From 876449ceefbd93a082469e9ffbf5378b6b361f9a Mon Sep 17 00:00:00 2001 From: "kilo-code-bot[bot]" <240665456+kilo-code-bot[bot]@users.noreply.github.com> Date: Thu, 18 Jun 2026 13:51:51 -0600 Subject: [PATCH] [Docs] FileVault cannot be enabled locally on macOS 15.7 by managed local account (#47799) ## Summary - Documents that on macOS 15.7, FileVault cannot be enabled locally through System Settings when the end user account type is set to Standard or Skip (no account). - Adds notes to both the setup experience guide and the enforce disk encryption guide with the workaround (enforce disk encryption via Fleet). - Notes that this issue does not affect macOS 26. Closes #47711 Related to #47680 Built for [Mel Pike](https://fleetdm.slack.com/archives/D0AKX7DJFCN/p1781726233185189?thread_ts=1777299502.461149&cid=D0AKX7DJFCN) by [Kilo for Slack](https://kilo.ai/slack) Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com> --- articles/enforce-disk-encryption.md | 4 +++- articles/setup-experience.md | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/articles/enforce-disk-encryption.md b/articles/enforce-disk-encryption.md index 229b3f545d..a14c07bdb6 100644 --- a/articles/enforce-disk-encryption.md +++ b/articles/enforce-disk-encryption.md @@ -8,7 +8,9 @@ In Fleet, you can enforce disk encryption for your macOS and Windows hosts, and When disk encryption is enforced, hosts' disk encryption keys will be stored in Fleet. -For macOS hosts that automatically enroll, end users are forced to enable disk encryption during Setup Assistant and the disk encryption key is automatically escrowed to Fleet. For hosts that manually enroll, end users are forced to enable disk encryption. The key gets escrowed the next time they log out and log back in. For both enroll methods, end users can't defer. +For macOS hosts that automatically enroll, end users are forced to enable disk encryption during Setup Assistant and the disk encryption key is automatically escrowed to Fleet. For hosts that manually enroll, end users are forced to enable disk encryption. The key gets escrowed the next time they log out and log back in. For both enroll methods, end users can't defer. + +> On macOS 15.7, if the end user account type is set to **Standard** or **Skip (no account)** during [setup experience](https://fleetdm.com/guides/setup-experience), FileVault cannot be enabled locally through System Settings. To encrypt the disk on these hosts, enforce disk encryption via Fleet using the steps below. This issue does not affect macOS 26. For Windows, currently disk encryption is enforced on the C: volume (default system/OS drive) only on hosts with a [TPM chip](https://support.microsoft.com/en-us/topic/what-s-a-trusted-platform-module-tpm-705f241d-025d-4470-80c5-4feeb24fa1ee). For Linux, encryption requires end user interaction. diff --git a/articles/setup-experience.md b/articles/setup-experience.md index 83f087610f..9670f01688 100644 --- a/articles/setup-experience.md +++ b/articles/setup-experience.md @@ -54,6 +54,8 @@ To view the password for a host's managed account, head to **Host details > Acti > The managed account does not have a Secure Token. To access a FileVault-encrypted disk, first unlock it using the [escrowed recovery key](https://fleetdm.com/guides/macos-mdm-setup#disk-encryption), then log in as `_fleetadmin` at the login window. +> On macOS 15.7, if the end user account type is set to **Standard** or **Skip (no account)**, FileVault cannot be enabled locally through System Settings by the managed local account. To encrypt the disk, [enforce disk encryption via Fleet](https://fleetdm.com/guides/enforce-disk-encryption) instead. This issue does not affect macOS 26. + ## Platform SSO Fleet supports configuring Platform SSO (PSSO) for macOS hosts with the option to create a local user account during enrollment. If you use Okta, see [Deploying Okta Platform SSO with Fleet](https://fleetdm.com/guides/deploying-okta-platform-sso-with-fleet) for setup instructions. PSSO can be used with or without [end user authentication](#end-user-authentication) enabled.