From f0c0411d1081d2b536174a3c6ebf9bdebf2faac0 Mon Sep 17 00:00:00 2001 From: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Date: Mon, 8 Sep 2025 17:09:11 +0200 Subject: [PATCH] [Guide update] IdP authentication before BYOD iOS, iPadOS, and Android enrollment (#32475) Related to: - #30684 - @noahtalerman: Added a "Variables" section in the YAML reference so we can link to it. --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Rachael Shaw --- articles/foreign-vitals-map-idp-users-to-hosts.md | 12 +++++++----- articles/macos-setup-experience.md | 2 ++ docs/Configuration/yaml-files.md | 3 ++- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/articles/foreign-vitals-map-idp-users-to-hosts.md b/articles/foreign-vitals-map-idp-users-to-hosts.md index 3aed4cd903..9829e03829 100644 --- a/articles/foreign-vitals-map-idp-users-to-hosts.md +++ b/articles/foreign-vitals-map-idp-users-to-hosts.md @@ -1,16 +1,18 @@ -# Foreign vitals: map IdP users to hosts +# Foreign host vitals: Identity provider (IdP) username, groups, and department ![Import users from IdP to Fleet](../website/assets/images/articles/add-users-from-idp-cover-img-800x400@2x.png) _Available in Fleet Premium._ -To add IdP host vitals, like the end user's groups, department, and full name, follow steps for your IdP. +Fleet can map an end user's IdP username, groups, and department to their host(s) in Fleet. Then, you can use these IdP host vitals as [variables in configuration profiles](https://fleetdm.com/docs/configuration/yaml-files#variables) or criteria for labels. -Fleet currently gathers your end user's IdP username when [end users log in](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication) during the automatic enrollment (DEP) setup process. +Fleet gathers IdP host vitals when an end user authenticates during these enrollment scenarios: +- Automatic enrollment (ADE) for Apple (macOS, iOS, iPadOS) hosts. +- Manual enrollment for personal (BYOD) iOS and iPadOS hosts (Android coming soon). -By connecting Fleet to your IdP to sync user data, you can add additional information, like the end user's groups and full name to your host data in Fleet. This allows you to leverage IdP information as variables in macOS configuration profiles to, for example, [deploy a WiFi certificate](https://fleetdm.com/guides/connect-end-user-to-wifi-with-certificate#step-4-add-pkcs-12-configuration-profile-to-fleet). +Learn how to enforce authentication in the [setup experience guide](https://fleetdm.com/guides/macos-setup-experience#end-user-authentication). -Fleet currently supports syncing data with [Okta](#okta), [Microsoft Active Directory (AD) / Entra ID](#microsoft-entra-id), [Google Workspace](#google-workspace), and [authentik](#google-workspace), with support for more IdPs coming soon. +The IdPs Fleet currently supports are [Okta](#okta), [Microsoft Active Directory (AD) / Entra ID](#microsoft-entra-id), [Google Workspace](#google-workspace), and [authentik](#google-workspace). ## Okta diff --git a/articles/macos-setup-experience.md b/articles/macos-setup-experience.md index 8dffbbde8b..20d81d527a 100644 --- a/articles/macos-setup-experience.md +++ b/articles/macos-setup-experience.md @@ -30,6 +30,8 @@ Using Fleet, you can require end users to authenticate with your identity provid ### End user authentication +You can enforce end user authentication during automatic enrollment (ADE) for Apple (macOS, iOS, iPadOS) hosts and manual enrollment for personal (BYOD) iOS and iPadOS hosts (Android coming soon). + 1. Create a new SAML app in your IdP. In your new app, use `https:///api/v1/fleet/mdm/sso/callback` for the SSO URL. If this URL is set incorrectly, end users won't be able to enroll. On iOS hosts, they'll see a "This screen size is not supported yet" error message. 2. In your new SAML app, set **Name ID** to email (required). Fleet will trim this email and use it diff --git a/docs/Configuration/yaml-files.md b/docs/Configuration/yaml-files.md index ff07f2b665..2d5c5d1f34 100644 --- a/docs/Configuration/yaml-files.md +++ b/docs/Configuration/yaml-files.md @@ -387,11 +387,12 @@ controls: Use `labels_include_all` to target hosts that have all labels, `labels_include_any` to target hosts that have any label, or `labels_exclude_any` to target hosts that don't have any of the labels. Only one of `labels_include_all`, `labels_include_any`, or `labels_exclude_any` can be specified. If none are specified, all hosts are targeted. +#### Variables + For macOS configuration profiles, you can use any of Apple's [built-in variables](https://support.apple.com/en-my/guide/deployment/dep04666af94/1/web/1.0). Fleet also supports adding [GitHub](https://docs.github.com/en/actions/learn-github-actions/variables#defining-environment-variables-for-a-single-workflow) or [GitLab](https://docs.gitlab.com/ci/variables/) environment variables in your configuration profiles. Use `$ENV_VARIABLE` format. - In Fleet Premium, you can use reserved variables beginning with `$FLEET_VAR_`. Fleet will populate these variables when profiles are sent to hosts. Supported variables are: | Name | Platforms | Description |