Added new 'update_new_hosts' OS Setting config field (#37027)

**Related issue:** Resolves #36189 

Added new 'update_new_hosts' OS Setting config field

changes/36189-added-migration-for-update-new-hosts

@@ -0,0 +1 @@
+* Created migration for adding 'update_new_hosts' flag to both App and Team configs.

cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigJson.json

@@ -114,15 +114,18 @@
       "enable_disk_encryption": false,
       "macos_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "ios_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "ipados_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "windows_updates": {
         "deadline_days": 7,

cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerJson.json

@@ -87,15 +87,18 @@
       "windows_require_bitlocker_pin": null,
       "macos_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "ios_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "ipados_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "windows_updates": {
         "deadline_days": 7,

cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigTeamMaintainerYaml.yml

@@ -43,12 +43,15 @@ spec:
       mode: ""
       webhook_url: ""
     macos_updates:
+      update_new_hosts: null
       minimum_version: null
       deadline: null
     ios_updates:
+      update_new_hosts: null
       minimum_version: null
       deadline: null
     ipados_updates:
+      update_new_hosts: null
       minimum_version: null
       deadline: null
     windows_updates:

cmd/fleetctl/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml

@@ -45,12 +45,15 @@ spec:
     macos_updates:
       minimum_version: null
       deadline: null
+      update_new_hosts: null
     ios_updates:
       minimum_version: null
       deadline: null
+      update_new_hosts: null
     ipados_updates:
       minimum_version: null
       deadline: null
+      update_new_hosts: null
     windows_updates:
       deadline_days: 7
       grace_period_days: 3

cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json

@@ -66,15 +66,18 @@
       "windows_require_bitlocker_pin": null,
       "macos_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "ios_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "ipados_updates": {
         "minimum_version": null,
-        "deadline": null
+        "deadline": null,
+        "update_new_hosts": null
       },
       "windows_updates": {
         "deadline_days": 7,

cmd/fleetctl/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml

@@ -45,12 +45,15 @@ spec:
     macos_updates:
       minimum_version: null
       deadline: null
+      update_new_hosts: null
     ios_updates:
       minimum_version: null
       deadline: null
+      update_new_hosts: null
     ipados_updates:
       minimum_version: null
       deadline: null
+      update_new_hosts: null
     windows_updates:
       deadline_days: 7
       grace_period_days: 3

cmd/fleetctl/fleetctl/testdata/expectedGetTeamsJson.json

@@ -30,14 +30,17 @@
 				"enable_disk_encryption": false,
 				"windows_require_bitlocker_pin": false,
 				"macos_updates": {
+					"update_new_hosts": null,
 					"minimum_version": null,
 					"deadline": null
 				},
 				"ios_updates": {
+					"update_new_hosts": null,
 					"minimum_version": null,
 					"deadline": null
 				},
 				"ipados_updates": {
+					"update_new_hosts": null,
 					"minimum_version": null,
 					"deadline": null
 				},
@@ -120,14 +123,17 @@
 				"enable_disk_encryption": false,
 				"windows_require_bitlocker_pin": false,
 				"macos_updates": {
+					"update_new_hosts": null,
 					"minimum_version": "12.3.1",
 					"deadline": "2021-12-14"
 				},
 				"ios_updates": {
+					"update_new_hosts": null,
 					"minimum_version": "17.5",
 					"deadline": "2022-11-15"
 				},
 				"ipados_updates": {
+					"update_new_hosts": null,
 					"minimum_version": "18.0",
 					"deadline": "2023-01-01"
 				},

cmd/fleetctl/fleetctl/testdata/expectedGetTeamsYaml.yml

@@ -16,12 +16,15 @@ spec:
       enable_disk_encryption: false
       windows_require_bitlocker_pin: null
       macos_updates:
+        update_new_hosts: null
         minimum_version: null
         deadline: null
       ios_updates:
+        update_new_hosts: null
         minimum_version: null
         deadline: null
       ipados_updates:
+        update_new_hosts: null
         minimum_version: null
         deadline: null
       windows_updates:

cmd/fleetctl/fleetctl/testdata/generateGitops/expectedGlobalControls.yaml

@@ -18,12 +18,15 @@ android_settings:
 macos_updates:
   minimum_version: "15.1"
   deadline: "2024-12-31"
+  update_new_hosts:
 ios_updates:
   minimum_version: "18.1"
   deadline: "2025-12-31"
+  update_new_hosts:
 ipados_updates:
   minimum_version: "18.2"
   deadline: "2026-12-31"
+  update_new_hosts:
 windows_updates:
   deadline_days: 5
   grace_period_days: 2

cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/teams/no-team.yml

@@ -5,9 +5,11 @@ controls:
   ios_updates:
     deadline: "2025-12-31"
     minimum_version: "18.1"
+    update_new_hosts:
   ipados_updates:
     deadline: "2026-12-31"
     minimum_version: "18.2"
+    update_new_hosts:
   macos_migration:
     enable: true
     mode: voluntary
@@ -16,6 +18,7 @@ controls:
   macos_updates:
     deadline: "2024-12-31"
     minimum_version: "15.1"
+    update_new_hosts:
   scripts:
   - path: ../lib/no-team/scripts/Script Z.ps1
   windows_enabled_and_configured: true

cmd/fleetctl/fleetctl/testdata/generateGitops/test_dir_premium/teams/team-a-thumbsup.yml

@@ -27,15 +27,18 @@ controls:
   ios_updates:
     deadline: "2021-12-31"
     minimum_version: "98.1"
+    update_new_hosts:
   ipados_updates:
     deadline: "2022-12-31"
     minimum_version: "98.2"
+    update_new_hosts:
   macos_settings:
     custom_settings:
     - path: "../lib/team-a-👍/profiles/team-macos-mobileconfig-profile.mobileconfig"
   macos_updates:
     deadline: "2020-12-31"
     minimum_version: "95.1"
+    update_new_hosts:
   scripts:
   - path: "../lib/team-a-👍/scripts/Script B.ps1"
   windows_enabled_and_configured: true

cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml

@@ -61,12 +61,15 @@ spec:
     macos_updates:
       deadline: null
       minimum_version: null
+      update_new_hosts: null
     ios_updates:
       deadline: null
       minimum_version: null
+      update_new_hosts: null
     ipados_updates:
       deadline: null
       minimum_version: null
+      update_new_hosts: null
     windows_updates:
       deadline_days: null
       grace_period_days: null

cmd/fleetctl/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml

@@ -61,12 +61,15 @@ spec:
     macos_updates:
       deadline: null
       minimum_version: null
+      update_new_hosts: null
     ios_updates:
       deadline: null
       minimum_version: null
+      update_new_hosts: null
     ipados_updates:
       deadline: null
       minimum_version: null
+      update_new_hosts: null
     windows_updates:
       deadline_days: null
       grace_period_days: null

cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml

@@ -34,12 +34,15 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ios_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ipados_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       windows_updates:
         deadline_days: null
         grace_period_days: null

cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml

@@ -34,12 +34,15 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ios_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ipados_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       windows_updates:
         deadline_days: null
         grace_period_days: null

cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml

@@ -32,12 +32,15 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ios_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ipados_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       windows_updates:
         deadline_days: null
         grace_period_days: null

cmd/fleetctl/fleetctl/testdata/macosSetupExpectedTeam1Set.yml

@@ -33,12 +33,15 @@ spec:
       macos_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ios_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       ipados_updates:
         deadline: null
         minimum_version: null
+        update_new_hosts: null
       windows_updates:
         deadline_days: null
         grace_period_days: null

server/datastore/mysql/migrations/tables/20251209221730_AddUpdateNewHostsFlagToConfig.go

@@ -0,0 +1,74 @@
+package tables
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/fleetdm/fleet/v4/pkg/optjson"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+)
+
+func init() {
+	MigrationClient.AddMigration(Up_20251209221730, Down_20251209221730)
+}
+
+func Up_20251209221730(tx *sql.Tx) error {
+	// Update global config
+	if err := updateAppConfigJSON(tx, func(config *fleet.AppConfig) error {
+		if config != nil {
+			config.MDM.MacOSUpdates.UpdateNewHosts = optjson.SetBool(config.MDM.MacOSUpdates.Configured())
+		}
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	// Update team config
+	rows, err := tx.Query("SELECT config, id FROM teams WHERE config IS NOT NULL")
+	if err != nil {
+		return fmt.Errorf("selecting team configs: %w", err)
+	}
+	defer rows.Close()
+
+	type teamData struct {
+		id  uint
+		raw []byte
+	}
+	var teams []teamData
+	for rows.Next() {
+		var t teamData
+		if err := rows.Scan(&t.raw, &t.id); err != nil {
+			return fmt.Errorf("scanning teams row: %w", err)
+		}
+		teams = append(teams, t)
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	if err := rows.Err(); err != nil {
+		return fmt.Errorf("iterating team configs: %w", err)
+	}
+
+	for _, t := range teams {
+		var config fleet.TeamConfig
+		if err := json.Unmarshal(t.raw, &config); err != nil {
+			return fmt.Errorf("unmarshalling team config: %w", err)
+		}
+		config.MDM.MacOSUpdates.UpdateNewHosts = optjson.SetBool(config.MDM.MacOSUpdates.Configured())
+
+		b, err := json.Marshal(config)
+		if err != nil {
+			return fmt.Errorf("marshaling team config: %w", err)
+		}
+
+		if _, err := tx.Exec(`UPDATE teams SET config = ? WHERE id = ?`, b, t.id); err != nil {
+			return fmt.Errorf("updating team config: %w", err)
+		}
+	}
+	return nil
+}
+
+func Down_20251209221730(tx *sql.Tx) error {
+	return nil
+}

server/datastore/mysql/migrations/tables/20251209221730_AddUpdateNewHostsFlagToConfig_test.go

@@ -0,0 +1,115 @@
+package tables
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/fleetdm/fleet/v4/pkg/optjson"
+	"github.com/fleetdm/fleet/v4/server/fleet"
+	"github.com/stretchr/testify/require"
+)
+
+func TestUp_20251209221730(t *testing.T) {
+	db := applyUpToPrev(t)
+
+	// Setup AppConfig
+	var prevRaw []byte
+	var appConfig1 fleet.AppConfig
+	err := db.Get(&prevRaw, `SELECT json_value FROM app_config_json`)
+	require.NoError(t, err)
+
+	appConfig1.MDM.MacOSUpdates.Deadline = optjson.SetString("2025-01-01")
+	appConfig1.MDM.MacOSUpdates.MinimumVersion = optjson.SetString("14.0.0")
+
+	b1, err := json.Marshal(appConfig1)
+	require.NoError(t, err)
+
+	_, err = db.Exec(`UPDATE app_config_json SET json_value = ?`, b1)
+	require.NoError(t, err)
+
+	// Setup Teams
+	// Team 1: Configured
+	teamConfig1 := fleet.TeamConfig{}
+	teamConfig1.MDM.MacOSUpdates.Deadline = optjson.SetString("2025-01-01")
+	teamConfig1.MDM.MacOSUpdates.MinimumVersion = optjson.SetString("14.0.0")
+	bT1, err := json.Marshal(teamConfig1)
+	require.NoError(t, err)
+	_, err = db.Exec(`INSERT INTO teams (id, name, config) VALUES (1, 'team1', ?)`, bT1)
+	require.NoError(t, err)
+
+	// Team 2: Not Configured (missing deadline)
+	teamConfig2 := fleet.TeamConfig{}
+	teamConfig2.MDM.MacOSUpdates.MinimumVersion = optjson.SetString("14.0.0")
+	bT2, err := json.Marshal(teamConfig2)
+	require.NoError(t, err)
+	_, err = db.Exec(`INSERT INTO teams (id, name, config) VALUES (2, 'team2', ?)`, bT2)
+	require.NoError(t, err)
+
+	// Team 3: Not Configured (missing min version)
+	teamConfig3 := fleet.TeamConfig{}
+	teamConfig3.MDM.MacOSUpdates.Deadline = optjson.SetString("2025-01-01")
+	bT3, err := json.Marshal(teamConfig3)
+	require.NoError(t, err)
+	_, err = db.Exec(`INSERT INTO teams (id, name, config) VALUES (3, 'team3', ?)`, bT3)
+	require.NoError(t, err)
+
+	// Team 4: Explicitly false but Configured (should become true)
+	teamConfig4 := fleet.TeamConfig{}
+	teamConfig4.MDM.MacOSUpdates.Deadline = optjson.SetString("2025-01-01")
+	teamConfig4.MDM.MacOSUpdates.MinimumVersion = optjson.SetString("14.0.0")
+	teamConfig4.MDM.MacOSUpdates.UpdateNewHosts = optjson.Bool{Value: false}
+	bT4, err := json.Marshal(teamConfig4)
+	require.NoError(t, err)
+	_, err = db.Exec(`INSERT INTO teams (id, name, config) VALUES (4, 'team4', ?)`, bT4)
+	require.NoError(t, err)
+
+	// Apply current migration.
+	applyNext(t, db)
+
+	// Verify AppConfig
+	var rawAppConfig []byte
+	err = db.QueryRow(`SELECT json_value FROM app_config_json WHERE id = 1`).Scan(&rawAppConfig)
+	require.NoError(t, err)
+	var finalAppConfig fleet.AppConfig
+	err = json.Unmarshal(rawAppConfig, &finalAppConfig)
+	require.NoError(t, err)
+	require.True(t, finalAppConfig.MDM.MacOSUpdates.UpdateNewHosts.Set)
+	require.True(t, finalAppConfig.MDM.MacOSUpdates.UpdateNewHosts.Value)
+
+	// Verify Teams
+	// Team 1: Configured -> True
+	var rawTeamConfig1 []byte
+	err = db.QueryRow(`SELECT config FROM teams WHERE id = 1`).Scan(&rawTeamConfig1)
+	require.NoError(t, err)
+	var finalTeamConfig1 fleet.TeamConfig
+	err = json.Unmarshal(rawTeamConfig1, &finalTeamConfig1)
+	require.NoError(t, err)
+	require.True(t, finalTeamConfig1.MDM.MacOSUpdates.UpdateNewHosts.Value)
+
+	// Team 2: Missing deadline -> False
+	var rawTeamConfig2 []byte
+	err = db.QueryRow(`SELECT config FROM teams WHERE id = 2`).Scan(&rawTeamConfig2)
+	require.NoError(t, err)
+	var finalTeamConfig2 fleet.TeamConfig
+	err = json.Unmarshal(rawTeamConfig2, &finalTeamConfig2)
+	require.NoError(t, err)
+	require.False(t, finalTeamConfig2.MDM.MacOSUpdates.UpdateNewHosts.Value)
+
+	// Team 3: Missing minimum version -> False
+	var rawTeamConfig3 []byte
+	err = db.QueryRow(`SELECT config FROM teams WHERE id = 3`).Scan(&rawTeamConfig3)
+	require.NoError(t, err)
+	var finalTeamConfig3 fleet.TeamConfig
+	err = json.Unmarshal(rawTeamConfig3, &finalTeamConfig3)
+	require.NoError(t, err)
+	require.False(t, finalTeamConfig3.MDM.MacOSUpdates.UpdateNewHosts.Value)
+
+	// Team 4: Was false, but configured -> True
+	var rawTeamConfig4 []byte
+	err = db.QueryRow(`SELECT config FROM teams WHERE id = 4`).Scan(&rawTeamConfig4)
+	require.NoError(t, err)
+	var finalTeamConfig4 fleet.TeamConfig
+	err = json.Unmarshal(rawTeamConfig4, &finalTeamConfig4)
+	require.NoError(t, err)
+	require.True(t, finalTeamConfig4.MDM.MacOSUpdates.UpdateNewHosts.Value)
+}

server/datastore/mysql/teams_test.go

@@ -718,14 +718,17 @@ func testTeamsMDMConfig(t *testing.T, ds *Datastore) {
 			MacOSUpdates: fleet.AppleOSUpdateSettings{
 				MinimumVersion: optjson.SetString("10.15.0"),
 				Deadline:       optjson.SetString("2025-10-01"),
+				UpdateNewHosts: optjson.Bool{Set: true},
 			},
 			IOSUpdates: fleet.AppleOSUpdateSettings{
 				MinimumVersion: optjson.SetString("11.11.11"),
 				Deadline:       optjson.SetString("2024-04-04"),
+				UpdateNewHosts: optjson.Bool{Set: true},
 			},
 			IPadOSUpdates: fleet.AppleOSUpdateSettings{
 				MinimumVersion: optjson.SetString("12.12.12"),
 				Deadline:       optjson.SetString("2023-03-03"),
+				UpdateNewHosts: optjson.Bool{Set: true},
 			},
 			WindowsUpdates: fleet.WindowsUpdates{
 				DeadlineDays:    optjson.SetInt(7),

server/fleet/app.go

@@ -320,6 +320,8 @@ var versionStringRegex = regexp.MustCompile(`^\d+(\.\d+)?(\.\d+)?$`)
 // AppleOSUpdateSettings is the common type that contains the settings
 // for OS updates on Apple devices.
 type AppleOSUpdateSettings struct {
+	// UpdateNewHosts if true, only enforce the latest macOS version for new hosts (during enrollment)
+	UpdateNewHosts optjson.Bool `json:"update_new_hosts"`
 	// MinimumVersion is the required minimum operating system version.
 	MinimumVersion optjson.String `json:"minimum_version"`
 	// Deadline the required installation date for Nudge to enforce the required

server/service/appconfig_test.go

@@ -935,9 +935,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
@@ -985,9 +985,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
@@ -1017,9 +1017,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
@@ -1056,9 +1056,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
@@ -1095,9 +1095,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
@@ -1134,9 +1134,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{
@@ -1198,9 +1198,9 @@ func TestMDMConfig(t *testing.T) {
 					Script:                      optjson.String{Set: true},
 					ManualAgentInstall:          optjson.Bool{Set: true},
 				},
-				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
-				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}},
+				MacOSUpdates:            fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IOSUpdates:              fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
+				IPadOSUpdates:           fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.Bool{Set: true}},
 				VolumePurchasingProgram: optjson.Slice[fleet.MDMAppleVolumePurchasingProgramInfo]{Set: true, Value: []fleet.MDMAppleVolumePurchasingProgramInfo{}},
 				WindowsUpdates:          fleet.WindowsUpdates{DeadlineDays: optjson.Int{Set: true}, GracePeriodDays: optjson.Int{Set: true}},
 				WindowsSettings: fleet.WindowsSettings{

server/service/integration_enterprise_test.go

@@ -252,14 +252,17 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("17.5.1"),
 			Deadline:       optjson.SetString("2024-07-23"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("18.0"),
 			Deadline:       optjson.SetString("2024-08-24"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.Int{Set: true},
@@ -364,14 +367,17 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("17.5.1"),
 			Deadline:       optjson.SetString("2024-07-23"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("18.0"),
 			Deadline:       optjson.SetString("2024-08-24"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(1),
@@ -401,14 +407,17 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("17.5.1"),
 			Deadline:       optjson.SetString("2024-07-23"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("18.0"),
 			Deadline:       optjson.SetString("2024-08-24"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(1),
@@ -440,14 +449,17 @@ func (s *integrationEnterpriseTestSuite) TestTeamSpecs() {
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("10.15.0"),
 			Deadline:       optjson.SetString("2021-01-01"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("17.5.1"),
 			Deadline:       optjson.SetString("2024-07-23"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.SetString("18.0"),
 			Deadline:       optjson.SetString("2024-08-24"),
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(1),
@@ -2662,14 +2674,17 @@ func (s *integrationEnterpriseTestSuite) TestWindowsUpdatesTeamConfig() {
 		MacOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.String{Set: true},
 			Deadline:       optjson.String{Set: true},
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.String{Set: true},
 			Deadline:       optjson.String{Set: true},
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		IPadOSUpdates: fleet.AppleOSUpdateSettings{
 			MinimumVersion: optjson.String{Set: true},
 			Deadline:       optjson.String{Set: true},
+			UpdateNewHosts: optjson.Bool{Set: true},
 		},
 		WindowsUpdates: fleet.WindowsUpdates{
 			DeadlineDays:    optjson.SetInt(5),
@@ -3781,7 +3796,7 @@ func (s *integrationEnterpriseTestSuite) TestMDMAppleOSUpdates() {
 		// get the appconfig, nothing changed
 		acResp = appConfigResponse{}
 		s.DoJSON("GET", "/api/latest/fleet/config", nil, http.StatusOK, &acResp)
-		require.Equal(t, fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}}, acResp.MDM.MacOSUpdates)
+		require.Equal(t, fleet.AppleOSUpdateSettings{MinimumVersion: optjson.String{Set: true}, Deadline: optjson.String{Set: true}, UpdateNewHosts: optjson.SetBool(false)}, acResp.MDM.MacOSUpdates)
 
 		// no activity got created
 		activitiesResp = listActivitiesResponse{}

tools/cloner-check/generated_files/appconfig.txt

@@ -115,6 +115,7 @@ github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMEnabledAndConfigured	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	AppleBMTermsExpired	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	EnabledAndConfigured	bool
 github.com/fleetdm/fleet/v4/server/fleet/MDM	MacOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	UpdateNewHosts	optjson.Bool
 github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	MinimumVersion	optjson.String
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Valid	bool

tools/cloner-check/generated_files/teamconfig.txt

@@ -33,6 +33,7 @@ github.com/fleetdm/fleet/v4/server/fleet/TeamConfig	MDM	fleet.TeamMDM
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	EnableDiskEncryption	bool
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	RequireBitLockerPIN	bool
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	MacOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	UpdateNewHosts	optjson.Bool
 github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	MinimumVersion	optjson.String
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Valid	bool

tools/cloner-check/generated_files/teammdm.txt

@@ -1,6 +1,10 @@
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	EnableDiskEncryption	bool
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	RequireBitLockerPIN	bool
 github.com/fleetdm/fleet/v4/server/fleet/TeamMDM	MacOSUpdates	fleet.AppleOSUpdateSettings
+github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	UpdateNewHosts	optjson.Bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Bool	Set	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Bool	Valid	bool
+github.com/fleetdm/fleet/v4/pkg/optjson/Bool	Value	bool
 github.com/fleetdm/fleet/v4/server/fleet/AppleOSUpdateSettings	MinimumVersion	optjson.String
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Set	bool
 github.com/fleetdm/fleet/v4/pkg/optjson/String	Valid	bool
@@ -27,9 +31,6 @@ github.com/fleetdm/fleet/v4/server/fleet/MacOSSetup	BootstrapPackage	optjson.Str
 github.com/fleetdm/fleet/v4/server/fleet/MacOSSetup	EnableEndUserAuthentication	bool
 github.com/fleetdm/fleet/v4/server/fleet/MacOSSetup	MacOSSetupAssistant	optjson.String
 github.com/fleetdm/fleet/v4/server/fleet/MacOSSetup	EnableReleaseDeviceManually	optjson.Bool
-github.com/fleetdm/fleet/v4/pkg/optjson/Bool	Set	bool
-github.com/fleetdm/fleet/v4/pkg/optjson/Bool	Valid	bool
-github.com/fleetdm/fleet/v4/pkg/optjson/Bool	Value	bool
 github.com/fleetdm/fleet/v4/server/fleet/MacOSSetup	Script	optjson.String
 github.com/fleetdm/fleet/v4/server/fleet/MacOSSetup	Software	optjson.Slice[*github.com/fleetdm/fleet/v4/server/fleet.MacOSSetupSoftware]
 github.com/fleetdm/fleet/v4/pkg/optjson/Slice[*github.com/fleetdm/fleet/v4/server/fleet.MacOSSetupSoftware]	Set	bool