Consolidate Workstations teams into a single team (#38906)

This pull request introduces several updates to the configuration for the Workstations team, primarily to support conditional access testing, enhance device management, and expand policy coverage. The changes include enabling conditional access, adding new configuration profiles and scripts, and updating policies and software deployments. **Conditional Access and Device Management Enhancements:** - Enabled conditional access for the Workstations team by setting `conditional_access_enabled: true` in the integrations section. - Added new configuration profiles for conditional access and Santa (macOS security tool), targeting specific test groups via labels. [[1]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR49-R51) [[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R83) - Included new scripts to support conditional access and device security, such as creating allow files, installing/uninstalling security tools, and enabling Windows Defender. **Policy and Query Expansion:** - Introduced new policies to check for Company Portal installation and Entra conditional access compliance. - Added a query to collect Santa denied logs for improved security monitoring. **Software Deployment Updates:** - Added Company Portal for macOS as a self-service app for the "Conditional access test group". - Minor formatting update for the Keynote app store ID. **Other Notable Changes:** - Removed the "💻🐣 Workstations (canary)" entry from the organization settings, streamlining team categorization. - Cleaned up comments related to update channels in agent options for clarity.
2026-01-27 21:56:32 -06:00
parent 5c11a9feb7
commit 6d20e092bf
4 changed files with 51 additions and 357 deletions
@@ -10,10 +10,10 @@ org_settings:
    host_expiry_enabled: false
  integrations:
    google_calendar:
-    - api_key_json: $DOGFOOD_CALENDAR_API_KEY
-      domain: fleetdm.com
-    jira: [ ]
-    zendesk: [ ]
+      - api_key_json: $DOGFOOD_CALENDAR_API_KEY
+        domain: fleetdm.com
+    jira: []
+    zendesk: []
  mdm:
    end_user_authentication:
      entity_id: dogfood-eula.fleetdm.com
@@ -23,22 +23,21 @@ org_settings:
      metadata_url: ""
    end_user_license_agreement: ../it-and-security/lib/macos/misc/eula.pdf
    apple_business_manager:
-    - organization_name: Fleet Device Management Inc.
-      macos_team: "💻 Workstations" 
-      ios_team: "📱🏢 Company-owned mobile devices"
-      ipados_team: "📱🏢 Company-owned mobile devices"
-    - organization_name: Mactivate LLC
-      macos_team: "🧪 Testing & QA" 
-      ios_team: "🧪 Testing & QA"
-      ipados_team: "🧪 Testing & QA"
+      - organization_name: Fleet Device Management Inc.
+        macos_team: "💻 Workstations"
+        ios_team: "📱🏢 Company-owned mobile devices"
+        ipados_team: "📱🏢 Company-owned mobile devices"
+      - organization_name: Mactivate LLC
+        macos_team: "🧪 Testing & QA"
+        ios_team: "🧪 Testing & QA"
+        ipados_team: "🧪 Testing & QA"
    volume_purchasing_program:
-    - location: Fleet Device Management Inc.
-      teams:
-      - "💻 Workstations"
-      - "💻🐣 Workstations (canary)"
-      - "📱🏢 Company-owned mobile devices"
-      - "📱🔐 Personal mobile devices"
-      - "🧪 Testing & QA"
+      - location: Fleet Device Management Inc.
+        teams:
+          - "💻 Workstations"
+          - "📱🏢 Company-owned mobile devices"
+          - "📱🔐 Personal mobile devices"
+          - "🧪 Testing & QA"
  org_info:
    contact_url: https://fleetdm.slack.com/archives/C071NNMSP2R
    org_logo_url: ""
@@ -71,7 +70,7 @@ org_settings:
      destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL
      enable_failing_policies_webhook: true
      host_batch_size: 0
-      policy_ids: [ ]
+      policy_ids: []
    host_status_webhook:
      days_count: 5
      destination_url: $DOGFOOD_HOST_STATUS_WEBHOOK_URL
@@ -92,7 +91,7 @@ queries:
  - path: ./lib/all/queries/collect-known-vulnerable-chrome-extensions.yml
  - path: ./lib/macos/queries/detect-apns-certificate.yml
  - path: ./lib/macos/queries/collect-macos-compatibility-data.yml
-controls: 
+controls:
  enable_disk_encryption: true
  macos_migration:
    enable: true
@@ -124,3 +123,4 @@ labels:
  - path: ./lib/all/labels/department-finance.yml
  - path: ./lib/all/labels/department-product-design.yml
  - path: ./lib/all/labels/department-executive.yml
+  - path: ./lib/all/labels/department-customer-success.yml
@@ -0,0 +1,6 @@
+- name: "Department: Customer Success"
+  description: Hosts belonging to members of the Customer Success department
+  label_membership_type: host_vitals
+  criteria:
+    vital: end_user_idp_department
+    value: Customer Success
@@ -1,332 +0,0 @@
-name: "💻🐣 Workstations (canary)"
-team_settings:
-  webhook_settings:
-    failing_policies_webhook:
-      destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL
-      enable_failing_policies_webhook: true
-      host_batch_size: 0
-      policy_ids:
-        - 14937
-        - 14100
-  features:
-    enable_host_users: true
-    enable_software_inventory: true
-  host_expiry_settings:
-    host_expiry_enabled: false
-    host_expiry_window: 0
-  secrets:
-    - secret: $DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET
-  integrations:
-    conditional_access_enabled: true
-    google_calendar:
-      enable_calendar_events: true
-      webhook_url: $DOGFOOD_CALENDAR_WEBHOOK_URL
-agent_options:
-  config:
-    decorators:
-      load:
-        - SELECT uuid AS host_uuid FROM system_info;
-        - SELECT hostname AS hostname FROM system_info;
-    options:
-      disable_distributed: false
-      distributed_interval: 10
-      distributed_plugin: tls
-      distributed_tls_max_attempts: 3
-      logger_tls_endpoint: /api/osquery/log
-      logger_tls_period: 10
-      pack_delimiter: /
-  overrides:
-    platforms:
-      darwin:
-        decorators:
-          load:
-            - SELECT uuid AS host_uuid FROM system_info;
-            - SELECT hostname AS hostname FROM system_info;
-        options:
-          disable_distributed: false
-          distributed_interval: 10
-          distributed_plugin: tls
-          distributed_tls_max_attempts: 3
-          logger_tls_endpoint: /api/osquery/log
-          logger_tls_period: 10
-          pack_delimiter: /
-        auto_table_construction:
-          tcc_system:
-            path: /Library/Application Support/com.apple.TCC/TCC.db
-            query: "select service, client, client_type, auth_value, auth_reason, policy_id, indirect_object_identifier, indirect_object_identifier_type, last_modified from access"
-            columns:
-              - service
-              - client
-              - client_type
-              - auth_value
-              - auth_reason
-              - policy_id
-              - indirect_object_identifier
-              - indirect_object_identifier_type
-              - last_modified
-          tcc_user:
-            path: /Users/%/Library/Application Support/com.apple.TCC/TCC.db
-            query: "select service, client, client_type, auth_value, auth_reason, policy_id, indirect_object_identifier, indirect_object_identifier_type, last_modified from access"
-            columns:
-              - service
-              - client
-              - client_type
-              - auth_value
-              - auth_reason
-              - policy_id
-              - indirect_object_identifier
-              - indirect_object_identifier_type
-              - last_modified
-  update_channels:
-    # We want to use these hosts to smoke test edge releases.
-    osqueryd: edge
-    orbit: edge
-    desktop: edge
-controls:
-  enable_disk_encryption: true
-  macos_settings:
-    custom_settings:
-      - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig
-      - path: ../lib/macos/configuration-profiles/automatic-app-store-updates.mobileconfig
-      - path: ../lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig
-        labels_include_any:
-          - "Conditional access test group"
-      - path: ../lib/macos/configuration-profiles/date-time.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-guest-shares.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig
-      # - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig
-      # Commenting out until I understand why we have this and if there's a better multi-platform solution
-      - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig
-      - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig
-      - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig
-      - path: ../lib/macos/configuration-profiles/firewall.mobileconfig
-      - path: ../lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig
-      - path: ../lib/macos/configuration-profiles/google-chrome-managed-bookmarks.mobileconfig
-      - path: ../lib/macos/configuration-profiles/google-updater-background-task.mobileconfig
-      - path: ../lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig
-      - path: ../lib/macos/configuration-profiles/misc.mobileconfig
-      - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig
-      - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig
-      - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig
-      - path: ../lib/macos/declaration-profiles/Passcode settings.json
-      - path: ../lib/macos/declaration-profiles/Software Update settings.json
-      - path: ../lib/macos/configuration-profiles/1password-managed-settings.mobileconfig
-        labels_include_any:
-          - "Macs with 1Password installed"
-      - path: ../lib/macos/configuration-profiles/santa-configuration.mobileconfig
-        labels_include_any:
-          - "Santa test devices"
-      - path: ../lib/macos/configuration-profiles/santa-rules.mobileconfig
-        labels_include_any:
-          - "Santa test devices"
-      - path: ../lib/macos/configuration-profiles/nudge-configuration.mobileconfig
-      - path: ../lib/macos/configuration-profiles/microsoft-autoupdate-settings.mobileconfig
-        labels_include_any:
-          - "Microsoft AutoUpdate installed"
-  macos_setup:
-    bootstrap_package: ""
-    enable_end_user_authentication: true
-    macos_setup_assistant: null
-  macos_updates:
-    deadline:
-    minimum_version:
-  windows_settings:
-    custom_settings:
-      - path: ../lib/windows/configuration-profiles/Enable firewall.xml
-      - path: ../lib/windows/configuration-profiles/Password settings.xml
-      - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml
-      - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml
-      - path: ../lib/windows/configuration-profiles/Disable Guest account.xml
-      - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml
-  windows_updates:
-    deadline_days: 7
-    grace_period_days: 2
-  scripts:
-    - path: ../lib/macos/scripts/collect-fleetd-logs.sh
-    - path: ../lib/macos/scripts/execute-disable-fleet-desktop.sh
-    - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh
-    - path: ../lib/macos/scripts/remove-old-nudge.sh
-    - path: ../lib/macos/scripts/mdm-migration.sh
-    - path: ../lib/macos/scripts/system-maintenance.sh
-    - path: ../lib/macos/scripts/santa-block-script.sh
-    - path: ../lib/macos/scripts/uninstall-fleetd-macos.sh
-    - path: ../lib/macos/scripts/install-wine.sh
-    - path: ../lib/macos/scripts/create-conditional-access-allow-file.sh
-    - path: ../lib/macos/scripts/set-lock-screen-message.sh
-    - path: ../lib/windows/scripts/turn-off-mdm.ps1
-    - path: ../lib/windows/scripts/install-bitdefender.ps1
-    - path: ../lib/windows/scripts/enable-ms-defender.ps1
-    - path: ../lib/windows/scripts/create-admin-user.ps1
-    - path: ../lib/windows/scripts/uninstall-fleetd-windows.ps1
-    - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
-    - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
-    - path: ../lib/macos/scripts/uninstall-santa-extension.sh
-    - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
-    - path: ../lib/macos/scripts/install-nudge.sh
-policies:
-  # macOS policies
-  - path: ../lib/macos/policies/1password-emergency-kit-check.yml
-  - path: ../lib/macos/policies/update-firefox.yml
-  - path: ../lib/macos/policies/update-slack.yml
-  - path: ../lib/macos/policies/latest-macos.yml
-  - path: ../lib/macos/policies/update-1password.yml
-  - path: ../lib/macos/policies/all-software-updates-installed.yml
-  - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml
-  - path: ../lib/macos/policies/disk-encryption-check.yml
-  - path: ../lib/macos/policies/1password-installed.yml
-  - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
-  - path: ../lib/macos/policies/company-portal-installed.yml
-  - path: ../lib/macos/policies/entra-conditional-access-check.yml
-  - path: ../lib/macos/policies/install-nudge.yml
-  # Windows policies
-  - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
-  - path: ../lib/windows/policies/all-windows-updates-installed.yml
-  - path: ../lib/windows/policies/disk-encryption-check.yml
-  - path: ../lib/windows/policies/1password-installed.yml
-  - path: ../lib/windows/policies/update-1password.yml
-  - path: ../lib/windows/policies/windows-defender-compliance-check.yml
-  # Linux policies
-  - path: ../lib/linux/policies/disk-encryption-check.yml
-  - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
-queries:
-  - path: ../lib/macos/queries/detect-apple-intelligence.yml
-  - path: ../lib/macos/queries/collect-santa-denied-logs.yml
-software:
-  packages:
-    - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
-      self_service: true
-      categories:
-        - Browsers
-    - path: ../lib/macos/software/1password.yml # 1Password for macOS
-      self_service: true
-    - path: ../lib/macos/software/santa.yml # Santa for macOS
-      self_service: true
-      labels_include_any:
-        - Santa test devices
-    - path: ../lib/macos/software/zoom.yml # Zoom for macOS
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Productivity
-        - Communication
-    - path: ../lib/macos/software/fleet-keynote-theme.yml # Fleet Keynote theme for macOS
-      self_service: true
-      labels_include_any:
-        - "Keynote installed"
-    - path: ../lib/macos/software/company-portal.yml # Company Portal for macOS
-      self_service: true
-      labels_include_any:
-        - "Conditional access test group"
-    - path: ../lib/macos/software/nudge.yml # Nudge for macOS 
-      self_service: false
-    - path: ../lib/macos/software/nudge-assets.yml # Nudge assets for macOS
-      self_service: false
-    - path: ../lib/linux/software/zoom-deb.yml # Zoom for Ubuntu
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "Debian-based Linux hosts"
-    - path: ../lib/linux/software/zoom-rpm.yml # Zoom for RedHat
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "RPM-based Linux hosts"
-    - path: ../lib/linux/software/slack-deb.yml # Slack for Ubuntu
-      display_name: "Slack"
-      self_service: true
-      categories:
-        - Productivity
-        - Communication
-      labels_include_any:
-        - "Debian-based Linux hosts"
-    - path: ../lib/linux/software/slack-rpm.yml # Slack for RedHat
-      display_name: "Slack"
-      self_service: true
-      categories:
-        - Productivity
-        - Communication
-      labels_include_any:
-        - "RPM-based Linux hosts"
-    - path: ../lib/windows/software/zoom-arm.yml # Zoom for Windows (ARM)
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "ARM-based Windows hosts"
-    - path: ../lib/windows/software/zoom.yml # Zoom for Windows (x86)
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "x86-based Windows hosts"
-    - path: ../lib/windows/software/google-chrome-arm.yml # Google Chrome for Windows (ARM)
-      self_service: true
-      categories:
-        - Browsers
-      labels_include_any:
-        - "ARM-based Windows hosts"
-    - path: ../lib/windows/software/1password.yml # 1Password for Windows
-      self_service: true
-  app_store_apps:
-    - app_store_id: '409183694' # Keynote
-      self_service: true
-  fleet_maintained_apps:
-    # macOS apps
-    - slug: slack/darwin # Slack for macOS
-      self_service: true
-      setup_experience: true
-      post_install_script:
-        path: ../lib/macos/scripts/migrate-slack-preferences.sh
-      categories:
-        - Communication
-        - Productivity
-    - slug: google-chrome/darwin # Google Chrome for macOS
-      self_service: true
-      categories:
-        - Browsers
-    - slug: brave-browser/darwin # Brave for macOS (ARM)
-      self_service: true
-      labels_include_any:
-        - Apple Silicon macOS hosts
-    - slug: docker-desktop/darwin # Docker for macOS (ARM)
-      self_service: true
-      labels_include_any:
-        - Apple Silicon macOS hosts
-    - slug: microsoft-edge/darwin # Microsoft Edge for macOS
-      self_service: true
-    - slug: visual-studio-code/darwin # Microsoft Visual Studio for macOS (ARM)
-      self_service: true
-      labels_include_any:
-        - Apple Silicon macOS hosts
-    - slug: microsoft-teams/darwin # Microsoft Teams for macOS
-      self_service: true
-    # Windows apps
-    - slug: slack/windows # Slack for Windows
-      display_name: "Slack"
-      self_service: true
-      setup_experience: true
-      categories:
-        - Productivity
-        - Communication
-      labels_include_any:
-        - "x86-based Windows hosts"
-    - slug: google-chrome/windows # Google Chrome for Windows
-      self_service: true
-      categories:
-        - Browsers
-      labels_include_any:
-        - "x86-based Windows hosts"
-    - slug: brave-browser/windows # Brave for Windows
-      self_service: true
-    - slug: visual-studio-code/windows # Microsoft Visual Studio for Windows
-      self_service: true
@@ -17,6 +17,7 @@ team_settings:
  secrets:
    - secret: $DOGFOOD_WORKSTATIONS_ENROLL_SECRET
  integrations:
+    conditional_access_enabled: true
    google_calendar:
      enable_calendar_events: true
      webhook_url: $DOGFOOD_CALENDAR_WEBHOOK_URL
@@ -35,8 +36,6 @@ agent_options:
      logger_tls_period: 10
      pack_delimiter: /
  update_channels:
-    # We want to use these hosts to stick to stable releases
-    # to perform smoke tests after promoting edge to stable.
    osqueryd: stable
    orbit: stable
    desktop: stable
@@ -47,6 +46,9 @@ controls:
      - path: ../lib/macos/configuration-profiles/date-time.mobileconfig
      - path: ../lib/macos/configuration-profiles/automatic-app-store-updates.mobileconfig
      - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig
+      - path: ../lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig
+        labels_include_any:
+          - "Conditional access test group"
      - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig
      - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig
      - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig
@@ -67,11 +69,18 @@ controls:
      - path: ../lib/macos/configuration-profiles/misc.mobileconfig
      - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig
      - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig
+      - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig
      - path: ../lib/macos/declaration-profiles/Passcode settings.json
      - path: ../lib/macos/declaration-profiles/Software Update settings.json
      - path: ../lib/macos/configuration-profiles/1password-managed-settings.mobileconfig
        labels_include_any:
          - "Macs with 1Password installed"
+      - path: ../lib/macos/configuration-profiles/santa-configuration.mobileconfig
+        labels_include_any:
+          - "Santa test devices"
+      - path: ../lib/macos/configuration-profiles/santa-rules.mobileconfig
+        labels_include_any:
+          - "Santa test devices"
      - path: ../lib/macos/configuration-profiles/nudge-configuration.mobileconfig
      - path: ../lib/macos/configuration-profiles/microsoft-autoupdate-settings.mobileconfig
        labels_include_any:
@@ -100,11 +109,15 @@ controls:
    - path: ../lib/macos/scripts/remove-old-nudge.sh
    - path: ../lib/macos/scripts/uninstall-fleetd-macos.sh
    - path: ../lib/macos/scripts/install-wine.sh
+    - path: ../lib/macos/scripts/create-conditional-access-allow-file.sh
    - path: ../lib/macos/scripts/set-lock-screen-message.sh
    - path: ../lib/windows/scripts/uninstall-fleetd-windows.ps1
    - path: ../lib/windows/scripts/turn-off-mdm.ps1
+    - path: ../lib/windows/scripts/install-bitdefender.ps1
+    - path: ../lib/windows/scripts/enable-ms-defender.ps1
    - path: ../lib/windows/scripts/create-admin-user.ps1
    - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
+    - path: ../lib/macos/scripts/uninstall-santa-extension.sh
    - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
    - path: ../lib/macos/scripts/install-nudge.sh
    - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
@@ -120,6 +133,8 @@ policies:
  - path: ../lib/macos/policies/disk-encryption-check.yml
  - path: ../lib/macos/policies/1password-installed.yml
  - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
+  - path: ../lib/macos/policies/company-portal-installed.yml
+  - path: ../lib/macos/policies/entra-conditional-access-check.yml
  - path: ../lib/macos/policies/install-nudge.yml
  # Windows policies
  - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
@@ -133,6 +148,7 @@ policies:
  - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
 queries:
  - path: ../lib/macos/queries/detect-apple-intelligence.yml
+  - path: ../lib/macos/queries/collect-santa-denied-logs.yml
 software:
  packages:
    - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
@@ -157,7 +173,11 @@ software:
      self_service: true
      labels_include_any:
        - "Keynote installed"
-    - path: ../lib/macos/software/nudge.yml # Nudge for macOS 
+    - path: ../lib/macos/software/company-portal.yml # Company Portal for macOS
+      self_service: true
+      labels_include_any:
+        - "Conditional access test group"
+    - path: ../lib/macos/software/nudge.yml # Nudge for macOS
      self_service: false
    - path: ../lib/macos/software/nudge-assets.yml # Nudge assets for macOS
      self_service: false
@@ -222,7 +242,7 @@ software:
      self_service: true
      setup_experience: true
  app_store_apps:
-    - app_store_id: '409183694' # Keynote
+    - app_store_id: "409183694" # Keynote
      self_service: true
  fleet_maintained_apps:
    # macOS apps