Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

[Docs] FileVault cannot be enabled locally on macOS 15.7 by managed local account (#47799)

Browse Source 
## Summary

- Documents that on macOS 15.7, FileVault cannot be enabled locally
through System Settings when the end user account type is set to
Standard or Skip (no account).
- Adds notes to both the setup experience guide and the enforce disk
encryption guide with the workaround (enforce disk encryption via
Fleet).
- Notes that this issue does not affect macOS 26.

Closes #47711
Related to #47680

Built for [Mel
Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1781726233185189?thread_ts=1777299502.461149&cid=D0AKX7DJFCN)
by [Kilo for Slack](https://kilo.ai/slack)

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
This commit is contained in:
kilo-code-bot[bot]
2026-06-18 13:51:51 -06:00
committed by GitHub
co-authored by kiloconnect[bot]
parent 0fa7566c42
commit 876449ceef
2 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/enforce-disk-encryption.md
+3 -1
View File
@@ -8,7 +8,9 @@ In Fleet, you can enforce disk encryption for your macOS and Windows hosts, and
When disk encryption is enforced, hosts' disk encryption keys will be stored in Fleet.
For macOS hosts that automatically enroll, end users are forced to enable disk encryption during Setup Assistant and the disk encryption key is automatically escrowed to Fleet. For hosts that manually enroll, end users are forced to enable disk encryption. The key gets escrowed the next time they log out and log back in. For both enroll methods, end users can't defer.
For macOS hosts that automatically enroll, end users are forced to enable disk encryption during Setup Assistant and the disk encryption key is automatically escrowed to Fleet. For hosts that manually enroll, end users are forced to enable disk encryption. The key gets escrowed the next time they log out and log back in. For both enroll methods, end users can't defer.
> On macOS 15.7, if the end user account type is set to **Standard** or **Skip (no account)** during [setup experience](https://fleetdm.com/guides/setup-experience), FileVault cannot be enabled locally through System Settings. To encrypt the disk on these hosts, enforce disk encryption via Fleet using the steps below. This issue does not affect macOS 26.
For Windows, currently disk encryption is enforced on the C: volume (default system/OS drive) only on hosts with a [TPM chip](https://support.microsoft.com/en-us/topic/what-s-a-trusted-platform-module-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee). For Linux, encryption requires end user interaction.
articles/setup-experience.md
+2
View File
@@ -54,6 +54,8 @@ To view the password for a host's managed account, head to **Host details > Acti
> The managed account does not have a Secure Token. To access a FileVault-encrypted disk, first unlock it using the [escrowed recovery key](https://fleetdm.com/guides/macos-mdm-setup#disk-encryption), then log in as `_fleetadmin` at the login window.
> On macOS 15.7, if the end user account type is set to **Standard** or **Skip (no account)**, FileVault cannot be enabled locally through System Settings by the managed local account. To encrypt the disk, [enforce disk encryption via Fleet](https://fleetdm.com/guides/enforce-disk-encryption) instead. This issue does not affect macOS 26.
## Platform SSO
Fleet supports configuring Platform SSO (PSSO) for macOS hosts with the option to create a local user account during enrollment. If you use Okta, see [Deploying Okta Platform SSO with Fleet](https://fleetdm.com/guides/deploying-okta-platform-sso-with-fleet) for setup instructions. PSSO can be used with or without [end user authentication](#end-user-authentication) enabled.