From 42bde1c4ff169da341e17aef41e125834db2d7e6 Mon Sep 17 00:00:00 2001
From: Magnus Jensen <magnus@fleetdm.com>
Date: Thu, 2 Apr 2026 17:14:22 -0500
Subject: [PATCH] hide ACME attestation checkbox on Fleet free (#42935)

Follow up PR when doing the test plan for ACME
---
 .../cards/Advanced/Advanced.tsx               | 33 ++++++++++---------
 1 file changed, 18 insertions(+), 15 deletions(-)

diff --git a/frontend/pages/admin/OrgSettingsPage/cards/Advanced/Advanced.tsx b/frontend/pages/admin/OrgSettingsPage/cards/Advanced/Advanced.tsx
index 9af2dd0677..257ba3a78d 100644
--- a/frontend/pages/admin/OrgSettingsPage/cards/Advanced/Advanced.tsx
+++ b/frontend/pages/admin/OrgSettingsPage/cards/Advanced/Advanced.tsx
@@ -15,6 +15,7 @@ import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
 
 import { ACTIVITY_EXPIRY_WINDOW_DROPDOWN_OPTIONS } from "utilities/constants";
 import { getCustomDropdownOptions } from "utilities/helpers";
+import { isPremiumTier } from "utilities/permissions/permissions";
 
 import { IAppConfigFormProps } from "../constants";
 
@@ -522,21 +523,23 @@ const Advanced = ({
               </Checkbox>
             )}
           />
-          <GitOpsModeTooltipWrapper
-            position="left"
-            renderChildren={(disableChildren) => (
-              <Checkbox
-                disabled={disableChildren}
-                onChange={onInputChange}
-                name="requireHardwareAttestation"
-                value={requireHardwareAttestation}
-                parseTarget
-                helpText="Enabling this setting will require macOS hosts with Apple Silicon that automatically enroll (DEP) to use ACME with Managed Device Attestation"
-              >
-                Require hardware attestation
-              </Checkbox>
-            )}
-          />
+          {isPremiumTier(appConfig) && (
+            <GitOpsModeTooltipWrapper
+              position="left"
+              renderChildren={(disableChildren) => (
+                <Checkbox
+                  disabled={disableChildren}
+                  onChange={onInputChange}
+                  name="requireHardwareAttestation"
+                  value={requireHardwareAttestation}
+                  parseTarget
+                  helpText="Enabling this setting will require macOS hosts with Apple Silicon that automatically enroll (DEP) to use ACME with Managed Device Attestation"
+                >
+                  Require hardware attestation
+                </Checkbox>
+              )}
+            />
+          )}
         </div>
         <Button
           type="submit"