migration#migrate-hosts:~:text=If%20the%20host%20is%20not%20assigned%20to%20Fleet%20in%20ABM%20(manual%20enrollment)%2C%20the%20end%20user%20will%20be%20given%20the%20option%20to%20download%20the%20MDM%20enrollment%20profile%20on%20their%20My%20device%20page.) through the **My device** page.
|
||||
2. Run `sudo profiles renew -type enrollment` on automatically enrolled Mac.
|
||||
|
||||
> Fleet will soon improve this and automatically enable the user channel for all macOS hosts. Check out the [issue](https://github.com/fleetdm/fleet/issues/30043).
|
||||
|
||||
Support for declaration (DDM) profiles is coming soon.
|
||||
|
||||
Existing profiles with `PayloadScope` set to`User` won’t update automatically. These are delivered to the device channel and will remain there until you take action.
|
||||
|
||||
To avoid confusion, please follow these steps:
|
||||
- Check for profiles with `PayloadScope` set to `User`.
|
||||
- To keep delivering them to the device channel, change `PayloadScope` to `System` to reflect the actual scope in your `.mobileconfig`. Also, you can remove `PayloadScope` as the default scope in Fleet is `System`.
|
||||
- To deliver to the user channel, update the identifier(`PayloadIdentifier`) and re-upload the profile.
|
||||
|
||||
### See status
|
||||
|
||||
In the Fleet UI, head to the **Controls > OS settings** tab.
|
||||
@@ -55,6 +74,26 @@ For configuration profiles the default **PayloadScope** is **System**. You must
|
||||
|
||||
Finally, only **.mobileconfig** configuration profiles are supported for the user channel. Support for declaration (DDM) profiles is coming soon.
|
||||
|
||||
On Windows, due to limitations of the MDM protocol, verification of [Win32 and Desktop Bridge app ADMX
|
||||
policy](https://learn.microsoft.com/en-us/windows/client-management/win32-and-centennial-app-policy-configuration)
|
||||
CSPs are limited. Fleet only verifies that the host returned a success status code in response to the MDM
|
||||
command to install the configuration profile. You can query the registry keys defined by the ADMX
|
||||
policy. For instance, if an ADMX file defines the following policy:
|
||||
```
|
||||
<policy name="Subteam" class="Machine" displayName="Subteam" key="Software\Policies\employee\Attributes" explainText="Subteam" presentation="String">
|
||||
<parentCategory ref="DefaultCategory" />
|
||||
<supportedOn ref="SUPPORTED_WIN10" />
|
||||
<elements>
|
||||
<text id="Subteam" valueName="Subteam" />
|
||||
</elements>
|
||||
</policy>
|
||||
```
|
||||
|
||||
The following osquery query will return any values set by this policy:
|
||||
```
|
||||
SELECT data FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\Software\Policies\employee\Attributes\Subteam';
|
||||
```
|
||||
|
||||
<meta name="category" value="guides">
|
||||
<meta name="authorGitHubUsername" value="noahtalerman">
|
||||
<meta name="authorFullName" value="Noah Talerman">
|
||||
|
||||
@@ -79,7 +79,7 @@ Fleet:
|
||||
|
||||
- verifies, installs, uninstalls & tests all Fleet-maintained apps alongside the install and uninstall scripts we generate
|
||||
- transforms data from multiple sources, including [Homebrew Casks](https://github.com/Homebrew/homebrew-cask) and [WinGet manifests](https://github.com/microsoft/winget-pkgs/tree/master/manifests), into [standardized manifests](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/), checking data sources [multiple times per day](https://github.com/fleetdm/fleet/blob/main/.github/workflows/ingest-maintained-apps.yml)
|
||||
- fetches the [full maintained apps list](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/apps.json) from GitHub daily (or when you run `fleetctl trigger --name=maintained_apps`)
|
||||
- fetches the [full maintained apps list](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/apps.json) from GitHub hourly (or when you run `fleetctl trigger --name=maintained_apps`; interval was daily prior to Fleet 4.71.0)
|
||||
- fetches an individual app's manifest when the **Add** button is pressed from the maintained apps list in the UI, and when an individual app is [retrieved](https://fleetdm.com/docs/rest-api/rest-api#get-fleet-maintained-app) or [added](https://fleetdm.com/docs/rest-api/rest-api#add-fleet-maintained-app) via the REST API
|
||||
- DOES NOT directly pull data from WinGet or Homebrew to end-user devices
|
||||
|
||||
|
||||
@@ -4,6 +4,8 @@
|
||||
|
||||
_Available in Fleet Premium._
|
||||
|
||||
To add IdP host vitals, like the end user's groups, department, and full name, follow steps for your IdP.
|
||||
|
||||
Fleet currently gathers your end user's IdP username when [end users log in](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication) during the automatic enrollment (DEP) setup process.
|
||||
|
||||
By connecting Fleet to your IdP to sync user data, you can add additional information, like the end user's groups and full name to your host data in Fleet. This allows you to leverage IdP information as variables in macOS configuration profiles to, for example, [deploy a WiFi certificate](https://fleetdm.com/guides/connect-end-user-to-wifi-with-certificate#step-4-add-pkcs-12-configuration-profile-to-fleet).
|
||||
@@ -42,10 +44,9 @@ To map users from Okta to hosts in Fleet, we'll do the following steps:
|
||||
8. In Fleet, head to **Settings > Integrations > Identity provider (IdP)** and verify that Fleet successfully received the request from IdP.
|
||||
9. Back in Okta, select **Save**.
|
||||
10. Under the **Provisioning** tab, select **To App** and then select **Edit** in the **Provisioning to App** section. Enable **Create Users**, **Update User Attributes**, **Deactivate Users**, and then select **Save**.
|
||||
11. On the same page, make sure that `givenName` and `familyName` have Okta value assigned to it. Currently, Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Delete the rest of the attributes.
|
||||
11. On the same page, make sure that `givenName` and `familyName` have Okta value assigned to it. Currently, Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Fleet also supports the `department` attribute (optional). Delete the rest of the attributes.
|
||||
|
||||
|
||||
|
||||
#### Step 3: Map users and groups to hosts in Fleet
|
||||
|
||||
To send users and groups information to Fleet, you have to assign them to your new SCIM app.
|
||||
@@ -85,15 +86,13 @@ To map users from Entra ID to hosts in Fleet, we'll do the following steps:
|
||||
#### Step 3: Map users and groups to hosts in Fleet
|
||||
|
||||
1. From the side menu, select **Attribute mapping** and then select **Provision Microsoft Entra ID Groups**.
|
||||
2. Ensure that the attributes `displayName`, `members`, and `externalId` are mapped to **Microsoft Entra ID Attribute**. Currently, Fleet support only these attributes and they are required as well. Delete the rest of the attributes, select **Save**, and after it's
|
||||
saved, select close icon on the top right corner.
|
||||
|
||||
3. Select **Provision Microsoft Entra ID Users**.
|
||||
4. Ensure that the attributes `userName`, `givenName`, `familyName`, `active`, and `externalId` are mapped to **Microsoft Entra ID Attribute**. Currently, Fleet requires the `userName` `givenName`, and `familyName` SCIM attributes. Delete the rest of the attributes. Then, elect **Save** and select the close icon in the top right corner.
|
||||
2. Select **Provision Microsoft Entra ID Users**.
|
||||
3. Ensure that the attributes `userName`, `givenName`, `familyName`, `department`, `active`, and `externalId` are mapped to **Microsoft Entra ID Attribute**. Currently, Fleet requires the `userName` `givenName`, and `familyName` SCIM attributes. Delete the rest of the attributes. Then, elect **Save** and select the close icon in the top right corner.
|
||||
|
||||
5. Next, from the side menu, select **Users and groups** , **+ Add user/group**, and **None Selected**.
|
||||
6. Select the users and groups that you want to map to hosts in Fleet and then select **Assign**.
|
||||
7. From the side menu, select **Overview** and select **Start provisioning**.
|
||||
4. Next, from the side menu, select **Users and groups** , **+ Add user/group**, and **None Selected**.
|
||||
5. Select the users and groups that you want to map to hosts in Fleet and then select **Assign**.
|
||||
6. From the side menu, select **Overview** and select **Start provisioning**.
|
||||
|
||||
It might take up to 40 minutes until Microsoft Entra ID sends data to Fleet. To speed this up, you can use the "Provision on demand" option in Microsoft Entra ID.
|
||||
|
||||
@@ -251,7 +250,7 @@ To map users from Google Workspace to hosts in Fleet, we'll do the following ste
|
||||
|
||||
After following the steps above, you should be able to see the latest requests from your IdP to Fleet if you navigate to **Settings > Integrations > Identity Provider (IdP)**.
|
||||
|
||||
To verify that user information is added to a host, go to the host that has IdP username assigned, and verify that **Full name (IdP)** and **Groups (IdP)** are populated correctly.
|
||||
To verify that user information is added to a host, go to the host that has IdP username assigned, and verify that **Full name (IdP)**, **Department (IdP)**, and **Groups (IdP)** are populated correctly.
|
||||
|
||||
### Troubleshooting
|
||||
|
||||
|
||||
@@ -329,7 +329,7 @@ controls:
|
||||
enable_release_device_manually: true
|
||||
macos_setup_assistant: ../lib/dep-profile.json
|
||||
script: ../lib/macos-setup-script.sh
|
||||
software:
|
||||
software:
|
||||
- app_store_id: "1091189122"
|
||||
- package_path: ../lib/software/adobe-acrobat.software.yml
|
||||
macos_migration: # Available in Fleet Premium
|
||||
@@ -376,6 +376,7 @@ In Fleet Premium, you can use reserved variables beginning with `$FLEET_VAR_` (c
|
||||
- `$FLEET_VAR_HOST_END_USER_IDP_USERNAME`: host's IdP username. When this changes, Fleet will automatically resend the profile.
|
||||
- `$FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART`: local part of the email (e.g. john from john@example.com). When this changes, Fleet will automatically resend the profile.
|
||||
- `$FLEET_VAR_HOST_END_USER_IDP_GROUPS`: comma separated IdP groups that host belongs to. When these change, Fleet will automatically resend the profile.
|
||||
- `$FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT`: host's IdP department. When this changes, Fleet will automatically resend the profile.
|
||||
- `$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_<CA_NAME>` (`<CA_NAME>` should be replaced with name of the certificate authority configured in [scep_proxy](#scep-proxy).)
|
||||
- `$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_<CA_NAME>`
|
||||
- `$FLEET_VAR_DIGICERT_PASSWORD_<CA_NAME>` (`<CA_NAME>` should be replaced with name of the certificate authority configured in [digicert](#digicert).)
|
||||
@@ -470,7 +471,7 @@ Currently, for Fleet-maintained apps and App Store (VPP) apps, the `labels_` and
|
||||
- `post_install_script.path` is the script Fleet will run on hosts after the software install. There is no default.
|
||||
- `self_service` specifies whether or not end users can install from **Fleet Desktop > Self-service**.
|
||||
- `categories` is an array of categories. See [supported categories](#labels-and-categories).
|
||||
|
||||
|
||||
> Without specifying a hash, Fleet downloads each installer for each team on each GitOps run.
|
||||
|
||||
#### Example
|
||||
@@ -516,7 +517,7 @@ Currently, one app for each of an App Store app's supported platforms are added.
|
||||
|
||||
- `fleet_maintained_apps` is a list of Fleet-maintained apps. Provide the `slug` field to include a Fleet-maintained app on a team. To find the `slug`, head to **Software > Add software** and select a Fleet-maintained app, then select **Show details**. You can also see the [list of app slugs on GitHub](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/apps.json).
|
||||
|
||||
Currently, Fleet-maintained apps will be updated to the latest version published by Fleet when GitOps runs, [with the exception of Chrome](https://github.com/fleetdm/fleet/issues/30325).
|
||||
Currently, Fleet-maintained apps will be updated to the latest version published by Fleet when GitOps runs.
|
||||
|
||||
Fleet-maintained apps have default categories. You can see the default categories in the [Fleet-maintained app metadata on GitHub](https://github.com/fleetdm/fleet/tree/main/ee/maintained-apps/outputs). If you do not specify `categories` when adding a self-service Fleet-maintained app, the default categories will be used.
|
||||
|
||||
@@ -691,7 +692,7 @@ org_settings:
|
||||
email: user1@example.com
|
||||
api_token: $ZENDESK_API_TOKEN
|
||||
group_id: 1234
|
||||
digicert:
|
||||
digicert: # Available in Fleet Premium
|
||||
- name: DIGICERT_WIFI
|
||||
url: https://one.digicert.com
|
||||
api_token: $DIGICERT_API_TOKEN
|
||||
@@ -700,12 +701,12 @@ org_settings:
|
||||
certificate_user_principal_names:
|
||||
- $FLEET_VAR_HOST_HARDWARE_SERIAL@example.com
|
||||
certificate_seat_id: $FLEET_VAR_HOST_HARDWARE_SERIAL@example.com
|
||||
ndes_scep_proxy:
|
||||
ndes_scep_proxy: # Available in Fleet Premium
|
||||
url: https://example.com/certsrv/mscep/mscep.dll
|
||||
admin_url: https://example.com/certsrv/mscep_admin/
|
||||
username: Administrator@example.com
|
||||
password: myPassword
|
||||
custom_scep_proxy:
|
||||
custom_scep_proxy: # Available in Fleet Premium
|
||||
- name: SCEP_VPN
|
||||
url: https://example.com/scep
|
||||
challenge: $SCEP_VPN_CHALLENGE
|
||||
|
||||
@@ -45,6 +45,7 @@ Authorization: Bearer <API key>
|
||||
Run test using [Runscope](https://www.runscope.com/). See [instructions](https://developer.okta.com/docs/guides/scim-provisioning-integration-prepare/main/#test-your-scim-api).
|
||||
|
||||
## Entra ID integration
|
||||
|
||||
- [SCIM guide](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups)
|
||||
- [SCIM validator](https://scimvalidator.microsoft.com/)
|
||||
- Note: only test attributes implemented by Fleet
|
||||
|
||||
@@ -706,7 +706,6 @@ Retrieves the specified carve block. This endpoint retrieves the data that was c
|
||||
|
||||
## Fleet configuration
|
||||
|
||||
- [Get certificate](#get-certificate)
|
||||
- [Get configuration](#get-configuration)
|
||||
- [Modify configuration](#modify-configuration)
|
||||
- [Get global enroll secrets](#get-global-enroll-secrets)
|
||||
@@ -717,6 +716,7 @@ Retrieves the specified carve block. This endpoint retrieves the data that was c
|
||||
|
||||
The Fleet server exposes API endpoints that handle the configuration of Fleet as well as endpoints that manage enroll secret operations. These endpoints require prior authentication, you so you'll need to log in before calling any of the endpoints documented below.
|
||||
|
||||
|
||||
### Get certificate
|
||||
|
||||
Returns the Fleet certificate.
|
||||
@@ -1636,9 +1636,9 @@ _Available in Fleet Premium._
|
||||
| jira | array | See [`integrations.jira`](#integrations-jira). |
|
||||
| zendesk | array | See [`integrations.zendesk`](#integrations-zendesk). |
|
||||
| google_calendar | array | See [`integrations.google_calendar`](#integrations-google-calendar). |
|
||||
| digicert | array | See [`integrations.digicert`](#integrations-digicert). |
|
||||
| ndes_scep_proxy | object | See [`integrations.ndes_scep_proxy`](#integrations-ndes-scep-proxy). |
|
||||
| custom_scep_proxy | array | See [`integrations.custom_scep_proxy`](#integrations-scep-proxy). |
|
||||
| digicert | array | _Available in Fleet Premium._ See [`integrations.digicert`](#integrations-digicert). |
|
||||
| ndes_scep_proxy | object | _Available in Fleet Premium._ See [`integrations.ndes_scep_proxy`](#integrations-ndes-scep-proxy). |
|
||||
| custom_scep_proxy | array | _Available in Fleet Premium._ See [`integrations.custom_scep_proxy`](#integrations-scep-proxy). |
|
||||
|
||||
|
||||
<br/>
|
||||
|
||||
Reference in New Issue
Block a user