From 89fb977695eee2678ac238958f66e22984dbfb49 Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Mon, 26 Jan 2026 16:58:01 -0500
Subject: [PATCH] `mdm_bridge` is only supported for device-scoped commands
 (#38015)

- Clarify that `mdm_bridge` is only supported for device-scoped commands
- Also add example query
- Context:
https://github.com/fleetdm/fleet/issues/37905#issuecomment-3719060086
---
 schema/osquery_fleet_schema.json | 3 ++-
 schema/tables/mdm_bridge.yml     | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json
index 31dcba08bd..329242f614 100644
--- a/schema/osquery_fleet_schema.json
+++ b/schema/osquery_fleet_schema.json
@@ -17218,7 +17218,8 @@
     "platforms": [
       "windows"
     ],
-    "description": "Allows querying MDM enrolled devices using \"get\" commands.",
+    "description": "Allows querying MDM enrolled devices using \"get\" commands. Currently, only supports commands that target the device scope. Head to the [Windows configuration profiles (CSPs) documentation](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) to verify that the setting support the device scope.",
+    "examples": "Identify Macs that are DEP capable but have not been enrolled to MDM.\n\n```\nSELECT raw_mdm_command_output FROM mdm_bridge WHERE mdm_command_input = '<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/System/AllowTelemetry</LocURI></Target></Item></Get></SyncBody>';\n```",
     "columns": [
       {
         "name": "enrollment_status",
diff --git a/schema/tables/mdm_bridge.yml b/schema/tables/mdm_bridge.yml
index 52fb0e2021..97c65318ea 100644
--- a/schema/tables/mdm_bridge.yml
+++ b/schema/tables/mdm_bridge.yml
@@ -1,7 +1,13 @@
 name: mdm_bridge
 platforms:
   - windows
-description: Allows querying MDM enrolled devices using "get" commands.
+description: Allows querying MDM enrolled devices using "get" commands. Currently, only supports commands that target the device scope. Head to the [Windows configuration profiles (CSPs) documentation](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-configuration-service-provider) to verify that the setting support the device scope.
+examples: |-
+  Identify Macs that are DEP capable but have not been enrolled to MDM.
+
+  ```
+  SELECT raw_mdm_command_output FROM mdm_bridge WHERE mdm_command_input = '<SyncBody><Get><CmdID>1</CmdID><Item><Target><LocURI>./Device/Vendor/MSFT/Policy/Result/System/AllowTelemetry</LocURI></Target></Item></Get></SyncBody>';
+  ```
 columns:
   - name: enrollment_status
     type: text