fleet/articles/fleet-maintained-apps.md

Fleet-maintained apps

Available in Fleet Premium

In Fleet, you can install Fleet-maintained apps on macOS and Windows hosts without the need for manual uploads or extra configuration. This simplifies the process and adds another source of applications for your fleet. View a list of the currently supported apps in the software catalog.

Fleet maintains installation metadata for a number of apps, letting you add them to your own Fleet instance and install them on your hosts without any additional configuration.

Important notes on CPU architecture

macOS

Currently, the macOS versions of these apps are Apple Silicon-only rather than universal:

• 1Password
• Brave
• Docker Desktop
• Figma
• Microsoft Visual Studio (VS) Code
• Notion
• Postman
• Slack
• Zoom

Windows

Fleet prefers 64-bit x86 versions of applications when available. Installing on Arm hosts (e.g. in a VM on an Apple Silicon machine) may not work or have other unintended consequences.

Add a Fleet-maintained app

1. Head to the Software page for a fleet, then click Add software. You'll land on the Fleet-maintained apps list.
2. Click the Add button for the app and platform you wish to add.

You'll see a ✅ icon instead of an Add button if the application has already been added to your fleet as a custom package or VPP app, or if you've already added the Fleet-maintained app.

3. Click Add software to download the installer package from the app's publisher into Fleet and make it available for install for your selected fleet.

Fleet verifies install and uninstall scripts for each maintained app, and keeps the scripts up to date as an app's vendor releases new versions. You can override Fleet's scripts, or add pre-install queries or post-install scripts, either when adding the app (by clicking Advanced options) or later on (by editing the package).

Install the app

You can install a Fleet-maintained app three ways:

1. Manually in the Host Details page under the Software tab. Select the app you just added and choose Install from the Actions dropdown.
2. Manually from the Self-service tab on the My Device page from an end user's machine, if you've enabled Self-service for the app.
3. Automatically on hosts via policy automations.

You can track the installation process in the Activities section on the Details tab of this Host Details page.

Fleet keeps Fleet-maintained apps up to date automatically (see Update apps automatically). You can also add a patch policy to detect and remediate hosts running outdated versions.

Uninstall the app

To remove the app, navigate to the Host Details page for the appropriate host, then to the Software tab. Find the app, then click on the Actions drop-down, then Uninstall.

Fleet will run the uninstall script configured for the software title. For macOS, Fleet generates default scripts based on the Homebrew recipe (see zap in recipe). For Windows, Fleet leverages MSI or .exe data to generate default scripts.

The uninstallation process is also visible in the Activities section on the Details tab of this Host Details page.

Update apps automatically

By default, Fleet keeps each Fleet-maintained app up to date. When the app's publisher releases a new version, Fleet downloads it and uses it for new installs. Hosts running an older version update to the latest version the next time the app is installed, for example, via Self-service or policy automations.

This "Latest" behavior is the default. To control which version Fleet installs, pin the app to a specific or major version.

Pin a version

Pin a Fleet-maintained app to keep it on a specific version instead of automatically updating to the latest version.

1. On the Software page, select the app to open its details page.
2. Select Actions > Versions.
3. Choose Pin to {version} to stay on a specific version, or Pin to major version ({N}) to stay on a major version and receive only its minor and patch updates.
4. Select Save.

New installs use the pinned version. To return to automatic updates, open Actions > Versions again and select Automatically update to latest.

Pinning is available in Fleet Premium and requires the Maintainer role or higher.

With GitOps, set the version key under the app's fleet_maintained_apps entry:

software:
  fleet_maintained_apps:
    - slug: google-chrome/darwin
      version: "149.0.7827.54"

Use a caret (^) constraint to pin to a major version (for example, "^147"). Omit version to keep the app on the latest version. See the GitOps reference for details.

You can also pin via the REST API using the version parameter on the PATCH /api/v1/fleet/software/titles/:id/package endpoint.

Roll back to a previous version

If a new version introduces a bug, roll back by pinning the app to the previous version using the same Actions > Versions workflow (or the GitOps version key or REST API above).

Hosts already running the newer version will downgrade to the pinned version the next time the app is installed.

Keep apps up to date with patch policies

You can create a patch policy for a Fleet-maintained app to automatically detect hosts running outdated versions. With GitOps, the patch policy query automatically updates to include the latest version each time specs are applied.

To add a patch policy, open the app's details page under Software, then select Actions > Patch.

To automatically install updates when the policy fails, enable the automation at Policies > Manage automations > Install software.

For a detailed walkthrough, see the patch management guide.

Manage apps with GitOps

To manage Fleet-maintained apps using Fleet's best practice GitOps, check out fleet_maintained_apps, found under the software key, in the GitOps reference documentation.

Note: with GitOps enabled, any Fleet-maintained apps added using the web UI will not persist if not also added in YAML.

How does Fleet maintain these apps?

Fleet:

• verifies, installs, uninstalls & tests all Fleet-maintained apps alongside the install and uninstall scripts we generate
• transforms data from multiple sources, including Homebrew Casks and WinGet manifests, into standardized manifests, checking data sources multiple times per day
• fetches the full maintained apps list from GitHub hourly (or when you run fleetctl trigger --name=maintained_apps; interval was daily prior to Fleet 4.71.0)
• fetches an individual app's manifest when the Add button is pressed from the maintained apps list in the UI, and when an individual app is retrieved or added via the REST API
• DOES NOT directly pull data from WinGet or Homebrew to end-user devices

For a deeper look at the whole pipeline, including validation on real hosts, how broken updates are frozen, and the security model, see how Fleet keeps Fleet-maintained apps safe and up to date.