mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 13:37:30 +00:00
4.72.0 doc changes (#31766)
Documentation changes for 4.72.0 --------- Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Ian Littman <iansltx@gmail.com> Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com> Co-authored-by: Noah Talerman <noahtal@umich.edu> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
This commit is contained in:
Rachael Shaw
GitHub
parent
743c510e84
commit
6b37527c8a
13 changed files with 210 additions and 56 deletions
|
|
@ -74,6 +74,8 @@ An uninstall script will run when an admin chooses to uninstall the software fro
|
|||
|
||||
You can use `$PACKAGE_ID` in uninstall scripts as a placeholder for the package IDs (for .pkg files), package name (for Linux installers), product code (for MSIs), or software name (for EXE installers). The Fleet server will substitute `$PACKAGE_ID` on upload.
|
||||
|
||||
Fleet also provides an `$UPGRADE_CODE` placeholder for MSIs. This placeholder is replaced with the `UpgradeCode` extracted from the MSI on upload. If Fleet cannot extract an upgrade code from an MSI when using the default uninstall script, Fleet will use a product code-based uninstall script instead. If Fleet cannot extract an upgrade code from an MSI when a user-provided uninstall script uses the placeholder, the software upload will fail.
|
||||
|
||||
> Currently, the default MSI uninstaller script only uninstalls that exact installer, rather than earlier/later versions of the same application.
|
||||
|
||||
> Uninstall scripts do _not_ download the installer package to a host before running; if a .tar.gz archive includes an uninstall script, the contents of that script and any dependencies should be copied into the uninstall script text field rather than referred to by filename.
|
||||
|
|
|
|||
|
|
@ -144,6 +144,7 @@ How to unenroll a host from Fleet:
|
|||
- [Signing fleetd](#signing-fleetd)
|
||||
- [Grant full disk access to osquery on macOS](#grant-full-disk-access-to-osquery-on-macos)
|
||||
- [Using mTLS](#using-mtls)
|
||||
- [Using host identity certificates](#using-host-identity-certificates)
|
||||
- [Specifying update channels](#specifying-update-channels)
|
||||
- [Testing osquery queries locally](#testing-osquery-queries-locally)
|
||||
- [Finding fleetd logs](#finding-fleetd-logs)
|
||||
|
|
@ -309,6 +310,38 @@ If this setting is not used, you will need to configure client TLS certificates
|
|||
|
||||
To use mTLS use the [AutoSelectCertificateForUrls policy](https://chromeenterprise.google/policies/?policy=AutoSelectCertificateForUrls) to point Chrome to your client certificates
|
||||
|
||||
### Using host identity certificates
|
||||
|
||||
`Applies only to Fleet Premium`
|
||||
|
||||
Host identity certificates allow Fleet's agent (fleetd) to use hardware-backed client certificates for authentication to the Fleet server. All fleetd requests (except `/api/fleet/orbit/ping` and [Fleet Desktop](https://github.com/fleetdm/fleet/blob/2b33a445e9bfce808cebe31f8fef91058e8635e3/docs/Contributing/product-groups/orchestration/tpm-backed-http-signing.md#fleet-desktop-authentication) requests) to the Fleet server will include an HTTP message signature for enhanced security.
|
||||
|
||||
This feature uses the host's TPM (Trusted Platform Module) to generate and store cryptographic keys, providing strong hardware-based authentication.
|
||||
|
||||
This provides a level of security similar to [mTLS](#using-mtls), but the certificate is hardware-backed and managed by the TPM rather than being stored as a file on disk. The TPM ensures the private key cannot be extracted or copied, providing stronger security guarantees.
|
||||
|
||||
Currently, host identity certificates are only supported for Linux hosts (`.deb` and `.rpm` fleetd agents) with TPM 2.0 hardware (or vTPM for VMs) and Linux kernel 4.12 or later.
|
||||
|
||||
#### Generating fleetd with host identity certificates
|
||||
|
||||
To use host identity certificates, generate fleetd with the `--fleet-managed-host-identity-certificate` flag:
|
||||
|
||||
```sh
|
||||
fleetctl package \
|
||||
--type deb \
|
||||
--fleet-url=https://fleet.example.com \
|
||||
--enroll-secret=your-enroll-secret \
|
||||
--fleet-managed-host-identity-certificate
|
||||
```
|
||||
|
||||
#### Important considerations
|
||||
|
||||
- Hosts without TPM 2.0 will fail to enroll when this option is enabled
|
||||
- This feature cannot be combined with other client certificate options (`--fleet-tls-client-certificate`)
|
||||
- SCEP certificate requests can be throttled by the [osquery_enroll_cooldown](https://fleetdm.com/docs/configuration/fleet-server-configuration#osquery-enroll-cooldown) server option, similar to how fleetd enrollments are throttled
|
||||
- When a host requests a host identity certificate, the server will expect all future traffic from that host to be signed with HTTP message signatures. This allows mixed environments where some hosts use managed client certificates and others do not
|
||||
- Fleet administrators can enforce HTTP message signature requirements server-wide using the [auth.require_http_message_signature](https://fleetdm.com/docs/configuration/fleet-server-configuration#auth-require-http-message-signature) server configuration option
|
||||
|
||||
### Specifying update channels
|
||||
|
||||
Fleetd uses the concept of "update channels" to determine the version of it's components: Orbit, Fleet Desktop, osquery.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,88 @@
|
|||
# Account-driven User Enrollment for personal Apple devices (BYOD)
|
||||
|
||||
|
||||
|
||||
_Available in Fleet Premium._
|
||||
|
||||
In Fleet, you can allow your end users to enroll their personal iPhones and iPads to Fleet using [Account-driven User Enrollment](https://support.apple.com/en-gb/guide/deployment/dep23db2037d/web).
|
||||
|
||||
With Account-driven User Enrollment, end users can separate work and personal data using their [Managed Apple Account](https://support.apple.com/en-gb/guide/apple-business-manager/axm78b477c81/web). End users retain privacy over their personal information, while IT admins manage work-related OS settings and applications.
|
||||
|
||||
- [Step 1: Connect Apple Business Manager (ABM) to Fleet](#step-1-connect-apple-business-manager-abm-to-fleet)
|
||||
- [Step 2: Add and verify your domain in Apple Business Manager (ABM)](#step-2-add-and-verify-your-domain-in-apple-business-manager-abm)
|
||||
- [Step 3: Connect (federate) your identity provider (IdP) with Apple Business Manager (ABM)](#step-3-connect-federate-your-identity-provider-idp-with-apple-business-manager-abm)
|
||||
- [Step 4: Create a team for personal hosts](#step-4-create-a-team-for-personal-hosts)
|
||||
- [Step 5: Log in on the device to enroll to Fleet (end user's iPhone or iPad)](#step-5-log-in-on-the-device-to-enroll-to-fleet-end-users-iphone-or-ipad)
|
||||
|
||||
|
||||
## Step 1: Connect Apple Business Manager (ABM) to Fleet
|
||||
|
||||
1. Follow the [instructions](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm) to connect ABM to Fleet.
|
||||
> **Note:** You may skip this if you have already connected ABM to enable automatic enrollment.
|
||||
2. For Account-driven User Enrollment to work, ensure that personal (BYOD) iOS and iPadOS hosts are associated with Fleet in the **Default Server Assignment** section in Apple Business Manager.
|
||||
> **Note:** If you're trying Fleet and testing Account-driven User Enrollment, [self-host a service discovery file](#self-host-a-service-discovery-file-well-known-resource) instead. That way, hosts keep enrolling to your current MDM solution instead of Fleet.
|
||||
|
||||
## Step 2: Add and verify your domain in Apple Business Manager (ABM)
|
||||
|
||||
Follow the [Apple documentation](https://support.apple.com/en-gb/guide/apple-business-manager/axm48c3280c0/web#axm2033c47b0) to add and verify your company domain in your ABM. Use the domain name associated with your work email (for example, `yourcompany.com` from `name@yourcompany.com`). This will enable the automatic creation of Apple Managed Accounts from your identity provider (IdP) accounts in the next step.
|
||||
|
||||
## Step 3: Connect (federate) your identity provider (IdP) with Apple Business Manager (ABM)
|
||||
|
||||
Follow the [Apple documentation](https://support.apple.com/en-gb/guide/apple-business-manager/axmb19317543/web) to connect your identity provider (IdP). This will enable end users to log in to their Managed Apple Account using their existing IdP credentials.
|
||||
|
||||
> **Note:** For visual walk-throughs, see [Connect Google Workspace to ABM](https://www.youtube.com/watch?v=CPfO6W67d3A) and [Connect Microsoft Entra ID to ABM](https://www.youtube.com/watch?v=_-PnhMurAVk).
|
||||
|
||||
## Step 4: Create a team for personal hosts
|
||||
|
||||
Fleet's [best practice](https://fleetdm.com/guides/teams#best-practice) is to create a team, e.g., `📱🔐 Personal mobile devices`, for personal hosts that have access to company resources.
|
||||
|
||||
In this team you can add custom OS settings that are compatible with hosts enrolled with Account-driven User Enrollment. To find out which payloads are compatible with User Enrollment, visit the [Apple documentation](https://support.apple.com/en-gb/guide/deployment/dep6ae3f1d5a/1/web/1.0).
|
||||
|
||||
## Step 5: Log in on the device to enroll to Fleet (end user's iPhone or iPad)
|
||||
|
||||
On their iPhone or iPad, ask end users to:
|
||||
|
||||
1. Open the **Settings** app.
|
||||
2. Go to **General > VPN & Device Management**.
|
||||
3. Tap **Sign In to Work or School Account**.
|
||||
4. Sign in with their IdP credentials (e.g., Google Workspace or Microsoft Entra ID).
|
||||
|
||||
After signing in, the device will automatically enroll in Fleet.
|
||||
|
||||
## Self-host a service discovery file (well-known resource)
|
||||
|
||||
>**Note:**
|
||||
> - If your iOS/iPadOS hosts are running version 18.2 or later, you can skip this. Fleet manages service discovery automatically for these versions.
|
||||
> - If your iOS/iPadOS hosts are running a version below 18.2 or you're trying Fleet, you'll need to self-host a [service discovery JSON file](https://support.apple.com/en-gb/guide/deployment/dep4d9e9cd26/web#depcae01b5df).
|
||||
> - If you're trying Fleet and using a different MDM solution in production, hosting this file will direct only Account-driven User Enrollments to Fleet. iOS/iPadOS hosts purchased in ABM and hosts using an enrollment profile will still enroll to your current MDM solution.
|
||||
|
||||
Host the JSON file below at the following URL: `https://<company_domain>/.well-known/com.apple.remotemanagement.`
|
||||
|
||||
> **Note:** Make sure to include the trailing dot in the URL when hosting the file.
|
||||
|
||||
Make sure the `Content-Type` header is set to `application/json`.
|
||||
|
||||
```json
|
||||
{
|
||||
"Servers": [
|
||||
{
|
||||
"Version": "mdm-byod",
|
||||
"BaseURL": "https://<fleet_server_url>/api/mdm/apple/account_driven_enroll"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Host vitals limitations
|
||||
|
||||
Apple limits the amount of host vitals Fleet can collect on personal iOS/iPadOS hosts.
|
||||
|
||||
- Fleet can't collect serial numbers from personal iOS/iPadOS hosts.
|
||||
- Software inventory will only include applications installed by Fleet.
|
||||
|
||||
<meta name="articleTitle" value="Account-driven User Enrollment for personal Apple devices (BYOD)">
|
||||
<meta name="authorFullName" value="Marko Lisica">
|
||||
<meta name="authorGitHubUsername" value="marko-lisica">
|
||||
<meta name="category" value="guides">
|
||||
<meta name="publishedOn" value="2025-08-08">
|
||||
<meta name="description" value="Enroll personal (BYOD) iPhones and iPads with Managed Apple Account">
|
||||
|
|
@ -19,11 +19,11 @@ Then click **Turn on** under the Apple (macOS, iOS, iPadOS) MDM section.
|
|||
> - If your certificate expires, you will have to turn MDM off and back on for all macOS hosts.
|
||||
> - Be sure to use the same Apple ID from year-to-year. If you don't, you will have to turn MDM off and back on for all macOS hosts.
|
||||
|
||||
## Automatic enrollment
|
||||
## Apple Business Manager (ABM)
|
||||
|
||||
> Available in Fleet Premium
|
||||
|
||||
Add your ABM to automatically enroll newly purchased Apple hosts when they're first unboxed and set up by your end users.
|
||||
Connect Fleet to your ABM to allow automatic enrollment for company-owned and [Account-driven User Enrollment](https://fleetdm.com/guides/enroll-personal-byod-ios-ipad-hosts-with-managed-apple-account) for personal (BYOD) macOS, iOS, and iPadOS hosts.
|
||||
|
||||
To connect Fleet to ABM, you have to add an ABM token to Fleet. To add an ABM token:
|
||||
|
||||
|
|
@ -45,7 +45,7 @@ After connecting Fleet to ABM, set Fleet to be the MDM for all Macs:
|
|||
4. Click **MDM Server Assignment** and click **Edit** next to **Default Server Assignment**.
|
||||
5. Switch **Mac**, **iPhone**, and **iPad** to Fleet.
|
||||
|
||||
macOS, iOS, and iPadOS hosts listed in ABM and associated to a Fleet instance with MDM enabled will sync to Fleet and appear in the Hosts view with the **MDM status** label set to "Pending".
|
||||
macOS, iOS, and iPadOS hosts listed in ABM and associated to a Fleet instance with MDM enabled will sync to Fleet and appear in the Hosts view with the **MDM status** label set to "Pending".
|
||||
|
||||
Hosts that automatically enroll will be assigned to a default team. You can configure the default team for macOS, iOS, and iPadOS hosts by:
|
||||
|
||||
|
|
|
|||
|
|
@ -177,7 +177,7 @@ Testing requires a test Mac that is present in your Apple Business Manager (ABM)
|
|||
|
||||
2. In Fleet, navigate to the Hosts page and find your Mac. Make sure that the host's **MDM status** is set to "Pending."
|
||||
|
||||
> New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." See our [automatic enrollment guide](https://fleetdm.com/guides/macos-mdm-setup#automatic-enrollment) for more information.
|
||||
> New Macs purchased through Apple Business Manager appear in Fleet with MDM status set to "Pending." See our [automatic enrollment guide](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager) for more information.
|
||||
|
||||
3. Transfer this host to the "Workstations (canary)" team by selecting the checkbox to the left of the host and selecting **Transfer** at the top of the table. In the modal, choose the Workstations (canary) team and select **Transfer**.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,74 +1,86 @@
|
|||
# Software self-service
|
||||
|
||||
|
||||
|
||||
|
||||
_Available in Fleet Premium_
|
||||
|
||||
Fleet’s self-service software feature empowers end users by allowing them to independently install approved software packages from a curated list through the Fleet Desktop “My device” page. This not only reduces the administrative burden on IT teams but also enhances user productivity and satisfaction. In this guide, we will walk you through the process of uploading, editing, and managing self-service software packages in Fleet, enabling seamless software distribution and management.
|
||||
Fleet’s self-service software lets end users update and install approved apps from a curated list on the **Fleet Desktop > Self-service** page. This reduces overhead for IT and keeps teams productive. This guide covers how to add, install, and update self-service software in Fleet.
|
||||
|
||||
> Software packages can be added to a specific team or to "No team." "No team" is the default assignment for hosts that are not part of any specific team.
|
||||
## Add software
|
||||
|
||||
## Step-by-step instructions
|
||||
|
||||
### Add self-service software
|
||||
|
||||
1. Select the team to which you want to add the software package from the dropdown in the upper left corner of the page.
|
||||
1. Select the team to which you want to add the software from the dropdown in the upper left corner of the page.
|
||||
2. Select **Software** in the main navigation menu.
|
||||
3. Press the **Add software** button in the upper right corner of the page.
|
||||
4. Stay on the **Fleet-maintained** tab to add a Fleet-maintained App, or select one of the other tabs if you want to add an App Store (VPP) app or upload a custom software package.
|
||||
5. Based on the type of software you would like to add, follow instructions for adding a [Fleet-maintained app](https://fleetdm.com/guides/fleet-maintained-apps#add-a-fleet-maintained-app), a [VPP app](https://fleetdm.com/guides/install-vpp-apps-on-macos-using-fleet#add-the-app-to-fleet), or a [custom package](https://fleetdm.com/guides/deploy-software-packages#add-a-custom-package). In each case, you can check the **Self-service** box when adding software to make it immediately available for self-service installation once added.
|
||||
3. Select the **Add software** button in the upper right corner of the page.
|
||||
4. Pick a [Fleet-maintained app](https://fleetdm.com/guides/fleet-maintained-apps), [App Store (VPP) app](https://fleetdm.com/guides/install-vpp-apps-on-macos-using-fleet#add-the-app-to-fleet), or upload a [custom package](https://fleetdm.com/guides/deploy-software-packages).
|
||||
5. Check **Self-service** to make it available for self-service as soon as it's added.
|
||||
|
||||
### Enable self-service on existing software
|
||||
You can also add the software and later make it available in self-service:
|
||||
|
||||
1. Select the team to which you added the software from the dropdown in the upper left corner of the page.
|
||||
2. Select **Software** in the main navigation menu.
|
||||
3. To make it easier to find your software, select the **All software** dropdown and choose **Available for install.** This filters the results in the table to show only software that can be installed on hosts. If you don’t see your software, page through the results or search for your software's name in the search bar. Once you find the software, select its title.
|
||||
4. Press the ✏️ icon, then check **Self-service** in the **Options** section. You can also assign categories to your software, which will organize the display of software to end users on the **My device > Self-service** page.
|
||||
5. Press the **Save** button.
|
||||
3. Select the **All software** dropdown and choose **Available for install.** This filters the results in the table to show only software that can be installed on hosts. If you don’t see your software, page through the results or search for your software's name in the search bar. Once you find the software, select its title.
|
||||
4. Select the pencil (edit) icon, then check **Self-service** in the **Options** section. You can also assign categories to your software, which will organize the display of software to end users on the **My device > Self-service** page.
|
||||
5. Select the **Save** button.
|
||||
|
||||
### Download a self-service software package
|
||||
If a software item isn't made available in self-service, end users will not see it in **Fleet Desktop > Self-service**. IT admins can still install, update, and uninstall the software from Fleet.
|
||||
|
||||
1. Select the team to which you added the software from the dropdown in the upper left corner of the page.
|
||||
2. Select **Software** in the main navigation menu.
|
||||
3. Select the **All software** dropdown and choose **Self-service.** Page through the results to find your software or search for the software package name in the search bar.
|
||||
4. Select the row containing the software’s name.
|
||||
5. Press the **Download** icon (next to the ✏️ icon) to the right of the software package's filename.
|
||||
## IT admin experience
|
||||
|
||||
### Delete self-service software
|
||||
How to view, update, install, or uninstall self-service software:
|
||||
|
||||
1. Select the team to which you added the software from the dropdown in the upper left corner of the page.
|
||||
2. Select **Software** in the main navigation menu.
|
||||
3. Select the **All software** dropdown and choose **Self-service.** Page through the results to find your software or search for the software package name in the search bar.
|
||||
4. Select the row containing the software’s name.
|
||||
5. Press the 🗑️ icon to the right of the software package's filename, then press the "Delete" button to confirm.
|
||||
1. Go to **Hosts**.
|
||||
2. Select a host to go to the Host details page.
|
||||
3. Open the **Software > Library** tab and select **Self-service** in the dropdown.
|
||||
4. To update, install, or uninstall, select **Update**, **Install**, or **Uninstall**.
|
||||
|
||||
### Install self-service software
|
||||
**Update** appears for [eligible updates](#how-updates-works), regardless of whether the app is set to self-service.
|
||||
|
||||
To install self-service software on a host:
|
||||
Tips:
|
||||
|
||||
1. From the Fleet desktop icon in the OS menu bar, select **Self-service.** This will open your default web browser to the list of self-service software packages available to install.
|
||||
2. Select **Install** to the right of the software title you'd like to install.
|
||||
- Use the **Software > Library** table to quickly identify and action pending updates.
|
||||
- When a software install or uninstall fails, select **Failed** to see error details that can help with troubleshooting.
|
||||
- To automatically install software, you can use Fleet's policy automations. [Learn how](https://fleetdm.com/guides/automatic-software-install-in-fleet).
|
||||
|
||||
### Uninstall self-service software
|
||||
## End user experience
|
||||
|
||||
To uninstall self-service software on a host:
|
||||
How to update, install, or uninstall self-service software:
|
||||
|
||||
1. From the Fleet desktop icon in the OS menu bar, select **Self-service.** This will open your default web browser to the list of self-service software packages available to uninstall.
|
||||
2. Select **Uninstall** to the right of the software title you'd like to uninstall.
|
||||
1. Find the Fleet icon in your menu bar and select **Self-service.** This will open your default web browser to the list of self-service software available to update, install, or uninstall.
|
||||
2. If updates are available, end users can update one or all available self-service software. They can also view update progress and error details directly.
|
||||
|
||||
### Use the REST API for self-service software
|
||||
## API
|
||||
|
||||
Fleet provides a REST API for managing software, including self-service software packages. Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software).
|
||||
Fleet provides a REST API for managing software, including self-service software packages. Learn more about Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software).
|
||||
|
||||
### Manage self-service software with GitOps
|
||||
## GitOps
|
||||
|
||||
To manage self-service software using GitOps, check out the `software` key in the [GitOps reference documentation](https://fleetdm.com/docs/using-fleet/gitops#software).
|
||||
To manage self-service software using GitOps, see the `software` key in the [GitOps reference documentation](https://fleetdm.com/docs/using-fleet/gitops#software).
|
||||
|
||||
> Note: When managing Fleet via GitOps, software packages uploaded using the web UI will not persist unless they are also added in GitOps using the `hash_sha256` field.
|
||||
> **Note:** When managing Fleet via GitOps, software packages uploaded using the web UI persist only if they are also defined in GitOps with the `hash_sha256` field.
|
||||
|
||||
## Conclusion
|
||||
## Advanced
|
||||
|
||||
Fleet’s self-service software feature not only simplifies software management for IT administrators but also empowers end users by giving them access to necessary software on demand. This feature ensures that your hosts remain secure while improving overall user experience. For further information and advanced management techniques, refer to Fleet's [REST API](https://fleetdm.com/docs/rest-api/rest-api#software) and [GitOps](https://fleetdm.com/docs/using-fleet/gitops#software) documentation.
|
||||
### How updates work
|
||||
|
||||
When Fleet shows **Update** instead of **Install**:
|
||||
|
||||
- The software is detected in Fleet's software inventory (software installed on the host).
|
||||
- Fleet has a newer version of the software. This version is newer than at least one version of the software in Fleet's software inventory.
|
||||
|
||||
Currently, if a host has two versions of the software installed, with each version installed in different locations, Fleet can only upgrade one version. In this scenario, Fleet will still show **Update**. If this happens, the best practice is to run a custom script to uninstall the old version. Here's an example script that removes a copy of Google Chrome present in a macOS host's `Downloads/` folder:
|
||||
|
||||
```sh
|
||||
rm -r /Users/noahtalerman/Downloads/Google\ Chrome.app
|
||||
```
|
||||
|
||||
For more technical detail and edge cases, refer to the [software self-service diagram](https://drive.google.com/file/d/1rOR0zRT5DKZfJVPq2WdNpdWkO0ARYbsj/view).
|
||||
|
||||
### Statuses
|
||||
|
||||
When an install, uninstall, or update is triggered by an IT admin or end user in the Fleet UI or by an end user—Fleet continuously monitors (["polls"](https://en.wikipedia.org/wiki/Polling_(computer_science))) and surfaces a loading status (e.g., "Installing...").
|
||||
|
||||
- If the host is online, Fleet will poll automatically every 5 seconds to check for completion. When the install, uninstall, or update completes or fails, the status will update without the IT admin or end user having to reload the page.
|
||||
- If the host is offline, IT admins see a pending status. When pending, the action has not started on the host. IT admins can cancel pending actions on **Host details > Activity > Upcoming** tab.
|
||||
|
||||
<meta name="articleTitle" value="Software self-service">
|
||||
<meta name="authorFullName" value="Jahziel Villasana-Espinoza">
|
||||
|
|
|
|||
|
|
@ -677,6 +677,20 @@ The key size of the salt which is generated when hashing user passwords.
|
|||
salt_key_size: 36
|
||||
```
|
||||
|
||||
### auth_require_http_message_signature
|
||||
|
||||
*Available in Fleet Premium.*
|
||||
|
||||
When enabled, Fleet server will require HTTP message signatures for all incoming fleetd (orbit and osquery) requests to verify request authenticity and integrity. The fleetd agents must run with `--fleet-managed-client-certificate` flag so they can request a host identity certificate from Fleet server and then use it to create HTTP message signatures (requires orbit 1.46.0 or higher).
|
||||
|
||||
- Default value: `false`
|
||||
- Environment variable: `FLEET_AUTH_REQUIRE_HTTP_MESSAGE_SIGNATURE`
|
||||
- Config file format:
|
||||
```yaml
|
||||
auth:
|
||||
require_http_message_signature: true
|
||||
```
|
||||
|
||||
## App
|
||||
|
||||
### app_token_key_size
|
||||
|
|
|
|||
|
|
@ -868,12 +868,12 @@ Can only be configured for all teams (`org_settings`).
|
|||
|
||||
#### apple_business_manager
|
||||
|
||||
After [adding an Apple Business Manager (ABM) token via the UI](https://fleetdm.com/guides/macos-mdm-setup#automatic-enrollment), the `apple_business_manager` section lets you determine which team Apple devices are assigned to in Fleet when they appear in Apple Business Manager.
|
||||
After [adding an Apple Business Manager (ABM) token via the UI](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager), the `apple_business_manager` section lets you determine which team Apple hosts are assigned to in Fleet when they appear in Apple Business Manager.
|
||||
|
||||
- `organization_name` is the organization name associated with the Apple Business Manager account.
|
||||
- `macos_team` is the team where macOS hosts are automatically added when they appear in Apple Business Manager.
|
||||
- `ios_team` is the the team where iOS hosts are automatically added when they appear in Apple Business Manager.
|
||||
- `ipados_team` is the team where iPadOS hosts are automatically added when they appear in Apple Business Manager.
|
||||
- `macos_team` is the team where macOS hosts are automatically added when they appear in Apple Business Manager. If not specified, defaults to "No team".
|
||||
- `ios_team` is the the team where iOS hosts are automatically added when they appear in Apple Business Manager. If not specified, defaults to "No team".
|
||||
- `ipados_team` is the team where iPadOS hosts are automatically added when they appear in Apple Business Manager. If not specified, defaults to "No team".
|
||||
|
||||
#### Example
|
||||
|
||||
|
|
|
|||
|
|
@ -757,9 +757,9 @@ None.
|
|||
| Name | Type | In | Description |
|
||||
| ---- | ---- | -- | ----------- |
|
||||
| id | integer | path | *Required* The ABM token's ID |
|
||||
| macos_team_id | integer | body | macOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team" |
|
||||
| ios_team_id | integer | body | iOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team" |
|
||||
| ipados_team_id | integer | body | iPadOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team" |
|
||||
| macos_team_id | integer | body | macOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team". |
|
||||
| ios_team_id | integer | body | iOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team". |
|
||||
| ipados_team_id | integer | body | iPadOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. If not specified, defaults to "No team". |
|
||||
|
||||
#### Example
|
||||
|
||||
|
|
|
|||
|
|
@ -507,6 +507,10 @@ Returns a list of the activities that have been performed in Fleet. For a compre
|
|||
| per_page | integer | query | Results per page. |
|
||||
| order_key | string | query | What to order results by. Can be any column in the `activities` table. |
|
||||
| order_direction | string | query | **Requires `order_key`**. The direction of the order given the order key. Options include `"asc"` and `"desc"`. Default is `"asc"`. |
|
||||
| query | string | query | Search query keywords. Searchable fields include `user_name` and `user_email`.
|
||||
| activity_type | string | query | Indicates the activity `type` to filter by. See available activity types on the [Audit logs page](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/audit-logs.md).
|
||||
| start_created_at | string | query | Filters to include only activities that happened after this date. If not specified, set to the earliest possible date.
|
||||
| end_created_at | string | query | Filters to include only activities that happened before this date. If not specified, set to now.
|
||||
|
||||
#### Example
|
||||
|
||||
|
|
@ -3881,10 +3885,11 @@ A `team_id` of `0` returns the statistics for hosts that are not part of any tea
|
|||
{
|
||||
"counts_updated_at": "2021-03-21T12:32:44Z",
|
||||
"mobile_device_management_enrollment_status": {
|
||||
"enrolled_manual_hosts_count": 0,
|
||||
"enrolled_automated_hosts_count": 2,
|
||||
"enrolled_manual_hosts_count": 10,
|
||||
"enrolled_automated_hosts_count": 200,
|
||||
"enrolled_personal_hosts_count": 30,
|
||||
"unenrolled_hosts_count": 0,
|
||||
"hosts_count": 2
|
||||
"hosts_count": 240
|
||||
},
|
||||
"mobile_device_management_solution": [
|
||||
{
|
||||
|
|
|
|||
BIN
website/assets/images/articles/apple-account-driven-user-enrollment.png
vendored
Normal file
BIN
website/assets/images/articles/apple-account-driven-user-enrollment.png
vendored
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 157 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 104 KiB |
BIN
website/assets/images/articles/software-self-service-2670x1514.png
vendored
Normal file
BIN
website/assets/images/articles/software-self-service-2670x1514.png
vendored
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 320 KiB |
Loading…
Reference in a new issue