Files

T

kitzyandRachael Shaw 7d59390b5c Document custom host vitals support for Host vitals labels (#50661 )

**Related issue:** N/A

## Summary

Fleet's "Host vitals" label type already supports matching on a custom
host vital's exact value (in addition to the existing IdP-based
criteria), but this wasn't documented anywhere outside the custom host
vitals guide (see companion PR #50660). Adds that coverage across the
remaining references:

- `articles/managing-labels-in-fleet.md`: the "Host vitals" label type
bullet only listed the two IdP criteria; now also mentions custom host
vitals, and notes the type is exact-match only.
- `docs/Configuration/yaml-files.md`:
- Adds a `custom_host_vital` example to the labels GitOps reference,
alongside the existing IdP example.
- Adds a new `## custom_host_vitals` section documenting the top-level
GitOps key used to define vitals in the first place (referenced by the
labels criteria above), which had no reference-doc coverage at all.
Calls out that, unlike `labels`, omitting the key entirely deletes every
existing custom host vital rather than leaving them intact.
- `docs/REST API/rest-api.md`:
- The `criteria` parameter table was missing `custom_host_vital` as a
valid `vital` value and missing `custom_host_vital_id` entirely — added
both.
- None of the 6 registered custom host vitals endpoints (list, create,
update, delete, set a host's value, and the spec/replace-all endpoint
GitOps uses) had reference entries at all. Adds a full "Custom host
vitals" section following the existing "Custom variables" section's
format, including the same destructive replace-all behavior called out
in the YAML reference above.

# Checklist for submitter

- [ ] QA'd all new/changed functionality manually

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>

2026-08-06 12:17:45 -05:00

80 KiB

Raw Permalink Blame History

GitOps

In Fleet, you can manage your devices as code. This section of the docs is a reference for how to do that.

Quick start: install fleetctl and run fleetctl new to generate a starter repository. Learn how.

Want to get hands-on? We run free GitOps workshops globally where you can get certified.

custom_host_vitals

Custom host vitals are global and can only be specified inline in your default.yml file. They cannot be specified in fleets/fleet-name.yml or fleets/unassigned.yml.

name specifies the vital's name. Must be unique across all custom host vitals.

Each vital is assigned an ID by Fleet when it's created, which isn't set in YAML. Find it in the Custom host vitals table in the Fleet UI to reference the vital as $FLEET_HOST_VITAL_<id> in scripts and configuration profiles, or as custom_host_vital_id in a Host vitals label's criteria.

custom_host_vitals is an optional key, but unlike labels, omitting it entirely deletes every existing custom host vital. To keep existing vitals, list them.

Removing an entry deletes that vital on the next GitOps run. A run fails if the vital is still referenced by a script, configuration profile, or Host vitals label. Remove the reference first.

Example

default.yml

custom_host_vitals:
  - name: Asset tag
  - name: Function
  - name: ITAM device ID

labels

Labels can be specified in your default.yml and fleets/fleet-name.yml files using inline configuration or references to separate files in your lib/ folder. Labels cannot be specified in fleets/unassigned.yml.

Labels support path: (single file) and paths: (glob pattern) references. See path: vs paths: for details. Filenames must not contain *, ?, [, or { when using path:.

name specifies the label's name. Must be unique across all global and fleet labels.
- Changing a label's name in GitOps will delete and re-create the label, temporarily clearing its membership. To avoid this, update the label name in the UI before making the change in YAML.
description specifies the label's description.
platform specifies platforms for the label to target. Provides an additional filter. Choices for platform are darwin, windows, ubuntu, and centos. All platforms are included by default and this option is represented by an empty string. Only supported if label_membership_type is dynamic.
label_membership_type specifies label type which determines how hosts are added to the label. Choices for type are dynamic , manual, and host_vitals (default: dynamic).
query is the query in SQL syntax used to filter the hosts. Only supported if label_membership_type is dynamic.
hosts is a list of host identifiers (id, hardware_serial, or uuid). The label will apply to any host with a matching identifier. Only supported if label_membership_type is manual. If omitted, existing host membership is preserved (no changes). If provided but empty, all hosts are removed from the label.
criteria is the criteria for adding hosts to a host vitals label. Hosts with vital data matching the specified value will be added to the label. To match on a custom host vital, set vital to custom_host_vital and also specify custom_host_vital_id. See criteria documentation for details.

Only one of query, hosts, or criteria can be specified. If none are specified, a manual label with no hosts will be created.

The hostname host identifier is deprecated. Please use a host's id, hardware_serial, or uuid instead.

labels is an optional key. Its behavior depends on the labels exception in Settings > Integrations > Change management.

When the labels exception is disabled, labels are managed in git. If labels is included in default.yml, existing global labels not listed will be deleted. If included in fleets/fleet-name.yml, the fleet's existing labels not listed will be deleted. Omitting the labels key also deletes that file's existing labels. The Fleet UI prevents creating and editing labels while GitOps mode is enabled.

When the labels exception is enabled, labels are managed outside of git. fleetctl gitops leaves existing labels intact, and fails if a YAML file includes a labels key. The Fleet UI allows creating and editing labels, even while GitOps mode is enabled. Learn more in the GitOps mode guide.

Any labels referenced in other sections (like policies, reports or software) must be specified in the labels section.

Example

Inline

default.yml

labels:
  - name: Arm64
    platform: darwin,windows
    description: Hosts on the Arm64 architecture
    query: "SELECT 1 FROM system_info WHERE cpu_type LIKE 'arm64%' OR cpu_type LIKE 'aarch64%'"
    label_membership_type: dynamic
  - name: C-Suite
    description: Hosts belonging to the C-Suite
    label_membership_type: manual
    hosts:
      - "IR7M6ZGQJM"
      - "JMFWY8VZ09"
  - name: Engineering department
    description: Hosts used by engineers
    label_membership_type: host_vitals
    criteria:
      vital: end_user_idp_department
      value: Engineering
  - name: Point of sale terminals
    description: Hosts whose "Function" custom host vital is set to "Point of sale"
    label_membership_type: host_vitals
    criteria:
      vital: custom_host_vital
      custom_host_vital_id: 2
      value: Point of sale

Separate file

lib/labels-name.labels.yml

- name: Arm64
  description: Hosts on the Arm64 architecture
  query: SELECT 1 FROM system_info WHERE cpu_type LIKE "arm64%" OR cpu_type LIKE "aarch64%"
  label_membership_type: dynamic
- name: C-Suite
  description: Hosts belonging to the C-Suite
  label_membership_type: manual
  hosts:
      - "IR7M6ZGQJM"
      - "JMFWY8VZ09"
  - name: Engineering department
    description: Hosts used by engineers
    label_membership_type: host_vitals
    criteria:
      vital: end_user_idp_department
      value: Engineering

default.yml

labels:
  - path: ./lib/labels-name.labels.yml
  - paths: ./lib/labels/*.yml

policies

Policies can be specified inline in your default.yml, fleets/fleet-name.yml, or fleets/unassigned.yml files. They can also be specified in separate files in your lib/ folder.

Policies support path: (single file) and paths: (glob pattern) references. See path: vs paths: for details. Filenames must not contain *, ?, [, or { when using path:.

Options

For available options, see the parameters for the Create policy and Create team policy API endpoints.

Patch policy

Available in Fleet Premium

You can create a patch policy by setting type to patch and specifying fleet_maintained_app_slug.

A patch policy's query automatically updates. Hosts will fail this policy if they’re not running the latest version found in the app's metadata. If version is set for fleet_maintained_apps, that version is included in the query.

To automatically install the app when this policy fails, you can add an automation by setting install_software to true.

Automations

Install software

Available in Fleet Premium

To trigger software install, when policy fails, specify one of:

install_software.package_path is the path to a custom package YAML. Only one package can be specified in the package YAML.
install_software.fleet_maintained_app_slug is a Fleet-maintained app slug.
install_software.hash_sha256 is SHA256 hash of a custom package.

Run script

Available in Fleet Premium

To trigger script run, when policy fails, specify:

run_script.path is a path to a script YAML.

Specifying one package without a list is deprecated as of Fleet 4.73. It is maintained for backwards compatibility. Please use a list instead even if you're only specifying one package.

Example

Inline

default.yml, fleets/fleet-name.yml, or fleets/unassigned.yml

policies:
  - name: macOS - Enable FileVault
    description: This policy checks if FileVault (disk encryption) is enabled.
    resolution: As an IT admin, turn on disk encryption in Fleet.
    query: "SELECT 1 FROM filevault_status WHERE status = 'FileVault is On.';"
    platform: darwin
    critical: false
    calendar_events_enabled: false
    conditional_access_enabled: true
    labels_include_any:
      - Engineering
      - Customer Support

Separate file

lib/policies-name.policies.yml

- name: macOS - Enable FileVault
  description: This policy checks if FileVault (disk encryption) is enabled.
  resolution: As an IT admin, turn on disk encryption in Fleet.
  query: "SELECT 1 FROM filevault_status WHERE status = 'FileVault is On.';"
  platform: darwin
  critical: false
  calendar_events_enabled: false
  conditional_access_enabled: true
- name: macOS - Disable guest account
  description: This policy checks if the guest account is disabled.
  resolution: As an IT admin, deploy a macOS, login window profile with the DisableGuestAccount option set to true.
  query: "SELECT 1 FROM managed_policies WHERE domain='com.apple.mcx' AND username = '' AND name='DisableGuestAccount' AND CAST(value AS INT) = 1;"
  platform: darwin
  critical: false
  calendar_events_enabled: false
  run_script:
    path: ./disable-guest-account.sh
- name: macOS - Firefox installed
  platform: darwin
  description: This policy checks that Firefox is installed.
  resolution: Install Firefox app if not installed.
  query: "SELECT 1 FROM apps WHERE bundle_identifier = 'org.mozilla.firefox'"
  continuous_automations_enabled: true
  install_software:
    package_path: ./firefox.package.yml
- name: macOS - Logic Pro installed
  platform: darwin
  description: This policy checks that Logic Pro is installed
  resolution: Install Logic Pro App Store app if not installed
  query: "SELECT 1 FROM apps WHERE bundle_identifier = 'com.apple.logic10'"
  install_software:
    app_store_id: "1487937127" # (for App Store apps)
- name: macOS - Zoom installed
  platform: darwin
  description: This policy checks that Zoom is installed
  resolution: Install Logic Pro App Store app if not installed
  query: "SELECT 1 FROM apps WHERE bundle_identifier = 'us.zoom.xos'"
  install_software:
    fleet_maintained_app_slug: zoom/darwin
    package_path: ./linux-firefox.deb.package.yml
    # app_store_id: "1487937127" (for App Store apps)
- name: Zoom up to date
  description: Outdated software might introduce security vulnerabilities or compatibility issues.
  resolution: Install the latest version from self-service.
  type: patch
  fleet_maintained_app_slug: zoom/darwin
  continuous_automations_enabled: true
  install_software: true

default.yml (for policies that neither install software nor run scripts), fleets/fleet-name.yml, or fleet/unassigned.yml

policies:
  - path: ../lib/policies-name.policies.yml
  - paths: ../lib/*.policies.yml

Currently, the run_script and install_software policy automations can only be configured for a fleet (fleets/fleet-name.yml) or "Unassigned" (fleets/unassigned.yml). The automations can only be added to policies in which the script (or software) is defined in the same fleet (or "Unassigned"). calendar_events_enabled can only be configured for policies on a fleet.

If using labels_include_any/labels_exclude_any for targeting, these keys are specified on the individual policies. Specifying at the top level of policies will not apply the labels to each policy.

reports

Reports can be specified inline in your default.yml file or fleets/fleet-name.yml files. They can also be specified in separate files in your lib/ folder.

Reports support path: (single file) and paths: (glob pattern) references. See path: vs paths: for details. Filenames must not contain *, ?, [, or { when using path:.

Options

For possible options, see the parameters for the Create report API endpoint.

Example

Inline

default.yml or fleets/fleet-name.yml

reports:
  - name: Collect failed login attempts
    description: Lists the users at least one failed login attempt and timestamp of failed login. Number of failed login attempts reset to zero after a user successfully logs in.
    query: SELECT users.username, account_policy_data.failed_login_count, account_policy_data.failed_login_timestamp FROM users INNER JOIN account_policy_data using (uid) WHERE account_policy_data.failed_login_count > 0;
    platform: darwin,linux,windows
    interval: 300
    observer_can_run: false
    automations_enabled: false
    labels_include_any:
      - Engineering
      - Customer Support

Separate file

lib/reports-name.reports.yml

- name: Collect failed login attempts
  description: Lists the users at least one failed login attempt and timestamp of failed login. Number of failed login attempts reset to zero after a user successfully logs in.
  query: SELECT users.username, account_policy_data.failed_login_count, account_policy_data.failed_login_timestamp FROM users INNER JOIN account_policy_data using (uid) WHERE account_policy_data.failed_login_count > 0;
  platform: darwin,linux,windows
  interval: 300
  observer_can_run: false
  automations_enabled: false
- name: Collect USB devices
  description: Collects the USB devices that are currently connected to macOS and Linux hosts.
  query: SELECT model, vendor FROM usb_devices;
  platform: darwin,linux
  interval: 300
  observer_can_run: true
  automations_enabled: false

default.yml or fleets/fleet-name.yml

reports:
  - path: ../lib/reports-name.reports.yml
    labels_include_any:
      - Engineering
      - Customer Support
  - paths: ../lib/*.reports.yml

agent_options

Agent options can be specified inline in your default.yml file or fleets/fleet-name.yml files. They can also be specified in separate files in your lib/ folder.

See "Agent configuration" to find all possible options.

Example

Inline

default.yml or fleets/fleet-name.yml

agent_options:
  config:
    decorators:
      load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT hostname AS hostname FROM system_info;
    options:
      disable_distributed: false
      distributed_interval: 10
      distributed_plugin: tls
      distributed_tls_max_attempts: 3
      logger_tls_endpoint: /api/osquery/log
      logger_tls_period: 10
      pack_delimiter: /

Separate file

lib/agent-options.yml

config:
  decorators:
    load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
  options:
    disable_distributed: false
    distributed_interval: 10
    distributed_plugin: tls
    distributed_tls_max_attempts: 3
    logger_tls_endpoint: /api/osquery/log
    logger_tls_period: 10
    pack_delimiter: /

default.yml or fleets/fleet-name.yml

We want - for policies and reports because it’s an array. Agent Options we do not use - for path.

agent_options:
  path: ../lib/agent-options.yml

controls

The controls section allows you to configure scripts and device management (MDM) features in Fleet.

scripts is a list of paths to macOS, Windows, or Linux scripts. Supports path: (single file) and paths: (glob pattern, filtered to .sh, .py, and .ps1 files only). Filenames must not contain *, ?, [, or { when using path:. See path: vs paths: for details.
windows_enabled_and_configured specifies whether or not to turn on Windows MDM features (default: false). Can only be configured for "All fleets" (default.yml).
windows_entra_tenant_ids is a list of Microsoft Entra tenant IDs to enable automatic (Autopilot) and manual enrollment by end users (Settings > Accounts > Access work or school on Windows). Can only be configured for "All fleets" (default.yml). Find your Tenant ID, on Microsoft Entra ID > Home.
windows_entra_client_ids is a list of Microsoft Entra application (client) IDs for the applications used to enroll Windows hosts via Microsoft Entra. Set this when you set up Entra enrollment: Microsoft Entra issues v2 access tokens whose audience is the application's client ID, so Fleet needs the client ID to authorize enrollment. Can only be configured for "All fleets" (default.yml). Find your Application (client) ID on Microsoft Entra ID > App registrations > your MDM application > Overview.
enable_turn_on_windows_mdm_manually specifies whether or not to require end users to sign in using Settings > Access work or school (default: false). If false, MDM is automatically turned on for all Windows hosts that aren't connected to any MDM solution. Either method results in an MDM status of "On (manual)". To get a status of "On (company-owned)", use Windows Autopilot. Can only be configured for "All fleets" (default.yml).
windows_migration_enabled specifies whether or not to automatically migrate Windows hosts connected to another MDM solution. If false, MDM is only turned on after hosts are unenrolled from your old MDM solution. enable_turn_on_windows_mdm_manually must be set to false. (default: false). Can only be configured for "All fleets" (default.yml).
enable_disk_encryption specifies whether or not to enforce disk encryption on macOS, Windows, and Linux hosts (default: false).
windows_require_bitlocker_pin specifies whether or not to require end users on Windows hosts to set a BitLocker PIN. When set, this PIN is required to unlock Windows host during startup. enable_disk_encryption must be set to true. (default: false).
apple_require_hardware_attestation specifies whether or not to require Apple Silicon macOS hosts to complete a device attestation challenge verifying that the hardware serial matches a known host record from AB as part of DEP enrollment (default: false). Can only be configured for "All fleets" (default.yml).
enable_recovery_lock_password specifies whether or not to enforce Recovery Lock password on eligible macOS hosts (default: false).
name_template sets a naming convention for macOS, iOS, and iPadOS hosts. Fleet resolves the template per host, renames the host on the device via an MDM command, and updates the host's name in Fleet. Supports the built-in host identity variables ($FLEET_VAR_HOST_HARDWARE_SERIAL, $FLEET_VAR_HOST_UUID, $FLEET_VAR_HOST_PLATFORM), the IdP end-user variables ($FLEET_VAR_HOST_END_USER_IDP_USERNAME, _USERNAME_LOCAL_PART, _GROUPS, _DEPARTMENT, _FULL_NAME), and custom ($FLEET_SECRET_*) variables; certificate authority variables aren't supported. A referenced custom variable must already exist. Supported for fleets and for hosts that aren't in a fleet ("Unassigned"): set it in a fleet's YAML, or in no_team.yml/default.yml controls to apply it to "Unassigned" hosts. Removing the key clears the template but doesn't rename any host. Available in Fleet Premium.
android_enabled_and_configured specifies whether or not to turn on Android MDM features (default: false). Can only be configured for "All fleets" (default.yml).

Example

controls:
  scripts:
    - path: ../lib/macos-script.sh
    - path: ../lib/windows-script.ps1
    - path: ../lib/linux-script.sh
    - paths: ../lib/scripts/*.sh  # Glob pattern (filtered to .sh, .py, and .ps1 only)
  windows_enabled_and_configured: true
  windows_entra_tenant_ids:
    - 4e342a0d-ec1a-4353-bdeb-785542e0a8fb
  windows_entra_client_ids:
    - 8c8e3fd4-9b2c-4d3e-8f10-2233445566aa
  enable_turn_on_windows_mdm_manually: false # Available in Fleet Premium
  windows_migration_enabled: true # Available in Fleet Premium
  enable_disk_encryption: true # Available in Fleet Premium
  apple_require_hardware_attestation: false # Available in Fleet Premium
  enable_recovery_lock_password: true # Available in Fleet Premium
  name_template: "iPad $FLEET_VAR_HOST_HARDWARE_SERIAL" # Available in Fleet Premium
  android_enabled_and_configured: true
  macos_updates: # Available in Fleet Premium
    deadline: "2024-12-31"
    minimum_version: "15.1"
    update_new_hosts: true
  ios_updates: # Available in Fleet Premium
    deadline: "2024-12-31"
    minimum_version: "18.1"
  ipados_updates: # Available in Fleet Premium
    deadline: "2024-12-31"
    minimum_version: "18.1"
  windows_updates: # Available in Fleet Premium
    deadline_days: 5
    grace_period_days: 2
  apple_settings:
    configuration_profiles:
      - paths: ../lib/macos/profiles/*.mobileconfig
      - path: ../lib/macos/profiles/my-declaration.json
    assets:
      - path: ../lib/macos/assets/my-asset.json
    managed_local_account_settings:
      - enabled: true   
    end_user_local_account_type: "admin"
  windows_settings:
    configuration_profiles:
      - paths: ../lib/windows/profiles/*.xml
        labels_include_any:
          - Engineering
    managed_local_account_settings:
      - enabled: true   
  android_settings:
    configuration_profiles:
      - path: ../lib/android-profile.json
    certificates:
      - name: wifi-certificate
        certificate_authority_name: EST_WIFI
        subject_name: CN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME, OU=$FLEET_VAR_HOST_UUID, ST=$FLEET_VAR_HOST_HARDWARE_SERIAL
        subject_alternative_name: "DNS=example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME"
  setup_experience: # Available in Fleet Premium
    bootstrap_package: https://example.org/bootstrap_package.pkg
    enable_end_user_authentication: true
    apple_enable_release_device_manually: true
    apple_setup_assistant: ../lib/dep-profile.json
    macos_script: ../lib/macos-setup-script.sh
  macos_migration: # Available in Fleet Premium
    enable: true
    mode: voluntary
    webhook_url: https://example.org/webhook_handler
  apple_account_provisioning: # Available in Fleet Premium
    oauth_idp_token_url: https://fleet-example.okta.com/oauth2/v1/token
    oauth_idp_client_id: Ooa12345abcdeFGHI678
    oauth_idp_client_secret: a1b2c3d4e5

macos_updates

deadline specifies the deadline in YYYY-MM-DD format. The exact deadline is set to noon local time for hosts on macOS 14 and above, 20:00 UTC for hosts on older macOS versions. (default: "").
minimum_version specifies the minimum required macOS version (default: "").
update_new_hosts - macOS hosts that automatically enroll (ADE) are updated to Apple's latest version during macOS Setup Assistant. For backwards compatibility, if not specified, and deadline and minimum_version are set, update_new_hosts is set to true. Otherwise, update_new_hosts defaults to false.

ios_updates

deadline specifies the deadline in YYYY-MM-DD format; the exact deadline is set to noon local time. (default: "").
minimum_version specifies the minimum required iOS version (default: "").

ipados_updates

deadline specifies the deadline in YYYY-MM-DD format; the exact deadline is set to noon local time. (default: "").
minimum_version specifies the minimum required iPadOS version (default: "").

windows_updates

deadline_days specifies the number of days before Windows installs updates (default: null)
grace_period_days specifies the number of days before Windows restarts to install updates (default: null)

apple_settings and windows_settings

Both apple_settings and windows_settings support the following:

configuration_profiles is a list of configuration profiles. Accepts .mobileconfig/.json (macOS/iOS/iPadOS) or .xml (Windows).
managed_local_account_settings are settings for the managed local account.
- enabled specifies whether to create the managed local account on that platform (default: false).

Only apple_settings supports the following:

end_user_local_account_type specifies the end user account type for macOS hosts. Requires managed_local_account_settings.enabled to be true. Default: "admin".

Each entry can use either path: or paths::

path: references a single file. Filenames must not contain *, ?, [, or {.
paths: accepts a glob pattern to match multiple files (e.g. ../lib/windows/profiles/*.xml). Labels and other options specified on a paths: entry apply to all matched files.

Use labels_include_all to target hosts that have all labels, labels_include_any to target hosts that have any label, or labels_exclude_any to target hosts that don't have any of the labels. Only one of labels_include_all, labels_include_any, or labels_exclude_any can be specified. If none are specified, all hosts are targeted.

In addition to configuration profiles, you can upload assets which are .json files containing an Apple asset declaration (com.apple.asset). Assets follow the same path: / paths: syntax as profiles but should be stored in a separate assets/ folder (e.g. ../lib/macos/assets/my-asset.json).

android_settings

android_settings.configuration_profiles is a list of Android configuration profiles (.json).

Each entry can use either path: or paths:. Filenames must not contain *, ?, [, or { when using path:. See path: vs paths: for glob pattern support.

android_settings.certificates

name is the name of the certificate. Name can be used as a certificate alias to reference in configuration profiles (custom settings).
certificate_authority_name is the name of the certificate authority (CA) to issue the certificate from. Currently, only a custom SCEP CA is supported.
subject_name is the certificate's subject name (SN). Separate subject fields with a comma (,). For example: "/CN=john@example.com/O=Acme Inc.".
subject_alternative_name is the certificate's subject alternative name (SAN). Separate SAN fields with a comma (,). Each field is a key-value pair. Supported keys (case-insensitive) are:
- DNS for a DNS hostname (e.g. DNS=wifi.example.com).
- EMAIL for an email address / RFC 822 name (e.g. EMAIL=john@example.com).
- UPN for a Microsoft User Principal Name (e.g. UPN=john@corp.example.com), commonly used for Active Directory / Intune Wi-Fi authentication.
- IP for an IPv4 or IPv6 address (e.g. IP=10.0.0.1 or IP=2001:db8::1).
- URI for a URI (e.g. URI=spiffe://example.com/workload/wifi).
Example: "DNS=wifi.example.com, UPN=$FLEET_VAR_HOST_END_USER_IDP_USERNAME".

You can use Fleet's host variables in subject_name and subject_alternative_name to make the certificate unique to each host.

apple_account_provisioning

The apple_account_provisioning section can only be configured for "All fleets" (default.yml) and only supports macOS hosts today

oauth_idp_token_url is the token URL for your Oauth ROPG(Resource Owner Password Grant) IdP. For Okta it is normally of the form https://your-okta-domain.okta.com/oauth2/v1/token
oauth_idp_client_id is the client ID of your Oauth ROPG application within your IdP. In Okta this can be found under your application's Client Credentials
oauth_idp_client_secret is the client secret of your Oauth ROPG application within your IdP

setup_experience

The setup_experience section lets you control the out-of-the-box setup experience.

bootstrap_package is the URL to a bootstrap package. Fleet will download the bootstrap package. Applies to macOS only (default: "").
macos_manual_agent_install specifies whether Fleet's agent (fleetd) will be installed as part of setup experience. Applies to macOS only (default: false)
enable_end_user_authentication specifies whether or not to require IdP authentication when the user first sets up their host. Applies to macOS, Windows, Linux, iOS/iPadOS, and Android.
require_all_software_macos specifies whether to cancel setup on a macOS host if any software installs fail.
require_all_software_windows specifies whether to cancel setup on a Windows host if any software installs fail. When true, the host is blocked at the Windows Enrollment Status Page and the end user must reset the device to try again. When false, the Enrollment Status Page lists the software that failed and the end user can continue to the desktop and install it later via self-service.
lock_end_user_info specifies whether or not to enable end user to edit the local account Account Name and Full Name in macOS Setup Assistant. (default: true)
require_all_software specifies whether to cancel setup on a macOS host if any software installs fail.
apple_enable_release_device_manually when enabled, you're responsible for sending the DeviceConfigured command. End users will be stuck in Setup Assistant until this command is sent. Applies to Apple (macOS, iOS, iPadOS) hosts that automatically enroll via Apple Business (AB).
apple_setup_assistant is a path to a custom automatic enrollment (ADE) profile (.json). Applies to macOS and iOS/iPadOS hosts.
macos_script is the path to a custom setup script to run after the host is first set up. Applies to macOS only.

enable_managed_local_account and end_user_local_account_type at this level are deprecated. Please use the platform-specific apple_settings.managed_local_account_settings, apple_settings.end_user_local_account_type, or windows_settings.managed_local_account_settings instead.

Example

fleets/fleet-name.yml, or fleets/unassigned.yml

setup_experience:
  bootstrap_package: "https://your-storage/package.pkg"
  macos_manual_agent_install: false
  enable_end_user_authentication: true
  lock_end_user_info: true
  apple_enable_release_device_manually: false
  apple_setup_assistant: "./setup_assistant.json"
  macos_script: "./post_setup.sh"

macos_migration

The macos_migration section lets you control the end user migration workflow for macOS hosts that enrolled to your old MDM solution.

enable specifies whether or not to enable end user migration workflow (default: false)
mode specifies whether the end user initiates migration (voluntary) or they're nudged every 15-20 minutes to migrate (forced) (default: "").
webhook_url is the URL that Fleet sends a webhook to when the end user selects Start. Receive this webhook using your automation tool (ex. Tines) to unenroll your end users from your old MDM solution.

Can only be configured for "All fleets" (default.yml).

software

The software section allows you to configure packages, store apps (Apple App Store and Google Play Store), and Fleet-maintained apps that you want to install on your hosts.

packages is a list of paths to custom packages (.pkg, .ipa, .msi, .exe, .deb, .rpm, .tar.gz, .sh, .py, or .ps1).
app_store_apps is a list of Apple App Store or Android Play Store apps.
fleet_maintained_apps is a list of Fleet-maintained apps.

Currently, you can specify install_software in the policies YAML to automatically install software when a host fails a policy.

Currently, Fleet only allows one package, Apple App Store app, or Fleet-maintained app for a specific software. This means, if you specify a Google Chrome for macOS twice in packages or once in packages and once in fleet_maintained_apps, only one of them will be added to Fleet.

Currently, when a .ipa file is added in packages, Fleet adds software for both iOS and iPadOS, along with all specified settings (e.g. self_service). If software for one platform is deleted in the UI, it will come back when GitOps is re-run.

Script-only packages (.sh, .ps1, .py) also support $FLEET_SECRET_* variables. Fleet replaces them with their values when the install script is sent to the host.

Example

fleets/fleet-name.yml, or fleets/unassigned.yml

software:
  packages:
    - path: ../lib/software-name.package.yml
      categories:
        - "🌎 Browsers"
      self_service: true
      setup_experience: true
    - path: ../lib/onboarding-script.sh.package.yml
      setup_experience_platform: darwin, linux
    - path: ../lib/software-name2.package.yml
  app_store_apps:
    - app_store_id: "546505307"
      platform: ios
      labels_include_any: # Available in Fleet Premium
        - Product
        - Marketing
      categories:
        - "👬 Communication"
      setup_experience: true
      auto_update_enabled: true
      auto_update_window_start: "00:00"
      auto_update_window_end: "04:00"
      configuration:
        path: ../lib/software/zoom-config.xml
    - app_store_id: "us.zoom.videomeetings"
      platform: android
      self_service: true
      setup_experience: true
      configuration:
        path: ../lib/software/zoom-config.json
  fleet_maintained_apps:
    - slug: slack/darwin
      version: "4.47.65"
      install_script:
        path: ../lib/software/slack-install-script.sh
      uninstall_script:
        path: ../lib/software/slack-uninstall-script.sh
      post_install_script:
        path: ../lib/software/slack-config-script.sh
      self_service: true
      setup_experience: true
      labels_include_any:
        - Design
        - Sales
      categories:
        - "👬 Communication"
        - "💻 Productivity"
    - slug: parallels/darwin
      version: "^26"
      self_service: true
      labels_include_any:
        - Engineering

self_service, labels, categories, and setup_experience

self_service specifies whether end users can install from Fleet Desktop > Self-service (default: false) on macOS or self-service web app on iOS/iPadOS.
labels_include_all targets hosts that have all of the specified labels. labels_include_any targets hosts that have any of the specified labels. labels_exclude_any targets hosts that have none of the specified labels. Only one of these fields can be set. If none are set, all hosts are targeted.
categories is a list of self-service category names. Categories group self-service software on your end users' Fleet Desktop > My device page so that end users can filter by category and install all software in a category at once.
- Category names support emojis and can be up to 255 characters long. The uniqueness checks ignore emojis, so "🌎 Browsers" and "🔍 Browsers" are treated as the same name.
- For Fleet-maintained apps, if categories is omitted, apps get their default categories. If categories is empty, default categories are removed. If custom categories are specified, apps don't get their default categories unless they're specified explicitly.
setup_experience installs the software when hosts enroll (default: false). On Windows and Linux hosts, if the software has associated policies, Fleet checks them first and skips the install when the host passes all of them. Learn more in the setup experience guide.
setup_experience_platform specifies which platform to target for the .sh script-only packages in setup experience. Choices for platform are darwin and linux. If not specified and setup_experience is true, Linux is the default platform.

packages

url specifies the URL at which the software is located. Fleet will download the software and upload it to S3 (up to 3 attempts). If you don't want to host the package, add it to Fleet first and then copy the hash_sha256.
hash_sha256 specifies the SHA256 hash of the package file. If provided, and a package with that hash was already added to Fleet, the download will be skipped. This speeds up GitOps runs. If a package with that hash doesn't exist in Fleet, Fleet will download the package from the url and add the package if the hash matches. Fleet will error if the hash doesn't match. You can specify hash_sha256 without url if the package was already added to Fleet via the UI or the API.
always_download disables conditional HTTP downloads using ETag headers. By default (false), Fleet stores the ETag from the download response and sends it as If-None-Match on subsequent GitOps runs. If the server returns 304 Not Modified, the download is skipped entirely. Set to true to force Fleet to re-download the package on every GitOps run. Cannot be used together with hash_sha256 (hash-pinned packages are already cached by hash). Not all servers support ETags correctly; if your download URL returns unreliable ETags, set always_download: true.
display_name is the package name that will be displayed in the UI. If not set, name will be used instead.
pre_install_query.path is the SQL query Fleet runs before installing the software. Software will be installed only if the query returns results.
install_script.path specifies the command Fleet will run on hosts to install software. The default script is dependent on the software type (i.e. .pkg). Not supported for .sh and .ps1 files.
uninstall_script.path is the script Fleet will run on hosts to uninstall software. The default script is dependent on the software type (i.e. .pkg).
post_install_script.path is the script Fleet will run on hosts after the software install. There is no default.
icon.path is a relative path to the PNG icon that will be displayed in Fleet and on Fleet Desktop > Self-service instead of the default icon built into Fleet. It must be a square PNG with dimensions between 120x120 px and 1024x1024 px. Custom icons will only override the icon for the software title and fleet where they are added.

Example

Multiple versions of the same software

You can add multiple packages for the same software in a package YAML file. This enables staged rollouts and support of architecture-specific installers.

self_service, categories, and labels are defined per package. setup_experience is defined on the fleet-level.

If multiple packages target the same host, Fleet will install the one that was added first.

In GitOps, the first package added is the first one in the package YAML file's list on the initial run that adds the title's packages. Reordering the list on a later run doesn't change the order.

You can preview the order of the packages in the UI. The first package in the list is always a fallback in case of a conflict.

fleets/fleet-name.yml, or fleets/unassigned.yml

software:
  packages:
    - path: ../lib/software/santa.package.yml

lib/software/santa.package.yml

- url: https://github.com/northpolesec/santa/releases/download/2026.2/santa-2026.2.pkg
  install_script:
    path: ../lib/software/santa-install-script.sh
  self_service: true
  labels_include_all:
    - macOS
- url: https://github.com/northpolesec/santa/releases/download/2026.4/santa-2026.4.pkg
  install_script:
    path: ../lib/software/santa-install-script.sh
  self_service: true
  categories:
    - "💻 Productivity"
  labels_include_all:
    - macOS
    - IT test team

URL

lib/software-name.package.yml:

- url: https://dl.tailscale.com/stable/tailscale-setup-1.72.0.exe
  install_script:
    path: ../lib/software/tailscale-install-script.ps1
  uninstall_script:
    path: ../lib/software/tailscale-uninstall-script.ps1
  post_install_script:
    path: ../lib/software/tailscale-config-script.ps1

Hash

You can view the hash for existing software in the software detail page in the Fleet UI. It is also returned after uploading a new software item via the API.

# Mozilla Firefox (Firefox 136.0.1.pkg) version 136.0.1
- hash_sha256: fd22528a87f3cfdb81aca981953aa5c8d7084581b9209bb69abf69c09a0afaaf

Conditional downloads

By default, Fleet uses conditional HTTP downloads to avoid re-downloading unchanged packages. On the first GitOps run, Fleet downloads the package normally and stores the server's ETag. On subsequent runs, Fleet sends a conditional GET request. If the server confirms the content hasn't changed (304 Not Modified), the download is skipped.

If your server doesn't support ETags reliably, you can disable this behavior with always_download: true:

- url: https://dl.tailscale.com/stable/tailscale-setup-1.72.0.exe
  always_download: true

Note: Conditional download is currently unsupported for .ipa files.

Script-only

Script-only packages (.sh, .py, and .ps1 files) are referenced directly inline in the fleet's YAML file. The file contents become the install script. Script packages do not support install_script, uninstall_script, post_install_script, pre_install_query, or automatic install (install_software in policies).

self_service, categories, labels, and icon are specified inline in the team's YAML file.

software:
  packages:
    - path: ../lib/linux/scripts/vpn-setup.sh
      display_name: VPN setup
      icon:
         path: ../lib/icons/vpn-setup.png
      self_service: true
      categories:
        - "🛟 Support"
      labels_include_any:
      - Engineering
      - Customer Support

app_store_apps

app_store_id is the ID of the Apple App Store or Android Play Store app. You can find this ID at the end of the app's URL. For example, "Bear - Markdown Notes" URL is "https://apps.apple.com/us/app/bear-markdown-notes/id1016366447" making the app_store_id is "1016366447". Similarly, the URL for "Google Chrome" on Android is "https://play.google.com/store/apps/details?id=com.android.chrome," so the app_store_id is "com.android.chrome."
- For Apple App Store apps, make sure to include only the ID itself, and not the id prefix shown in the URL. The ID must be wrapped in quotes as shown in the example so that it is processed as a string.
platform is the platform of the app (darwin, ios, ipados, or android). If not specified, and app_store_id is Apple App Store ID, one app for each of the Apple App Store app's supported platforms is added. For example, adding Bear (supported on iOS and iPadOS) adds both the iOS and iPadOS apps to your software that's available to install in Fleet.
icon.path is a relative path to the PNG icon that will be displayed in Fleet and on Fleet Desktop > Self-service instead of the default icon the icon sourced from Apple. It must be a square PNG with dimensions between 120x120 px and 1024x1024 px. Custom icons will only override the icon for the software title and fleet where they are added.
configuration.path is the app managed configuration. For iOS and iPadOS apps it is in XML format, and for Android Play Store apps it is in JSON format. Currently only supported for iOS, iPadOS, and Android.
- Android: managedConfiguration and workProfileWidgets are supported from Android application policy.
- Configuration keys vary by app. Refer to the app vendor's documentation for available managed configuration options. For example, see Zoom's Android managed configuration, Zoom's iOS managed configuration, or GlobalProtect's Android configuration.
auto_update_enabled enables automatic updates for the app (default: false). Only supported for iOS and iPadOS App Store (VPP) apps.
auto_update_window_start is the start of the daily maintenance window during which Fleet will apply automatic updates, formatted as HH:MM in the host's local time (e.g. "00:00"). Required when auto_update_enabled is true. Must be wrapped in quotes so it is processed as a string.
auto_update_window_end is the end of the daily maintenance window, formatted as HH:MM in the host's local time (e.g. "04:00"). Required when auto_update_enabled is true. If the end time is earlier than the start time, the window wraps to the next day (e.g. "22:00" to "02:00"). Must be wrapped in quotes so it is processed as a string.

To add the same App Store app for multiple platforms, specify the app_store_id multiple times, along with the platform you want. If you don't specify a platform, one app for each available platform will be added (macOS, iOS, and iPadOS).

When you update an Android app's configuration via GitOps, the app's settings are applied without reinstalling the app. The install status will show as "Pending" until the configuration is applied.

fleet_maintained_apps

fleet_maintained_apps is a list of Fleet-maintained apps. Provide the slug field to include a Fleet-maintained app on a fleet. To find the slug, head to Software > Add software and select a Fleet-maintained app, then select Show details. You can also see the list of app slugs on GitHub.

By default, Fleet-maintained apps will be updated to the latest version published by Fleet when GitOps runs.

The fields below are all optional.

self_service specifies whether end users can install from Fleet Desktop > Self-service.
pre_install_query.path is the SQL query Fleet runs before installing the software. Software will be installed only if the query returns results.
post_install_script.path is the script that, if supplied, Fleet will run on hosts after the software installs.
icon.path is a relative path to the PNG icon that will be displayed in Fleet and on Fleet Desktop > Self-service instead of the default icon the icon sourced from Apple. It must be a square PNG with dimensions between 120x120 px and 1024x1024 px. Custom icons will only override the icon for the software title and fleet where they are added.
⁠version specifies the app version. Available versions are listed in the Fleet UI under Actions > Versions. If omitted, Fleet automatically downloads the latest version found in Fleet's catalog. The version must be wrapped in quotes (e.g. "147.0.1") so that it is processed as a string.
- To pin to the major version, use a caret (^) constraint. You can specify only the major version, without the minor and patch versions. For example, "⁠^147" means that Fleet will continuously download the latest version until the app updates to 148.0.

If the fields below are omitted, they default to values specified in the app's metadata on GitHub.

install_script.path specifies the command Fleet will run on hosts to install software.
uninstall_script.path is the script Fleet will run on hosts to uninstall software.
categories is an array of categories, see categories.

org_settings and settings

Currently, managing users and ticket destinations (Jira and Zendesk) are only supported using Fleet's UI or API.

features

The features section of the configuration YAML lets you turn on/off Fleet features.

additional_queries adds extra host details. This information will be updated at the same time as other host details and is returned by the API when host objects are returned (default: empty).
enable_host_users specifies whether or not Fleet collects user data from hosts (default: true).
enable_software_inventory specifies whether or not Fleet collects software inventory from hosts (default: true).
historical_data controls per-dataset collection of the data that drive the dashboard charts. Each sub-key defaults to true:
- uptime — host activity samples that drive the Hosts active dashboard chart.
- vulnerabilities — per-host software vulnerability data that drive the Vulnerability exposure dashboard chart.
vulnerability_exposure_historical_reporting lets you define and persist the default filters for the Vulnerability exposure dashboard chart (risk registry) when the page loads. These filter display only and don't change which data Fleet collects. A user can still adjust the filters in the UI, but these changes aren't saved. historical_data.vulnerabilities must be enabled.
- software_filters is the list of software categories to show. Valid values: os (operating system), browsers (Google Chrome, Safari, Mozilla Firefox, Brave, and Opera), office (Word, Excel, PowerPoint, and Outlook), and adobe (Acrobat, Flash, and Shockwave Player) (default: all categories).
- epss_min / epss_max filters vulnerabilities by probability of exploit (EPSS) score (range 0 to 100).
- has_known_exploit, when true, only includes software that has vulnerabilities which have been actively exploited in the wild (CISA KEV) (default: false).
- exclude_vulnerabilities is a list of specific CVEs to exclude.

A dataset is collected for a given host only when the sub-key is true at both the global level (org_settings.features.historical_data) and the host's fleet level (settings.features.historical_data). Setting a sub-key to false at either level disables collection for the affected hosts. Flipping the global sub-key off disables it for every fleet, regardless of per-fleet settings.

Can be configured for "All fleets" (org_settings) and specific fleets (settings).

Example

org_settings:
  features:
    additional_queries:
      time: SELECT * FROM time
      macs: SELECT mac FROM interface_details
    enable_host_users: true
    enable_software_inventory: true
    historical_data:
      uptime: true
      vulnerabilities: false
    vulnerability_exposure_historical_reporting:
      software_filters:
        - os
        - browsers
        - office
        - adobe
      has_known_exploit: true
      epss_min: 0
      epss_max: 100
      exclude_vulnerabilities:
        - CVE-2025-50897
        - CVE-2025-76306

fleet_desktop

The fleet_desktop section lets you customize the Fleet Desktop experience by overriding default URLs.

transparency_url directs end users to a custom URL when they select About Fleet in the Fleet Desktop dropdown (default: https://fleetdm.com/transparency).
alternative_browser_host is a custom hostname that my hosts will access Fleet Desktop from.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  fleet_desktop:
    transparency_url: https://example.org/transparency
    alternative_browser_host: fleet-desktop.example.com

gitops

The gitops section allows configuring GitOps mode in the Fleet UI. When GitOps mode is enabled, many UI features become read-only to ensure that configuration changes are made only via GitOps.

gitops_mode_enabled — when true, Fleet's UI shows GitOps-managed sections as read-only with a tooltip pointing to the repository URL. Requires Fleet Premium.
repository_url (default: "") — the URL of the GitOps repository that manages this Fleet. Must be a valid http:// or https:// URL. Required when gitops_mode_enabled: true.

Can only be configured for "All fleets" (org_settings).

GitOps mode exceptions for labels, software, and enroll secrets can't be set in YAML. Configure them in the Fleet UI under Settings > Integrations > Change management. Learn more in the GitOps mode guide.

If gitops: is not provided in your YAML file, any existing GitOps mode settings will be preserved.

Example

org_settings:
  gitops:
    gitops_mode_enabled: true
    repository_url: https://github.com/example/fleet-config

host_expiry_settings

The host_expiry_settings section lets you define if and when hosts should be automatically deleted from Fleet if they have not checked in.

host_expiry_enabled (default: false)
host_expiry_window if a host has not communicated with Fleet in the specified number of days, it will be removed. Must be > 0 when host expiry is enabled (default: 0).

If this setting is not defined in your YAML files, unlike all other settings, it will not get reset to the default values.

Can be configured for "All fleets" (org_settings) and specific fleets (settings).

Example

org_settings:
  host_expiry_settings:
    host_expiry_enabled: true
    host_expiry_window: 10

activity_expiry_settings

The activity_expiry_settings section lets you define how to handle activities.

activity_expiry_enabled when enabled, allows automatic cleanup of activities (and associated live query data) older than the specified number of days. Activities linked to a host are preserved until the host is deleted.
activity_expiry_window the number of days to retain activity records, if activity expiry is enabled.
preserve_host_activity_on_reenrollment When enabled, preserves host activities after a wipe and re-enrollment. Currently only supported for company-owned (AB) Apple hosts. Delete activities > Max activity age still applies. (Default: false)

Example

org_settings:
  activity_expiry_settings:
    activity_expiry_enabled: true
    activity_expiry_window: 30
    preserve_host_activity_on_reenrollment: true

org_info

org_name is the name of your organization (default: "")
org_logo_path_dark_mode is a path to an image file for your organization's logo (default: Fleet logo). Only one of org_logo_path_dark_mode or org_logo_url_dark_mode may be specified.
org_logo_path_light_mode is a path to an image file for your organization's logo (default: Fleet logo). Only one of org_logo_path_light_mode or org_logo_url_light_mode may be specified.
org_logo_url_dark_mode is a public URL of the logo for your organization (default: Fleet logo). Only one of org_logo_path_dark_mode or org_logo_url_dark_mode may be specified.
org_logo_url_light_mode is a public URL of the logo for your organization that can be used with light backgrounds (default: Fleet logo). Only one of org_logo_path_light_mode or org_logo_url_light_mode may be specified.
contact_url is a URL or file URI that appears in error messages presented to end users (default: "https://fleetdm.com/company/contact")

Can only be configured for "All fleets" (org_settings).

To get the best results for your logos (org_logo_url_dark_mode/org_logo_path_dark_mode and org_logo_url_light_mode/org_logo_path_light_mode), use the following sizes:

For square logos, use a PNG, JPEG/JPG, WebP or SVGs that's 256x256 pixels (px).
For rectangular logos (wordmark), use a PNG, JPEG/JPG, WebP or SVGs that's 516x256 pixels (px).

Example

org_settings:
  org_info:
    org_name: Fleet
    org_logo_url_dark_mode: https://example.com/logo.png
    org_logo_url_light_mode: https://example.com/logo-light.png
    contact_url: https://fleetdm.com/company/contact

secrets

The secrets section defines the valid secrets that hosts can use to enroll to Fleet. Supply one of these secrets when generating the fleetd agent you'll use to enroll hosts.

Can be configured for "All fleets" (org_settings) and specific fleets (settings).

Example

org_settings:
  secrets:
  - secret: $ENROLL_SECRET

server_settings

ai_features_disabled disables AI-assisted policy descriptions and resolutions. (default: false)
enable_analytics specifies whether or not to enable Fleet's usage statistics. (default: true)
live_reporting_disabled disables the ability to run live reports (ad hoc reports executed via the UI or fleetctl). (default: false)
discard_reports_data disables storing results for all reports and deletes existing stored data. If set to true, data is still sent to the configured log destination if automations_enabled. (default: false)
report_cap sets the maximum number of results to store per report before the report is clipped. If increasing this cap, we recommend enabling reports for one query at a time and monitoring your infrastructure. (default: 1000)
scripts_disabled blocks access to run scripts. Scripts may still be added in the UI and CLI. (default: false)
server_url is the base URL of the Fleet instance. If this URL changes and Apple (macOS, iOS, iPadOS) hosts already have MDM turned on, the end users will have to turn MDM off and back on to use MDM features. (default: provided during Fleet setup)

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  server_settings:
    ai_features_disabled: false
    enable_analytics: true
    live_reporting_disabled: false
    discard_reports_data: false
    scripts_disabled: false
    server_url: https://instance.fleet.com

sso_settings

The sso_settings section lets you define single sign-on (SSO) settings.

enable_sso (default: false)
idp_name is the human-friendly name for the identity provider that will provide single sign-on authentication (default: "").
idp_image_url is an optional link to an image such as a logo for the identity provider. (default: "").
entity_id is the entity ID: a Uniform Resource Identifier (URI) that you use to identify Fleet when configuring the identity provider. It must exactly match the Entity ID field used in identity provider configuration (default: "").
metadata is the metadata (in XML format) provided by the identity provider. (default: "")
metadata_url is the URL that references the identity provider metadata. Only one of metadata or metadata_url is required (default: "").
enable_jit_provisioning specifies whether or not to enable just-in-time user provisioning (default: false).
enable_sso_idp_login specifies whether or not to allow single sign-on login initiated by identity provider (default: false).
sso_server_url is used if the URL your Fleet users (admins, maintainers, observers) use to login to Fleet via SSO is different than the base URL of your Fleet instance. If not configured, login via SSO will use the base URL of the Fleet instance.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  sso_settings:
    enable_sso: true
    idp_name: Okta
    idp_image_url: https://www.okta.com/favicon.ico
    entity_id: https://example.okta.com
    metadata: $SSO_METADATA
    enable_jit_provisioning: true # Available in Fleet Premium
    enable_sso_idp_login: true
    sso_server_url: https://admin.example.com # Optional, SSO will only work from this URL

integrations

The integrations section lets you configure your Google Calendar, Conditional access (enabling/disabling for hosts in "Unassigned"), Jira, and Zendesk. After configuration, you can enable automations like calendar event and ticket creation for failing policies. Currently, enabling ticket creation is only available using Fleet's UI or API (YAML files coming soon).

This section also lets you connect Google Workspace to sync identity provider (IdP) host vitals directly from your directory.

Can be configured for "All fleets" (org_settings) and specific fleets (settings).

Example

default.yml

org_settings:
  integrations:
    conditional_access_enabled: true
    google_calendar:
      - api_key_json: $GOOGLE_CALENDAR_API_KEY_JSON
        domain: fleetdm.com
    google_workspace:
      - api_key_json: $GOOGLE_WORKSPACE_API_KEY_JSON
        domain: fleetdm.com
        impersonated_user_email: admin@example.com
    jira:
      - url: https://example.atlassian.net
        username: user1
        api_token: $JIRA_API_TOKEN
        project_key: PJ1
    zendesk:
      - url: https://example.zendesk.com
        email: user1@example.com
        api_token: $ZENDESK_API_TOKEN
        group_id: 1234

/fleets/fleet-name.yml

At the fleet level, there is the additional option to enable conditional access, which blocks third party app sign-ins on hosts failing policies. (Available in Fleet Premium. Must have Microsoft Entra connected.)

integrations:
  conditional_access_enabled: true

google_calendar

For "All fleets" (org_settings):

api_key_json is the contents of the JSON file downloaded when you create your Google Workspace service account API key (default: "").
domain is the primary domain used to identify your end user's work calendar (default: "").

For specific fleets (settings):

enable_calendar_events to enable calendar events for a fleet (default: false).
webhook_url is the webhook URL triggered during a user's calendar event (default: "").

google_workspace

Available in Fleet Premium.

Connecting Google Workspace populates identity provider (IdP) host vitals directly from your directory. While Google Workspace is configured, SCIM provisioning (Okta, Entra ID, etc.) is ignored; configure one or the other, not both.

api_key_json is the contents of the JSON file downloaded when you create your Google Workspace service account API key. The service account must have domain-wide delegation enabled (default: "").
domain is your Google Workspace primary domain (default: "").
impersonated_user_email is a Google Workspace admin the service account impersonates via domain-wide delegation (default: "").

Can be configured for "All fleets" (org_settings).

jira

url is the URL of your Jira (default: "")
username is the username of your Jira account (default: "").
api_token is the Jira API token (default: "").
project_key is the project key location in your Jira project's URL. For example, in "jira.example.com/projects/EXMPL," "EXMPL" is the project key (default: "").

Can be configured for "All fleets" (org_settings). Use API to configure Jira for specific fleets or "Unassigned" hosts.

zendesk

url is the URL of your Zendesk (default: "")
username is the username of your Zendesk account (default: "").
api_token is the Zendesk API token (default: "").
group_idis found by selecting Admin > People > Groups in Zendesk. Find your group and select it. The group ID will appear in the search field.

Can be configured for "All fleets" (org_settings). Use API to configure Zendesk for specific fleets or "Unassigned" hosts.

certificate_authorities

Available in Fleet Premium.

This section lets you configure your certificate authorities (CA) to help your end users connect to Wi-Fi and VPN.

Example

default.yml

org_settings:
  certificate_authorities:
    digicert:
      - name: DIGICERT_WIFI
        url: https://one.digicert.com
        api_token: $DIGICERT_API_TOKEN
        profile_id: 926dbcdd-41c4-4fe5-96c3-b6a7f0da81d8
        certificate_common_name: $FLEET_VAR_HOST_HARDWARE_SERIAL@example.com
        certificate_user_principal_names:
          - $FLEET_VAR_HOST_HARDWARE_SERIAL@example.com
        certificate_seat_id: $FLEET_VAR_HOST_HARDWARE_SERIAL@example.com
    ndes_scep_proxy:
      url: https://example.com/certsrv/mscep/mscep.dll
      admin_url: https://example.com/certsrv/mscep_admin/
      username: Administrator@example.com
      password: myPassword
    custom_scep_proxy:
      - name: SCEP_VPN
        url: https://example.com/scep
        challenge: $SCEP_VPN_CHALLENGE
    custom_est_proxy:
      - name: SECTIGO_WIFI
        url: https://example.com/.well-known/est/abc123
        username: $SECTIGO_USERNAME_PASSWORD
        password: $SECTIGO_WIFI_PASSWORD
    hydrant: # Available in Fleet Premium
    - name: EST_WIFI
      url: https://example.com/est
      username: $EST_PROXY_USERNAME
      password: $EST_PROXY_PASSWORD
    hydrant:
      - name: HYDRANT_WIFI
        url: https://example.hydrantid.com/.well-known/est/abc123
        client_id: $HYDRANT_CLIENT_ID
        client_secret: $HYDRANT_CLIENT_SECRET
    smallstep:
      - name: SMALLSTEP_WIFI
        url: https://example.scep.smallstep.com/p/agents/integration-fleet
        challenge_url: https://example.scep.smallstep.com/xr9f4db7-83f1-48ab-8982-8b6870d4fl85/challenge
        username: $SMALLSTEP_USERNAME
        password: $SMALLSTEP_PASSWORD

digicert

name is the name of certificate authority that will be used in variables in configuration profiles. Only letters, numbers, and underscores are allowed.
url is the URL to DigiCert One instance (default: https://one.digicert.com).
api_token is the token used to authenticate requests to DigiCert.
profile_id is the ID of certificate profile in DigiCert.
certificate_common_name is the certificate's CN.
certificate_user_principal_names is the certificate's user principal names (UPN) attribute in Subject Alternative Name (SAN).
certificate_seat_id is the ID of the DigiCert's seat. Seats are license units in DigiCert.

Can only be configured for "All fleets" (org_settings).

ndes_scep_proxy

url is the URL of the NDES SCEP endpoint (default: "").
admin_url is the URL of the NDES admin endpoint (default: "").
username is the username of the NDES admin endpoint (default: "").
password is the password of the NDES admin endpoint (default: "").

Can only be configured for "All fleets" (org_settings).

custom_scep_proxy

name is the name of certificate authority that will be used in variables in configuration profiles. Only letters, numbers, and underscores are allowed.
url is the URL of the Simple Certificate Enrollment Protocol (SCEP) server.
challenge is the static challenge password used to authenticate requests to SCEP server.

custom_est_proxy

name is the name of the certificate authority that will be used in variables in configuration profiles. Only letters, numbers, and underscores are allowed.
url is the EST (Enrollment Over Secure Transport) endpoint's URL.
username is the username used to authenticate with the EST endpoint.
password is the password used to authenticate with the EST endpoint.

hydrant

name is the name of the certificate authority that will be used in variables in configuration profiles. Only letters, numbers, and underscores are allowed.
url is the EST (Enrollment Over Secure Transport) endpoint provided by Hydrant.
client_id is the client ID provided by Hydrant.
client_secret is the client secret provided by Hydrant.

smallstep

name is the name of the certificate authority that will be used in variables in configuration profiles. Only letters, numbers, and underscores are allowed.
url is the SCEP URL from Smallstep.
challenge_url is the Webhook URL from Smallstep.
username is the Challenge Basic Authentication Username from Smallstep.
password is the Challenge Basic Authentication Password from Smallstep.

Can only be configured for "All fleets" (org_settings).

webhook_settings

The webhook_settings section lets you define webhook settings for failing policy, vulnerability, and host status automations.

interval is how often policy webhooks/tickets and host status webhooks are triggered, formatted as number + unit of measurement (e.g. "90m"). Can be specified in seconds ("s"), minutes ("m"), or hours ("h"). (Default: "24h")

activities_webhook

enable_activities_webhook (default: false)
destination_url is the URL to POST to when an activity is generated (default: "")

Can be configured for all fleets (org_settings), specific fleets (settings), or "Unassigned" (settings).

Example

org_settings:
  webhook_settings:
    activities_webhook:
      enable_activities_webhook: true
      destination_url: https://example.org/webhook_handler

failing_policies_webhook

These settings can also be configured per-fleet when nested under settings.

enable_failing_policies_webhook (default: false)
destination_url is the URL to POST to when the condition for the webhook triggers (default: "").
policy_ids is the list of policies that will trigger a webhook.
host_batch_size is the maximum number of host identifiers to send in one webhook request. A value of 0 means all host identifiers with a failing policy will be sent in a single request.

Example

org_settings:
  webhook_settings:
    failing_policies_webhook:
      enable_failing_policies_webhook: true
      destination_url: https://example.org/webhook_handler
      host_batch_size: 0
      policy_ids:
        - 1
        - 2
        - 3

host_status_webhook

enable_host_status_webhook (default: false)
destination_url is the URL to POST to when the condition for the webhook triggers (default: "").
days_count is the number of days that hosts need to be offline to count as part of the percentage (default: 0).
host_percentage is the percentage of hosts that need to be offline to trigger the webhook. (default: 0).

Can be configured for "All fleets" (org_settings) and specific fleets (settings).

Example

org_settings:
  webhook_settings:
    host_status_webhook:
      enable_host_status_webhook: true
      destination_url: https://example.org/webhook_handler
      days_count: 7
      host_percentage: 25

vulnerabilities_webhook

enable_vulnerabilities_webhook (default: false)
destination_url is the URL to POST to when the condition for the webhook triggers (default: "").
host_batch_size is the maximum number of host identifiers to send in one webhook request. A value of 0 means all host identifiers with a detected vulnerability will be sent in a single request.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  webhook_settings:
    vulnerabilities_webhook:
      enable_vulnerabilities_webhook: true
      destination_url: https://example.org/webhook_handler
      host_batch_size: 0

mdm

apple_business

After adding an Apple Business (AB) token via the UI, the apple_business section lets you determine which fleet Apple hosts are assigned to in Fleet when they appear in Apple Business.

organization_name is the organization name associated with the Apple Business account.
macos_fleet is the fleet where macOS hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".
ios_fleet is the the fleet where iOS hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".
ipados_fleet is the fleet where iPadOS hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".
byod_fleet is the fleet where BYOD hosts are automatically added when they appear in Apple Business. If not specified, defaults to "Unassigned".

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  mdm:
    apple_business: # Available in Fleet Premium
    - organization_name: Fleet Device Management Inc.
      macos_fleet: 💻 Workstations
      ios_fleet: 📱🏢 Company-owned iPhones
      ipados_fleet: 🔳🏢 Company-owned iPads
      byod_fleet: 📱 BYOD iPhones

volume_purchasing_program

After you've uploaded a Volume Purchasing Program (VPP) token, the volume_purchasing_program section lets you configure the fleets in Fleet that have access to that VPP token's App Store apps. Currently, adding a VPP token is only available using Fleet's UI.

location is the name of the organization unit in the Apple Business account. Apple previously called this "location." Fleet will rename it to "organization unit" in the next major version.
fleets is a list of fleet names. If you choose specific fleets, App Store apps in this VPP account will only be available to install on hosts in these fleets. If not specified, App Store apps will not be available to install on any fleet. To apply it to all fleets, use - All fleets.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  mdm:
    volume_purchasing_program: # Available in Fleet Premium
    - location: Fleet Device Management Inc.
      fleets:
      - 💻 Workstations
      - 💻🐣 Workstations (canary)
      - 📱🏢 Company-owned iPhones
      - 🔳🏢 Company-owned iPads

end_user_authentication

The end_user_authentication section lets you define the identity provider (IdP) settings used for IdP authentication during Automated Device Enrollment (ADE).

Once the IdP settings are configured, you can use the controls.setup_experience.enable_end_user_authentication key to control the end user experience during ADE.

idp_name is the human-friendly name for the identity provider that will provide single sign-on authentication (default: "").
entity_id is the entity ID: a Uniform Resource Identifier (URI) that you use to identify Fleet when configuring the identity provider. It must exactly match the Entity ID field used in identity provider configuration (default: "").
metadata is the metadata (in XML format) provided by the identity provider. (default: "")
metadata_url is the URL that references the identity provider metadata. Only one of metadata or metadata_url is required (default: "").

Can only be configured for "All fleets" (org_settings):

Example

org_settings:
  mdm:
    end_user_authentication:
      entity_id: https://example.okta.com
      idp_name: Okta
      metadata: $END_USER_SSO_METADATA
      metadata_url: ""

end_user_license_agreement

You can require an end user to agree to an end user license agreement (EULA) before they can use their new Mac. end_user_authentication must be configured, and controls.enable_end_user_authentication must be set to true.

end_user_license_agreement is the path to the PDF document.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  mdm:
    end_user_license_agreement: ./lib/eula.pdf

apple_server_url

Update this URL if you're self-hosting Fleet and you want your hosts to talk to this URL for MDM features. (If not configured, hosts will use the base URL of the Fleet instance.)

If this URL changes and hosts already have MDM turned on, the end users will have to turn MDM off and back on to use MDM features.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  mdm:
    apple_server_url: https://instance.fleet.com

yara_rules

The yara_rules section lets you define YARA rules that will be served by Fleet's authenticated YARA rule functionality.

Can only be configured for "All fleets" (org_settings). To target rules to specific fleets, target the reports referencing the rules to the desired fleets.

Example

org_settings:
  yara_rules:
    - path: ./lib/rule1.yar
    - path: ./lib/rule2.yar

smtp_settings

If you're self hosting Fleet, the smtp_settings section lets you configure an e-mail (SMTP) server. This enables Fleet to send user invite and password reset emails.

If you're using Fleet's managed-cloud offering, an SMTP server is already setup for you.

For possible options, see the parameters for the smtp_settings object in the API.

Can only be configured for "All fleets" (org_settings).

Example

org_settings:
  smtp_settings:
    enable_smtp: true
    sender_address: organization@example.com
    server: localhost
    port: 1025
    authentication_type: none

Can only be configured for "All fleets" (org_settings).

Unlike other options, omitting smtp_settings or leaving it blank won't reset the values back to the default.

Tips

When renaming a fleet, first update the name in the UI, then update your YAML. If you only update the YAML, the fleet will be deleted and its hosts will lose their settings because they become "Unassigned".

Any settings not defined in your YAML files will be reset to the default values or deleted (e.g. software packages).

For the GitOps API token, create a dedicated API-only user with fleetctl user create --api-only. These users can modify configurations via GitOps but can’t access the Fleet UI. Assign the GitOps role and set the appropriate global or fleet scope in the UI.

scripts, configuration_profiles, labels, policies, and reports support both path (singular) and paths (plural).

path references a single file path.
paths accepts a wildcard (glob pattern) to match multiple files at once (e.g. ../lib/windows/profiles/*.xml).

Paths are always relative to the file you’re editing. You can't specify both path and paths on the same entry. Filenames containing *, ?, [, or { can't be referenced using path. If your filenames contain these characters (e.g. a Windows configuration profile named [AllowSpotlightCollection].xml), either rename the files, or use paths with a wildcard pattern like *.xml.

80 KiB Raw Permalink Blame History Unescape Escape

GitOps

custom_host_vitals

Example

labels

Example

Inline

Separate file

policies

Options

Patch policy

Automations

Install software

Run script

Example

Inline

Separate file

reports

Options

Example

Inline

Separate file

agent_options

Example

Inline

Separate file

controls

Example

macos_updates

ios_updates

ipados_updates

windows_updates

apple_settings and windows_settings

android_settings

android_settings.certificates

apple_account_provisioning

setup_experience

Example

macos_migration

software

Example

self_service, labels, categories, and setup_experience

packages

Example

Multiple versions of the same software

URL

Hash

Conditional downloads

Script-only

app_store_apps

fleet_maintained_apps

org_settings and settings

features

Example

fleet_desktop

Example

gitops

Example

host_expiry_settings

Example

activity_expiry_settings

Example

org_info

Example

secrets

Example

server_settings

Example

sso_settings

Example

integrations

Example

google_calendar

google_workspace

jira

zendesk

certificate_authorities

Example

digicert

ndes_scep_proxy

80 KiB

Raw Permalink Blame History