From ad9301a455efe452969007ecd290f7cc953c91a4 Mon Sep 17 00:00:00 2001
From: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
Date: Mon, 16 Mar 2026 11:58:51 -0500
Subject: [PATCH] Solutions updates 2026-03-12 (#41596)
---
.../managed-app-configurations/README.md | 10 +++
...llow-work-profile-widgets-for-APPNAME.json | 7 ++
.../block-apps.mobileconfig | 1 +
.../passcode.mobileconfig | 37 ++++++++++
.../restrictions.mobileconfig | 1 +
.../macos/configuration-profiles/README.md | 11 +++
.../block-apps.mobileconfig | 70 +++++++++++++++++++
.../lock-screen.mobileconfig | 41 +++++++++++
.../password-policy.mobileconfig | 45 ++++++++++++
.../restrictions.mobileconfig | 39 +++++++++++
.../declaration-profiles/software-update.json | 9 +++
11 files changed, 271 insertions(+)
create mode 100644 docs/solutions/android/managed-app-configurations/README.md
create mode 100644 docs/solutions/android/managed-app-configurations/allow-work-profile-widgets-for-APPNAME.json
create mode 120000 docs/solutions/ios-ipados/configuration-profiles/block-apps.mobileconfig
create mode 100644 docs/solutions/ios-ipados/configuration-profiles/passcode.mobileconfig
create mode 120000 docs/solutions/ios-ipados/configuration-profiles/restrictions.mobileconfig
create mode 100644 docs/solutions/macos/configuration-profiles/README.md
create mode 100644 docs/solutions/macos/configuration-profiles/block-apps.mobileconfig
create mode 100644 docs/solutions/macos/configuration-profiles/lock-screen.mobileconfig
create mode 100644 docs/solutions/macos/configuration-profiles/password-policy.mobileconfig
create mode 100644 docs/solutions/macos/configuration-profiles/restrictions.mobileconfig
create mode 100644 docs/solutions/macos/declaration-profiles/software-update.json
diff --git a/docs/solutions/android/managed-app-configurations/README.md b/docs/solutions/android/managed-app-configurations/README.md
new file mode 100644
index 0000000000..b7f9344274
--- /dev/null
+++ b/docs/solutions/android/managed-app-configurations/README.md
@@ -0,0 +1,10 @@
+# Android Managed App Configurations
+
+## [Allow Work Profile Widgets](allow-work-profile-widgets-for-APPNAME.json)
+
+- Change `APPNAME` in the filename and the `"APPNAME Widget": "Allow Work Profile Widgets for APPNAME"` line in the file to the name of the app you'd like to allow Work Profile widgets for.
+- Scope this configuration to the app:
+ - UI: Software > Select the app > Actions > Edit configuration
+ - [GitOps](https://fleetdm.com/docs/configuration/yaml-files#app-store-apps): Under the `app_store_app` entry, add the path under the `configuration.path` for the app.
+- No need to add the identifier (i.e., `com.google.android.calendar` for Google Calendar) to the configuration. Fleet automatically takes care of this, since the config is scoped to the app.
+- [Learn more](https://fleetdm.com/guides/install-app-store-apps#configuration) about app configurations.
diff --git a/docs/solutions/android/managed-app-configurations/allow-work-profile-widgets-for-APPNAME.json b/docs/solutions/android/managed-app-configurations/allow-work-profile-widgets-for-APPNAME.json
new file mode 100644
index 0000000000..9fa88e92ff
--- /dev/null
+++ b/docs/solutions/android/managed-app-configurations/allow-work-profile-widgets-for-APPNAME.json
@@ -0,0 +1,7 @@
+{
+ "managedConfiguration": {
+ "APPNAME Widget": "Allow Work Profile Widgets for APPNAME",
+ "config": true
+ },
+ "workProfileWidgets": "WORK_PROFILE_WIDGETS_ALLOWED"
+}
diff --git a/docs/solutions/ios-ipados/configuration-profiles/block-apps.mobileconfig b/docs/solutions/ios-ipados/configuration-profiles/block-apps.mobileconfig
new file mode 120000
index 0000000000..f2863cab64
--- /dev/null
+++ b/docs/solutions/ios-ipados/configuration-profiles/block-apps.mobileconfig
@@ -0,0 +1 @@
+../../macos/configuration-profiles/block-apps.mobileconfig
\ No newline at end of file
diff --git a/docs/solutions/ios-ipados/configuration-profiles/passcode.mobileconfig b/docs/solutions/ios-ipados/configuration-profiles/passcode.mobileconfig
new file mode 100644
index 0000000000..cac31ba7a2
--- /dev/null
+++ b/docs/solutions/ios-ipados/configuration-profiles/passcode.mobileconfig
@@ -0,0 +1,37 @@
+
+
+
+
+ PayloadContent
+
+
+ allowSimple
+
+ forcePIN
+
+ maxFailedAttempts
+ 10
+ minLength
+ 6
+ PayloadIdentifier
+ com.fleetdm.passwordpolicy
+ PayloadType
+ com.apple.mobiledevice.passwordpolicy
+ PayloadUUID
+ CD81A573-4FD3-4A63-B7B9-6651544E458A
+ PayloadVersion
+ 1
+
+
+ PayloadDisplayName
+ Passcode
+ PayloadIdentifier
+ com.fleetdm.passwordpolicy
+ PayloadType
+ Configuration
+ PayloadUUID
+ D1958A4A-2CBD-4076-89E9-2BC1AB026936
+ PayloadVersion
+ 1
+
+
diff --git a/docs/solutions/ios-ipados/configuration-profiles/restrictions.mobileconfig b/docs/solutions/ios-ipados/configuration-profiles/restrictions.mobileconfig
new file mode 120000
index 0000000000..1ee5e5a57c
--- /dev/null
+++ b/docs/solutions/ios-ipados/configuration-profiles/restrictions.mobileconfig
@@ -0,0 +1 @@
+../../macos/configuration-profiles/restrictions.mobileconfig
\ No newline at end of file
diff --git a/docs/solutions/macos/configuration-profiles/README.md b/docs/solutions/macos/configuration-profiles/README.md
new file mode 100644
index 0000000000..dfed27e7c7
--- /dev/null
+++ b/docs/solutions/macos/configuration-profiles/README.md
@@ -0,0 +1,11 @@
+# macOS Configuration Profiles
+
+## [Password Policy](password-policy.mobileconfig)
+
+- It's best to combine this profile with the [Lock Screen](lock-screen.mobileconfig) config profile.
+
+
+## [Block Apps](block-apps.mobileconfig)
+
+- This blocks a several system apps, as well as Siri.
+- See Apple's documentation [for this profile](https://developer.apple.com/documentation/devicemanagement/restrictions) and app bundle identifiers for [iOS/iPadOS](https://support.apple.com/guide/deployment/bundle-ids-for-iphone-and-ipad-apple-apps-depece748c41/web) and [macOS](https://support.apple.com/guide/deployment/get-the-bundle-id-for-a-mac-app-dep0af2cd611/1/web/1.0).
diff --git a/docs/solutions/macos/configuration-profiles/block-apps.mobileconfig b/docs/solutions/macos/configuration-profiles/block-apps.mobileconfig
new file mode 100644
index 0000000000..809b9bf481
--- /dev/null
+++ b/docs/solutions/macos/configuration-profiles/block-apps.mobileconfig
@@ -0,0 +1,70 @@
+
+
+
+
+ PayloadContent
+
+
+ blockedAppBundleIDs
+
+ com.apple.AppStore
+ com.apple.AppStoreConnect
+ com.apple.store.Jolly
+ com.apple.calculator
+ com.apple.clips
+ com.apple.compass
+ com.apple.MobileAddressBook
+ com.apple.facetime
+ com.apple.DocumentsApp
+ com.apple.findmy
+ com.apple.games
+ com.apple.mobilegarageband
+ com.apple.Health
+ com.apple.iBooks
+ com.apple.iMovie
+ com.apple.itunesu
+ com.apple.MobileStore
+ com.apple.Keynote
+ com.apple.mobilemail
+ com.apple.Maps
+ com.apple.measure
+ com.apple.MobileSMS
+ com.apple.Music
+ com.apple.news
+ com.apple.mobilenotes
+ com.apple.Photo-Booth
+ com.apple.mobileslideshow
+ com.apple.podcasts
+ com.apple.reminders
+ com.apple.mobilesafari
+ com.apple.stocks
+ com.apple.tips
+ com.apple.tv
+ com.apple.VoiceMemos
+ com.apple.Passbook
+ com.apple.Bridge
+
+ allowAssistant
+
+ PayloadIdentifier
+ com.fleetdm.block-apps
+ PayloadType
+ com.apple.applicationaccess
+ PayloadUUID
+ 6A48073C-9D28-4B7A-9C69-6D0507CDF377
+ PayloadVersion
+ 1
+
+
+ PayloadDisplayName
+ Blocked Apps
+ PayloadIdentifier
+ com.fleetdm.block-apps
+ PayloadType
+ Configuration
+ PayloadUUID
+ 278D7F3D-454C-47FE-A65F-1BB7087F228D
+ PayloadVersion
+ 1
+
+
diff --git a/docs/solutions/macos/configuration-profiles/lock-screen.mobileconfig b/docs/solutions/macos/configuration-profiles/lock-screen.mobileconfig
new file mode 100644
index 0000000000..cecc8daf2f
--- /dev/null
+++ b/docs/solutions/macos/configuration-profiles/lock-screen.mobileconfig
@@ -0,0 +1,41 @@
+
+
+
+
+ PayloadContent
+
+
+ askForPassword
+
+
+ askForPasswordDelay
+
+ 0
+
+ idleTime
+
+ 600
+ moduleName
+ Organization Lock Screen Settings
+ PayloadIdentifier
+ com.fleetdm.lock-screen
+ PayloadType
+ com.apple.screensaver
+ PayloadUUID
+ 13DAA34A-FE09-4262-B8BD-2FCAB9E0473E
+ PayloadVersion
+ 1
+
+
+ PayloadDisplayName
+ Lock Screen
+ PayloadIdentifier
+ com.fleetdm.lock-screen
+ PayloadType
+ Configuration
+ PayloadUUID
+ 064F48CF-D311-4DA6-BD3B-B54D5A855A60
+ PayloadVersion
+ 1
+
+
diff --git a/docs/solutions/macos/configuration-profiles/password-policy.mobileconfig b/docs/solutions/macos/configuration-profiles/password-policy.mobileconfig
new file mode 100644
index 0000000000..8383f42ff2
--- /dev/null
+++ b/docs/solutions/macos/configuration-profiles/password-policy.mobileconfig
@@ -0,0 +1,45 @@
+
+
+
+
+ PayloadContent
+
+
+ allowSimple
+
+ changeAtNextAuth
+
+ maxFailedAttempts
+ 10
+ maxPINAgeInDays
+ 365
+ minComplexChars
+ 1
+ minLength
+ 10
+ pinHistory
+ 5
+ requireAlphanumeric
+
+ PayloadIdentifier
+ com.fleetdm.password-policy
+ PayloadType
+ com.apple.mobiledevice.passwordpolicy
+ PayloadUUID
+ 29184017-5E10-447B-9208-7C7323B8E21A
+ PayloadVersion
+ 1
+
+
+ PayloadDisplayName
+ Password Policy
+ PayloadIdentifier
+ com.fleetdm.password-policy
+ PayloadType
+ Configuration
+ PayloadUUID
+ 59A95127-AC40-4166-A08A-BEE5BBA98EE5
+ PayloadVersion
+ 1
+
+
diff --git a/docs/solutions/macos/configuration-profiles/restrictions.mobileconfig b/docs/solutions/macos/configuration-profiles/restrictions.mobileconfig
new file mode 100644
index 0000000000..b750d5b17b
--- /dev/null
+++ b/docs/solutions/macos/configuration-profiles/restrictions.mobileconfig
@@ -0,0 +1,39 @@
+
+
+
+
+ PayloadContent
+
+
+ allowChat
+
+ allowBookstore
+
+ allowiTunes
+
+ allowMusicService
+
+ allowRadioService
+
+ PayloadIdentifier
+ com.fleetdm.restrictions
+ PayloadType
+ com.apple.applicationaccess
+ PayloadUUID
+ 33B4543C-4CBF-479A-B354-AEDC0C8F19C1
+ PayloadVersion
+ 1
+
+
+ PayloadDisplayName
+ Restrictions
+ PayloadIdentifier
+ com.fleetdm.restrictions
+ PayloadType
+ Configuration
+ PayloadUUID
+ EE9E588C-E5BB-46EA-B180-8072F3594938
+ PayloadVersion
+ 1
+
+
diff --git a/docs/solutions/macos/declaration-profiles/software-update.json b/docs/solutions/macos/declaration-profiles/software-update.json
new file mode 100644
index 0000000000..3ce9b057d7
--- /dev/null
+++ b/docs/solutions/macos/declaration-profiles/software-update.json
@@ -0,0 +1,9 @@
+{
+ "Type": "com.apple.configuration.softwareupdate.enforcement.specific",
+ "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
+ "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
+ "Payload": {
+ "TargetOSVersion": "15.7.3",
+ "TargetLocalDateTime": "2026-03-12T09:30:00"
+ }
+}