Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases Wiki Activity

Preview of v4.78.0 doc changes (#35929)

Browse Source
This commit is contained in:
Rachael Shaw
2025-12-19 17:07:58 -06:00
committed by GitHub
parent df188add91
commit 45b162f940
14 changed files with 4691 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/automatic-software-install-in-fleet.md
+3 -2
View File
@@ -8,11 +8,12 @@ In Fleet, you can automatically and remotely install software on hosts. This gui
Current supported software deployment formats:
- macOS: .pkg, App Store (VPP) apps, and [Fleet-maintained apps](https://fleetdm.com/guides/fleet-maintained-apps)
- Windows: .msi, .exe, and [Fleet-maintained apps](https://fleetdm.com/guides/fleet-maintained-apps)
- Linux: .deb, .rpm
- Windows: .msi, .exe, .ps1, and [Fleet-maintained apps](https://fleetdm.com/guides/fleet-maintained-apps)
- Linux: .deb, .rpm, and .sh
> If you check the "Automatic install" box when adding software, you do not have to create your own policy, so you can skip the remaining steps of this process.
> Script packages (`.sh` and `.ps1` files) do not support automatic install.
2. **Add a policy**: In Fleet, add a policy that failure to pass will trigger the required installation. Go the **Policies** tab, select a team, then press the **Add policy** button. Next, click **Create your own policy**, enter your policy SQL, click **Save**, fill in remaining details in the Save modal, then and click **Save** again.
```sql
articles/connect-end-user-to-wifi-with-certificate.md
+18 -19
View File
@@ -46,10 +46,10 @@ The following steps show how to connect end users to Wi-Fi or VPN with DigiCert
### Step 4: Add PKCS12 configuration profile to Fleet
1. Create a [configuration profile](https://fleetdm.com/guides/custom-os-settings) with a PKCS12 payload.
- For `Password`, use `$FLEET_VAR_DIGICERT_PASSWORD_<CA_NAME>`.
- For `Data`, use `$FLEET_VAR_DIGICERT_DATA_<CA_NAME>`.
- For `Password`, use `$FLEET_VAR_DIGICERT_PASSWORD_{CA_NAME}`.
- For `Data`, use `$FLEET_VAR_DIGICERT_DATA_{CA_NAME}`.
2. Replace the `<CA_NAME>` with the name you created in step 3. For example, if the name of the CA is "WIFI_AUTHENTICATION", the variables will look like `$FLEET_VAR_DIGICERT_PASSWORD_WIFI_AUTHENTICATION` and `$FLEET_VAR_DIGICERT_DATA_WIFI_AUTHENTICATION`.
2. Replace the `{CA_NAME}` with the name you created in step 3. For example, if the name of the CA is "WIFI_AUTHENTICATION", the variables will look like `$FLEET_VAR_DIGICERT_PASSWORD_WIFI_AUTHENTICATION` and `$FLEET_VAR_DIGICERT_DATA_WIFI_AUTHENTICATION`.
3. In Fleet, head to **Controls > OS settings > Custom settings** and add the configuration profile to deploy certificates to your hosts.
@@ -71,9 +71,9 @@ When Fleet delivers the profile to your hosts, Fleet will replace the variables.
<array>
<dict>
<key>Password</key>
<string>$FLEET_VAR_DIGICERT_PASSWORD_<CA_NAME></string>
<string>$FLEET_VAR_DIGICERT_PASSWORD_{CA_NAME}</string>
<key>PayloadContent</key>
<data>$FLEET_VAR_DIGICERT_DATA_<CA_NAME></data>
<data>$FLEET_VAR_DIGICERT_DATA_{CA_NAME}</data>
<key>PayloadDisplayName</key>
<string>CertificatePKCS12</string>
<key>PayloadIdentifier</key>
@@ -224,10 +224,10 @@ We're currently working with Smallstep to develop a specific Smallstep-Fleet con
### Step 3: Add SCEP configuration profile to Fleet
1. Create a [configuration profile](https://fleetdm.com/guides/custom-os-settings) with the SCEP payload.
- For `Challenge`, use`$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_<CA_NAME>`.
- For `URL`, use `$FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_<CA_NAME>`, and make sure to add `$FLEET_VAR_SCEP_RENEWAL_ID` to `OU`.
- For `Challenge`, use`$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_{CA_NAME}`.
- For `URL`, use `$FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_{CA_NAME}`, and make sure to add `$FLEET_VAR_SCEP_RENEWAL_ID` to `OU`.
2. Replace the `<CA_NAME>` with the name you created in step 2. For example, if the name of the CA is "WIFI_AUTHENTICATION", the variables will look like this: `$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_WIFI_AUTHENTICATION` and `FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_WIFI_AUTHENTICATION`.
2. Replace the `{CA_NAME}` with the name you created in step 2. For example, if the name of the CA is "WIFI_AUTHENTICATION", the variables will look like this: `$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_WIFI_AUTHENTICATION` and `FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_WIFI_AUTHENTICATION`.
3. If your Wi-Fi or VPN requires certificates that are unique to each host, update the `Subject`. You can use `$FLEET_VAR_HOST_END_USER_EMAIL_IDP` if your hosts automatically enrolled (via ADE) to Fleet with [end user authentication](https://fleetdm.com/docs/rest-api/rest-api#get-human-device-mapping) enabled. You can also use any of the [Apple's built-in variables](https://support.apple.com/en-my/guide/deployment/dep04666af94/1/web/1.0).
@@ -248,7 +248,7 @@ When the profile is delivered to your hosts, Fleet will replace the variables. I
<key>PayloadContent</key>
<dict>
<key>Challenge</key>
<string>$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_<CA_NAME></string>
<string>$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_{CA_NAME}</string>
<key>Key Type</key>
<string>RSA</string>
<key>Key Usage</key>
@@ -271,7 +271,7 @@ When the profile is delivered to your hosts, Fleet will replace the variables. I
</array>
</array>
<key>URL</key>
<string>$FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_<CA_NAME></string>
<string>$FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_{CA_NAME}</string>
</dict>
<key>PayloadDisplayName</key>
<string>WIFI SCEP</string>
@@ -405,9 +405,9 @@ The following steps show how to connect end users to Wi-Fi or VPN with a [custom
### Step 2: Add SCEP configuration profile to Fleet
1. Create a [configuration profile](https://fleetdm.com/guides/custom-os-settings) with the SCEP payload. In the profile, for `Challenge`, use`$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_<CA_NAME>`. For `URL`, use `$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_<CA_NAME>`, and make sure to add `$FLEET_VAR_SCEP_RENEWAL_ID` to `OU`.
1. Create a [configuration profile](https://fleetdm.com/guides/custom-os-settings) with the SCEP payload. In the profile, for `Challenge`, use`$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_{CA_NAME}`. For `URL`, use `$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_{CA_NAME}`, and make sure to add `$FLEET_VAR_SCEP_RENEWAL_ID` to `OU`.
2. Replace the `<CA_NAME>` with the name you created in step 3. For example, if the name of the CA is "WIFI_AUTHENTICATION", the variables will look like this: `$FLEET_VAR_CUSTOM_SCEP_PASSWORD_WIFI_AUTHENTICATION` and `FLEET_VAR_CUSTOM_SCEP_DIGICERT_DATA_WIFI_AUTHENTICATION`.
2. Replace the `{CA_NAME}` with the name you created in step 3. For example, if the name of the CA is "WIFI_AUTHENTICATION", the variables will look like this: `$FLEET_VAR_CUSTOM_SCEP_PASSWORD_WIFI_AUTHENTICATION` and `FLEET_VAR_CUSTOM_SCEP_DIGICERT_DATA_WIFI_AUTHENTICATION`.
3. If your Wi-Fi or VPN requires certificates that are unique to each host, update the `Subject`. You can use `$FLEET_VAR_HOST_END_USER_EMAIL_IDP` if your hosts automatically enrolled (via ADE) to Fleet with [end user authentication](https://fleetdm.com/docs/rest-api/rest-api#get-human-device-mapping) enabled. You can also use any of [Apple's built-in variables](https://support.apple.com/en-my/guide/deployment/dep04666af94/1/web/1.0).
@@ -431,7 +431,7 @@ When the profile is delivered to your hosts, Fleet will replace the variables. I
<key>PayloadContent</key>
<dict>
<key>Challenge</key>
<string>$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_<CA_NAME></string>
<string>$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_{CA_NAME}</string>
<key>Key Type</key>
<string>RSA</string>
<key>Key Usage</key>
@@ -454,7 +454,7 @@ When the profile is delivered to your hosts, Fleet will replace the variables. I
</array>
</array>
<key>URL</key>
<string>$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_<CA_NAME></string>
<string>$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_{CA_NAME}</string>
</dict>
<key>PayloadDisplayName</key>
<string>WIFI SCEP</string>
@@ -564,7 +564,7 @@ You can add any other options listed under Device/SCEP in the [Microsoft documen
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
</Meta>
<Data>$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_<CA_NAME></Data>
<Data>$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_{CA_NAME}</Data>
</Item>
</Replace>
<Replace>
@@ -575,7 +575,7 @@ You can add any other options listed under Device/SCEP in the [Microsoft documen
<Meta>
<Format xmlns="syncml:metinf">chr</Format>
</Meta>
<Data>$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_<CA_NAME></Data>
<Data>$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_{CA_NAME}</Data>
</Item>
</Replace>
<Replace>
@@ -754,13 +754,12 @@ If an end user is on vacation (offline for more than 30 days), their certificate
### User scoped certificates
You can also upload a certificate to be installed in the login keychain of the managed user on a
macOS host using a user-scoped configuration profile.
You can deploy a user scoped certificate on macOS and Windows hosts using a user scoped configuration profile.
1. **Add your CA as before**
Use the above steps to integrate your CA with Fleet.
1. **Create a certificate payload**
Use your preferred tool (e.g., Apple Configurator or a `.mobileconfig` generator) to create a configuration profile that includes your certificate.
Use your preferred tool (e.g., Apple Configurator or a `.mobileconfig` generator) to create a configuration profile that includes your certificate. For Windows, use the [example profile](#example-configuration-profiles) and replace `./Device` with `./User` in all `<LocURI>` elements.
2. **Ensure the payload is scoped to the user**
In the payload, set the `PayloadScope` to `User`. This tells macOS to install the certificate in the user’s login keychain instead of the system keychain.
3. **Upload the configuration profile to Fleet**
articles/deploy-software-packages.md
+18 -3
View File
@@ -28,11 +28,11 @@ Learn more about automatically installing software [the Automatically install so
* Select the "Custom package" tab.
* Choose a file to upload. `.pkg`, `.msi`, `.exe`, `.rpm`, `.deb`, `.ipa`, and `.tar.gz` files are supported.
* Choose a file to upload. `.pkg`, `.msi`, `.exe`, `.rpm`, `.deb`, `.ipa`, `.tar.gz`, `.sh`, and `.ps1` files are supported.
* If you check the "Automatic install" box, Fleet will create a policy that checks for the existence of the software and will automatically trigger an install on hosts where the software does not exist.
* If you check the "Automatic install" box, Fleet will create a policy that checks for the existence of the software and will automatically trigger an install on hosts where the software does not exist. Note: Automatic install is not supported for payload-free packages (`.sh` and `.ps1` files).
* To allow users to install the software from Fleet Desktop, check the “Self-service” checkbox.
* To allow users to install the software from Fleet Desktop, check the "Self-service" checkbox.
* To customize installer behavior, click on “Advanced options.”
@@ -55,6 +55,21 @@ Software installer uploads will fail if Fleet can't extract this metadata and ve
.tar.gz archives are uploaded as-is without attempting to pull metadata, and will be added successfully as long as they are valid archives, and as long as install and uninstall scripts are supplied.
### Payload-free packages
Payload-free packages (`.sh` and `.ps1` files) are packages that only contain a script that runs directly on hosts without installing traditional software. The script file's contents become the install script. The `.sh` files are supported for Linux hosts, and`.ps1` files for Windows hosts.
Payload-free packages are useful for:
- Self-service configuration scripts (e.g., connecting to a VPN, configuring printers)
- Running maintenance tasks on demand
- Deploying configuration changes that don't require a traditional installer
Script packages do not support `install_script` (the file contents are the install script), `uninstall_script`, `post_install_script`, `pre_install_query`, and automatic install.
If these parameters are provided when uploading a script package, they will be ignored.
### Pre-install query
A pre-install query is a valid osquery SQL statement that will be evaluated on the host before installing the software. If provided, the installation will proceed only if the query returns any value.
articles/enforce-os-updates.md
+3 -1
View File
@@ -12,10 +12,12 @@ For Apple (macOS, iOS, and iPadOS) hosts, Apple provides a [list of available OS
1. Head to the **Controls** > **OS updates** tab.
2. To enforce OS updates for macOS, iOS, or iPadOS, select the platform and set a **Minimum version** and **Deadline**.
2. To enforce OS updates for enrolled macOS, iOS, or iPadOS hosts, select the platform and set a **Minimum version** and **Deadline**.
3. For Windows, select **Windows** and set a **Deadline** and **Grace period**.
4. *macOS only*: check "Update new hosts to latest" if you would like hosts to automatically update to the latest OS version during automatic (ADE) enrollment, regardless of the minimum version and deadline settings.
### Fleet API
Use the [modify team endpoint](https://fleetdm.com/docs/rest-api/rest-api#modify-team) to turn on minimum OS version enforcement. The relevant payload keys in the `mdm` object are:
articles/foreign-vitals-map-idp-users-to-hosts.md
+1 -1
View File
@@ -10,7 +10,7 @@ Fleet supports [Okta](#okta), [Microsoft Active Directory (AD) / Entra ID](#micr
Fleet automatically collects IdP host vitals when an [end user authenticates](https://fleetdm.com/guides/setup-experience#end-user-authentication) during these enrollment scenarios:
- Automatic enrollment (ADE) for Apple (macOS, iOS, iPadOS) hosts.
- Manual enrollment for personal (BYOD) iOS, iPadOS, and Android hosts.
- Manual enrollment for personal (BYOD) iOS, iPadOS, Android, and [Windows](https://fleetdm.com/guides/windows-mdm-setup#automatic-enrollment) hosts.
You can also manually add/update a host's IdP username on the Host details page. Fleet will then automatically map the username to other IdP vitals.
articles/gitops-mode-software.md
+2
View File
@@ -8,6 +8,8 @@ When using GitOps, you can optionally put Fleet in [GitOps mode](https://fleetdm
To manage custom packages via GitOps, please see the [`packages`](https://fleetdm.com/docs/configuration/yaml-files#packages) in Fleet's GitOps docs.
> For script packages (`.sh` and `.ps1` files), the `install_script`, `uninstall_script`, `post_install_script`, and `pre_install_query` fields are not supported and will be ignored. The script file's contents become the install script. Learn more in the [deploy software guide](https://fleetdm.com/guides/deploy-software-packages#script-packages).
If you want to use Fleet to host custom packages instead of a third-party package hosting tool (ex. [Artifactory](https://jfrog.com/artifactory/)), first turn GitOps mode on in **Settings > Integration > Change management**
1. Navigate to **Software** and select a team. Then select **Add Software > Custom package**
2. Select a team and choose a file to upload and select **Add software**
articles/secrets-in-scripts-and-configuration-profiles.md
+3
View File
@@ -90,6 +90,9 @@ Here's an example profile with `$FLEET_SECRET_CERT_PASSWORD` and `$FLEET_SECRET_
</plist>
```
> In XML, certain characters (`&`, `<`, `>`, `"`, `'`) must be escaped because they have special meanings in the markup language. Fleet variables will be automatically escaped when used in a `.mobileconfig` configuration profile. For example, `&` will become `&amp;`.
## Known limitations and issues
- **Apple MDM profiles**: Fleet secret variables (`$FLEET_SECRET_*`) cannot be used in the `PayloadDisplayName` field of Apple configuration profiles. This field becomes the visible name of the profile and using secrets here could expose sensitive information. Place secrets in other fields like `PayloadDescription`, `Password`, or `PayloadContent` instead.
articles/setup-experience.md
+9 -5
View File
@@ -125,6 +125,8 @@ To sign the package we need a valid Developer ID Installer certificate:
You can install software during first time macOS, iOS, iPadOS and [Windows and Linux setup](https://fleetdm.com/guides/windows-linux-setup-experience). Android support is coming soon.
Currently, for macOS hosts, software is only installed on hosts that automatically enroll to Fleet via Apple Business Manager (ABM). For iOS and iPadOS hosts, software is only installed on hosts that enroll via ABM and hosts that manually enroll via the `/enroll` link (profile-based device enrollment).
Add setup experience software:
1. Click on the **Controls** tab in the main navigation bar, then **Setup experience** > **4. Install software**.
@@ -132,19 +134,21 @@ Add setup experience software:
2. Click **Add software**, then select or search for the software you want installed during the setup experience.
3. Press **Save** to save your selection.
To see the end user experience on iOS/iPadOS, check out the [iOS video](https://www.youtube.com/shorts/_XXNGrQPqys) and [iPadOS video](https://www.youtube.com/shorts/IIzo4NyUolM).
### Retries
For macOS, Windows, and Linux hosts, software installs are automatically attempted up to 3 times (1 initial attempt + 2 retries) to handle intermittent network issues or temporary failures. When Fleet retries, IT admins can see error messages for all attempts in the **Host details > Activity** card. The end user only sees an error message if the third, and final, attempt fails.
Retries only happen for custom packages and Fleet-maintained apps. For App Store (VPP) apps, the MDM command to install the app is sent once and either succeeds or fails.
#### Blocking setup on failed software installs
#### Stop setup on failed software installs
You may additionally configure the setup experience to halt immediately if any software item fails to install. To enable this feature:
For macOS hosts, you can configure the setup experience to stop if any software item fails to install:
1. Click **Show advanced options** on the Install Software screen.
2. Check the "Cancel setup if software install fails" checkbox.
3. Press **Save**.
1. In **Controls > Setup experience > Install software > macOS**, select **Show advanced options**.
2. Check the **Cancel setup if software install fails** checkbox.
3. Select **Save**.
When this feature is enabled, any failed software will immediately end the setup experience and display a screen similar to this one, allowing the user to view details of the failure for troubleshooting purposes:
articles/software-self-service.md
+38 -2
View File
@@ -14,6 +14,8 @@ Fleet’s self-service software lets end users update and install approved apps
4. Pick a [Fleet-maintained app](https://fleetdm.com/guides/fleet-maintained-apps), [app store app](https://fleetdm.com/guides/install-app-store-apps#add-the-app-to-fleet), or upload a [custom package](https://fleetdm.com/guides/deploy-software-packages).
5. Check **Self-service** to make it available for self-service as soon as it's added.
> Script packages (`.sh` and `.ps1` files) are useful for self-service configuration tasks like connecting to a VPN or configuring printers. Learn more in the [deploy software guide](https://fleetdm.com/guides/deploy-software-packages#script-packages).
You can also add the software and later make it available in self-service:
1. Select the team to which you added the software from the dropdown in the upper left corner of the page.
@@ -24,6 +26,33 @@ You can also add the software and later make it available in self-service:
If a software item isn't made available in self-service, end users will not see it in **Fleet Desktop > Self-service**. IT admins can still install, update, and uninstall the software from Fleet.
## Deploy self-service on iOS and iPadOS
Install this configuration profile to add the self-service web app to the home screen on iPhone and iPad.
### Create the self-service configuration profile
On your Mac, open [iMazing Profile Editor](https://imazing.com/profile-editor). Create a new profile and add a **Web Clip** payload with these settings:
#### Under the General tab
- **Name:** Friendly name like "iOS self-service".
- **Identifier and UUID:** You can use default values.
#### Under the Web Clip tab
- **Label:** Type "Self-service". This name will display as the app name on the home screen.
- **URL:** `<your_server_url>/device/$FLEET_VAR_HOST_UUID/self-service`
- **Removable:** Uncheck it.
- **Icon:** Upload a square icon that will be displayed as the app icon on the home screen.
- **Full Screen:** Check this field.
- **Target Application Bundle Identifier:** Select **Choose...**, type "safari" in the search box, and select **Safari - com.apple.mobilesafari**.
#### Download configuration profile
You can also download the configuration profile (`.mobileconfig`) and change values in code editor. If you want to change the icon, use iMazing Profile Editor and follow the steps above.
Download example Web Clip profile from [our repository](https://github.com/fleetdm/fleet/tree/main/docs/solutions/ios-ipados/Fleet-self-service.mobileconfig).
## IT admin experience
How to view, update, install, or uninstall self-service software:
@@ -45,8 +74,15 @@ Tips:
How to update, install, or uninstall self-service software:
1. Find the Fleet icon in your menu bar and select **Self-service.** This will open your default web browser to the list of self-service software available to update, install, or uninstall.
2. If updates are available, end users can update one or all available self-service software. They can also view update progress and error details directly.
**macOS and Windows:**
Find the Fleet icon in your menu bar (macOS) or system tray (Windows) and select **Self-service.** This will open your default web browser to the list of self-service software available to update, install, or uninstall.
**iOS and iPadOS:**
Tap the **Self-service** icon on your home screen. This opens the self-service software catalog where you can install apps.
If updates are available, end users can update one or all available self-service software. They can also view update progress and error details directly.
## API
articles/windows-mdm-setup.md
+4 -2
View File
@@ -53,9 +53,11 @@ With Windows MDM turned on, enroll a Windows host to Fleet by installing [Fleet'
To automatically enroll Windows workstations when they’re first unboxed and set up by your end users, we will connect Fleet to Microsoft Entra ID.
After you connect Fleet to Microsoft Entra ID, you can customize the Windows setup experience with [Windows Autopilot](https://learn.microsoft.com/en-us/autopilot/windows-autopilot).
Connecting Fleet to Entra also enables end users to manually turn on MDM via the [Settings > Access work or school workflow](https://support.microsoft.com/en-us/account-billing/join-your-work-device-to-your-work-or-school-network-ef4d6adb-5095-4e51-829e-5457430f3973#:~:text=If%20you%27ve%20had%20your%20device%20for%20a%20while%20and%20it%27s%20already%20been%20set%20up%2C%20you%20can%20follow%20these%20steps%20to%20join%20your%20device%20to%20the%20network.). Fleet will collect the email and store it as the IdP [username](https://fleetdm.com/guides/foreign-vitals-map-idp-users-to-hosts). If a different email is used during the [setup experience](https://fleetdm.com/guides/setup-experience#end-user-authentication), it won't override the one used in **Settings > Access work or school**.
In order to connect Fleet to Microsoft Entra ID, the IT admin (you) needs a Microsoft Enterprise Mobility + Security E3 license. Each end user who automatically enrolls needs at least a [Microsoft Entra P1 license](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing). If they already have an [E3 or E5 license](https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricing) then you're good to go.
After you connect Fleet to Entra, you can customize the Windows setup experience with [Windows Autopilot](https://learn.microsoft.com/en-us/autopilot/windows-autopilot).
In order to connect Fleet to Entra, the IT admin (you) needs a Microsoft Enterprise Mobility + Security E3 license. Each end user who automatically enrolls or manually turns on MDM needs at least a [Microsoft Entra P1 license](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing). If they already have an [E3 or E5 license](https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricing) then you're good to go.
### Step 1: Buy Microsoft licenses
docs/Configuration/yaml-files.md
+32 -7
View File
@@ -320,7 +320,8 @@ The `controls` section allows you to configure scripts and device management (MD
- `scripts` is a list of paths to macOS, Windows, or Linux scripts.
- `windows_enabled_and_configured` specifies whether or not to turn on Windows MDM features (default: `false`). Can only be configured for all teams (`default.yml`).
- `windows_migration_enabled` specifies whether or not to automatically migrate Windows hosts connected to another MDM solution. If `false`, MDM is only turned on after hosts are unenrolled from your old MDM solution (default: `false`). Can only be configured for all teams (`default.yml`).
- `enable_turn_on_windows_mdm_manually` specifies whether or not to require end users to manually turn on MDM in **Settings > Access work or school** (default: `false`). If `false`, MDM is automatically turned on for all Windows hosts that aren't connected to any MDM solution. Can only be configured for all teams (`default.yml`).
- `windows_migration_enabled` specifies whether or not to automatically migrate Windows hosts connected to another MDM solution. If `false`, MDM is only turned on after hosts are unenrolled from your old MDM solution. `enable_turn_on_windows_mdm_manually` must be set to `false`. (default: `false`). Can only be configured for all teams (`default.yml`).
- `enable_disk_encryption` specifies whether or not to enforce disk encryption on macOS, Windows, and Linux hosts (default: `false`).
- `windows_require_bitlocker_pin` specifies whether or not to require end users on Windows hosts to set a BitLocker PIN. When set, this PIN is required to unlock Windows host during startup. `enable_disk_encryption` must be set to `true`. (default: `false`).
@@ -333,6 +334,7 @@ controls:
- path: ../lib/windows-script.ps1
- path: ../lib/linux-script.sh
windows_enabled_and_configured: true
enable_turn_on_windows_mdm_manually: false # Available in Fleet Premium
windows_migration_enabled: true # Available in Fleet Premium
enable_disk_encryption: true # Available in Fleet Premium
macos_updates: # Available in Fleet Premium
@@ -365,6 +367,10 @@ controls:
android_settings:
custom_settings:
- path: ../lib/android-profile.json
certificates:
- name: wifi-certificate
certificate_authority_name: EST_WIFI
subject_name: /CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL
macos_setup: # Available in Fleet Premium
bootstrap_package: https://example.org/bootstrap_package.pkg
enable_end_user_authentication: true
@@ -397,15 +403,25 @@ controls:
- `deadline_days` specifies the number of days before Windows installs updates (default: `null`)
- `grace_period_days` specifies the number of days before Windows restarts to install updates (default: `null`)
### macos_settings, windows_settings and android_settings
### macos_settings and windows_settings
- `macos_settings.custom_settings` is a list of paths to macOS, iOS, and iPadOS configuration profiles (.mobileconfig) or declaration profiles (.json).
- `windows_settings.custom_settings` is a list of paths to Windows configuration profiles (.xml).
- `android_settings.custom_settings` is a list of paths to Android configuration profiles (.json).
Use `labels_include_all` to target hosts that have all labels, `labels_include_any` to target hosts that have any label, or `labels_exclude_any` to target hosts that don't have any of the labels. Only one of `labels_include_all`, `labels_include_any`, or `labels_exclude_any` can be specified. If none are specified, all hosts are targeted.
### android_settings
- `android_settings.custom_settings` is a list of paths to Android configuration profiles (.json).
Use `labels_include_all` to target hosts that have all labels, `labels_include_any` to target hosts that have any label, or `labels_exclude_any` to target hosts that don't have any of the labels. Only one of `labels_include_all`, `labels_include_any`, or `labels_exclude_any` can be specified. If none are specified, all hosts are targeted.
#### android_settings.certificates
- `name` is the name of the certificate. Name can be used as a certificate alias to reference in configuration profiles (custom settings).
- `certificate_authority_name` is the name of the [certificate authority (CA)](#certificate-authorities) to issue the certificate from. Currently, only a custom SCEP CA is supported.
- `subject_name` is the certificate's subject name (SN). Separate subject fields by a "/". For example: "/CN=john@example.com/O=Acme Inc.".
#### Variables
For macOS configuration profiles, you can use any of Apple's [built-in variables](https://support.apple.com/en-my/guide/deployment/dep04666af94/1/web/1.0) in [Automated Certificate Management Environment (ACME)](https://developer.apple.com/documentation/devicemanagement/acmecertificate), [Simple Certificate Enrolment Protocol (SCEP)](https://developer.apple.com/documentation/devicemanagement/scep), or [VPN](https://developer.apple.com/documentation/devicemanagement/vpn) payloads.
@@ -425,6 +441,7 @@ In Fleet Premium, you can use reserved variables beginning with `$FLEET_VAR_`. F
| `$FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT` | macOS, iOS, iPadOS, Windows | Host's IdP department. When this changes, Fleet will automatically resend the profile. |
| `$FLEET_VAR_HOST_UUID` | macOS, iOS, iPadOS, Windows | Host's hardware UUID. |
| `$FLEET_VAR_HOST_HARDWARE_SERIAL` | macOS, iOS, iPadOS | Host's hardware serial number. |
| `$FLEET_VAR_HOST_PLATFORM` | macOS, iOS, iPadOS, Windows | Host's platform. Values are `"macos"`, `"ios"`, `"ipados"`, and `"windows"`. |
| `$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_<CA_NAME>` | macOS, iOS, iPadOS, Windows | Fleet-managed one-time challenge password used during SCEP certificate configuration profile deployment. `<CA_NAME>` should be replaced with name of the certificate authority configured in [custom_scep_proxy](#custom-scep-proxy). |
| `$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_<CA_NAME>` | macOS, iOS, iPadOS, Windows | Fleet-managed SCEP proxy endpoint URL used during SCEP certificate configuration profile deployment. |
| `$FLEET_VAR_SCEP_RENEWAL_ID` | macOS, iOS, iPadOS | Fleet-managed ID that's required to automatically renew Smallstep, Microsoft NDES, and custom SCEP certificates. The ID must be specified in the Organizational Unit (OU) field in the configuration profile. |
@@ -436,8 +453,13 @@ In Fleet Premium, you can use reserved variables beginning with `$FLEET_VAR_`. F
The dollar sign (`$`) can be escaped so it's not considered a variable by using a backslash (e.g. `\$100`). Additionally, `MY${variable}HERE` syntax can be used to put strings around the variable.
In XML, certain characters (`&`, `<`, `>`, `"`, `'`) must be escaped because they have special meanings in the markup language. GitHub and GitLab environment variables, as well as Fleet's reserved variables, will be automatically escaped when used in a `.mobileconfig` configuration profile. For example, `&` will become `&amp;`.
If certificate authority (CA) variables (ex. `$FLEET_VAR_DIGICERT_DATA_<CA_NAME>`) don't exist, GitOps dry runs will succeed but GitOps runs will fail.
To hide variable values in the API and UI, you can use Fleet's [custom variables](https://fleetdm.com/guides/secrets-in-scripts-and-configuration-profiles#gitops).
### macos_setup
The `macos_setup` section lets you control the out-of-the-box macOS [setup experience](https://fleetdm.com/guides/setup-experience) for hosts that use Automated Device Enrollment (ADE).
@@ -482,7 +504,7 @@ Can only be configured for all teams (`default.yml`).
The `software` section allows you to configure packages, store apps (Apple App Store and Google Play Store), and Fleet-maintained apps that you want to install on your hosts.
- `packages` is a list of paths to custom packages (.pkg, .msi, .exe, .deb, .rpm, .tar.gz, .sh, or .ps1).
- `packages` is a list of paths to custom packages (.pkg, .ipa, .msi, .exe, .deb, .rpm, .tar.gz, .sh, or .ps1).
- `app_store_apps` is a list of Apple App Store or Android Play Store apps.
- `fleet_maintained_apps` is a list of Fleet-maintained apps.
@@ -490,6 +512,8 @@ Currently, you can specify `install_software` in the [`policies` YAML](#policies
Currently, Fleet only allows one package, Apple App Store app, or Fleet-maintained app for a specific software. This means, if you specify a Google Chrome for macOS twice in `packages` or once in `packages` and once in `fleet_maintained_apps`, only one of them will be added to Fleet.
Currently, when a `.ipa` file is added in `packages`, Fleet adds software for both iOS and iPadOS, along with all specified settings (e.g. `self_service`). If software for one platform is deleted in the UI, it will come back when GitOps is re-run.
#### Example
`teams/team-name.yml`, or `teams/no-team.yml`
@@ -585,8 +609,9 @@ You can view the hash for existing software in the software detail page in the F
### app_store_apps
- `app_store_id` is the ID of the Apple App Store app. You can find this at the end of the app's App Store URL. For example, "Bear - Markdown Notes" URL is "https://apps.apple.com/us/app/bear-markdown-notes/id1016366447" and the `app_store_id` is `1016366447`.
+ Make sure to include only the ID itself, and not the `id` prefix shown in the URL. The ID must be wrapped in quotes as shown in the example so that it is processed as a string.
- `app_store_id` is the ID of the Apple App Store or Android Play Store app. You can find this ID at the end of the app's URL. For example, "Bear - Markdown Notes" URL is "https://apps.apple.com/us/app/bear-markdown-notes/id1016366447" making the `app_store_id` is "1016366447". Similarly, the URL for "Google Chrome" on Android is "https://play.google.com/store/apps/details?id=com.android.chrome," so the `app_store_id` is "com.android.chrome."
+ For Apple App Store apps, make sure to include only the ID itself, and not the `id` prefix shown in the URL. The ID must be wrapped in quotes as shown in the example so that it is processed as a string.
- `platform` is the platform of the app (`darwin`, `ios`, `ipados`, or `android`). If not specified, and `app_store_id` is Apple App Store ID, one app for each of the Apple App Store app's supported platforms is added. For example, adding [Bear](https://apps.apple.com/us/app/bear-markdown-notes/id1016366447) (supported on iOS and iPadOS) adds both the iOS and iPadOS apps to your software that's available to install in Fleet.
- `icon.path` is a relative path to the PNG icon that will be displayed in Fleet and on **Fleet Desktop > Self-service** instead of the default icon the icon sourced from Apple. It must be a square PNG with dimensions between 120x120 px and 1024x1024 px. Custom icons will only override the icon for the software title and team where they are added.
To add the same App Store app for multiple platforms, specify the `app_store_id` multiple times, along with the `platform` you want. If you don't specify a platform, one app for each available platform will be added (macOS, iOS, and iPadOS).
docs/Contributing/reference/api-for-contributors.md
+71
View File
@@ -16,6 +16,7 @@ These API endpoints in this document are only used when contributing to Fleet. T
- [Setup](#setup)
- [Scripts](#scripts)
- [Software](#software)
- [Certificates](#certificates)
- [Users](#users)
- [Conditional access](#conditional-access)
- [Host identity](#host-identity)
@@ -4878,6 +4879,76 @@ Body: <blob>
---
## Certificates
### Apply certificate templates
_Available in Fleet Premium_
`POST /api/latest/fleet/spec/certificates`
#### Parameters
| Name | Type | In | Description |
| --------- | ------ | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| specs | array | body | **Required**. An array of objects with the certificate templates. Each item must contain `name` with the certificate template name, a `team` with a team name, `certificate_authority_id` with the certificate authority id, and `subject_name` with the certificate's subject name. |
> Any existing certificate template that is not included in the list will be removed, and existing templates with the same name as the new template will be edited. Providing an empty list of certificate templates will remove existing scripts.
#### Example
`POST /api/latest/fleet/spec/certificates`
##### Request body
```json
{
"specs": [
{
"name": "WIFI_CERTIFICATE",
"team": "workstations",
"certificate_authority_id": 1,
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL"
},
{
"name": "WIFI_CERTIFICATE_TEST",
"team": "workstations-canary",
"certificate_authority_id": 1,
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL"
}
]
}
```
##### Default response
`Status: 200`
### Delete certificate templates
`DELETE /api/latest/fleet/spec/certificates`
#### Parameters
| Name | Type | In | Description |
|-----------|---------|-------|----------------------------------------------------------------------------------------|
| ids | array | body | **Required**. An array of certificate template ids to be deleted |
| team_id | integer | body | **Required**. The team_id which the certificate templates you want to delete belong to |
#### Example
`DELETE /api/latest/fleet/spec/certificates`
```json
{
"ids": [1, 2, 3, 4],
"team_id": 1
}
```
##### Default response
`Status: 200`
## Users
### Update user-specific UI settings
docs/REST API/rest-api.md
+169 -8
View File
@@ -511,6 +511,10 @@ Returns a list of the activities that have been performed in Fleet. For a compre
| per_page | integer | query | Results per page. |
| order_key | string | query | What to order results by. Can be any column in the `activities` table. |
| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `"asc"` and `"desc"`. Default is `"asc"`. |
| query | string | query | Search query keywords. Searchable fields include `actor_full_name` and `actor_email`.
| activity_type | string | query | Indicates the activity `type` to filter by. See available activity types in the [Audit logs docs](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/audit-logs.md).
| start_created_at | string | query | Filters to include only activities that happened after this date. If not specified, set to the earliest possible date.
| end_created_at | string | query | Filters to include only activities that happened before this date. If not specified, set to now. |
#### Example
@@ -590,6 +594,8 @@ Returns a list of the activities that have been performed in Fleet. For a compre
- [Update certificate authority (CA)](#update-certificate-authority-ca)
- [List certificate authorities (CAs)](#list-certificate-authorities-cas)
- [Get certificate authority (CA)](#get-certificate-authority-ca)
- [List certificate templates](#list-certificate-templates)
- [Get certificate template](#get-certificate-template)
- [Delete certificate authority (CA)](#delete-certificate-authority-ca)
- [Request certificate](#request-certificate)
@@ -850,6 +856,119 @@ Get details of the certificate authority.
}
```
### List certificate templates
List certificate added to Fleet. Currently, they can only be added via GitOps.
`GET /api/v1/fleet/certificates`
#### Parameters
| Name | Type | In | Description |
| ----------| ------- | ---- | -------------------------------------------------------------- |
| team | string | query | _Available in Fleet Premium_. The team ID to filter profiles. |
| page | integer | query | Page number of the results to fetch. |
| per_page | integer | query | Results per page. |
#### Request headers
This endpoint accepts the node key from Fleet's Android agent for authentication in addition to [default authentication](#retrieve-your-api-token) with a Bearer token.
The `Authorization` header must be formatted as follows:
```
Authorization: Node key <node_key>
```
#### Example
`GET /api/v1/fleet/certificates/`
##### Request headers
```http
Authorization: Node key 24dd9ebf-02cd-4d4c-888a-5caa441ee5d5
```
##### Default response
`Status: 200`
```json
{
"certificates": [
{
"id": 1,
"name": "wifi-certificate",
"certificate_authority_id": "1",
"certificate_authority_name": "PRODUCTION_SCEP_SERVER",
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",
"created_at": "2025-11-04T00:00:00Z",
},
{
"id": 2,
"name": "vpn-certificate",
"certificate_authority_id": "1",
"certificate_authority_name": "PRODUCTION_SCEP_SERVER",
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID",
"created_at": "2025-11-04T00:00:00Z",
}
],
"meta": {
"has_next_results": false,
"has_previous_results": false
}
}
```
### Get certificate template
Get details of the certificate added to Fleet.
`GET /api/v1/fleet/certificates/:id`
#### Parameters
| Name | Type | In | Description |
|---------------- |-------- |------|-------------------------------------------------------------|
| id | integer | path | **Required**. The ID of the certificate. |
| host_id | integer | query | ID of the host. If included, variables in `subject_name` will be replaced with host's values. |
#### Request headers
This endpoint accepts the node key from Fleet's Android agent for authentication in addition to [default authentication](#retrieve-your-api-token) with a Bearer token.
The `Authorization` header must be formatted as follows:
```
Authorization: Node key <node_key>
```
#### Example
`GET /api/v1/fleet/certificates/1`
##### Request headers
```http
Authorization: Node key 24dd9ebf-02cd-4d4c-888a-5caa441ee5d5
```
##### Default response
`Status: 200`
```json
{
"certificate_authority_id": 2,
"certificate_authority_name": "PRODUCTION_SCEP_SERVER",
"created_at": "2025-11-04T00:00:00Z",
"id": 1,
"name": "wifi-certificate",
"subject_name": "/CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME/OU=$FLEET_VAR_HOST_UUID/ST=$FLEET_VAR_HOST_HARDWARE_SERIAL",
}
```
### Delete certificate authority (CA)
> **Experimental feature**. This feature is undergoing rapid improvement, which may result in breaking changes to the API or configuration surface. It is not recommended for use in automated workflows.
@@ -1252,8 +1371,12 @@ None.
"sso_server_url": ""
},
"conditional_access": {
"microsoft_entra_tenant_id": "<TENANT ID>",
"microsoft_entra_connection_configured": true
"microsoft_entra_tenant_id": "",
"microsoft_entra_connection_configured": false,
"okta_idp_id": "0ogmbinlfy9hvGs7cx492",
"okta_assertion_consumer_service_url": "https://example.okta.com/sso/saml2/0ogmbinlfy9hvGs7cx492",
"okta_audience_uri": "https://www.okta.com/saml2/service-provider/asdhjlksoewpoasn",
"okta_certificate": "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----"
},
"host_expiry_settings": {
"host_expiry_enabled": false,
@@ -1271,6 +1394,7 @@ None.
"mdm": {
"android_enabled_and_configured": true,
"windows_enabled_and_configured": true,
"enable_turn_on_windows_mdm_manually": false,
"enable_disk_encryption": true,
"windows_require_bitlocker_pin": false,
"macos_updates": {
@@ -1490,6 +1614,7 @@ Modifies the Fleet's configuration with the supplied information.
| integrations | object | body | See [integrations](#integrations). |
| gitops | object | body | See [gitops](#gitops). |
| mdm | object | body | See [mdm](#mdm). |
| conditional_access | object | body | See [conditional_access](#conditional-access). |
| features | object | body | See [features](#features). |
| scripts | array | body | A list of script files to add so they can be executed at a later time. |
| yara_rules | array | body | A list of YARA rule files to add. |
@@ -1557,7 +1682,11 @@ Modifies the Fleet's configuration with the supplied information.
},
"conditional_access": {
"microsoft_entra_tenant_id": "<TENANT ID>",
"microsoft_entra_connection_configured": true
"microsoft_entra_connection_configured": true,
"okta_idp_id": "0ogmbinlfy9hvGs7cx492",
"okta_assertion_consumer_service_url": "https://example.okta.com/sso/saml2/0ogmbinlfy9hvGs7cx492",
"okta_audience_uri": "https://www.okta.com/saml2/service-provider/asdhjlksoewpoasn",
"okta_certificate": "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----"
},
"host_expiry_settings": {
"host_expiry_enabled": false,
@@ -1580,6 +1709,7 @@ Modifies the Fleet's configuration with the supplied information.
"enabled_and_configured": false,
"android_enabled_and_configured": false,
"windows_enabled_and_configured": false,
"enable_turn_on_windows_mdm_manually": false,
"enable_disk_encryption": true,
"windows_require_bitlocker_pin": false,
"macos_updates": {
@@ -2128,11 +2258,38 @@ _Available in Fleet Premium._
}
```
#### conditional_access
_Available in Fleet Premium._
| Name | Type | Description |
| --------------------- | ------- | -------------------------------------------------------------------------------- |
| okta_idp_id | string | The IdP ID found in Okta after creating an IdP in **Security** > **Identity Providers** > **SAML 2.0 IdP** |
| okta_assertion_consumer_service_url | string | The assertion consumer service URL found in Okta after creating an IdP in **Security** > **Identity Providers** > **SAML 2.0 IdP** |
| okta_audience_uri | string | The audience URI found in Okta after creating an IdP in **Security** > **Identity Providers** > **SAML 2.0 IdP** |
| okta_certificate | string | The certificate provided by Okta during the **Set Up Authenticator** workflow |
When updating conditional access config, all `conditional_access` fields must either be empty or included in the request.
##### Example request body
```json
{
"conditional_access": {
"okta_idp_id": "0ogmbinlfy9hvGs7cx492",
"okta_assertion_consumer_service_url": "https://example.okta.com/sso/saml2/0ogmbinlfy9hvGs7cx492",
"okta_audience_uri": "https://www.okta.com/saml2/service-provider/asdhjlksoewpoasn",
"okta_certificate": "-----BEGIN CERTIFICATE-----\nMIIC...\n-----END CERTIFICATE-----"
}
}
```
#### mdm
| Name | Type | Description |
| --------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| windows_enabled_and_configured | boolean | Enables Windows MDM support. |
| enable_turn_on_windows_mdm_manually | boolean | _Available in Fleet Premium._ Specifies whether or not to require end users to manually turn on MDM in **Settings > Access work or school**. If `false`, MDM is automatically turned on for all Windows hosts that aren't connected to any MDM solution. |
| enable_disk_encryption | boolean | _Available in Fleet Premium._ Hosts that belong to no team will have disk encryption enabled if set to true. |
| windows_require_bitlocker_pin | boolean | _Available in Fleet Premium._ End users on Windows hosts that belong to no team will be required to set a BitLocker PIN if set to true. `enable_disk_encryption` must be set to true. When the PIN is set, it's required to unlock Windows host during startup. |
| macos_updates | object | See [`mdm.macos_updates`](#mdm-macos-updates). |
@@ -2266,6 +2423,7 @@ _Available in Fleet Premium._
{
"mdm": {
"windows_enabled_and_configured": false,
"enable_turn_on_windows_mdm_manually": false,
"enable_disk_encryption": true,
"windows_require_bitlocker_pin": false,
"macos_updates": {
@@ -6796,7 +6954,7 @@ List software that can be automatically installed during setup. If `install_duri
| Name | Type | In | Description |
| ----- | ------ | ----- | ---------------------------------------- |
| platform | string | query | Platform to show compatible software for. Either `"macos"`, `"windows"`, `"linux"`, `"ios"`, or `"ipados"`. Defaults to `"macos"`. |
| platform | string | query | Platform to show compatible software for. Either `"macos"`, `"windows"`, `"linux"`, `"ios"`, `"ipados"`, or `"android"`. Defaults to `"macos"`. |
| team_id | integer | query | _Available in Fleet Premium_. The ID of the team to filter software by. If not specified, it will filter only software that's available to hosts with no team. |
| page | integer | query | Page number of the results to fetch. |
| per_page | integer | query | Results per page. |
@@ -6869,7 +7027,7 @@ Set software that will be automatically installed during setup. Software that is
| Name | Type | In | Description |
| ----- | ------ | ----- | ---------------------------------------- |
| platform | string | query | Platform to install software for. Either `"macos"`, `"windows"`, `"linux"`, `"ios"`, or `"ipados"`. Defaults to `"macos"`. |
| platform | string | query | Platform to install software for. Either `"macos"`, `"windows"`, `"linux"`, `"ios"`, `"ipados"`, or `"android"`. Defaults to `"macos"`. |
| team_id | integer | query | _Available in Fleet Premium_. The ID of the team to set the software for. If not specified, it will set the software for hosts with no team. |
| software_title_ids | array | body | The ID of software titles to install during setup. |
@@ -10744,7 +10902,7 @@ Returns the list of Apple App Store (VPP) apps that can be added to the specifie
_Available in Fleet Premium._
Add app store apps from the Apple App Store or the Google Play store.
Add Apple App Store or Google Play store app. Apple apps must be added in Apple Business Manager (ABM) before adding them to Fleet.
`POST /api/v1/fleet/software/app_store_apps`
@@ -10759,6 +10917,7 @@ Add app store apps from the Apple App Store or the Google Play store.
| ensure | string | form | For macOS only, if set to "present" (currently the only valid value if set), create a policy that triggers a software install only on hosts missing the software. |
| labels_include_any | array | form | Target hosts that have any label, specified by label name, in the array. |
| labels_exclude_any | array | form | Target hosts that don't have any label, specified by label name, in the array. |
| configuration | object | form | The Android Play Store app's managed configuration in JSON format. Currently only supported for Android. |
Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither are specified, all hosts are targeted.
@@ -10795,7 +10954,8 @@ Only one of `labels_include_any` or `labels_exclude_any` can be specified. If ne
_Available in Fleet Premium._
Modify an Apple app store (VPP) or a Google Play app's options.
Modify an Apple App Store (VPP) or a Google Play app's options.
`PATCH /api/v1/fleet/software/titles/:title_id/app_store_app`
@@ -10809,6 +10969,7 @@ Modify an Apple app store (VPP) or a Google Play app's options.
| categories | string[] | body | Zero or more of the [supported categories](https://fleetdm.com/docs/configuration/yaml-files#supported-software-categories), used to group self-service software on your end users' **Fleet Desktop > My device** page. Software with no categories will be still be shown under **All**. |
| labels_include_any | array | form | Target hosts that have any label, specified by label name, in the array. |
| labels_exclude_any | array | form | Target hosts that don't have any label, specified by label name, in the array. |
| configuration | object | form | The Android Play Store app's managed configuration in JSON format. Currently only supported for Android. |
Only one of `labels_include_any` or `labels_exclude_any` can be specified. If neither are specified, all hosts are targeted.
@@ -11912,7 +12073,7 @@ _Available in Fleet Premium_
| jira | array | See [`integrations.jira`](#integrations-jira2). |
| zendesk | array | See [`integrations.zendesk`](#integrations-zendesk2). |
| google_calendar | array | See [`integrations.google_calendar`](#integrations-google-calendar2). |
| conditional_access_enabled | boolean | **Available in Fleet Premium for managed cloud customers.** Whether to block third party app sign-ins on hosts failing policies. Must have Microsoft Entra connected and configured in global config. |
| conditional_access_enabled | boolean | **Available in Fleet Premium.** Whether to block third party app sign-ins on hosts failing policies. Must have Microsoft Entra or Okta connected and configured in global config. |
<br/>
docs/solutions/ios-ipados/Fleet-self-service.mobileconfig
+4320
View File
File diff suppressed because it is too large Load Diff