fleet/articles/fleet-maintained-apps.md

Fleet-maintained apps

Available in Fleet Premium

In Fleet, you can install Fleet-maintained apps on macOS and Windows hosts without the need for manual uploads or extra configuration. This simplifies the process and adds another source of applications for your fleet. View a list of the currently supported apps in the software catalog.

Fleet maintains installation metadata for a number of apps, letting you add them to your own Fleet instance and install them on your hosts without any additional configuration.

For Windows apps that support both machine and user scope, Fleet provides the machine-scoped app. This way, end users with standard (non-admin) access can't uninstall required apps.

Important notes on CPU architecture

macOS

Currently, the macOS versions of these apps are Apple Silicon-only rather than universal:

• 1Password
• Brave
• Docker Desktop
• Figma
• Microsoft Visual Studio (VS) Code
• Notion
• Postman
• Slack
• Zoom

Windows

Fleet prefers 64-bit x86 versions of applications when available. Installing on Arm hosts (e.g. in a VM on an Apple Silicon machine) may not work or have other unintended consequences.

Add a Fleet-maintained app

1. Head to the Software page for a fleet, then click Add software. You'll land on the Fleet-maintained apps list.
2. Click the Add button for the app and platform you wish to add.

You'll see a ✅ icon instead of an Add button if the application has already been added to your fleet as a custom package or VPP app, or if you've already added the Fleet-maintained app.

3. Click Add software to download the installer package from the app's publisher into Fleet and make it available for install for your selected fleet.

Fleet verifies install and uninstall scripts for each maintained app, and keeps the scripts up to date as an app's vendor releases new versions. You can override Fleet's scripts, or add pre-install queries or post-install scripts, either when adding the app (by clicking Advanced options) or later on (by editing the package).

Install the app

You can install a Fleet-maintained app three ways:

1. Manually in the Host Details page under the Software tab. Select the app you just added and choose Install from the Actions dropdown.
2. Manually from the Self-service tab on the My Device page from an end user's machine, if you've enabled Self-service for the app.
3. Automatically on hosts via policy automations.

You can track the installation process in the Activities section on the Details tab of this Host Details page.

Fleet keeps Fleet-maintained apps up to date automatically (see Update apps automatically). You can also add a patch policy to detect and remediate hosts running outdated versions.

Uninstall the app

To remove the app, navigate to the Host Details page for the appropriate host, then to the Software tab. Find the app, then click on the Actions drop-down, then Uninstall.

Fleet will run the uninstall script configured for the software title. For macOS, Fleet generates default scripts based on the Homebrew recipe (see zap in recipe). For Windows, Fleet leverages MSI or .exe data to generate default scripts.

The uninstallation process is also visible in the Activities section on the Details tab of this Host Details page.

Update apps automatically

By default, Fleet keeps each Fleet-maintained app up to date. When the app's publisher releases a new version, Fleet downloads it and uses it for new installs. Hosts running an older version update to the latest version the next time the app is installed, for example, via Self-service or policy automations.

This "Latest" behavior is the default. To control which version Fleet installs, pin the app to a specific or major version.

Pin a version

Pin a Fleet-maintained app to keep it on a specific version instead of automatically updating to the latest version.

1. On the Software page, select the app to open its details page.
2. Select Actions > Versions.
3. Choose Pin to {version} to stay on a specific version, or Pin to major version ({N}) to stay on a major version and receive only its minor and patch updates.
4. Select Save.

New installs use the pinned version. To return to automatic updates, open Actions > Versions again and select Automatically update to latest.

Pinning is available in Fleet Premium and requires the Maintainer role or higher.

With GitOps, set the version key under the app's fleet_maintained_apps entry:

software:
  fleet_maintained_apps:
    - slug: google-chrome/darwin
      version: "149.0.7827.54"

Use a caret (^) constraint to pin to a major version (for example, "^147"). Omit version to keep the app on the latest version. See the GitOps reference for details.

You can also pin via the REST API using the version parameter on the PATCH /api/v1/fleet/software/titles/:id/package endpoint.

Rollback to a previous version

Installing an older version of an app on top of a newer version might cause issues for some apps. The best practice is to test this on a test device first.

Sometimes, end users report that the latest version of an app introcduces buggy behavior that prevents them from getting their work done. If this happens, you can rollback the app to the older version:

1. Pin the app to the older version. Learn how.
2. If you use patch policy to keep your app up to date, delete the policy.
3. Create a new, custom policy (Zoom example below) that fails if a host has the version with the buggy behavior and add a software automation to install the older version.

SELECT 1 WHERE NOT EXISTS (
    SELECT 1 FROM programs WHERE name = 'Zoom' AND version = '<version_with_bug>'
);

Keep apps up to date with patch policies

You can create a patch policy for a Fleet-maintained app to automatically detect hosts running outdated versions. With GitOps, the patch policy query automatically updates to include the latest version each time specs are applied.

To add a patch policy, open the app's details page under Software, then select Actions > Patch.

To automatically install updates when the policy fails, enable the automation at Policies > Manage automations > Install software.

For a detailed walkthrough, see the patch management guide.

Manage apps with GitOps

To manage Fleet-maintained apps using Fleet's best practice GitOps, check out fleet_maintained_apps, found under the software key, in the GitOps reference documentation.

Note: with GitOps enabled, any Fleet-maintained apps added using the web UI will not persist if not also added in YAML.

How does Fleet maintain these apps?

Fleet:

• verifies, installs, uninstalls & tests all Fleet-maintained apps alongside the install and uninstall scripts we generate
• transforms data from multiple sources, including Homebrew Casks and WinGet manifests, into standardized manifests, checking data sources multiple times per day
• fetches the full maintained apps list from GitHub hourly (or when you run fleetctl trigger --name=maintained_apps; interval was daily prior to Fleet 4.71.0)
• fetches an individual app's manifest when the Add button is pressed from the maintained apps list in the UI, and when an individual app is retrieved or added via the REST API
• DOES NOT directly pull data from WinGet or Homebrew to end-user devices

For a deeper look at the whole pipeline, including validation on real hosts, how broken updates are frozen, and the security model, see how Fleet keeps Fleet-maintained apps safe and up to date.