### Summary
This PR adds documentation for an edge case in Intune: certain policies
may appear in the NodeCache without a proper Boolean value
(`ExpectedValue: -1`), which can lead to confusion when verifying the
CSP policy application.
### What changed
- Added a **note** explaining the `-1` value in the NodeCache.
- A PowerShell example was included to detect the issue.
- Added guidance on verifying the runtime state of the setting.
- Linked to the related GitHub
[issue](https://github.com/fleetdm/confidential/issues/9817) for further
context.
### Why this is needed
When dogfooding the original guide, we identified that some policies
applied via Intune don’t explicitly set a value in the registry. Without
this clarification, users may get failures when creating CSPs for Fleet
as it expects a positive value. This update helps avoid confusion and
provides a reliable way to verify policy state.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked table schema to confirm autoupdate
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<ins>*🌐 IT and Enablement:*</ins>
- Rename "🌐 Digital Experience" to "🌐 IT and Enablement" dept
- Rename "digital-experience.rituals.yml" to
"it-and-enablement.rituals.yml"
<ins>*🧑🚀 People*</ins>
- Create 🧑🚀 People dept
- Create "people.rituals.yml"
<ins>*🔭 CEO*</ins> (<= WHY? To maintain the [structure of the
handbook](https://fleetdm.com/handbook/company/leadership#outline-of-departmental-page-structure).)
- Create 🔭 CEO page and link to leadership
- Create ceo.rituals.yml
<ins>*💸 Finance*</ins>
- Renamed label "#g-finance" to ":help-finance" to match the rest of the
departmental labels.
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
We had duplicate section for user scoped profiles.
Besides that, removed the section where we mention that we'll work soon
on #30043 as we decided that we'll document that it's necessary to
re-enroll manually enrolled hosts.
Related to:
- #30043
- Noted that Fleet generates a new encryption key and the original one
does still remain under step #3 after a customer noted inconsistencies
in our docs.
- The statement was taken from our enforce-disk-encryption article.
related to #29157
Adding a quick doc update to mention that the idp user info will not be
populated to the create account screen during setup experience if the
host is restarted during mdm enrollment
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
- Add missing step of selecting "Trust Lifecycle" from the dropdown on
the first page when creating a service user.
- Fixed inconsistent deep links: some linked to the demo portal, others
linked to the main portal. Updated all links to go to the main portal.
- Fixed typos.
---------
Co-authored-by: George Karr <georgekarrv@users.noreply.github.com>
* Explain how we get the base dir for $INSTALLER_PATH
* Underscore that install/uninstall scripts are required for tarballs
* Remove inaccurate reference to $INSTALLER_PATH on uninstall scripts
(we don't use it there)
Closes: https://github.com/fleetdm/confidential/issues/11093
Changes:
- Moved the content from the AWS section of the "Hosting Fleet"
documentation page to the "Deploy Fleet on AWS with Terraform" guide
- Moved the content from the Render section of the "Hosting Fleet"
documentation page to the "Deploy Fleet on Render" guide
- Updated the Hosting Fleet page to include card links to the reference
architecture docs, the try-fleet page, and deployment guides for Render,
GCP, Kubernetes, and AWS.
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
For #30089 . This behavior appears to be an Apple bug, or at least an
unsupported usecase(rebooting while at the Remote Management screen,
before the DeviceConfigured is sent) and thus our best course of action
is to document that a user should Wipe/Reset the device when this
happens unless we learn more about how to prevent this which seems
unlikely.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a new section detailing potential causes and recovery steps for
automatic enrollment failures during macOS MDM setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
for #30058
# Details
Added instructions on creating Host Vitals labels, and consolidated the
instructions for adding name and description into one step.
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
# Checklist for submitter
> Closes#29896
> Closes#30038
If some of the following don't apply, delete the relevant line.
<!-- Note that API documentation changes are now addressed by the
product design team. -->
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated instructions to clarify that VPP apps appear in the **Software
> Library** tab.
* Improved descriptions regarding app installation status and
uninstallation limitations for VPP apps.
* Added notes that Fleet automatically refetches host vitals and updates
software inventory after installations.
* Made minor formatting and trailing whitespace adjustments for clarity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Closes: https://github.com/fleetdm/confidential/issues/11272
Changes:
- Added an embedded PDF to the "How Fleet raised a $27M Series B without
a pitch deck" article.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Embedded the Series B memo PDF directly within the article for easier
viewing on larger screens, with a clickable link fallback for smaller
screens.
* **Style**
* Updated article styles to improve the appearance and layout of
embedded documents.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For #30386.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Improved formatting for consistency.
* Expanded instructions for enabling the Windows `process_etw_events`
table, including required configuration flags.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Expanded and clarified instructions for Entra conditional access
integration.
* Added requirements for user group membership in Intune.
* Provided steps for deploying the Company Portal app during macOS
device setup.
* Included reminders for assigning users/groups to Conditional Access
policies.
* Added guidance on temporarily disabling Conditional Access.
* Explained compliance implications when unenrolling from Fleet MDM.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Related to #29322
docs for delivering config profiles to host user channels
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added detailed instructions for deploying certificates to a user's
login keychain on macOS devices.
* Introduced a new section explaining how user-scoped configuration
profiles are assigned, including behavior with multiple local users and
supported profile types.
* Improved formatting and clarified existing explanations for better
readability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Embedded the memo link into "When we set out to raise Fleet's Series B"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the introduction of the article to embed the Series B memo
link directly within the first sentence, replacing the separate "Read
the memo" link with an embedded PDF viewer.
* Added a new article detailing major Apple IT and device management
updates from WWDC25, highlighting enhanced MDM features and Fleet’s
support for these capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Draft of the article for the website to link to the PDF
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new article: "How Fleet raised a $27M Series B without a pitch
deck," detailing Fleet's innovative fundraising approach and sharing
insights from their investor memo.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Brock Walters