diff --git a/it-and-security/default.yml b/it-and-security/default.yml
index fce73882ce..da4e611e5e 100644
--- a/it-and-security/default.yml
+++ b/it-and-security/default.yml
@@ -10,10 +10,10 @@ org_settings:
     host_expiry_enabled: false
   integrations:
     google_calendar:
-    - api_key_json: $DOGFOOD_CALENDAR_API_KEY
-      domain: fleetdm.com
-    jira: [ ]
-    zendesk: [ ]
+      - api_key_json: $DOGFOOD_CALENDAR_API_KEY
+        domain: fleetdm.com
+    jira: []
+    zendesk: []
   mdm:
     end_user_authentication:
       entity_id: dogfood-eula.fleetdm.com
@@ -23,22 +23,21 @@ org_settings:
       metadata_url: ""
     end_user_license_agreement: ../it-and-security/lib/macos/misc/eula.pdf
     apple_business_manager:
-    - organization_name: Fleet Device Management Inc.
-      macos_team: "💻 Workstations" 
-      ios_team: "📱🏢 Company-owned mobile devices"
-      ipados_team: "📱🏢 Company-owned mobile devices"
-    - organization_name: Mactivate LLC
-      macos_team: "🧪 Testing & QA" 
-      ios_team: "🧪 Testing & QA"
-      ipados_team: "🧪 Testing & QA"
+      - organization_name: Fleet Device Management Inc.
+        macos_team: "💻 Workstations"
+        ios_team: "📱🏢 Company-owned mobile devices"
+        ipados_team: "📱🏢 Company-owned mobile devices"
+      - organization_name: Mactivate LLC
+        macos_team: "🧪 Testing & QA"
+        ios_team: "🧪 Testing & QA"
+        ipados_team: "🧪 Testing & QA"
     volume_purchasing_program:
-    - location: Fleet Device Management Inc.
-      teams:
-      - "💻 Workstations"
-      - "💻🐣 Workstations (canary)"
-      - "📱🏢 Company-owned mobile devices"
-      - "📱🔐 Personal mobile devices"
-      - "🧪 Testing & QA"
+      - location: Fleet Device Management Inc.
+        teams:
+          - "💻 Workstations"
+          - "📱🏢 Company-owned mobile devices"
+          - "📱🔐 Personal mobile devices"
+          - "🧪 Testing & QA"
   org_info:
     contact_url: https://fleetdm.slack.com/archives/C071NNMSP2R
     org_logo_url: ""
@@ -71,7 +70,7 @@ org_settings:
       destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL
       enable_failing_policies_webhook: true
       host_batch_size: 0
-      policy_ids: [ ]
+      policy_ids: []
     host_status_webhook:
       days_count: 5
       destination_url: $DOGFOOD_HOST_STATUS_WEBHOOK_URL
@@ -92,7 +91,7 @@ queries:
   - path: ./lib/all/queries/collect-known-vulnerable-chrome-extensions.yml
   - path: ./lib/macos/queries/detect-apns-certificate.yml
   - path: ./lib/macos/queries/collect-macos-compatibility-data.yml
-controls: 
+controls:
   enable_disk_encryption: true
   macos_migration:
     enable: true
@@ -124,3 +123,4 @@ labels:
   - path: ./lib/all/labels/department-finance.yml
   - path: ./lib/all/labels/department-product-design.yml
   - path: ./lib/all/labels/department-executive.yml
+  - path: ./lib/all/labels/department-customer-success.yml
diff --git a/it-and-security/lib/all/labels/department-customer-success.yml b/it-and-security/lib/all/labels/department-customer-success.yml
new file mode 100644
index 0000000000..3ceae4906b
--- /dev/null
+++ b/it-and-security/lib/all/labels/department-customer-success.yml
@@ -0,0 +1,6 @@
+- name: "Department: Customer Success"
+  description: Hosts belonging to members of the Customer Success department
+  label_membership_type: host_vitals
+  criteria:
+    vital: end_user_idp_department
+    value: Customer Success
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
deleted file mode 100644
index 01e6bbac1c..0000000000
--- a/it-and-security/teams/workstations-canary.yml
+++ /dev/null
@@ -1,332 +0,0 @@
-name: "💻🐣 Workstations (canary)"
-team_settings:
-  webhook_settings:
-    failing_policies_webhook:
-      destination_url: $DOGFOOD_FAILING_POLICIES_WEBHOOK_URL
-      enable_failing_policies_webhook: true
-      host_batch_size: 0
-      policy_ids:
-        - 14937
-        - 14100
-  features:
-    enable_host_users: true
-    enable_software_inventory: true
-  host_expiry_settings:
-    host_expiry_enabled: false
-    host_expiry_window: 0
-  secrets:
-    - secret: $DOGFOOD_WORKSTATIONS_CANARY_ENROLL_SECRET
-  integrations:
-    conditional_access_enabled: true
-    google_calendar:
-      enable_calendar_events: true
-      webhook_url: $DOGFOOD_CALENDAR_WEBHOOK_URL
-agent_options:
-  config:
-    decorators:
-      load:
-        - SELECT uuid AS host_uuid FROM system_info;
-        - SELECT hostname AS hostname FROM system_info;
-    options:
-      disable_distributed: false
-      distributed_interval: 10
-      distributed_plugin: tls
-      distributed_tls_max_attempts: 3
-      logger_tls_endpoint: /api/osquery/log
-      logger_tls_period: 10
-      pack_delimiter: /
-  overrides:
-    platforms:
-      darwin:
-        decorators:
-          load:
-            - SELECT uuid AS host_uuid FROM system_info;
-            - SELECT hostname AS hostname FROM system_info;
-        options:
-          disable_distributed: false
-          distributed_interval: 10
-          distributed_plugin: tls
-          distributed_tls_max_attempts: 3
-          logger_tls_endpoint: /api/osquery/log
-          logger_tls_period: 10
-          pack_delimiter: /
-        auto_table_construction:
-          tcc_system:
-            path: /Library/Application Support/com.apple.TCC/TCC.db
-            query: "select service, client, client_type, auth_value, auth_reason, policy_id, indirect_object_identifier, indirect_object_identifier_type, last_modified from access"
-            columns:
-              - service
-              - client
-              - client_type
-              - auth_value
-              - auth_reason
-              - policy_id
-              - indirect_object_identifier
-              - indirect_object_identifier_type
-              - last_modified
-          tcc_user:
-            path: /Users/%/Library/Application Support/com.apple.TCC/TCC.db
-            query: "select service, client, client_type, auth_value, auth_reason, policy_id, indirect_object_identifier, indirect_object_identifier_type, last_modified from access"
-            columns:
-              - service
-              - client
-              - client_type
-              - auth_value
-              - auth_reason
-              - policy_id
-              - indirect_object_identifier
-              - indirect_object_identifier_type
-              - last_modified
-  update_channels:
-    # We want to use these hosts to smoke test edge releases.
-    osqueryd: edge
-    orbit: edge
-    desktop: edge
-controls:
-  enable_disk_encryption: true
-  macos_settings:
-    custom_settings:
-      - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig
-      - path: ../lib/macos/configuration-profiles/automatic-app-store-updates.mobileconfig
-      - path: ../lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig
-        labels_include_any:
-          - "Conditional access test group"
-      - path: ../lib/macos/configuration-profiles/date-time.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-guest-shares.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig
-      - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig
-      # - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig
-      # Commenting out until I understand why we have this and if there's a better multi-platform solution
-      - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig
-      - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig
-      - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig
-      - path: ../lib/macos/configuration-profiles/firewall.mobileconfig
-      - path: ../lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig
-      - path: ../lib/macos/configuration-profiles/google-chrome-managed-bookmarks.mobileconfig
-      - path: ../lib/macos/configuration-profiles/google-updater-background-task.mobileconfig
-      - path: ../lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig
-      - path: ../lib/macos/configuration-profiles/misc.mobileconfig
-      - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig
-      - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig
-      - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig
-      - path: ../lib/macos/declaration-profiles/Passcode settings.json
-      - path: ../lib/macos/declaration-profiles/Software Update settings.json
-      - path: ../lib/macos/configuration-profiles/1password-managed-settings.mobileconfig
-        labels_include_any:
-          - "Macs with 1Password installed"
-      - path: ../lib/macos/configuration-profiles/santa-configuration.mobileconfig
-        labels_include_any:
-          - "Santa test devices"
-      - path: ../lib/macos/configuration-profiles/santa-rules.mobileconfig
-        labels_include_any:
-          - "Santa test devices"
-      - path: ../lib/macos/configuration-profiles/nudge-configuration.mobileconfig
-      - path: ../lib/macos/configuration-profiles/microsoft-autoupdate-settings.mobileconfig
-        labels_include_any:
-          - "Microsoft AutoUpdate installed"
-  macos_setup:
-    bootstrap_package: ""
-    enable_end_user_authentication: true
-    macos_setup_assistant: null
-  macos_updates:
-    deadline:
-    minimum_version:
-  windows_settings:
-    custom_settings:
-      - path: ../lib/windows/configuration-profiles/Enable firewall.xml
-      - path: ../lib/windows/configuration-profiles/Password settings.xml
-      - path: ../lib/windows/configuration-profiles/Advanced PowerShell logging.xml
-      - path: ../lib/windows/configuration-profiles/Disable OneDrive.xml
-      - path: ../lib/windows/configuration-profiles/Disable Guest account.xml
-      - path: ../lib/windows/configuration-profiles/Windows Defender compliance settings.xml
-  windows_updates:
-    deadline_days: 7
-    grace_period_days: 2
-  scripts:
-    - path: ../lib/macos/scripts/collect-fleetd-logs.sh
-    - path: ../lib/macos/scripts/execute-disable-fleet-desktop.sh
-    - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh
-    - path: ../lib/macos/scripts/remove-old-nudge.sh
-    - path: ../lib/macos/scripts/mdm-migration.sh
-    - path: ../lib/macos/scripts/system-maintenance.sh
-    - path: ../lib/macos/scripts/santa-block-script.sh
-    - path: ../lib/macos/scripts/uninstall-fleetd-macos.sh
-    - path: ../lib/macos/scripts/install-wine.sh
-    - path: ../lib/macos/scripts/create-conditional-access-allow-file.sh
-    - path: ../lib/macos/scripts/set-lock-screen-message.sh
-    - path: ../lib/windows/scripts/turn-off-mdm.ps1
-    - path: ../lib/windows/scripts/install-bitdefender.ps1
-    - path: ../lib/windows/scripts/enable-ms-defender.ps1
-    - path: ../lib/windows/scripts/create-admin-user.ps1
-    - path: ../lib/windows/scripts/uninstall-fleetd-windows.ps1
-    - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
-    - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
-    - path: ../lib/macos/scripts/uninstall-santa-extension.sh
-    - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
-    - path: ../lib/macos/scripts/install-nudge.sh
-policies:
-  # macOS policies
-  - path: ../lib/macos/policies/1password-emergency-kit-check.yml
-  - path: ../lib/macos/policies/update-firefox.yml
-  - path: ../lib/macos/policies/update-slack.yml
-  - path: ../lib/macos/policies/latest-macos.yml
-  - path: ../lib/macos/policies/update-1password.yml
-  - path: ../lib/macos/policies/all-software-updates-installed.yml
-  - path: ../lib/macos/policies/enrollment-profile-up-to-date.yml
-  - path: ../lib/macos/policies/disk-encryption-check.yml
-  - path: ../lib/macos/policies/1password-installed.yml
-  - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
-  - path: ../lib/macos/policies/company-portal-installed.yml
-  - path: ../lib/macos/policies/entra-conditional-access-check.yml
-  - path: ../lib/macos/policies/install-nudge.yml
-  # Windows policies
-  - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
-  - path: ../lib/windows/policies/all-windows-updates-installed.yml
-  - path: ../lib/windows/policies/disk-encryption-check.yml
-  - path: ../lib/windows/policies/1password-installed.yml
-  - path: ../lib/windows/policies/update-1password.yml
-  - path: ../lib/windows/policies/windows-defender-compliance-check.yml
-  # Linux policies
-  - path: ../lib/linux/policies/disk-encryption-check.yml
-  - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
-queries:
-  - path: ../lib/macos/queries/detect-apple-intelligence.yml
-  - path: ../lib/macos/queries/collect-santa-denied-logs.yml
-software:
-  packages:
-    - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
-      self_service: true
-      categories:
-        - Browsers
-    - path: ../lib/macos/software/1password.yml # 1Password for macOS
-      self_service: true
-    - path: ../lib/macos/software/santa.yml # Santa for macOS
-      self_service: true
-      labels_include_any:
-        - Santa test devices
-    - path: ../lib/macos/software/zoom.yml # Zoom for macOS
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Productivity
-        - Communication
-    - path: ../lib/macos/software/fleet-keynote-theme.yml # Fleet Keynote theme for macOS
-      self_service: true
-      labels_include_any:
-        - "Keynote installed"
-    - path: ../lib/macos/software/company-portal.yml # Company Portal for macOS
-      self_service: true
-      labels_include_any:
-        - "Conditional access test group"
-    - path: ../lib/macos/software/nudge.yml # Nudge for macOS 
-      self_service: false
-    - path: ../lib/macos/software/nudge-assets.yml # Nudge assets for macOS
-      self_service: false
-    - path: ../lib/linux/software/zoom-deb.yml # Zoom for Ubuntu
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "Debian-based Linux hosts"
-    - path: ../lib/linux/software/zoom-rpm.yml # Zoom for RedHat
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "RPM-based Linux hosts"
-    - path: ../lib/linux/software/slack-deb.yml # Slack for Ubuntu
-      display_name: "Slack"
-      self_service: true
-      categories:
-        - Productivity
-        - Communication
-      labels_include_any:
-        - "Debian-based Linux hosts"
-    - path: ../lib/linux/software/slack-rpm.yml # Slack for RedHat
-      display_name: "Slack"
-      self_service: true
-      categories:
-        - Productivity
-        - Communication
-      labels_include_any:
-        - "RPM-based Linux hosts"
-    - path: ../lib/windows/software/zoom-arm.yml # Zoom for Windows (ARM)
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "ARM-based Windows hosts"
-    - path: ../lib/windows/software/zoom.yml # Zoom for Windows (x86)
-      display_name: "Zoom"
-      self_service: true
-      categories:
-        - Communication
-      labels_include_any:
-        - "x86-based Windows hosts"
-    - path: ../lib/windows/software/google-chrome-arm.yml # Google Chrome for Windows (ARM)
-      self_service: true
-      categories:
-        - Browsers
-      labels_include_any:
-        - "ARM-based Windows hosts"
-    - path: ../lib/windows/software/1password.yml # 1Password for Windows
-      self_service: true
-  app_store_apps:
-    - app_store_id: '409183694' # Keynote
-      self_service: true
-  fleet_maintained_apps:
-    # macOS apps
-    - slug: slack/darwin # Slack for macOS
-      self_service: true
-      setup_experience: true
-      post_install_script:
-        path: ../lib/macos/scripts/migrate-slack-preferences.sh
-      categories:
-        - Communication
-        - Productivity
-    - slug: google-chrome/darwin # Google Chrome for macOS
-      self_service: true
-      categories:
-        - Browsers
-    - slug: brave-browser/darwin # Brave for macOS (ARM)
-      self_service: true
-      labels_include_any:
-        - Apple Silicon macOS hosts
-    - slug: docker-desktop/darwin # Docker for macOS (ARM)
-      self_service: true
-      labels_include_any:
-        - Apple Silicon macOS hosts
-    - slug: microsoft-edge/darwin # Microsoft Edge for macOS
-      self_service: true
-    - slug: visual-studio-code/darwin # Microsoft Visual Studio for macOS (ARM)
-      self_service: true
-      labels_include_any:
-        - Apple Silicon macOS hosts
-    - slug: microsoft-teams/darwin # Microsoft Teams for macOS
-      self_service: true
-    # Windows apps
-    - slug: slack/windows # Slack for Windows
-      display_name: "Slack"
-      self_service: true
-      setup_experience: true
-      categories:
-        - Productivity
-        - Communication
-      labels_include_any:
-        - "x86-based Windows hosts"
-    - slug: google-chrome/windows # Google Chrome for Windows
-      self_service: true
-      categories:
-        - Browsers
-      labels_include_any:
-        - "x86-based Windows hosts"
-    - slug: brave-browser/windows # Brave for Windows
-      self_service: true
-    - slug: visual-studio-code/windows # Microsoft Visual Studio for Windows
-      self_service: true
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index 9f69766ce4..d28900b11a 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -17,6 +17,7 @@ team_settings:
   secrets:
     - secret: $DOGFOOD_WORKSTATIONS_ENROLL_SECRET
   integrations:
+    conditional_access_enabled: true
     google_calendar:
       enable_calendar_events: true
       webhook_url: $DOGFOOD_CALENDAR_WEBHOOK_URL
@@ -35,8 +36,6 @@ agent_options:
       logger_tls_period: 10
       pack_delimiter: /
   update_channels:
-    # We want to use these hosts to stick to stable releases
-    # to perform smoke tests after promoting edge to stable.
     osqueryd: stable
     orbit: stable
     desktop: stable
@@ -47,6 +46,9 @@ controls:
       - path: ../lib/macos/configuration-profiles/date-time.mobileconfig
       - path: ../lib/macos/configuration-profiles/automatic-app-store-updates.mobileconfig
       - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig
+      - path: ../lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig
+        labels_include_any:
+          - "Conditional access test group"
       - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig
       - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig
       - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig
@@ -67,11 +69,18 @@ controls:
       - path: ../lib/macos/configuration-profiles/misc.mobileconfig
       - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig
       - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig
+      - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig
       - path: ../lib/macos/declaration-profiles/Passcode settings.json
       - path: ../lib/macos/declaration-profiles/Software Update settings.json
       - path: ../lib/macos/configuration-profiles/1password-managed-settings.mobileconfig
         labels_include_any:
           - "Macs with 1Password installed"
+      - path: ../lib/macos/configuration-profiles/santa-configuration.mobileconfig
+        labels_include_any:
+          - "Santa test devices"
+      - path: ../lib/macos/configuration-profiles/santa-rules.mobileconfig
+        labels_include_any:
+          - "Santa test devices"
       - path: ../lib/macos/configuration-profiles/nudge-configuration.mobileconfig
       - path: ../lib/macos/configuration-profiles/microsoft-autoupdate-settings.mobileconfig
         labels_include_any:
@@ -100,11 +109,15 @@ controls:
     - path: ../lib/macos/scripts/remove-old-nudge.sh
     - path: ../lib/macos/scripts/uninstall-fleetd-macos.sh
     - path: ../lib/macos/scripts/install-wine.sh
+    - path: ../lib/macos/scripts/create-conditional-access-allow-file.sh
     - path: ../lib/macos/scripts/set-lock-screen-message.sh
     - path: ../lib/windows/scripts/uninstall-fleetd-windows.ps1
     - path: ../lib/windows/scripts/turn-off-mdm.ps1
+    - path: ../lib/windows/scripts/install-bitdefender.ps1
+    - path: ../lib/windows/scripts/enable-ms-defender.ps1
     - path: ../lib/windows/scripts/create-admin-user.ps1
     - path: ../lib/linux/scripts/uninstall-fleetd-linux.sh
+    - path: ../lib/macos/scripts/uninstall-santa-extension.sh
     - path: ../lib/macos/scripts/install-macos-compatibility-extension.sh
     - path: ../lib/macos/scripts/install-nudge.sh
     - path: ../lib/linux/scripts/install-fleet-desktop-required-extension.sh
@@ -120,6 +133,8 @@ policies:
   - path: ../lib/macos/policies/disk-encryption-check.yml
   - path: ../lib/macos/policies/1password-installed.yml
   - path: ../lib/macos/policies/install-macos-compatibility-extension.yml
+  - path: ../lib/macos/policies/company-portal-installed.yml
+  - path: ../lib/macos/policies/entra-conditional-access-check.yml
   - path: ../lib/macos/policies/install-nudge.yml
   # Windows policies
   - path: ../lib/windows/policies/antivirus-signatures-up-to-date.yml
@@ -133,6 +148,7 @@ policies:
   - path: ../lib/linux/policies/check-fleet-desktop-extension-enabled.yml
 queries:
   - path: ../lib/macos/queries/detect-apple-intelligence.yml
+  - path: ../lib/macos/queries/collect-santa-denied-logs.yml
 software:
   packages:
     - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal)
@@ -157,7 +173,11 @@ software:
       self_service: true
       labels_include_any:
         - "Keynote installed"
-    - path: ../lib/macos/software/nudge.yml # Nudge for macOS 
+    - path: ../lib/macos/software/company-portal.yml # Company Portal for macOS
+      self_service: true
+      labels_include_any:
+        - "Conditional access test group"
+    - path: ../lib/macos/software/nudge.yml # Nudge for macOS
       self_service: false
     - path: ../lib/macos/software/nudge-assets.yml # Nudge assets for macOS
       self_service: false
@@ -222,7 +242,7 @@ software:
       self_service: true
       setup_experience: true
   app_store_apps:
-    - app_store_id: '409183694' # Keynote
+    - app_store_id: "409183694" # Keynote
       self_service: true
   fleet_maintained_apps:
     # macOS apps