# Fleet-maintained apps _Available in Fleet Premium_ In Fleet, you can install Fleet-maintained apps on macOS and Windows hosts without the need for manual uploads or extra configuration. This simplifies the process and adds another source of applications for your fleet. View a list of the currently supported apps in the [software catalog](https://fleetdm.com/software-catalog). Fleet maintains installation metadata for [a number of apps](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/apps.json), letting you add them to your own Fleet instance and install them on your hosts without any additional configuration. For Windows apps that support both machine and user scope, Fleet provides the machine-scoped app. This way, end users with standard (non-admin) access can't uninstall required apps. ## Important notes on CPU architecture ### macOS Currently, the macOS versions of these apps are Apple Silicon-only rather than universal: * 1Password * Brave * Docker Desktop * Figma * Microsoft Visual Studio (VS) Code * Notion * Postman * Slack * Zoom ### Windows Fleet prefers 64-bit x86 versions of applications when available. Installing on Arm hosts (e.g. in a VM on an Apple Silicon machine) may not work or have other unintended consequences. ## Add a Fleet-maintained app 1. Head to the **Software** page for a fleet, then click **Add software**. You'll land on the Fleet-maintained apps list. 2. Click the **Add** button for the app and platform you wish to add. > You'll see a ✅ icon instead of an **Add** button if the application has already been added to your fleet as a custom package or VPP app, or if you've already added the Fleet-maintained app. 3. Click **Add software** to download the installer package from the app's publisher into Fleet and make it available for install for your selected fleet. Fleet verifies install and uninstall scripts for each maintained app, and keeps the scripts up to date as an app's vendor releases new versions. You can override Fleet's scripts, or add pre-install queries or post-install scripts, either when adding the app (by clicking **Advanced options**) or later on (by editing the package). ## Install the app You can install a Fleet-maintained app three ways: 1. Manually in the **Host Details** page under the **Software** tab. Select the app you just added and choose **Install** from the **Actions** dropdown. 2. Manually from the **Self-service** tab on the **My Device** page from an end user's machine, if you've [enabled Self-service](https://fleetdm.com/guides/software-self-service) for the app. 3. Automatically on hosts via [policy automations](https://fleetdm.com/guides/automatic-software-install-in-fleet). You can track the installation process in the **Activities** section on the **Details** tab of this **Host Details** page. Fleet keeps Fleet-maintained apps up to date automatically (see [Update apps automatically](#update-apps-automatically)). You can also add a [patch policy](https://fleetdm.com/guides/how-to-use-policies-for-patch-management-in-fleet) to detect and remediate hosts running outdated versions. ## Uninstall the app To remove the app, navigate to the **Host Details** page for the appropriate host, then to the **Software** tab. Find the app, then click on the **Actions** drop-down, then **Uninstall**. Fleet will run the uninstall script configured for the software title. For macOS, Fleet generates default scripts based on the Homebrew recipe (see `zap` in recipe). For Windows, Fleet leverages MSI or .exe data to generate default scripts. The uninstallation process is also visible in the **Activities** section on the **Details** tab of this **Host Details** page. ## Update apps automatically By default, Fleet keeps each Fleet-maintained app up to date. When the app's publisher releases a new version, Fleet downloads it and uses it for new installs. Hosts running an older version update to the latest version the next time the app is installed, for example, via [Self-service](https://fleetdm.com/guides/software-self-service) or [policy automations](https://fleetdm.com/guides/automatic-software-install-in-fleet). This "Latest" behavior is the default. To control which version Fleet installs, pin the app to a specific or major version. ## Pin a version Pin a Fleet-maintained app to keep it on a specific version instead of automatically updating to the latest version. 1. On the **Software** page, select the app to open its details page. 2. Select **Actions > Versions**. 3. Choose **Pin to {version}** to stay on a specific version, or **Pin to major version ({N})** to stay on a major version and receive only its minor and patch updates. 4. Select **Save**. New installs use the pinned version. To return to automatic updates, open **Actions > Versions** again and select **Automatically update to latest**. > Pinning is available in Fleet Premium and requires the Maintainer role or higher. With [GitOps](https://fleetdm.com/docs/configuration/yaml-files#fleet-maintained-apps), set the `version` key under the app's `fleet_maintained_apps` entry: ```yaml software: fleet_maintained_apps: - slug: google-chrome/darwin version: "149.0.7827.54" ``` Use a caret (`^`) constraint to pin to a major version (for example, `"^147"`). Omit `version` to keep the app on the latest version. See the [GitOps reference](https://fleetdm.com/docs/configuration/yaml-files#fleet-maintained-apps) for details. You can also pin via the REST API using the `version` parameter on the [`PATCH /api/v1/fleet/software/titles/:id/package`](https://fleetdm.com/docs/rest-api/rest-api#update-package) endpoint. ## Rollback to a previous version > Installing an older version of an app on top of a newer version might cause issues for some apps. The best practice is to test this on a test device first. Sometimes, end users report that the latest version of an app introcduces buggy behavior that prevents them from getting their work done. If this happens, you can rollback the app to the older version: 1. Pin the app to the older version. [Learn how](#pin-a-version). 2. If you use [patch policy](https://fleetdm.com/guides/how-to-use-policies-for-patch-management-in-fleet) to keep your app up to date, delete the policy. 3. Create a new, custom policy (Zoom example below) that fails if a host has the version with the buggy behavior and add a software automation to install the older version. ```sql SELECT 1 WHERE NOT EXISTS ( SELECT 1 FROM programs WHERE name = 'Zoom' AND version = '' ); ``` ## Keep apps up to date with patch policies You can create a **patch policy** for a Fleet-maintained app to automatically detect hosts running outdated versions. With [GitOps](https://fleetdm.com/docs/configuration/yaml-files#patch-policy), the patch policy query automatically updates to include the latest version each time specs are applied. To add a patch policy, open the app's details page under **Software**, then select **Actions > Patch**. To automatically install updates when the policy fails, enable the automation at **Policies > Manage automations > Install software**. For a detailed walkthrough, see the [patch management guide](https://fleetdm.com/guides/how-to-use-policies-for-patch-management-in-fleet). ## Manage apps with GitOps To manage Fleet-maintained apps using Fleet's best practice GitOps, check out `fleet_maintained_apps`, found under the `software` key, in the [GitOps reference documentation](https://fleetdm.com/docs/configuration/yaml-files#fleet-maintained-apps). > Note: with GitOps enabled, any Fleet-maintained apps added using the web UI will not persist if not also added in YAML. ## How does Fleet maintain these apps? Fleet: - verifies, installs, uninstalls & tests all Fleet-maintained apps alongside the install and uninstall scripts we generate - transforms data from multiple sources, including [Homebrew Casks](https://github.com/Homebrew/homebrew-cask) and [WinGet manifests](https://github.com/microsoft/winget-pkgs/tree/master/manifests), into [standardized manifests](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/), checking data sources [multiple times per day](https://github.com/fleetdm/fleet/blob/main/.github/workflows/ingest-maintained-apps.yml) - fetches the [full maintained apps list](https://github.com/fleetdm/fleet/blob/main/ee/maintained-apps/outputs/apps.json) from GitHub hourly (or when you run `fleetctl trigger --name=maintained_apps`; interval was daily prior to Fleet 4.71.0) - fetches an individual app's manifest when the **Add** button is pressed from the maintained apps list in the UI, and when an individual app is [retrieved](https://fleetdm.com/docs/rest-api/rest-api#get-fleet-maintained-app) or [added](https://fleetdm.com/docs/rest-api/rest-api#add-fleet-maintained-app) via the REST API - DOES NOT directly pull data from WinGet or Homebrew to end-user devices For a deeper look at the whole pipeline, including validation on real hosts, how broken updates are frozen, and the security model, see [how Fleet keeps Fleet-maintained apps safe and up to date](https://fleetdm.com/articles/inside-fleet-maintained-apps).