+ Enroll your device to Fleet
+
+ Follow the instructions below to download and install the Fleet profile
+ on your device.
+
+
+ -
+
+ 1.
+
+ Download the Fleet profile and select Allow in the
+ pop-up.
+
+
+ Download
+
+ -
+
+ 2.
+
+ Navigate to Settings and select Profile Downloaded.
+
+
+
+
![select profile downloaded in settings]()
+
+ -
+
+ 3.
+ Select Install.
+
+
+
![select install]()
+
+
+
+
+
+
diff --git a/server/fleet/service.go b/server/fleet/service.go
index b975691da3..023c560eab 100644
--- a/server/fleet/service.go
+++ b/server/fleet/service.go
@@ -930,6 +930,9 @@ type Service interface {
// CheckMDMAppleEnrollmentWithMinimumOSVersion checks if the minimum OS version is met for a MDM enrollment
CheckMDMAppleEnrollmentWithMinimumOSVersion(ctx context.Context, m *MDMAppleMachineInfo) (*MDMAppleSoftwareUpdateRequired, error)
+ // GetOTAProfile gets the OTA (over-the-air) profile for a given team based on the enroll secret provided.
+ GetOTAProfile(ctx context.Context, enrollSecret string) ([]byte, error)
+
///////////////////////////////////////////////////////////////////////////////
// CronSchedulesService
diff --git a/server/mdm/apple/apple_mdm.go b/server/mdm/apple/apple_mdm.go
index a280b36c28..eb047ad34a 100644
--- a/server/mdm/apple/apple_mdm.go
+++ b/server/mdm/apple/apple_mdm.go
@@ -1041,3 +1041,36 @@ func IOSiPadOSRefetch(ctx context.Context, ds fleet.Datastore, commander *MDMApp
}
return nil
}
+
+func GenerateOTAEnrollmentProfileMobileconfig(orgName, fleetURL, enrollSecret string) ([]byte, error) {
+ path, err := url.JoinPath(fleetURL, "/api/v1/fleet/ota_enrollment")
+ if err != nil {
+ return nil, fmt.Errorf("creating path for ota enrollment url: %w", err)
+ }
+
+ enrollURL, err := url.Parse(path)
+ if err != nil {
+ return nil, fmt.Errorf("parsing ota enrollment url: %w", err)
+ }
+
+ q := enrollURL.Query()
+ q.Set("enroll_secret", enrollSecret)
+ enrollURL.RawQuery = q.Encode()
+
+ var profileBuf bytes.Buffer
+ tmplArgs := struct {
+ Organization string
+ URL string
+ EnrollSecret string
+ }{
+ Organization: orgName,
+ URL: enrollURL.String(),
+ }
+
+ err = mobileconfig.OTAMobileConfigTemplate.Execute(&profileBuf, tmplArgs)
+ if err != nil {
+ return nil, fmt.Errorf("executing ota profile template: %w", err)
+ }
+
+ return profileBuf.Bytes(), nil
+}
diff --git a/server/mdm/apple/mobileconfig/profiles.go b/server/mdm/apple/mobileconfig/profiles.go
index a2dfdf4438..b71d2db5ab 100644
--- a/server/mdm/apple/mobileconfig/profiles.go
+++ b/server/mdm/apple/mobileconfig/profiles.go
@@ -1,6 +1,11 @@
package mobileconfig
-import "text/template"
+import (
+ "encoding/xml"
+ "fmt"
+ "strings"
+ "text/template"
+)
var funcMap = map[string]any{
"xml": XMLEscapeString,
@@ -113,3 +118,40 @@ var FleetCARootTemplate = template.Must(template.New("").Option("missingkey=erro
`))
+
+var OTAMobileConfigTemplate = template.Must(template.New("").Funcs(template.FuncMap{"xml": func(v string) (string, error) {
+ var escaped strings.Builder
+ if err := xml.EscapeText(&escaped, []byte(v)); err != nil {
+ return "", fmt.Errorf("XML escaping in OTA profile: %w", err)
+ }
+ return escaped.String(), nil
+}}).Option("missingkey=error").Parse(`
+
+
+