Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Preview of v4.86.0 doc changes (merge conflicts resolved) (#42428)

Browse Source
This commit is contained in:
Rachael Shaw
2026-05-29 17:37:53 -05:00
committed by GitHub
parent cf4d869906
commit c45ff9f029
19 changed files with 819 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Configuration/agent-configuration.md
+36
View File
@@ -306,6 +306,42 @@ agent_options:
script_execution_timeout: 600
```
## orbit
The `orbit` block configures the orbit agent itself (as opposed to osquery). It's kept separate from `command_line_flags` so orbit-specific settings don't need to satisfy the osquery flag schema.
To learn where to find fleetd logs on each platform, see [Finding fleetd logs](https://fleetdm.com/guides/fleet-troubleshooting-for-it-admins#finding-fleetd-logs).
### debug_logging (_Coming soon_)
When `true`, orbit runs at debug log level and passes `--verbose` and `--tls_dump` to osqueryd on every host in the team (or globally, if set on no-team agent options). Unlike `command_line_flags`, toggling this does **not** require an orbit restart: the change is applied on each host's next config poll (up to 30 seconds). Default: `false`.
Individual hosts can additionally be put into debug mode temporarily via the [`POST /api/v1/fleet/hosts/:id/debug-logging`](https://fleetdm.com/docs/rest-api/rest-api#set-host-orbit-debug-logging) endpoint or the **Enable debug logging** action on the host details page. Host-level overrides can only force debug on (they can't silence a host whose team default is on) and auto-expire after a configurable duration (default 24h, max 7d).
#### Example
```yaml
agent_options:
orbit:
debug_logging: true
```
### debug_logging_on_enroll_duration
A Go duration number in seconds (e.g. `3600`, `14400`). When greater than zero, every host that orbit-enrolls (or re-enrolls) into this team — or no-team for global agent options — is automatically put into debug mode for the configured duration after *its* enrollment. The host then reverts to the team default. Default: unset (no auto-stamp). Maximum: `86400` (24 hours).
Use this during a rollout to capture verbose Setup Experience logs from new hosts without having to flip debug per host afterward. Each host's debug expires `duration` after its own enrollment moment, not at a shared wall-clock time.
There is **no global fallback**: a host that enrolls into a team uses that team's setting, regardless of what's on global agent options. To apply this option broadly, set it on each team (typically via gitops).
#### Example
```yaml
agent_options:
orbit:
debug_logging_on_enroll_duration: 3600
```
<meta name="pageOrderInSection" value="300">
<meta name="description" value="Learn how to use configuration files and the fleetctl command line tool to configure agent options.">
<meta name="keywordsForDocsearch" value="command line flags, agent config file">
docs/Configuration/fleet-server-configuration.md
+67
View File
@@ -598,6 +598,35 @@ A value of 0 means no timeout.
write_timeout: 5s
```
### redis_host_cache_enabled
Enables a Redis-backed cache that fronts host lookups on the osquery and orbit auth paths.
When enabled, Fleet caches authenticated host records in Redis to reduce MySQL load on
high-volume check-in endpoints. Disable to bypass the cache and serve every check-in directly
from MySQL.
- Default value: true
- Environment variable: `FLEET_REDIS_HOST_CACHE_ENABLED`
- Config file format:
```yaml
redis:
host_cache_enabled: true
```
### redis_host_cache_ttl
Base TTL for entries in the Redis-backed host lookup cache. Each entry's actual TTL is jittered
by ±10% to avoid synchronized expiry waves. Must be greater than 0 when `redis_host_cache_enabled`
is true; to disable the cache, set `redis_host_cache_enabled=false` instead of zeroing this value.
- Default value: 60s
- Environment variable: `FLEET_REDIS_HOST_CACHE_TTL`
- Config file format:
```yaml
redis:
host_cache_ttl: 60s
```
## Server
### server_address
@@ -2682,6 +2711,25 @@ Optionally, if you're using a third-party to manage AWS resources, this is the A
software_installers_sts_external_id: your_unique_id
```
### s3_software_installers_gcs_iam_auth
When `true`, Fleet uses Google Application Default Credentials (ADC) bearer tokens for
authentication against Google Cloud Storage's S3-compatible endpoint instead of S3 HMAC keys.
Use this only with `s3_software_installers_endpoint_url` set to `https://storage.googleapis.com`.
This is incompatible with `s3_software_installers_access_key_id`,
`s3_software_installers_secret_access_key`, and `s3_software_installers_sts_assume_role_arn`.
On GCE, GKE, or Cloud Run, ADC typically resolves to the runtime workload identity (metadata server).
- Default value: false
- Environment variable: `FLEET_S3_SOFTWARE_INSTALLERS_GCS_IAM_AUTH`
- Config file format:
```yaml
s3:
software_installers_gcs_iam_auth: true
```
### s3_software_installers_endpoint_url
*Available in Fleet Premium.*
@@ -2843,6 +2891,25 @@ All carve objects will also be prefixed by date and hour (UTC), making the resul
carves_sts_external_id: your_unique_id
```
### s3_carves_gcs_iam_auth
When `true`, Fleet uses Google Application Default Credentials (ADC) bearer tokens for
authentication against Google Cloud Storage's S3-compatible endpoint instead of S3 HMAC keys.
Use this only with `s3_carves_endpoint_url` set to `https://storage.googleapis.com`.
This is incompatible with `s3_carves_access_key_id`,
`s3_carves_secret_access_key`, and `s3_carves_sts_assume_role_arn`.
On GCE, GKE, or Cloud Run, ADC typically resolves to the runtime workload identity (metadata server).
- Default value: false
- Environment variable: `FLEET_S3_CARVES_GCS_IAM_AUTH`
- Config file format:
```yaml
s3:
carves_gcs_iam_auth: true
```
### s3_carves_endpoint_url
> Same override behavior as [`s3_software_installers_endpoint_url`](#s3_software_installers_endpoint_url). Do not set this when using IRSA or IAM role-based authentication.
docs/Configuration/yaml-files.md
+70 -61
View File
@@ -410,6 +410,7 @@ controls:
- name: wifi-certificate
certificate_authority_name: EST_WIFI
subject_name: CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME, OU=$FLEET_VAR_HOST_UUID, ST=$FLEET_VAR_HOST_HARDWARE_SERIAL
subject_alternative_name: "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME"
setup_experience: # Available in Fleet Premium
bootstrap_package: https://example.org/bootstrap_package.pkg
enable_end_user_authentication: true
@@ -467,51 +468,19 @@ Use `labels_include_all` to target hosts that have all labels, `labels_include_a
- `name` is the name of the certificate. Name can be used as a certificate alias to reference in configuration profiles (custom settings).
- `certificate_authority_name` is the name of the [certificate authority (CA)](#certificate-authorities) to issue the certificate from. Currently, only a custom SCEP CA is supported.
- `subject_name` is the certificate's subject name (SN). Separate subject fields by a "/". For example: "CN=john@example.com, O=Acme Inc.".
- `subject_name` is the certificate's subject name (SN). Separate subject fields with a comma (`,`). For example: "/CN=john@example.com/O=Acme Inc.".
- `subject_alternative_name` is the certificate's subject alternative name (SAN). Separate SAN fields with a comma (`,`). Each field is a key-value pair. Supported keys (case-insensitive) are:
- `DNS` for a DNS hostname (e.g. `DNS=wifi.example.com`).
- `EMAIL` for an email address / RFC 822 name (e.g. `EMAIL=john@example.com`).
- `UPN` for a Microsoft User Principal Name (e.g. `UPN=john@corp.example.com`), commonly used for Active Directory / Intune Wi-Fi authentication.
- `IP` for an IPv4 or IPv6 address (e.g. `IP=10.0.0.1` or `IP=2001:db8::1`).
- `URI` for a URI (e.g. `URI=spiffe://example.com/workload/wifi`).
#### Variables
Example: `"DNS=wifi.example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME"`.
For macOS configuration profiles, you can use any of Apple's [built-in variables](https://support.apple.com/en-my/guide/deployment/dep04666af94/1/web/1.0) in [Automated Certificate Management Environment (ACME)](https://developer.apple.com/documentation/devicemanagement/acmecertificate), [Simple Certificate Enrolment Protocol (SCEP)](https://developer.apple.com/documentation/devicemanagement/scep), or [VPN](https://developer.apple.com/documentation/devicemanagement/vpn) payloads.
You can use [Fleet's host variables](https://fleetdm.com/guides/fleet-variables) in `subject_name` and `subject_alternative_name` to make the certificate unique to each host.
Fleet also supports adding [GitHub](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow) or [GitLab](https://docs.gitlab.com/ci/variables/) environment variables in your configuration profiles. Use `$ENV_VARIABLE` format.
If you use one of these variables in a configuration profile, Fleet will automatically resend it when the variable's value changes.
In Fleet Premium, you can use reserved variables beginning with `$FLEET_VAR_`. Fleet will populate these variables when profiles are sent to hosts. Supported variables are:
| Name | Platforms | Description |
| ---- | --------- | ----------- |
| <span style="display: inline-block; min-width: 240px;">`$FLEET_VAR_NDES_SCEP_CHALLENGE`</span> | macOS, iOS, iPadOS | Fleet-managed one-time NDES challenge password used during SCEP certificate configuration profile deployment. |
| `$FLEET_VAR_NDES_SCEP_PROXY_URL` | macOS, iOS, iPadOS | Fleet-managed NDES SCEP proxy endpoint URL used during SCEP certificate configuration profile deployment. |
| `$FLEET_VAR_HOST_END_USER_IDP_USERNAME` | macOS, iOS, iPadOS, Windows | Host's IdP username (e.g. "user@example.com"). When this changes, Fleet will automatically resend the profile. |
| `$FLEET_VAR_HOST_END_USER_IDP_FULL_NAME` | macOS, iOS, iPadOS, Windows | Host's IdP full name. When this changes, Fleet will automatically resend the profile. |` | macOS, iOS, iPadOS | Host's IdP username. When this changes, Fleet will automatically resend the profile. |
| `$FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART` | macOS, iOS, iPadOS, Windows | Local part of the email (e.g. john from john@example.com). When this changes, Fleet will automatically resend the profile. |
| `$FLEET_VAR_HOST_END_USER_IDP_GROUPS` | macOS, iOS, iPadOS, Windows | Comma separated IdP groups that host belongs to. When these change, Fleet will automatically resend the profile. |
| `$FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT` | macOS, iOS, iPadOS, Windows | Host's IdP department. When this changes, Fleet will automatically resend the profile. |
| `$FLEET_VAR_HOST_UUID` | macOS, iOS, iPadOS, Windows | Host's hardware UUID. |
| `$FLEET_VAR_HOST_HARDWARE_SERIAL` | macOS, iOS, iPadOS, Windows | Host's hardware serial number. |
| `$FLEET_VAR_HOST_PLATFORM` | macOS, iOS, iPadOS, Windows | Host's platform. Values are `"macos"`, `"ios"`, `"ipados"`, and `"windows"`. |
| `$FLEET_VAR_CUSTOM_SCEP_CHALLENGE_<CA_NAME>` | macOS, iOS, iPadOS, Windows | Fleet-managed one-time challenge password used during SCEP certificate configuration profile deployment. `<CA_NAME>` should be replaced with name of the certificate authority configured in [custom_scep_proxy](#custom-scep-proxy). |
| `$FLEET_VAR_CUSTOM_SCEP_PROXY_URL_<CA_NAME>` | macOS, iOS, iPadOS, Windows | Fleet-managed SCEP proxy endpoint URL used during SCEP certificate configuration profile deployment. |
| `$FLEET_VAR_SCEP_RENEWAL_ID` | macOS, iOS, iPadOS, Windows | Fleet-managed ID that's required to automatically renew Smallstep, Microsoft NDES, and custom SCEP certificates. The ID must be specified in the Organizational Unit (OU) field in the configuration profile. |
| `$FLEET_VAR_DIGICERT_PASSWORD_<CA_NAME>` | macOS, iOS, iPadOS | Fleet-managed password required to decode the base64-encoded certificate data issued by a specified DigiCert certificate authority during PKCS12 profile deployment. `<CA_NAME>` should be replaced with name of the certificate authority configured in [digicert](#digicert). |
| `$FLEET_VAR_DIGICERT_DATA_<CA_NAME>` | macOS, iOS, iPadOS | Fleet-managed base64-encoded certificate data issued by a specified DigiCert certificate authority during PKCS12 profile deployment. `<CA_NAME>` should be replaced with name of the certificate authority configured in [digicert](#digicert). |
| `$FLEET_VAR_SCEP_WINDOWS_CERTIFICATE_ID` | Windows | ID used for SCEP configuration profile on Windows. It must be included in the `<LocURI>` field.|
| `$FLEET_VAR_SMALLSTEP_SCEP_CHALLENGE_<CA_NAME>` | macOS, iOS, iPadOS | Fleet-managed one-time Smallstep challenge password used during SCEP certificate configuration profile deployment. `<CA_NAME>` should be replaced with name of the certificate authority configured in [custom_scep_proxy](#custom-scep-proxy). |
| `$FLEET_VAR_SMALLSTEP_SCEP_PROXY_URL_<CA_NAME>` | macOS, iOS, iPadOS | Fleet-managed Smallstep SCEP proxy endpoint URL used during SCEP certificate configuration profile deployment. |
The dollar sign (`$`) can be escaped so it's not considered a variable by using a backslash (e.g. `\$100`). Additionally, `MY${variable}HERE` syntax can be used to put strings around the variable.
In XML, certain characters (`&`, `<`, `>`, `"`, `'`) must be escaped because they have special meanings in the markup language. GitHub and GitLab environment variables, as well as Fleet's reserved variables, will be automatically escaped when used in a `.mobileconfig` configuration profile. For example, `&` will become `&amp;`.
In JSON, certain characters (`"`, `\`, and control characters) must be escaped because they have special meanings in the data format. GitHub and GitLab environment variables, as well as Fleet's reserved variables, will be automatically escaped when used in a `.json` configuration profile (Apple DDM declaration or Android profile). For example, `"` will become `\"`.
If certificate authority (CA) variables (ex. `$FLEET_VAR_DIGICERT_DATA_<CA_NAME>`) don't exist, GitOps dry runs will succeed but GitOps runs will fail.
To hide variable values in the API and UI, you can use Fleet's [custom variables](https://fleetdm.com/guides/secrets-in-scripts-and-configuration-profiles#gitops).
### setup_experience
### macos_setup
The `setup_experience` section lets you control the out-of-the-box [setup experience](https://fleetdm.com/guides/setup-experience).
@@ -584,7 +553,7 @@ software:
setup_experience: true
- path: ../lib/software-name2.package.yml
app_store_apps:
- app_store_id: "1091189122"
- app_store_id: "546505307"
platform: ios
labels_include_any: # Available in Fleet Premium
- Product
@@ -595,6 +564,8 @@ software:
auto_update_enabled: true
auto_update_window_start: "00:00"
auto_update_window_end: "04:00"
configuration:
path: ../lib/software/zoom-config.xml
- app_store_id: "us.zoom.videomeetings"
platform: android
self_service: true
@@ -713,9 +684,9 @@ software:
+ For Apple App Store apps, make sure to include only the ID itself, and not the `id` prefix shown in the URL. The ID must be wrapped in quotes as shown in the example so that it is processed as a string.
- `platform` is the platform of the app (`darwin`, `ios`, `ipados`, or `android`). If not specified, and `app_store_id` is Apple App Store ID, one app for each of the Apple App Store app's supported platforms is added. For example, adding [Bear](https://apps.apple.com/us/app/bear-markdown-notes/id1016366447) (supported on iOS and iPadOS) adds both the iOS and iPadOS apps to your software that's available to install in Fleet.
- `icon.path` is a relative path to the PNG icon that will be displayed in Fleet and on **Fleet Desktop > Self-service** instead of the default icon the icon sourced from Apple. It must be a square PNG with dimensions between 120x120 px and 1024x1024 px. Custom icons will only override the icon for the software title and fleet where they are added.
- `configuration.path` is the Android Play Store app's managed configuration in JSON format. Currently only supported for Android.
+ `managedConfiguration` and `workProfileWidgets` are supported from [Android application policy](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#ApplicationPolicy).
+ Configuration keys vary by app. Refer to the app vendor's documentation for available managed configuration options. For example, see [Zoom's Android managed configuration](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064790) or [GlobalProtect's Android configuration](https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/mobile-endpoint-management/manage-the-globalprotect-app-using-other-third-party-mdms/configure-the-globalprotect-app-for-android).
- `configuration.path` is the app managed configuration. For iOS and iPadOS apps it is in XML format, and for Android Play Store apps it is in JSON format. Currently only supported for iOS, iPadOS, and Android.
+ Android: `managedConfiguration` and `workProfileWidgets` are supported from [Android application policy](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#ApplicationPolicy).
+ Configuration keys vary by app. Refer to the app vendor's documentation for available managed configuration options. For example, see [Zoom's Android managed configuration](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064790), [Zoom's iOS managed configuration](https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0064102), or [GlobalProtect's Android configuration](https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/mobile-endpoint-management/manage-the-globalprotect-app-using-other-third-party-mdms/configure-the-globalprotect-app-for-android).
- `auto_update_enabled` enables automatic updates for the app (default: `false`). Only supported for iOS and iPadOS App Store (VPP) apps.
- `auto_update_window_start` is the start of the daily maintenance window during which Fleet will apply automatic updates, formatted as `HH:MM` in the host's local time (e.g. `"00:00"`). Required when `auto_update_enabled` is `true`. Must be wrapped in quotes so it is processed as a string.
- `auto_update_window_end` is the end of the daily maintenance window, formatted as `HH:MM` in the host's local time (e.g. `"04:00"`). Required when `auto_update_enabled` is `true`. If the end time is earlier than the start time, the window wraps to the next day (e.g. `"22:00"` to `"02:00"`). Must be wrapped in quotes so it is processed as a string.
@@ -795,6 +766,26 @@ org_settings:
alternative_browser_host: fleet-desktop.example.com
```
### gitops
The `gitops` section allows configuring [GitOps mode](https://fleetdm.com/learn-more-about/ui-gitops-mode) in the Fleet UI. When GitOps mode is enabled, many UI features become read-only to ensure that configuration changes are made only via GitOps.
- `gitops_mode_enabled` — when `true`, Fleet's UI shows GitOps-managed sections as read-only with a tooltip pointing to the repository URL. Requires Fleet Premium.
- `repository_url` (default: `""`) — the URL of the GitOps repository that manages this Fleet. Must be a valid `http://` or `https://` URL. Required when `gitops_mode_enabled: true`.
Can only be configured for "All fleets" (`org_settings`).
> If `gitops:` is not provided in your YAML file, any existing GitOps mode settings will be preserved.
#### Example
```yaml
org_settings:
gitops:
gitops_mode_enabled: true
repository_url: https://github.com/example/fleet-config
```
### host_expiry_settings
The `host_expiry_settings` section lets you define if and when hosts should be automatically deleted from Fleet if they have not checked in.
@@ -814,18 +805,37 @@ org_settings:
host_expiry_window: 10
```
### activity_expiry_settings
The `activity_expiry_settings` section lets you define how to handle activities.
- `activity_expiry_enabled` when enabled, allows automatic cleanup of activities (and associated live query data) older than the specified number of days. Activities linked to a host are preserved until the host is deleted.
- `activity_expiry_window` the number of days to retain activity records, if activity expiry is enabled.
- `preserve_host_activity_on_reenrollment` When enabled, preserves host activities after a wipe and re-enrollment. Currently only supported for company-owned (AB) Apple hosts. **Delete activities > Max activity age** still applies. (Default: `false`)
#### Example
```yaml
org_settings:
activity_expiry_settings:
activity_expiry_enabled: true
activity_expiry_window: 30
preserve_host_activity_on_reenrollment: true
```
### org_info
- `org_name` is the name of your organization (default: `""`)
- `org_logo_url` is a public URL of the logo for your organization (default: Fleet logo).
- `org_logo_url_light_background` is a public URL of the logo for your organization that can be used with light backgrounds (default: Fleet logo).
- `org_logo_path_dark_mode` is a path to an image file for your organization's logo (default: Fleet logo). Only one of `org_logo_path_dark_mode` or `org_logo_url_dark_mode` may be specified.
- `org_logo_path_light_mode` is a path to an image file for your organization's logo (default: Fleet logo). Only one of `org_logo_path_light_mode` or `org_logo_url_light_mode` may be specified.
- `org_logo_url_dark_mode` is a public URL of the logo for your organization (default: Fleet logo). Only one of `org_logo_path_dark_mode` or `org_logo_url_dark_mode` may be specified.
- `org_logo_url_light_mode` is a public URL of the logo for your organization that can be used with light backgrounds (default: Fleet logo). Only one of `org_logo_path_light_mode` or `org_logo_url_light_mode` may be specified.
- `contact_url` is a URL or [file URI](https://en.wikipedia.org/wiki/File_URI_scheme) that appears in error messages presented to end users (default: `"https://fleetdm.com/company/contact"`)
Can only be configured for "All fleets" (`org_settings`).
To get the best results for your logos (`org_logo_url` and `org_logo_url_light_background`), use the following sizes:
- For square logos, use a PNG that's 256x256 pixels (px).
- For rectangular logos (wordmark), use a PNG that's 516x256 pixels (px).
To get the best results for your logos (`org_logo_url_dark_mode`/`org_logo_path_dark_mode` and `org_logo_url_light_mode`/`org_logo_path_light_mode`), use the following sizes:
- For square logos, use a PNG, JPEG/JPG, WebP or SVGs that's 256x256 pixels (px).
- For rectangular logos (wordmark), use a PNG, JPEG/JPG, WebP or SVGs that's 516x256 pixels (px).
#### Example
@@ -833,8 +843,8 @@ To get the best results for your logos (`org_logo_url` and `org_logo_url_light_b
org_settings:
org_info:
org_name: Fleet
org_logo_url: https://example.com/logo.png
org_logo_url_light_background: https://example.com/logo-light.png
org_logo_url_dark_mode: https://example.com/logo.png
org_logo_url_light_mode: https://example.com/logo-light.png
contact_url: https://fleetdm.com/company/contact
```
@@ -1172,14 +1182,14 @@ org_settings:
### mdm
#### apple_business_manager
#### apple_business
After [adding an Apple Business Manager (ABM) token via the UI](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager), the `apple_business_manager` section lets you determine which fleet Apple hosts are assigned to in Fleet when they appear in Apple Business Manager.
After [adding an Apple Business (AB) token via the UI](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager), the `apple_business` section lets you determine which fleet Apple hosts are assigned to in Fleet when they appear in Apple Business.
- `organization_name` is the organization name associated with the Apple Business Manager account.
- `macos_fleet` is the fleet where macOS hosts are automatically added when they appear in Apple Business Manager. If not specified, defaults to "Unassigned".
- `ios_fleet` is the the fleet where iOS hosts are automatically added when they appear in Apple Business Manager. If not specified, defaults to "Unassigned".
- `ipados_fleet` is the fleet where iPadOS hosts are automatically added when they appear in Apple Business Manager. If not specified, defaults to "Unassigned".
- `organization_name` is the organization name associated with the Apple Business account.
- `macos_fleet` is the fleet where macOS hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".
- `ios_fleet` is the the fleet where iOS hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".
- `ipados_fleet` is the fleet where iPadOS hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".
Can only be configured for "All fleets" (`org_settings`).
@@ -1188,7 +1198,7 @@ Can only be configured for "All fleets" (`org_settings`).
```yaml
org_settings:
mdm:
apple_business_manager: # Available in Fleet Premium
apple_business: # Available in Fleet Premium
- organization_name: Fleet Device Management Inc.
macos_fleet: 💻 Workstations
ios_fleet: 📱🏢 Company-owned iPhones
@@ -1198,7 +1208,6 @@ org_settings:
#### volume_purchasing_program
After you've uploaded a [Volume Purchasing Program](https://fleetdm.com/guides/macos-mdm-setup#volume-purchasing-program-vpp) (VPP) token, the `volume_purchasing_program` section lets you configure the fleets in Fleet that have access to that VPP token's App Store apps. Currently, adding a VPP token is only available using Fleet's UI.
- `location` is the name of the organization unit in the Apple Business account. Apple previously called this "location." Fleet will rename it to "organization unit" in the next major version.
- `fleets` is a list of fleet names. If you choose specific fleets, App Store apps in this VPP account will only be available to install on hosts in these fleets. If not specified, App Store apps will not be available to install on any fleet. To apply it to all fleets, use `- All fleets`.