Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 19 Packages Projects Releases Wiki Activity

[Docs] Add end user account type section to setup experience guide (#44855)

Browse Source 
## Summary

- Adds a new "End user account type" section to
`articles/setup-experience.md` explaining:
- What standard vs. admin accounts can/cannot do on macOS, Windows, and
Linux
- What the OS default account type is on each platform (macOS: admin,
Windows: admin, Linux: standard)
- How Fleet's `end_user_local_account_type` MDM setting lets admins
enforce standard or admin account types on enrolled hosts

Closes #41781

Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1778087024445999?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
This commit is contained in:
kilo-code-bot[bot]
2026-07-07 10:53:21 -06:00
committed by GitHub
co-authored by Rachael Shaw Lucas Manuel Rodriguez kiloconnect[bot] melpike Marko Lisica Mike Thomas
parent af51636bda
commit 28f4da083b
1 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/setup-experience.md
+54 -1
View File
@@ -36,6 +36,59 @@ You can require IdP authentication during automatic enrollment (ADE) for Apple (
> (SSO)](https://fleetdm.com/docs/deploy/single-sign-on-sso) in Fleet, you still want to create a
> new SAML app for IdP authentication. This way, only Fleet users can log in to Fleet.
## End user account type
During setup, the end user's local account is created as either an **admin** or **standard** account. The account type determines what the end user can do on their device.
### Standard vs. admin accounts
| Capability | Admin | Standard |
| --- | --- | --- |
| Install system-wide software | ✅ | |
| Change system settings (e.g. network, firewall, date/time) | ✅ | |
| Create, modify, or delete other user accounts | ✅ | |
| Access and modify all files on the device | ✅ | |
| Run applications from their own user space | ✅ | ✅ |
| Use peripherals and personal settings | ✅ | ✅ |
These capabilities apply across macOS, Windows, and Linux. On all three platforms, standard accounts are restricted from making system-level changes, while admin accounts have full control over the device.
### OS default account types
Each operating system assigns a default account type when a user account is created during initial device setup:
| Platform | Default account type |
| --- | --- |
| macOS | Admin |
| Windows | Admin |
| Linux | Standard |
> Many organizations prefer standard accounts for end users to reduce the attack surface and prevent accidental system-level changes. Fleet lets you override the OS defaults to enforce this.
### Controlling account type with Fleet
Fleet's `end_user_local_account_type` setting lets you enforce either `admin`, `standard`, or `none` as the account type for the end user's local account on macOS hosts that automatically enroll via Apple Business (AB).
To configure via the Fleet UI:
1. Head to **Controls > Setup experience**.
2. Under the managed local account options, choose **Admin**, **Standard**, or **Skip (no account)** for the end user account type.
To configure via GitOps, set the `end_user_local_account_type` field under `mdm.macos_setup` in your YAML configuration:
```yaml
mdm:
macos_setup:
end_user_local_account_type: "standard"
```
Valid values are `"admin"`, `"standard"`, and `"none"`. When set to `"standard"`, Fleet creates the end user's local account as a standard (non-admin) account during macOS setup, regardless of the OS default. When set to `"none"`, Fleet skips creating the end user's local account during macOS setup, leaving the device with only the managed local admin account provisioned by Fleet.
> This setting applies to macOS hosts that automatically enroll via Apple Business (AB). For Windows and Linux, account type is controlled by the operating system during setup.
> System-scoped profiles apply device-wide, including to any Fleet-managed local admin account. Admins are responsible for ensuring profile scope (`PayloadScope`) aligns with their intended targets.
## Managed local account
Fleet can create a hidden admin account (`_fleetadmin`) with a unique password on each macOS host during Setup Assistant. IT admins can use this account as a break-glass login for troubleshooting.
@@ -64,7 +117,7 @@ Fleet supports configuring Platform SSO (PSSO) for macOS hosts with the option t
To require a EULA, in Fleet, head to **Settings > Integrations > MDM > End user license agreement (EULA)** or use the [Fleet API](https://fleetdm.com/docs/rest-api/rest-api#upload-an-eula-file).
Currently, the EULA is only displayed for macOS hosts that automatically enroll via Apple Business Manager (ABM).
Currently, the EULA is only displayed for macOS hosts that automatically enroll via Apple Business (AB).
## Managed local account
Fleet can create and manage a local admin account on macOS hosts that automatically enroll via Apple Business (AB). This account gives IT admins a secure way to access a macOS host for troubleshooting without relying on shared or static credentials.