Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

v4.90.0 doc changes (#48141)

Browse Source
This commit is contained in:
Rachael Shaw
2026-08-05 20:38:39 -05:00
committed by GitHub
parent cca2f084a1
commit bfa766e9b7
31 changed files with 1762 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Configuration/fleet-server-configuration.md
+8 -6
View File
@@ -3708,22 +3708,24 @@ If you have an [Apple Developer account that is enabled as an MDM vendor](https:
apple_vpp_app_metadata_api_bearer_token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ92eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikp
```
### mdm.enable_custom_filevault
### mdm.enable_custom_disk_encryption
> `mdm.enable_custom_os_updates_and_filevault` is deprecated as of Fleet 4.87.0. Custom OS updates will be enabled for all, for FileVault you can use `mdm.enable_custom_filevault` instead. When set to `true`, it enables both custom OS update and FileVault profiles (equivalent to setting both replacement options to `true`). Maintained for backwards compatibility.
> `mdm.enable_custom_filevault` is deprecated as of Fleet 4.90.0 and `mdm.enable_custom_os_updates_and_filevault` is deprecated as of Fleet 4.87.0. Both are maintained for backwards compatibility. Please use `mdm.enable_custom_disk_encryption` instead. As of Fleet 4.87.0, custom OS updates are enabled by default.
*Available in Fleet Premium.*
Allows users to add custom Apple MDM profiles for FileVault management, including [FDEFileVault](https://developer.apple.com/documentation/devicemanagement/fdefilevault), [FDEFileVaultOptions](https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions), and [FDERecoveryKeyEscrow](https://developer.apple.com/documentation/devicemanagement/fderecoverykeyescrow) configuration profiles
For macOS, allows users to add custom macOS [configuration profiles](https://fleetdm.com/guides/custom-os-settings) for FileVault, including [FDEFileVault](https://developer.apple.com/documentation/devicemanagement/fdefilevault), [FDEFileVaultOptions](https://developer.apple.com/documentation/devicemanagement/fdefilevaultoptions), and [FDERecoveryKeyEscrow](https://developer.apple.com/documentation/devicemanagement/fderecoverykeyescrow) configuration profiles.
> Enabling this option may cause conflicts between your custom FileVault configuration profiles and the profiles Fleet manages under the hood for disk encryption.
For Windows, allows users to add custom Windows profiles for BitLocker.
> Enabling this option may cause conflicts between your custom disk encryption configuration profiles and the profiles Fleet manages under the hood when [Fleet's disk encryption](https://fleetdm.com/guides/enforce-disk-encryption) is enabled.
- Default value: `false`
- Environment variable: `FLEET_MDM_ENABLE_CUSTOM_FILEVAULT`
- Environment variable: `FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION`
- Config file format:
```yaml
mdm:
enable_custom_filevault: false
enable_custom_disk_encryption: false
```
### mdm.allow_all_declarations
docs/Configuration/yaml-files.md
+73 -8
View File
@@ -342,7 +342,7 @@ agent_options:
The `controls` section allows you to configure scripts and device management (MDM) features in Fleet.
- `scripts` is a list of paths to macOS, Windows, or Linux scripts. Supports `path:` (single file) and `paths:` (glob pattern, filtered to `.sh` and `.ps1` files only). Filenames must not contain `*`, `?`, `[`, or `{` when using `path:`. See [`path:` vs `paths:`](#path-vs-paths-glob-patterns) for details.
- `scripts` is a list of paths to macOS, Windows, or Linux scripts. Supports `path:` (single file) and `paths:` (glob pattern, filtered to `.sh`, `.py`, and `.ps1` files only). Filenames must not contain `*`, `?`, `[`, or `{` when using `path:`. See [`path:` vs `paths:`](#path-vs-paths-glob-patterns) for details.
- `windows_enabled_and_configured` specifies whether or not to turn on Windows MDM features (default: `false`). Can only be configured for "All fleets" (`default.yml`).
- `windows_entra_tenant_ids` is a list of Microsoft Entra tenant IDs to enable automatic (Autopilot) and manual enrollment by end users (**Settings** > **Accounts** > **Access work or school** on Windows). Can only be configured for "All fleets" (`default.yml`). Find your **Tenant ID**, on [**Microsoft Entra ID** > **Home**](https://entra.microsoft.com/#home).
- `windows_entra_client_ids` is a list of Microsoft Entra application (client) IDs for the applications used to enroll Windows hosts via Microsoft Entra. Set this when you set up Entra enrollment: Microsoft Entra issues v2 access tokens whose audience is the application's client ID, so Fleet needs the client ID to authorize enrollment. Can only be configured for "All fleets" (`default.yml`). Find your **Application (client) ID** on [**Microsoft Entra ID** > **App registrations**](https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) > your MDM application > **Overview**.
@@ -352,6 +352,7 @@ The `controls` section allows you to configure scripts and device management (MD
- `windows_require_bitlocker_pin` specifies whether or not to require end users on Windows hosts to set a BitLocker PIN. When set, this PIN is required to unlock Windows host during startup. `enable_disk_encryption` must be set to `true`. (default: `false`).
- `apple_require_hardware_attestation` specifies whether or not to require Apple Silicon macOS hosts to complete a device attestation challenge verifying that the hardware serial matches a known host record from AB as part of DEP enrollment (default: `false`). Can only be configured for "All fleets" (default.yml).
- `enable_recovery_lock_password` specifies whether or not to enforce Recovery Lock password on eligible macOS hosts (default: `false`).
- `name_template` sets a naming convention for macOS, iOS, and iPadOS hosts. Fleet resolves the template per host, renames the host on the device via an MDM command, and updates the host's name in Fleet. Supports the built-in host identity variables (`$FLEET_VAR_HOST_HARDWARE_SERIAL`, `$FLEET_VAR_HOST_UUID`, `$FLEET_VAR_HOST_PLATFORM`), the IdP end-user variables (`$FLEET_VAR_HOST_END_USER_IDP_USERNAME`, `_USERNAME_LOCAL_PART`, `_GROUPS`, `_DEPARTMENT`, `_FULL_NAME`), and custom (`$FLEET_SECRET_*`) variables; certificate authority variables aren't supported. A referenced custom variable must already exist. Supported for fleets and for hosts that aren't in a fleet ("Unassigned"): set it in a fleet's YAML, or in `no_team.yml`/`default.yml` controls to apply it to "Unassigned" hosts. Removing the key clears the template but doesn't rename any host. _Available in Fleet Premium._
- `android_enabled_and_configured` specifies whether or not to turn on Android MDM features (default: `false`). Can only be configured for "All fleets" (`default.yml`).
#### Example
@@ -362,7 +363,7 @@ controls:
- path: ../lib/macos-script.sh
- path: ../lib/windows-script.ps1
- path: ../lib/linux-script.sh
- paths: ../lib/scripts/*.sh # Glob pattern (filtered to .sh and .ps1 only)
- paths: ../lib/scripts/*.sh # Glob pattern (filtered to .sh, .py, and .ps1 only)
windows_enabled_and_configured: true
windows_entra_tenant_ids:
- 4e342a0d-ec1a-4353-bdeb-785542e0a8fb
@@ -373,6 +374,7 @@ controls:
enable_disk_encryption: true # Available in Fleet Premium
apple_require_hardware_attestation: false # Available in Fleet Premium
enable_recovery_lock_password: true # Available in Fleet Premium
name_template: "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL" # Available in Fleet Premium
android_enabled_and_configured: true
macos_updates: # Available in Fleet Premium
deadline: "2024-12-31"
@@ -390,11 +392,19 @@ controls:
apple_settings:
configuration_profiles:
- paths: ../lib/macos/profiles/*.mobileconfig
- path: ../lib/macos/profiles/my-declaration.json
assets:
- path: ../lib/macos/assets/my-asset.json
managed_local_account_settings:
- enabled: true
end_user_local_account_type: "admin"
windows_settings:
configuration_profiles:
- paths: ../lib/windows/profiles/*.xml
labels_include_any:
- Engineering
managed_local_account_settings:
- enabled: true
android_settings:
configuration_profiles:
- path: ../lib/android-profile.json
@@ -442,8 +452,15 @@ controls:
### apple_settings and windows_settings
- `apple_settings.configuration_profiles` is a list of macOS, iOS, and iPadOS configuration profiles (.mobileconfig) or declaration profiles (.json).
- `windows_settings.configuration_profiles` is a list of Windows configuration profiles (.xml).
Both `apple_settings` and `windows_settings` support the following:
- `configuration_profiles` is a list of configuration profiles. Accepts .mobileconfig/.json (macOS/iOS/iPadOS) or .xml (Windows).
- `managed_local_account_settings` are settings for the managed local account.
- `enabled` specifies whether to create the managed local account on that platform (default: `false`).
Only `apple_settings` supports the following:
- `end_user_local_account_type` specifies the end user account type for macOS hosts. Requires `managed_local_account_settings.enabled` to be `true`. Default: `"admin"`.
Each entry can use either `path:` or `paths:`:
@@ -452,6 +469,8 @@ Each entry can use either `path:` or `paths:`:
Use `labels_include_all` to target hosts that have all labels, `labels_include_any` to target hosts that have any label, or `labels_exclude_any` to target hosts that don't have any of the labels. Only one of `labels_include_all`, `labels_include_any`, or `labels_exclude_any` can be specified. If none are specified, all hosts are targeted.
In addition to configuration profiles, you can upload **assets** which are `.json` files containing an Apple asset declaration (`com.apple.asset`). Assets follow the same `path:` / `paths:` syntax as profiles but should be stored in a separate `assets/` folder (e.g. `../lib/macos/assets/my-asset.json`).
### android_settings
- `android_settings.configuration_profiles` is a list of Android configuration profiles (.json).
@@ -498,8 +517,9 @@ The `setup_experience` section lets you control the out-of-the-box [setup experi
- `apple_enable_release_device_manually` when enabled, you're responsible for sending the [`DeviceConfigured` command](https://developer.apple.com/documentation/devicemanagement/device-configured-command). End users will be stuck in Setup Assistant until this command is sent. Applies to Apple (macOS, iOS, iPadOS) hosts that automatically enroll via Apple Business (AB).
- `apple_setup_assistant` is a path to a custom [automatic enrollment (ADE) profile](https://support.apple.com/guide/deployment/automated-device-enrollment-management-dep73069dd57/web) (.json). Applies to macOS and iOS/iPadOS hosts.
- `macos_script` is the path to a custom setup script to run after the host is first set up. Applies to macOS only.
- `enable_managed_local_account` specifies whether or not to create a local admin managed account on macOS hosts (default: `false`).
- `end_user_local_account_type` specifies the end user account type. `enable_managed_local_account` must be set to `true`. (default: `admin`).
`enable_managed_local_account` and `end_user_local_account_type` at this level are deprecated.
Please use the platform-specific `apple_settings.managed_local_account_settings`, `apple_settings.end_user_local_account_type`, or `windows_settings.managed_local_account_settings` instead.
#### Example
@@ -530,7 +550,7 @@ Can only be configured for "All fleets" (`default.yml`).
The `software` section allows you to configure packages, store apps (Apple App Store and Google Play Store), and Fleet-maintained apps that you want to install on your hosts.
- `packages` is a list of paths to custom packages (.pkg, .ipa, .msi, .exe, .deb, .rpm, .tar.gz, .sh, or .ps1).
- `packages` is a list of paths to custom packages (.pkg, .ipa, .msi, .exe, .deb, .rpm, .tar.gz, .sh, .py, or .ps1).
- `app_store_apps` is a list of Apple App Store or Android Play Store apps.
- `fleet_maintained_apps` is a list of Fleet-maintained apps.
@@ -540,6 +560,8 @@ Currently, Fleet only allows one package, Apple App Store app, or Fleet-maintain
Currently, when a `.ipa` file is added in `packages`, Fleet adds software for both iOS and iPadOS, along with all specified settings (e.g. `self_service`). If software for one platform is deleted in the UI, it will come back when GitOps is re-run.
Script-only packages (.sh, .ps1, .py) also support $FLEET_SECRET_* variables. Fleet replaces them with their values when the install script is sent to the host.
#### Example
`fleets/fleet-name.yml`, or `fleets/unassigned.yml`
@@ -600,6 +622,7 @@ software:
```
#### self_service, labels, categories, and setup_experience
- `self_service` specifies whether end users can install from **Fleet Desktop > Self-service** (default: `false`) on macOS or [self-service web app](https://fleetdm.com/learn-more-about/deploy-self-service-to-ios) on iOS/iPadOS.
- `labels_include_all` targets hosts that **have all** of the specified labels. `labels_include_any` targets hosts that **have any** of the specified labels. `labels_exclude_any` targets hosts that **have none** of the specified labels. Only one of these fields can be set. If none are set, all hosts are targeted.
- `categories` is a list of self-service category names. Categories group self-service software on your end users' **Fleet Desktop > My device** page so that end users can filter by category and install all software in a category at once.
@@ -622,6 +645,46 @@ software:
#### Example
##### Multiple versions of the same software
You can add multiple packages for the same software in a package YAML file. This enables staged rollouts and support of architecture-specific installers.
`self_service`, `categories`, and labels are defined per package. `setup_experience` is defined on the fleet-level.
If multiple packages target the same host, Fleet will install the one that was added first.
> In GitOps, the first package added is the first one in the package YAML file's list on the initial run that adds the title's packages. Reordering the list on a later run doesn't change the order.
>
> You can preview the order of the packages in the UI. The first package in the list is always a fallback in case of a conflict.
`fleets/fleet-name.yml`, or `fleets/unassigned.yml`
```yaml
software:
packages:
- path: ../lib/software/santa.package.yml
```
`lib/software/santa.package.yml`
```yaml
- url: https://github.com/northpolesec/santa/releases/download/2026.2/santa-2026.2.pkg
install_script:
path: ../lib/software/santa-install-script.sh
self_service: true
labels_include_all:
- macOS
- url: https://github.com/northpolesec/santa/releases/download/2026.4/santa-2026.4.pkg
install_script:
path: ../lib/software/santa-install-script.sh
self_service: true
categories:
- "💻 Productivity"
labels_include_all:
- macOS
- IT test team
```
##### URL
`lib/software-name.package.yml`:
@@ -660,7 +723,9 @@ If your server doesn't support ETags reliably, you can disable this behavior wit
##### Script-only
Script-only packages (`.sh` and `.ps1` files) are created by referencing a script file in the fleet YAML file. Script-only packages don't support `install_script` (the file contents are the install script) or automatic install (`install_software` in policies).
Script-only packages (`.sh`, `.py`, and `.ps1` files) are referenced directly inline in the fleet's YAML file. The file contents become the install script. Script packages do not support `install_script`, `uninstall_script`, `post_install_script`, `pre_install_query`, or automatic install (`install_software` in policies).
`self_service`, `categories`, `labels`, and `icon` are specified inline in the team's YAML file.
```yaml
software:
docs/Contributing/guides/cli/fleetctl-apply.md
+3
View File
@@ -502,6 +502,9 @@ spec:
- path: '/path/to/profile1.mobileconfig'
- path: '/path/to/profile2.mobileconfig'
- path: '/path/to/profile3.mobileconfig'
- path: '/path/to/declaration.json'
assets:
- path: '/path/to/asset.json'
enable_disk_encryption: true
windows_settings:
configuration_profiles:
docs/Contributing/reference/api-for-contributors.md
+19 -6
View File
@@ -713,6 +713,7 @@ Content-Type: application/octet-stream
"mdm_server_url": "https://example.com/mdm/apple/mdm",
"renew_date": "2024-10-20T00:00:00Z",
"terms_expired": false,
"token_invalid": false,
"macos_fleet": null,
"ios_fleet": null,
"ipados_fleet": null,
@@ -725,6 +726,7 @@ Content-Type: application/octet-stream
"mdm_server_url": "https://example.com/mdm/apple/mdm",
"renew_date": "2024-10-20T00:00:00Z",
"terms_expired": false,
"token_invalid": false,
"macos_fleet": null,
"ios_fleet": null,
"ipados_fleet": null,
@@ -815,6 +817,7 @@ None.
"mdm_server_url": "https://example.com/mdm/apple/mdm",
"renew_date": "2024-11-29T00:00:00Z",
"terms_expired": false,
"token_invalid": false,
"macos_fleet": 1,
"ios_fleet": 2,
"ipados_fleet": 3,
@@ -827,6 +830,7 @@ None.
"mdm_server_url": "https://example.com/mdm/apple/mdm",
"renew_date": "2024-11-29T00:00:00Z",
"terms_expired": false,
"token_invalid": false,
"macos_fleet": 1,
"ios_fleet": 2,
"ipados_fleet": 3,
@@ -884,6 +888,7 @@ Content-Type: application/octet-stream
"mdm_server_url": "https://example.com/mdm/apple/mdm",
"renew_date": "2025-10-20T00:00:00Z",
"terms_expired": false,
"token_invalid": false,
"macos_fleet": null,
"ios_fleet": null,
"ipados_fleet": null,
@@ -896,6 +901,7 @@ Content-Type: application/octet-stream
"mdm_server_url": "https://example.com/mdm/apple/mdm",
"renew_date": "2025-10-20T00:00:00Z",
"terms_expired": false,
"token_invalid": false,
"macos_fleet": null,
"ios_fleet": null,
"ipados_fleet": null,
@@ -1401,7 +1407,7 @@ Content-Type: application/octet-stream
_Available in Fleet Premium_
Returns the raw data about a DEP device's current state from the [Get Device Details](https://developer.apple.com/documentation/devicemanagement/device-details) API. Supports only Apple hosts which are, or were, assigned to Fleet in Apple Business.
Returns the raw data about a DEP device's current state from the [Get Device Details](https://developer.apple.com/documentation/devicemanagement/device-details) API. Supports only Apple hosts which are, or were, assigned to Fleet in Apple Business. If there is an error communicating with the DEP APIs, `dep_device` will be null and `dep_device_error` will contain human-readable error details.
`GET /api/v1/fleet/hosts/:id/dep_assignment`
@@ -1446,7 +1452,8 @@ Returns the raw data about a DEP device's current state from the [Get Device Det
"ab_token_id": 1,
"mdm_migration_deadline": "2025-12-05T00:00:00Z",
"mdm_migration_completed": "2025-12-05T00:00:00Z"
}
},
"dep_device_error": null
}
```
@@ -2220,7 +2227,8 @@ If the `name` is not already associated with an existing fleet, this API route c
| mdm.macos_updates.minimum_version | string | body | The required minimum operating system version. |
| mdm.macos_updates.deadline | string | body | The required installation date for Nudge to enforce the operating system version. |
| mdm.apple_settings | object | body | The Apple-specific MDM settings. |
| mdm.apple_settings.configuration_profiles | array | body | The list of objects consists of a `path` to .mobileconfig or JSON file and `labels_include_all`, `labels_include_any`, or `labels_exclude_any` list of label names. |
| mdm.apple_settings.configuration_profiles | array | body | The list of objects consists of a `path` to a .mobileconfig or JSON file and `labels_include_all`, `labels_include_any`, or `labels_exclude_any` list of label names. |
| mdm.apple_settings.assets | array | body | The list of objects consists of a `path` to a JSON asset declaration (`com.apple.asset`) file. |
| mdm.windows_settings | object | body | The Windows-specific MDM settings. |
| mdm.windows_settings.configuration_profiles | array | body | The list of objects consists of a `path` to XML files and `labels_include_all`, `labels_include_any`, or `labels_exclude_any` list of label names. |
| scripts | array | body | A list of script files to add to this fleet so they can be executed at a later time. |
@@ -2299,20 +2307,25 @@ If the `name` is not already associated with an existing fleet, this API route c
"apple_settings": {
"configuration_profiles": [
{
"path": "path/to/profile1.mobileconfig"
"path": "path/to/profile1.mobileconfig",
"labels_include_all": ["Label 1", "Label 2"]
},
{
"path": "path/to/profile2.json"
"path": "path/to/profile2.json",
"labels_exclude_any": ["Label 3", "Label 4"]
},
],
"assets": [
{
"path": "path/to/assets/asset.json"
},
],
"enable_disk_encryption": true
},
"windows_settings": {
"configuration_profiles": [
{
"path": "path/to/profile3.xml"
"path": "path/to/profile3.xml",
"labels_include_all": ["Label 1", "Label 2"]
}
]
docs/Contributing/reference/audit-logs.md
+119 -6
View File
@@ -902,9 +902,11 @@ This activity contains the following fields:
## edited_macos_profile
Generated when a user edits the macOS profiles of a fleet (or no fleet) via the fleetctl CLI.
Generated when a user edits the macOS profiles of a fleet (or no fleet) via the fleetctl CLI, or edits a single macOS profile via the edit profile endpoint.
This activity contains the following fields:
- "profile_name": Name of the edited profile. Only present when a single profile was edited; omitted for fleetctl/GitOps batch edits.
- "profile_identifier": Identifier of the edited profile. Only present when a single profile was edited; omitted for fleetctl/GitOps batch edits.
- "fleet_id": The ID of the fleet that the profiles apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
- "fleet_name": The name of the fleet that the profiles apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
@@ -912,6 +914,8 @@ This activity contains the following fields:
```json
{
"profile_name": "Custom settings 1",
"profile_identifier": "com.my.profile",
"team_id": 123,
"team_name": "Workstations",
"fleet_id": 123,
@@ -1352,9 +1356,10 @@ This activity contains the following fields:
## edited_windows_profile
Generated when a user edits the Windows profiles of a fleet (or no fleet) via the fleetctl CLI.
Generated when a user edits the Windows profiles of a fleet (or no fleet) via the fleetctl CLI, or edits a single Windows profile via the edit profile endpoint.
This activity contains the following fields:
- "profile_name": Name of the edited profile. Only present when a single profile was edited; omitted for fleetctl/GitOps batch edits.
- "fleet_id": The ID of the fleet that the profiles apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
- "fleet_name": The name of the fleet that the profiles apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
@@ -1362,6 +1367,7 @@ This activity contains the following fields:
```json
{
"profile_name": "Custom settings 1",
"team_id": 123,
"team_name": "Workstations",
"fleet_id": 123,
@@ -1489,9 +1495,11 @@ This activity contains the following fields:
## edited_declaration_profile
Generated when a user edits the macOS declarations of a fleet (or no fleet) via the fleetctl CLI.
Generated when a user edits the macOS declarations of a fleet (or no fleet) via the fleetctl CLI, or edits a single declaration via the edit profile endpoint.
This activity contains the following fields:
- "profile_name": Name of the edited declaration. Only present when a single declaration was edited; omitted for fleetctl/GitOps batch edits.
- "profile_identifier": Identifier of the edited declaration. Only present when a single declaration was edited; omitted for fleetctl/GitOps batch edits.
- "fleet_id": The ID of the fleet that the declarations apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
- "fleet_name": The name of the fleet that the declarations apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
@@ -1499,6 +1507,8 @@ This activity contains the following fields:
```json
{
"profile_name": "Passcode requirements",
"profile_identifier": "com.my.declaration",
"team_id": 123,
"team_name": "Workstations",
"fleet_id": 123,
@@ -1550,9 +1560,10 @@ This activity contains the following fields:
## edited_android_profile
Generated when a user edits the Android profiles of a fleet (or no fleet) via the fleetctl CLI.
Generated when a user edits the Android profiles of a fleet (or no fleet) via the fleetctl CLI, or edits a single Android profile via the edit profile endpoint.
This activity contains the following fields:
- "profile_name": Name of the edited profile. Only present when a single profile was edited; omitted for fleetctl/GitOps batch edits.
- "fleet_id": The ID of the fleet that the profiles apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
- "fleet_name": The name of the fleet that the profiles apply to, `null` if they apply to devices that are not in a fleet ("Unassigned").
@@ -1560,6 +1571,7 @@ This activity contains the following fields:
```json
{
"profile_name": "Custom settings 1",
"team_id": 123,
"team_name": "Workstations",
"fleet_id": 123,
@@ -2898,6 +2910,25 @@ This activity contains the following fields:
}
```
## edited_host_name_template
Generated when a user edits the host name template for a fleet (or no fleet).
This activity contains the following fields:
- "fleet_id": The ID of the fleet that the host name template applies to, `null` if it applies to devices that are not in a fleet ("Unassigned").
- "fleet_name": The name of the fleet that the host name template applies to, `null` if it applies to devices that are not in a fleet ("Unassigned").
- "name_template": The host name template, `null` if the template was cleared.
#### Example
```json
{
"fleet_id": 123,
"fleet_name": "Workstations",
"name_template": "WS-$FLEET_VAR_HOST_HARDWARE_SERIAL"
}
```
## rotated_managed_local_account_password
Generated when a managed local account password is rotated.
@@ -3134,8 +3165,33 @@ This activity contains the following fields:
```json
{
"fleet_id": 1,
"fleet_name": "💻 Workstations"
"fleet_id": 123,
"fleet_name": "Workstations"
}
```
## ran_custom_mdm_command
Generated when a user runs a custom MDM command via API or the fleetctl CLI.
This activity contains the following fields:
- "host_id": ID of the host.
- "host_display_name": Display name of the host.
- "host_uuid": UUID of the host.
- "command_uuid": UUID of the MDM command used to install the app.
- "request_type": the type of custom MDM command.
- "platform": the platform of the host ("darwin" or "windows").
#### Example
```json
{
"host_id": 1,
"host_display_name": "Anna's MacBook Pro",
"host_uuid": "1b3d5e7f-9a2c-4e6d-8b0a-1c3d5e7f9a2b",
"command_uuid": "98765432-1234-1234-1234-1234567890ab",
"request_type": "EraseDevice",
"platform": "darwin"
}
```
@@ -3181,6 +3237,63 @@ This activity contains the following fields:
}
```
## created_apple_asset_declaration
Generated when creating an Apple asset declaration.
This activity contains the following fields:
- "fleet_id": the ID of the fleet the asset belongs to.
- "fleet_name": the name of the fleet the asset belongs to.
- "asset_name": the name of the asset.
#### Example
```json
{
"fleet_id": 1,
"fleet_name": "💻 Workstations",
"asset_name": "My Asset"
}
```
## edited_apple_asset_declaration
Generated when an Apple asset declaration is edited.
This activity contains the following fields:
- "fleet_id": the ID of the fleet the asset belongs to.
- "fleet_name": the name of the fleet the asset belongs to.
- "asset_name": the name of the asset.
#### Example
```json
{
"fleet_id": 1,
"fleet_name": "💻 Workstations",
"asset_name": "My Asset"
}
```
## deleted_apple_asset_declaration
Generated when an Apple asset declaration is deleted.
This activity contains the following fields:
- "fleet_id": the ID of the fleet the asset belongs to.
- "fleet_name": the name of the fleet the asset belongs to.
- "asset_name": the name of the asset.
#### Example
```json
{
"fleet_id": 1,
"fleet_name": "💻 Workstations",
"asset_name": "My Asset"
}
```
<meta name="title" value="Audit logs">
<meta name="pageOrderInSection" value="1400">
docs/Contributing/reference/configuration-for-contributors.md
-14
View File
@@ -180,20 +180,6 @@ Whether to send anonymous usage statistics. Overrides the value set by `enable_a
enable_analytics: false
```
### microsoft_compliance_partner.proxy_api_key
For managed cloud customers only. The Fleet team sets this key.
Key that allows the Fleet server to communicate to the Microsoft compliance partner proxy on fleetdm.com.
- Default value: ""
- Environment variable: `FLEET_MICROSOFT_COMPLIANCE_PARTNER_PROXY_API_KEY`
- Config file format:
```yaml
microsoft_compliance_partner:
proxy_api_key: foobar
```
### mdm.enable_custom_os_updates_and_filevault
Documentation for setting has moved to the [Fleet server configuration](https://fleetdm.com/docs/configuration/fleet-server-configuration#mdm-enable-custom-os-updates-and-filevault) reference.
docs/Deploy/single-sign-on-sso.md
+4 -4
View File
@@ -169,9 +169,9 @@ After generating the XML file, upload it to your identity provider according to
## Fleet configuration
To configure SSO in Fleet head to **Settings > Integrations > Single sign-on (SSO) > Fleet users**.
To configure SSO in Fleet head to **Settings > Integrations > Authentication (SSO) > Fleet users**.
If you're configuring IdP authentication for setup experience head to **Settings > Integrations > Single sign-on (SSO) > End users**.
If you're configuring end user authentication head to **Settings > Integrations > Authentication (SSO) > End users**.
- **Identity provider name** - A human-readable name of the IdP. This is rendered on the login page.
@@ -189,7 +189,7 @@ If you're configuring IdP authentication for setup experience head to **Settings
`Applies only to Fleet Premium`
Fleet can automatically create users using just-in-time (JIT) provisioning. To enable this, go to **Settings > Integrations > Single sign-on (SSO) > Fleet users** and check **Create user and sync permissions on login**.
Fleet can automatically create users using just-in-time (JIT) provisioning. To enable this, go to **Settings > Integrations > Authentication (SSO) > Fleet users** and check **Create user and sync permissions on login**.
When enabled, Fleet will automatically create an account when a user logs in for the first time with the configured SSO. The new account's email and full name are copied from the user data in the SSO response.
@@ -289,7 +289,7 @@ When SCIM is configured with your IdP, Fleet automatically deletes a user's Flee
Fleet requires the `userName`, `email`, `givenName`, and `familyName` attributes to be mapped from your IdP for Fleet users. In Okta, are typically mapped from `userName`, `user.email`, `user.firstName`, and `user.lastName` respectively.
If the user is later reactivated in the IdP, Fleet will automatically recreate the account on the user’s next SSO login, as long as **Create user and sync permissions on login** in **Settings > Integrations > Single sign-on (SSO)** is enabled.
If the user is later reactivated in the IdP, Fleet will automatically recreate the account on the user’s next SSO login, as long as **Create user and sync permissions on login** in **Settings > Integrations > Authentication (SSO)** is enabled.
No manual intervention is required. This applies only to SSO-authenticated users. API-only and password-authenticated users are not affected.
docs/Get started/FAQ.md
+1 -1
View File
@@ -75,7 +75,7 @@ Fleet supports the following operating system versions on hosts.
| macOS | 14+ (Sonoma) |
| iOS/iPadOS | 17+ |
| Windows | Pro and Enterprise 10 21H2 (E) (LTS)+, Server 2012+ |
| Linux | CentOS 7.1+, Ubuntu 20.04+, Fedora 38+, Amazon Linux 2+, Debian 11+, Red Hat Enterprise Linux (RHEL) 7+, openSUSE 15.6+, Arch Linux, Omarchy |
| Linux | CentOS 7.1+, Ubuntu 20.04+, Fedora 38+, Amazon Linux 2+, Debian 11+, Red Hat Enterprise Linux (RHEL) 7+, openSUSE 15.6+, Arch Linux, Omarchy, CachyOS, Zorin OS 16+ |
| ChromeOS | 112.0.5615.134+ |
| Android | 14+ |
docs/REST API/rest-api.md
+645 -101
View File
File diff suppressed because it is too large Load Diff
docs/solutions/macos/configuration-profiles/fleet-sso-extension-example.mobileconfig
+93
View File
@@ -0,0 +1,93 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>ExtensionData</key>
<dict>
<key>BaseURL</key>
<string>https://fleet.example.com</string>
</dict>
<key>ExtensionIdentifier</key>
<string>com.fleetdm.fleet-desktop.pssoextension</string>
<key>PayloadDisplayName</key>
<string>Fleet Extensible Single Sign-On</string>
<key>PayloadIdentifier</key>
<string>com.apple.extensiblesso.AF68D4CF-1250-4FF4-AFFB-1176DB539C49</string>
<key>PayloadType</key>
<string>com.apple.extensiblesso</string>
<key>PayloadUUID</key>
<string>AF68D4CF-1250-4FF4-AFFB-1176DB539C49</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PlatformSSO</key>
<dict>
<key>AuthenticationMethod</key>
<string>Password</string>
<key>UseSharedDeviceKeys</key>
<true/>
<key>EnableRegistrationDuringSetup</key>
<true/>
<key>TokenToUserMapping</key>
<dict>
<key>AccountName</key>
<string>accountName</string>
<key>FullName</key>
<string>name</string>
</dict>
</dict>
<key>RegistrationToken</key>
<string>$FLEET_VAR_PSSO_DEVICE_REGISTRATION_TOKEN</string>
<key>ScreenLockedBehavior</key>
<string>DoNotHandle</string>
<key>TeamIdentifier</key>
<string>8VBZ3948LU</string>
<key>Type</key>
<string>Redirect</string>
<key>URLs</key>
<array>
<string>https://fleet.example.com</string>
</array>
</dict>
<dict>
<key>PayloadType</key>
<string>com.apple.associated-domains</string>
<key>PayloadIdentifier</key>
<string>com.apple.associated-domains.4D68D4CF-1250-4FF4-AFFB-1176DB539C49</string>
<key>PayloadUUID</key>
<string>4D68D4CF-1250-4FF4-AFFB-1176DB539C49</string>
<key>Configuration</key>
<array>
<dict>
<key>ApplicationIdentifier</key>
<string>8VBZ3948LU.com.fleetdm.fleet-desktop</string>
<key>AssociatedDomains</key>
<array>
<string>authsrv:fleet.example.com</string>
</array>
</dict>
<dict>
<key>ApplicationIdentifier</key>
<string>8VBZ3948LU.com.fleetdm.fleet-desktop.pssoextension</string>
<key>AssociatedDomains</key>
<array>
<string>authsrv:fleet.example.com</string>
</array>
</dict>
</array>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>Fleet Platform SSO</string>
<key>PayloadIdentifier</key>
<string>com.fleetdm.platformsso.fleet.A72B07D0-2E08-45CE-9423-1FCAFFAEC390</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>A72B07D0-2E08-45CE-9423-1FCAFFAEC390</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>