diff --git a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md
index 57ea5cdf0b..25449830a8 100644
--- a/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md
+++ b/docs/Contributing/product-groups/orchestration/understanding-host-vitals.md
@@ -55,6 +55,16 @@ SELECT
 SELECT email FROM users
 ```
 
+## conditional_access_microsoft_device_id
+
+- Platforms: darwin
+
+- Query:
+```sql
+SELECT * FROM (SELECT common_name AS device_id FROM certificates WHERE issuer LIKE '/DC=net+DC=windows+CN=MS-Organization-Access+OU%' LIMIT 1)
+		CROSS JOIN (SELECT label as user_principal_name FROM keychain_items WHERE account = 'com.microsoft.workplacejoin.registeredUserPrincipalName' LIMIT 1);
+```
+
 ## disk_encryption_darwin
 
 - Platforms: darwin
diff --git a/docs/Contributing/reference/audit-logs.md b/docs/Contributing/reference/audit-logs.md
index 890f4c4be5..ac030ac1fc 100644
--- a/docs/Contributing/reference/audit-logs.md
+++ b/docs/Contributing/reference/audit-logs.md
@@ -69,15 +69,13 @@ Generated when creating policies.
 This activity contains the following fields:
 - "policy_id": the ID of the created policy.
 - "policy_name": the name of the created policy.
-- "fleet_maintained": whether the policy is maintained by Fleet (e.g. automatic install/patch).
 
 #### Example
 
 ```json
 {
 	"policy_id": 123,
-	"policy_name": "foo",
-  "fleet_maintained": false
+	"policy_name": "foo"
 }
 ```
 
@@ -88,15 +86,13 @@ Generated when editing policies.
 This activity contains the following fields:
 - "policy_id": the ID of the edited policy.
 - "policy_name": the name of the edited policy.
-- "fleet_maintained": whether the policy is maintained by Fleet (e.g. automatic install/patch).
 
 #### Example
 
 ```json
 {
 	"policy_id": 123,
-	"policy_name": "foo",
-  "fleet_maintained": false
+	"policy_name": "foo"
 }
 ```
 
@@ -107,15 +103,13 @@ Generated when deleting policies.
 This activity contains the following fields:
 - "policy_id": the ID of the deleted policy.
 - "policy_name": the name of the deleted policy.
-- "fleet_maintained": whether the policy is maintained by Fleet (e.g. automatic install/patch).
 
 #### Example
 
 ```json
 {
 	"policy_id": 123,
-	"policy_name": "foo",
-  "fleet_maintained": false
+	"policy_name": "foo"
 }
 ```
 
diff --git a/server/fleet/agent_options_generated.go b/server/fleet/agent_options_generated.go
index 0cff4cc743..7d2aa63ca8 100644
--- a/server/fleet/agent_options_generated.go
+++ b/server/fleet/agent_options_generated.go
@@ -1,4 +1,4 @@
-// Automatically generated by tools/osquery-agent-options for osquery 5.14.1. DO NOT EDIT!
+// Automatically generated by tools/osquery-agent-options for osquery 5.17.0. DO NOT EDIT!
 // To update flags for a new osquery version, update the osqueryVersion variable in
 // "tools/osquery-agent-options/main.go" and run "cd server/fleet/ && go generate".
 package fleet
diff --git a/tools/osquery-agent-options/main.go b/tools/osquery-agent-options/main.go
index 0c7f35a1c0..50adec2e7d 100644
--- a/tools/osquery-agent-options/main.go
+++ b/tools/osquery-agent-options/main.go
@@ -27,7 +27,7 @@ import (
 
 var (
 	rxOption       = regexp.MustCompile(`\-\-(\w+)\s`)
-	osqueryVersion = "5.14.1"
+	osqueryVersion = "5.17.0"
 
 	structTpl = template.Must(template.New("struct").Funcs(template.FuncMap{
 		"camelCase": camelCaseOptionName,
@@ -69,7 +69,7 @@ func main() {
 	if runtime.GOOS != "darwin" {
 		log.Fatal("Currently only supported on macOS")
 	}
-	urlStr := fmt.Sprintf("https://tuf.fleetctl.com/targets/osqueryd/macos-app/%s/osqueryd.app.tar.gz", osqueryVersion)
+	urlStr := fmt.Sprintf("https://updates.fleetdm.com/targets/osqueryd/macos-app/%s/osqueryd.app.tar.gz", osqueryVersion)
 	osqueryTUFURL, err := url.Parse(urlStr)
 	if err != nil {
 		log.Fatalf("parse osquery TUF URL: %q: %s", urlStr, err)