Resolves#40813
* Added configurable body size limits for the `/api/osquery/log`,
`/api/osquery/distributed/write` and `/api/osquery/config` endpoints.
* Fixed false positive `PayloadTooLargeError` errors.
---------
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
## Summary
- **Reverts PR #41257**: Claude Desktop should NOT have
`setup_experience: true` — it should not be automatically installed
during device setup. PR #41257 (which added `setup_experience: true` to
both macOS and Windows Claude Desktop entries) has been closed.
- **Updates Claude Desktop "up to date" policy version strings** to
match the latest fleet-maintained app catalog versions:
- macOS: `1.1.4328` → `1.1.5749` (from
`ee/maintained-apps/outputs/claude/darwin.json`)
- Windows: `1.1.4088` → `1.1.5368` (from
`ee/maintained-apps/outputs/claude/windows.json`)
## Changes
| File | Change |
|------|--------|
| `it-and-security/lib/macos/policies/update-claude.yml` | Version
`1.1.4328` → `1.1.5749` |
| `it-and-security/lib/windows/policies/update-claude.yml` | Version
`1.1.4088` → `1.1.5368` |
Closes#41257
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773070240095919?thread_ts=1773069775.458399&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Removes the Company Portal software package from the Workstations team
- Removes the Company Portal SSO extension (extensible SSO)
configuration profile from the Workstations team
- Removes the "Conditional access test group" label that was used to
scope both Company Portal and the SSO extension
- Removes the `company-portal-installed` and
`entra-conditional-access-check` policies that were specifically for
Company Portal/Entra conditional access
- Removes the `create-conditional-access-allow-file.sh` and
`user-enroll-entra-company-portal.sh` scripts that were only used by the
removed policies/Company Portal
### Files deleted
-
`it-and-security/lib/macos/configuration-profiles/company-portal-sso-extension.mobileconfig`
- `it-and-security/lib/macos/software/company-portal.yml`
- `it-and-security/lib/macos/policies/company-portal-installed.yml`
-
`it-and-security/lib/macos/policies/entra-conditional-access-check.yml`
-
`it-and-security/lib/macos/scripts/create-conditional-access-allow-file.sh`
-
`it-and-security/lib/macos/scripts/user-enroll-entra-company-portal.sh`
- `it-and-security/lib/all/labels/conditional-access-test-group.yml`
### Files modified
- `it-and-security/teams/workstations.yml` — Removed references to
Company Portal software, SSO extension profile, related policies, and
the conditional access script
- `it-and-security/default.yml` — Removed the "Conditional access test
group" label definition
### Items intentionally kept
- `fleet-okta-conditional-access.mobileconfig` — This is an Okta-based
conditional access profile, not related to Company Portal/Entra SSO
- `conditional_access_enabled: true` in team settings — This is a
team-level integration setting, not Company Portal specific
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773067955110849)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41012
# Details
This PR makes it allowable to leave out almost all top-level keys from
GitOps files. The only required keys are _either_ `name:` (for a fleet
settings file) or `org_settings:` (for a global settings file). Omitting
a key is identical to supplying it with no value.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
Updated the "missing all global keys test", and added some new tests to
verify that omitting the key was the same as supplying it with an empty
value.
- [X] QA'd all new/changed functionality manually
1. Ran `fleetctl generate-gitops` to get a clean set of GitOps yml files
2. Removed all removable keys from default.yml and ran `fleetctl gitops`
3. Ran `fleetctl generate-gitops` again into a different dir
4. Ran `fleetctl gitops` with the original files to get back to original
state
5. Cleared out all now-removable keys and replaced them with empty value
(e.g. `reports:` with nothing under it)
6. Ran `fleetctl generate-gitops` again into a third dir
7. Compared the files from the second and third generate-gitops runs to
verify that omitting the key had the same result as supplying it with an
empty value
8. Did the above steps with a fleet (i.e. non-global) .yml file.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **New Features**
* GitOps files now support omitting top-level configuration keys instead
of requiring them to be explicitly set to empty values.
* org_settings is now required when team name is not specified.
* **Tests**
* Added integration tests validating behavior when omitting top-level
keys in global and team-level GitOps configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#40327
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#36682
- Added similar "not found" handling than the one we have when calling
`getHostScriptExecutionResultDB` within the `GetHostLockWipeStatus`
function for consistency => now return a 404 instead of a 500 when no
rows are returned.
- Applied similar changes to
https://github.com/fleetdm/fleet/issues/33090 (PR:
https://github.com/fleetdm/fleet/pull/40009) => logging an error instead
of returning a 404, so that the Host details page does not crash.
The actual fix would be to remove the `host_mdm_actions` record that
contains the orphan `lock_ref` mentioned in the issue.
I'm not sure what the root cause is, but I think setting up some
monitoring on the logs I added should help determining that.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
This pull request updates the workstation team settings to ensure that
disk space policies are enforced across all major operating systems. The
most important change is the addition of specific policy IDs for
monitoring disk space on Linux, macOS, and Windows.
**Policy enforcement improvements:**
* Added `policy_ids` for disk space monitoring on Linux (`38244`), macOS
(`38230`), and Windows (`38239`) in the `team_settings` section of
`it-and-security/teams/workstations.yml`.
Added a section for the ExpedITioners podcast with episode details,
including dates, guests, and descriptions.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
Updated marketing assets with new case studies and comparisons,
including details on various organizations using Fleet for device
management. Added new entries and modified existing ones for clarity and
completeness.
## Summary
- Add Claude Desktop as a Fleet-maintained app for macOS and Windows on
the Workstations team
- Both platforms have self-service and setup experience enabled
- Windows app scoped to x86 hosts via `x86-based Windows hosts` label
- Add version update policies for both platforms (macOS v1.1.4328,
Windows v1.1.4088)
## Test plan
- [ ] Verify `fleetctl gitops --dry-run` passes with workstations.yml
- [ ] Confirm Claude Desktop appears in self-service for macOS and
Windows hosts
- [ ] Confirm Claude Desktop is part of the macOS and Windows setup
experience
- [ ] Verify update policies flag hosts running older versions
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This pull request makes a small change to the GitHub Actions workflow
configuration by adding a new secret environment variable for use in the
dogfood environment.
- Added the `DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret to the environment
variables in the `.github/workflows/dogfood-gitops.yml` workflow file.
## Summary
- Adds cross-platform disk space check policies (macOS, Windows, Linux)
scoped to the workstations team
- Each policy calculates the percentage of available disk space relative
to total disk space and **fails when available disk space is 10% or
less**
- macOS/Linux policies query the `mounts` table for the root partition
(`/`); Windows policy queries the `logical_drives` table for NTFS drives
- Resolution contact channel is `#help-it`
### New files
- `it-and-security/lib/macos/policies/disk-space-check.yml`
- `it-and-security/lib/windows/policies/disk-space-check.yml`
- `it-and-security/lib/linux/policies/disk-space-check.yml`
### Modified files
- `it-and-security/teams/workstations.yml` — registers the three new
policies
### How it works
| Platform | Query logic |
|---|---|
| macOS | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Linux | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Windows | `SELECT 1 WHERE (SELECT CAST(SUM(free_space) AS REAL) /
SUM(size) FROM logical_drives WHERE file_system = 'NTFS') > 0.10` |
- **Pass (returns rows):** available disk space is more than 10%
- **Fail (returns no rows):** available disk space is 10% or less
### Why >10% free disk space matters
Each policy description now includes context on why maintaining
sufficient free disk space is important:
- **System stability:** Low disk space can cause system instability,
slowdowns, and crashes
- **OS requirements:** Operating systems need free space for virtual
memory/swap, temporary files, and system updates
- **Application reliability:** Applications may fail to save data or
function properly when disk space is critically low
- **Data protection:** Keeping sufficient free space ensures reliable
performance and prevents data loss
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772934328893319?thread_ts=1772933835.386689&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds `conditional_access.bypass_disabled: true` to
`it-and-security/default.yml` to disable the bypass option for
conditional access in Fleet's GitOps configuration
- This prevents end users from bypassing conditional access blocking
during login attempts
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772933047288969)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
This pull request makes a small change to the
`it-and-security/teams/workstations.yml` configuration file by clearing
the list of policy IDs for failing policies webhooks. No other settings
are modified.
- Set `policy_ids` to an empty list in the `team_settings` section,
removing the previous policy associations.
## Summary
- Added `calendar_events_enabled: false` to the "macOS - 1Password up to
date" policy to disable webhook/calendar automation
- The "macOS - Enrollment profile up to date" policy already had
`calendar_events_enabled: false` set, so no change was needed
## Changes
Only `it-and-security/lib/macos/policies/update-1password.yml` was
modified — a single line addition of `calendar_events_enabled: false` to
match the pattern used by other policies (e.g., `update-slack.yml`,
`latest-macos.yml`, `enrollment-profile-up-to-date.yml`).
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772931433677899)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Restores the Google Calendar integration settings in
`it-and-security/default.yml` that were removed in PR #39532
- Re-adds the `api_key_json` and `domain` configuration under
`org_settings.integrations.google_calendar`, reverting from the empty
array (`[]`) back to the original service account configuration
## Changes
The `google_calendar` integration in `it-and-security/default.yml` was
changed from an empty array back to:
```yaml
google_calendar:
- api_key_json: $DOGFOOD_CALENDAR_API_KEY
domain: fleetdm.com
```
This is an exact reversal of the change made in #39532.
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772930523927149?thread_ts=1772928789.366369&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- **Alex Mitchell** — Title changed from "Chief Customer Officer" to
"Head of Account Management". Moved from the Customer Success department
to the Sales department, now reporting to Chaz MacLaughlin (Global SVP
of Sales).
- **Zay Hanlon** — Now heads the Customer Success department (reports
directly to the CEO). Previously listed under Alex Mitchell.
- **Allen Houchins** — Already heads the IT department (reports directly
to the CEO). No handbook changes needed; verified no references placed
him under another manager.
- **Dhruv Majumdar** — Remains in the Customer Success department, now
reporting to Zay Hanlon (who heads the department).
### Files changed
- `handbook/customer-success/README.md` — Removed Alex Mitchell (Chief
Customer Officer) from team table; Zay Hanlon is now the top-listed role
as department head.
- `handbook/sales/README.md` — Added Alex Mitchell as "Head of Account
Management" under Chaz MacLaughlin.
Built for [Savannah
Friend](https://fleetdm.slack.com/archives/D0AK3T404H3/p1772927898988769)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Savannah Friend <157323611+SFriendLee@users.noreply.github.com>
## Summary
- Removes the `okta-verify/windows` Fleet-maintained app entry from the
workstations team GitOps configuration
(`it-and-security/teams/workstations.yml`)
- Okta Verify will no longer be available as self-service software or in
the setup experience for Windows workstations
- All other platform configurations (macOS, iOS, Android) for Okta
Verify remain unchanged
## Changes
**`it-and-security/teams/workstations.yml`**: Removed the following
maintained app entry from the `software.fleet_maintained_apps` section:
```yaml
- slug: okta-verify/windows
self_service: true
setup_experience: true
labels_include_any:
- "x86-based Windows hosts"
categories:
- Security
```
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924324101579)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new Fleet guide article for the community Intune-to-Fleet CSP
converter tool
- Covers how the tool works, prerequisites, step-by-step usage, result
monitoring, resolver map, customization, and troubleshooting
- Sets honest expectations upfront: ~70–75% policy coverage, community
tool (not official Fleet product)
## Changes
- `articles/migrating-intune-policies-to-fleet-csp-converter.md` — new
guide article
## Notes
- Tool repo: https://github.com/tux234/intune-to-fleet
- Modeled on the style of `creating-windows-csps` and the Okta Verify on
Windows guide
- Download links in the guide point to the external tool repo
---------
Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
