From 7b7fa2fcd114059b1a709003bfad4352f8e319e1 Mon Sep 17 00:00:00 2001
From: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Date: Wed, 26 Feb 2025 13:47:28 -0500
Subject: [PATCH 01/15] Fleet UI: Component fixes (styling bugs and code
 cleanup) (#26149)

---
 changes/26136-user-table-cleanup              |   1 +
 .../CustomLink/CustomLink.stories.tsx         |  79 ++++++++
 frontend/components/CustomLink/CustomLink.tsx |  19 +-
 frontend/components/CustomLink/_styles.scss   |  27 ++-
 .../LicenseExpirationBanner.tsx               |   3 +-
 .../AppleBMRenewalMessage.tsx                 |   3 +-
 .../AppleBMTermsMessage.tsx                   |   3 +-
 .../ApplePNCertRenewalMessage.tsx             |   3 +-
 .../VppRenewalMessage/VppRenewalMessage.tsx   |   3 +-
 .../PremiumFeatureIconWithTooltip.tsx         |  59 ------
 ...PremiumFeatureIconWithToooltip.stories.tsx |  14 --
 .../_styles.scss                              |   5 -
 .../PremiumFeatureIconWithTooltip/index.ts    |   1 -
 .../DataTable/ActionButton/ActionButton.tsx   |  12 +-
 .../TableContainer/DataTable/DataTable.tsx    |   2 -
 .../TooltipTruncatedTextCell.tsx              |  10 +-
 .../TooltipTruncatedTextCell/_styles.scss     |  19 ++
 .../AutoSizeInputField.stories.tsx            |  18 +-
 .../AutoSizeInputField/AutoSizeInputField.tsx |   2 +-
 .../DashboardPage/cards/MDM/_styles.scss      |  11 --
 .../DashboardPage/cards/Munki/_styles.scss    |   4 -
 .../DashboardPage/cards/Software/_styles.scss |   1 -
 .../BootstrapPackageTable/_styles.scss        |   4 -
 .../SetupAssistantProfileUploader.tsx         |   2 -
 .../FleetMaintainedAppDetailsPage.tsx         |   1 +
 .../SoftwareTitleDetailsTable/_styles.scss    |   7 -
 .../SoftwareTitles/SoftwareTable/_styles.scss |   5 -
 .../SoftwareVulnerabilitiesTable/_styles.scss |   4 -
 .../UsersPage/UsersPageTableConfig.tsx        |  86 ++++----
 .../TeamDetailsWrapper/UsersPage/_styles.scss |  14 +-
 .../TeamDetailsWrapper/_styles.scss           |   6 +
 .../admin/TeamManagementPage/_styles.scss     |  12 +-
 .../admin/UserManagementPage/_styles.scss     | 184 +++++++++---------
 .../UsersTable/UsersTableConfig.tsx           |  60 ++----
 .../hosts/ManageHostsPage/ManageHostsPage.tsx |   5 +-
 .../DeviceUserBanners/DeviceUserBanners.tsx   |   3 +-
 .../HostDetailsBanners/HostDetailsBanners.tsx |   3 +-
 .../OSSettingsErrorCell.tsx                   |   2 +-
 38 files changed, 301 insertions(+), 396 deletions(-)
 create mode 100644 changes/26136-user-table-cleanup
 delete mode 100644 frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithTooltip.tsx
 delete mode 100644 frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithToooltip.stories.tsx
 delete mode 100644 frontend/components/PremiumFeatureIconWithTooltip/_styles.scss
 delete mode 100644 frontend/components/PremiumFeatureIconWithTooltip/index.ts
 delete mode 100644 frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/_styles.scss

diff --git a/changes/26136-user-table-cleanup b/changes/26136-user-table-cleanup
new file mode 100644
index 0000000000..74824d55b1
--- /dev/null
+++ b/changes/26136-user-table-cleanup
@@ -0,0 +1 @@
+- Fleet UI: Constistent behavior for table overflow and not hiding badges when user names overflow table cell
diff --git a/frontend/components/CustomLink/CustomLink.stories.tsx b/frontend/components/CustomLink/CustomLink.stories.tsx
index 5e8600c15a..cf4b3c2800 100644
--- a/frontend/components/CustomLink/CustomLink.stories.tsx
+++ b/frontend/components/CustomLink/CustomLink.stories.tsx
@@ -1,5 +1,8 @@
+import React from "react";
 import { Meta, StoryObj } from "@storybook/react";
 
+import InfoBanner from "components/InfoBanner";
+import TooltipWrapper from "components/TooltipWrapper";
 import CustomLink from ".";
 
 const meta: Meta<typeof CustomLink> = {
@@ -24,3 +27,79 @@ export const ExternalLink: Story = {
     newTab: true,
   },
 };
+
+export const Multiline: Story = {
+  render: (args) => (
+    <div
+      style={{
+        width: "400px",
+      }}
+    >
+      Here&apos;s a CustomLink in a that might be split up across two lines{" "}
+      <CustomLink {...args} />
+    </div>
+  ),
+  args: {
+    url: "https://www.google.com",
+    text:
+      "This is a custom link that has multiple words that might span multiple lines and the icon should stick with the last word onto the new line",
+    multiline: true,
+    newTab: true,
+  },
+};
+
+export const TooltipVariant: Story = {
+  render: (args) => (
+    <TooltipWrapper
+      tipContent={
+        <>
+          Tip content with a custom link <CustomLink {...args} />
+        </>
+      }
+    >
+      Hover to see custom link in tooltip{" "}
+    </TooltipWrapper>
+  ),
+  args: {
+    url: "https://www.google.com",
+    text: "Tooltip link",
+    variant: "tooltip-link",
+    newTab: true,
+  },
+};
+
+export const BannerVariant: Story = {
+  render: (args) => (
+    <InfoBanner>
+      Here&apos;s a CustomLink in a banner <CustomLink {...args} />
+    </InfoBanner>
+  ),
+  args: {
+    url: "https://www.google.com",
+    text: "Banner link",
+    variant: "banner-link",
+    newTab: true,
+  },
+};
+
+export const FlashMessageVariant: Story = {
+  args: {
+    url: "https://www.google.com",
+    text: "Flash message link",
+    variant: "flash-message-link",
+  },
+};
+
+export const DisabledKeyboardNav: Story = {
+  render: (args) => (
+    <>
+      Here, you can&apos;t tab to this link even if you wanted to which is
+      useful when within a disabled component. <CustomLink {...args} />
+    </>
+  ),
+  args: {
+    url: "https://www.google.com",
+    text: "Disabled Keyboard Navigation",
+    disableKeyboardNavigation: true,
+  },
+};
diff --git a/frontend/components/CustomLink/CustomLink.tsx b/frontend/components/CustomLink/CustomLink.tsx
index b3b45eaccc..f99d02f37d 100644
--- a/frontend/components/CustomLink/CustomLink.tsx
+++ b/frontend/components/CustomLink/CustomLink.tsx
@@ -14,22 +14,14 @@ interface ICustomLinkProps {
   newTab?: boolean;
   /** Icon wraps on new line with last word */
   multiline?: boolean;
-  // TODO: Refactor to use variant
-  iconColor?: Colors;
-  // TODO: Refactor to use variant
-  color?: "core-fleet-blue" | "core-fleet-black" | "core-fleet-white";
   /** Restricts access via keyboard when CustomLink is part of disabled UI */
   disableKeyboardNavigation?: boolean;
   /**
    * Changes the appearance of the link.
    *
    * @default "default"
-   *
-   * TODO:
-   * Longterm: refactor 14 instances away from iconColor/color combo, which
-   * usually are identical and repetitive, toward variants e.g. "banner-link"
    */
-  variant?: "tooltip-link" | "default" | "flash-message-link";
+  variant?: "tooltip-link" | "banner-link" | "flash-message-link" | "default";
 }
 
 const baseClass = "custom-link";
@@ -40,8 +32,6 @@ const CustomLink = ({
   className,
   newTab = false,
   multiline = false,
-  iconColor = "core-fleet-blue",
-  color = "core-fleet-blue",
   disableKeyboardNavigation = false,
   variant = "default",
 }: ICustomLinkProps): JSX.Element => {
@@ -50,15 +40,16 @@ const CustomLink = ({
       case "tooltip-link":
       case "flash-message-link":
         return "core-fleet-white";
+      case "banner-link":
+        return "core-fleet-black";
       default:
-        return iconColor;
+        return "core-fleet-blue";
     }
   };
 
   const customLinkClass = classnames(baseClass, className, {
-    [`${baseClass}--black`]: color === "core-fleet-black",
-    [`${baseClass}--white`]: color === "core-fleet-white",
     [`${baseClass}--${variant}`]: variant !== "default",
+    [`${baseClass}--multiline`]: multiline,
   });
 
   const target = newTab ? "_blank" : "";
diff --git a/frontend/components/CustomLink/_styles.scss b/frontend/components/CustomLink/_styles.scss
index 8d050125ae..60dc80cb71 100644
--- a/frontend/components/CustomLink/_styles.scss
+++ b/frontend/components/CustomLink/_styles.scss
@@ -1,7 +1,10 @@
 .custom-link {
-  display: inline-flex;
-  align-items: center;
-  gap: $pad-xsmall;
+  // Changing display will break multiline links
+  &:not(.custom-link--multiline) {
+    display: inline-flex;
+    align-items: center;
+    gap: $pad-xsmall;
+  }
 
   &__no-wrap {
     white-space: nowrap;
@@ -10,18 +13,14 @@
     }
   }
 
-  // Legacy
-  &--black {
-    color: $core-fleet-black;
-  }
-
-  &--white {
-    color: $core-fleet-white;
-  }
-
   // Variants
+  &--tooltip-link,
+  &--banner-link,
+  &--flash-messsage-link {
+    color: inherit; // Overrides fleet blue link color with parent color
+  }
+
   &--tooltip-link {
-    color: $core-fleet-white;
-    font-size: $xx-small;
+    font-size: inherit; // Overrides link default font size with parent tooltip font size
   }
 }
diff --git a/frontend/components/LicenseExpirationBanner/LicenseExpirationBanner.tsx b/frontend/components/LicenseExpirationBanner/LicenseExpirationBanner.tsx
index 014283fa36..c1333b43b3 100644
--- a/frontend/components/LicenseExpirationBanner/LicenseExpirationBanner.tsx
+++ b/frontend/components/LicenseExpirationBanner/LicenseExpirationBanner.tsx
@@ -15,8 +15,7 @@ const LicenseExpirationBanner = (): JSX.Element => {
           url="https://fleetdm.com/learn-more-about/downgrading"
           text="Downgrade or renew"
           newTab
-          iconColor="core-fleet-black"
-          color="core-fleet-black"
+          variant="banner-link"
         />
       }
     >
diff --git a/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx b/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
index c64031d51f..d8a6a7cf15 100644
--- a/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
+++ b/frontend/components/MDM/AppleBMRenewalMessage/AppleBMRenewalMessage.tsx
@@ -19,8 +19,7 @@ const AppleBMRenewalMessage = ({ expired }: IAppleBMRenewalMessageProps) => {
           url="/settings/integrations/mdm/abm"
           text="Renew ABM"
           className={`${baseClass}`}
-          color="core-fleet-black"
-          iconColor="core-fleet-black"
+          variant="banner-link"
         />
       }
     >
diff --git a/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx b/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
index 6fcff4be67..ce59db8432 100644
--- a/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
+++ b/frontend/components/MDM/AppleBMTermsMessage/AppleBMTermsMessage.tsx
@@ -16,8 +16,7 @@ const AppleBMTermsMessage = () => {
           text="Go to ABM"
           className={`${baseClass}__new-tab`}
           newTab
-          color="core-fleet-black"
-          iconColor="core-fleet-black"
+          variant="banner-link"
         />
       }
     >
diff --git a/frontend/components/MDM/ApplePNCertRenewalMessage/ApplePNCertRenewalMessage.tsx b/frontend/components/MDM/ApplePNCertRenewalMessage/ApplePNCertRenewalMessage.tsx
index 824468ea61..7e790f4d96 100644
--- a/frontend/components/MDM/ApplePNCertRenewalMessage/ApplePNCertRenewalMessage.tsx
+++ b/frontend/components/MDM/ApplePNCertRenewalMessage/ApplePNCertRenewalMessage.tsx
@@ -20,8 +20,7 @@ const ApplePNCertRenewalMessage = ({ expired }: IApplePNCertRenewalMessage) => {
           text="Renew APNs"
           className={`${baseClass}__new-tab`}
           newTab
-          color="core-fleet-black"
-          iconColor="core-fleet-black"
+          variant="banner-link"
         />
       }
     >
diff --git a/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx b/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
index 8980f485f2..b4498002df 100644
--- a/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
+++ b/frontend/components/MainContent/banners/VppRenewalMessage/VppRenewalMessage.tsx
@@ -19,8 +19,7 @@ const VppRenewalMessage = ({ expired }: IVppRenewalMessageProps) => {
           url="/settings/integrations/mdm/vpp"
           text="Renew VPP"
           className={`${baseClass}`}
-          color="core-fleet-black"
-          iconColor="core-fleet-black"
+          variant="banner-link"
         />
       }
     >
diff --git a/frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithTooltip.tsx b/frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithTooltip.tsx
deleted file mode 100644
index 12fa73b863..0000000000
--- a/frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithTooltip.tsx
+++ /dev/null
@@ -1,59 +0,0 @@
-import CustomLink from "components/CustomLink";
-import Icon from "components/Icon";
-import { uniqueId } from "lodash";
-import React from "react";
-import ReactTooltip, { Place } from "react-tooltip";
-import { COLORS } from "styles/var/colors";
-
-interface IPremiumFeatureIconWithTooltip {
-  tooltipPlace?: Place;
-  tooltipDelayHide?: number;
-  tooltipPositionOverrides?: {
-    leftAdj?: number;
-    topAdj?: number;
-  };
-}
-const PremiumFeatureIconWithTooltip = ({
-  tooltipPlace,
-  tooltipDelayHide = 100,
-  tooltipPositionOverrides,
-}: IPremiumFeatureIconWithTooltip) => {
-  const [leftAdj, topAdj] = [
-    tooltipPositionOverrides?.leftAdj ?? 0,
-    tooltipPositionOverrides?.topAdj ?? 0,
-  ];
-  const tipId = uniqueId();
-  return (
-    <span className="premium-icon-tip">
-      <span data-tip data-for={tipId}>
-        <Icon name="premium-feature" className="premium-feature-icon" />
-      </span>
-      <ReactTooltip
-        place={tooltipPlace ?? "top"}
-        type="dark"
-        effect="solid"
-        id={tipId}
-        backgroundColor={COLORS["tooltip-bg"]}
-        delayHide={tooltipDelayHide}
-        delayUpdate={500}
-        overridePosition={(pos: { left: number; top: number }) => {
-          return {
-            left: pos.left + leftAdj,
-            top: pos.top + topAdj,
-          };
-        }}
-      >
-        {`This is a Fleet Premium feature. `}
-        <CustomLink
-          url="https://fleetdm.com/upgrade"
-          text="Learn more"
-          newTab
-          multiline={false}
-          iconColor="core-fleet-white"
-        />
-      </ReactTooltip>
-    </span>
-  );
-};
-
-export default PremiumFeatureIconWithTooltip;
diff --git a/frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithToooltip.stories.tsx b/frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithToooltip.stories.tsx
deleted file mode 100644
index dba2c44d4c..0000000000
--- a/frontend/components/PremiumFeatureIconWithTooltip/PremiumFeatureIconWithToooltip.stories.tsx
+++ /dev/null
@@ -1,14 +0,0 @@
-import { Meta, StoryObj } from "@storybook/react";
-
-import PremiumFeatureIconWithTooltip from "./PremiumFeatureIconWithTooltip";
-
-const meta: Meta<typeof PremiumFeatureIconWithTooltip> = {
-  title: "Components/PremiumFeatureIconWithTooltip",
-  component: PremiumFeatureIconWithTooltip,
-};
-
-export default meta;
-
-type Story = StoryObj<typeof PremiumFeatureIconWithTooltip>;
-
-export const Basic: Story = {};
diff --git a/frontend/components/PremiumFeatureIconWithTooltip/_styles.scss b/frontend/components/PremiumFeatureIconWithTooltip/_styles.scss
deleted file mode 100644
index ec9e7a06d9..0000000000
--- a/frontend/components/PremiumFeatureIconWithTooltip/_styles.scss
+++ /dev/null
@@ -1,5 +0,0 @@
-.premium-icon-tip {
-  font-style: normal;
-  font-size: $x-small;
-  font-weight: normal;
-}
diff --git a/frontend/components/PremiumFeatureIconWithTooltip/index.ts b/frontend/components/PremiumFeatureIconWithTooltip/index.ts
deleted file mode 100644
index f2c2609222..0000000000
--- a/frontend/components/PremiumFeatureIconWithTooltip/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./PremiumFeatureIconWithTooltip";
diff --git a/frontend/components/TableContainer/DataTable/ActionButton/ActionButton.tsx b/frontend/components/TableContainer/DataTable/ActionButton/ActionButton.tsx
index 27ca436b54..23fd8ce44b 100644
--- a/frontend/components/TableContainer/DataTable/ActionButton/ActionButton.tsx
+++ b/frontend/components/TableContainer/DataTable/ActionButton/ActionButton.tsx
@@ -1,6 +1,5 @@
 import React, { useCallback } from "react";
 import { kebabCase, noop } from "lodash";
-import PremiumFeatureIconWithTooltip from "components/PremiumFeatureIconWithTooltip";
 
 import { ButtonVariant } from "components/buttons/Button/Button";
 import Icon from "components/Icon/Icon";
@@ -17,7 +16,6 @@ export interface IActionButtonProps {
   hideButton?: boolean | ((targetIds: number[]) => boolean);
   iconSvg?: IconNames;
   iconPosition?: string;
-  indicatePremiumFeature?: boolean;
 }
 
 function useActionCallback(
@@ -41,7 +39,6 @@ const ActionButton = (buttonProps: IActionButtonProps): JSX.Element | null => {
     hideButton,
     iconSvg,
     iconPosition,
-    indicatePremiumFeature,
   } = buttonProps;
   const onButtonClick = useActionCallback(onActionButtonClick || noop);
 
@@ -62,14 +59,7 @@ const ActionButton = (buttonProps: IActionButtonProps): JSX.Element | null => {
 
   return (
     <div className={`${baseClass} ${baseClass}__${kebabCase(name)}`}>
-      {indicatePremiumFeature && (
-        <PremiumFeatureIconWithTooltip tooltipDelayHide={500} />
-      )}
-      <Button
-        disabled={indicatePremiumFeature}
-        onClick={() => onButtonClick(targetIds)}
-        variant={variant}
-      >
+      <Button onClick={() => onButtonClick(targetIds)} variant={variant}>
         <>
           {iconPosition === "left" && iconSvg && <Icon name={iconSvg} />}
           {buttonText}
diff --git a/frontend/components/TableContainer/DataTable/DataTable.tsx b/frontend/components/TableContainer/DataTable/DataTable.tsx
index 9edac4d4f9..6b665c828e 100644
--- a/frontend/components/TableContainer/DataTable/DataTable.tsx
+++ b/frontend/components/TableContainer/DataTable/DataTable.tsx
@@ -402,7 +402,6 @@ const DataTable = ({
       hideButton,
       iconSvg,
       iconPosition,
-      indicatePremiumFeature,
     } = actionButtonProps;
     return (
       <div className={`${baseClass}__${kebabCase(name)}`}>
@@ -414,7 +413,6 @@ const DataTable = ({
           targetIds={targetIds}
           variant={variant}
           hideButton={hideButton}
-          indicatePremiumFeature={indicatePremiumFeature}
           iconSvg={iconSvg}
           iconPosition={iconPosition}
         />
diff --git a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx
index 995665a669..c8373ea339 100644
--- a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx
+++ b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/TooltipTruncatedTextCell.tsx
@@ -17,6 +17,8 @@ interface ITooltipTruncatedTextCellProps {
   /** @deprecated use the prop `className` in order to add custom classes to this component */
   classes?: string;
   className?: string;
+  /** Content does not get truncated */
+  suffix?: React.ReactNode;
 }
 
 const baseClass = "tooltip-truncated-cell";
@@ -27,13 +29,14 @@ const TooltipTruncatedTextCell = ({
   tooltipBreakOnWord = false,
   classes = "w250",
   className,
+  suffix,
 }: ITooltipTruncatedTextCellProps): JSX.Element => {
   const classNames = classnames(baseClass, classes, className, {
     "tooltip-break-on-word": tooltipBreakOnWord,
   });
 
   // Tooltip visibility logic: Enable only when text is truncated
-  const ref = useRef<HTMLInputElement>(null);
+  const ref = useRef<HTMLSpanElement>(null);
   const [tooltipDisabled, setTooltipDisabled] = useState(true);
 
   useLayoutEffect(() => {
@@ -51,14 +54,14 @@ const TooltipTruncatedTextCell = ({
   return (
     <div className={classNames}>
       <div
-        className="data-table__tooltip-truncated-text"
+        className="data-table__tooltip-truncated-text-container"
         data-tip
         data-for={tooltipId}
         data-tip-disable={isDefaultValue || tooltipDisabled}
       >
         <span
           ref={ref}
-          className={`data-table__tooltip-truncated-text--cell ${
+          className={`data-table__tooltip-truncated-text ${
             isDefaultValue ? "text-muted" : ""
           } ${tooltipDisabled ? "" : "truncated"}`}
         >
@@ -81,6 +84,7 @@ const TooltipTruncatedTextCell = ({
           {/* Fixes triple click selecting next element in Safari */}
         </>
       </ReactTooltip>
+      {suffix && <span className="data-table__suffix">{suffix}</span>}
     </div>
   );
 };
diff --git a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss
index fecad0a775..824fe44285 100644
--- a/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss
+++ b/frontend/components/TableContainer/DataTable/TooltipTruncatedTextCell/_styles.scss
@@ -1,8 +1,22 @@
 .tooltip-truncated-cell {
+  display: flex;
+  align-items: center; // For badges, etc
+
   .text-muted {
     color: $ui-fleet-black-50;
   }
+
+  .data-table__tooltip-truncated-text-container {
+    display: flex; // Flex container for text and suffix
+    align-items: center; // Keep text and suffix aligned
+    min-width: 0; // Prevent flex child from growing beyond container
+  }
+
   .data-table__tooltip-truncated-text {
+    white-space: nowrap; /* Prevent wrapping */
+    overflow: hidden; /* Hide overflowing text */
+    text-overflow: ellipsis; /* Add ellipsis for truncated text */
+
     &--cell {
       display: inline-block;
       overflow: hidden;
@@ -35,4 +49,9 @@
       word-break: normal;
     }
   }
+
+  .data-table__suffix {
+    margin-left: 8px; /* Add spacing between text and suffix */
+    flex-shrink: 0; /* Prevent suffix from shrinking */
+  }
 }
diff --git a/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.stories.tsx b/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.stories.tsx
index cea0e18abf..fa5626acbc 100644
--- a/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.stories.tsx
+++ b/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.stories.tsx
@@ -1,26 +1,12 @@
-import React, { KeyboardEvent } from "react";
+import React from "react";
 import { Meta, StoryFn } from "@storybook/react";
 import { noop } from "lodash";
 
 import AutoSizeInputField from ".";
+import { IAutoSizeInputFieldProps } from "./AutoSizeInputField";
 
 import "../../../../index.scss";
 
-interface IAutoSizeInputFieldProps {
-  name: string;
-  placeholder: string;
-  value: string;
-  inputClassName?: string;
-  maxLength: number;
-  hasError?: boolean;
-  isDisabled?: boolean;
-  isFocused?: boolean;
-  onFocus: () => void;
-  onBlur: () => void;
-  onChange: (newSelectedValue: string) => void;
-  onKeyPress: (event: KeyboardEvent<HTMLTextAreaElement>) => void;
-}
-
 export default {
   component: AutoSizeInputField,
   title: "Components/FormFields/Input/AutoSizeInputField",
diff --git a/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.tsx b/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.tsx
index ef4d52a74b..711c846af0 100644
--- a/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.tsx
+++ b/frontend/components/forms/fields/AutoSizeInputField/AutoSizeInputField.tsx
@@ -1,7 +1,7 @@
 import React, { KeyboardEvent, useEffect, useRef } from "react";
 import classnames from "classnames";
 
-interface IAutoSizeInputFieldProps {
+export interface IAutoSizeInputFieldProps {
   name: string;
   placeholder: string;
   value: string;
diff --git a/frontend/pages/DashboardPage/cards/MDM/_styles.scss b/frontend/pages/DashboardPage/cards/MDM/_styles.scss
index e4f3526fe3..29ba4c319c 100644
--- a/frontend/pages/DashboardPage/cards/MDM/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/MDM/_styles.scss
@@ -14,16 +14,6 @@
           .status__header {
             width: 30%;
           }
-
-          .hosts__header {
-            border-right: 0;
-            padding-right: 0;
-            width: 60px;
-          }
-
-          .linkToFilteredHosts__header {
-            width: 140px;
-          }
         }
       }
     }
@@ -40,6 +30,5 @@
         }
       }
     }
-
   }
 }
diff --git a/frontend/pages/DashboardPage/cards/Munki/_styles.scss b/frontend/pages/DashboardPage/cards/Munki/_styles.scss
index bb4310970b..a447f7aa36 100644
--- a/frontend/pages/DashboardPage/cards/Munki/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/Munki/_styles.scss
@@ -21,7 +21,6 @@
           padding-right: 0;
         }
         .hosts_count__header {
-          border-right: 0;
           padding-right: 0;
           width: 9%;
         }
@@ -30,9 +29,6 @@
           border-left: 0;
           width: 40px;
         }
-        .linkToFilteredHosts__header {
-          width: 140px;
-        }
       }
 
       tbody {
diff --git a/frontend/pages/DashboardPage/cards/Software/_styles.scss b/frontend/pages/DashboardPage/cards/Software/_styles.scss
index 5ff0a14a7d..3535b1f320 100644
--- a/frontend/pages/DashboardPage/cards/Software/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/Software/_styles.scss
@@ -52,7 +52,6 @@
           padding-right: 0;
         }
         .hosts_count__header {
-          border-right: 0;
           padding-right: 0;
           width: 60px;
         }
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/components/BootstrapPackageTable/_styles.scss b/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/components/BootstrapPackageTable/_styles.scss
index 3533b35ffc..7a0137a330 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/components/BootstrapPackageTable/_styles.scss
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/BootstrapPackage/components/BootstrapPackageTable/_styles.scss
@@ -10,10 +10,6 @@
     min-width: auto;
   }
 
-  .data-table-block th:nth-last-child(2) {
-    border-right: 0;
-  }
-
   @media (max-width: $break-lg) {
     .view-hosts-link {
       span {
diff --git a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx
index 35789ee3b8..493c29c71c 100644
--- a/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx
+++ b/frontend/pages/ManageControlsPage/SetupExperience/cards/SetupAssistant/components/SetupAssistantProfileUploader/SetupAssistantProfileUploader.tsx
@@ -51,8 +51,6 @@ const SetupAssistantProfileUploader = ({
               text="Learn more"
               className={`${baseClass}__new-tab`}
               newTab
-              color="core-fleet-black"
-              iconColor="core-fleet-white"
             />
           </>
         );
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
index b024089ff6..9b4f3ddf21 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
@@ -129,6 +129,7 @@ const FleetMaintainedAppDetailsPage = ({
   }
 
   const { renderFlash } = useContext(NotificationContext);
+
   const handlePageError = useErrorHandler();
   const { isPremiumTier } = useContext(AppContext);
   const { selectedOsqueryTable, setSelectedOsqueryTable } = useContext(
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/_styles.scss
deleted file mode 100644
index 4bb68fc439..0000000000
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/_styles.scss
+++ /dev/null
@@ -1,7 +0,0 @@
-.software-title-details-table {
-  .data-table {
-    .hosts_count__header {
-      border-right: 0;
-    }
-  }
-}
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
index 97c1139dec..7e9bbb3ca0 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/_styles.scss
@@ -53,11 +53,6 @@
               width: $col-md;
             }
 
-            .hosts_count__header {
-              width: auto;
-              border-right: 0;
-            }
-
             @media (min-width: $break-lg) {
               // expand the width of version header at larger screen sizes
               .versions__header {
diff --git a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/_styles.scss b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/_styles.scss
index 736bb51064..9edb4adcc4 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/_styles.scss
@@ -4,10 +4,6 @@
     &__wrapper {
       overflow-x: auto;
     }
-
-    th:nth-last-child(2) {
-      border-right: 0;
-    }
   }
 
   // used to position header text with premium icon correctly
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/UsersPageTableConfig.tsx b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/UsersPageTableConfig.tsx
index 35458bfe5d..4ca20a2847 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/UsersPageTableConfig.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/UsersPageTableConfig.tsx
@@ -1,17 +1,16 @@
 import React from "react";
-import ReactTooltip from "react-tooltip";
 
+import stringUtils from "utilities/strings";
 import { IUser, UserRole } from "interfaces/user";
 import { ITeam } from "interfaces/team";
 import { IDropdownOption } from "interfaces/dropdownOption";
 
 import TextCell from "components/TableContainer/DataTable/TextCell/TextCell";
+import TooltipTruncatedTextCell from "components/TableContainer/DataTable/TooltipTruncatedTextCell";
 import ActionsDropdown from "components/ActionsDropdown";
 import CustomLink from "components/CustomLink";
 import TooltipWrapper from "components/TooltipWrapper";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
-import stringUtils from "utilities/strings";
-import { COLORS } from "styles/var/colors";
 
 interface IHeaderProps {
   column: {
@@ -59,6 +58,32 @@ export interface ITeamUsersTableData {
   id: number;
 }
 
+export const renderApiUserIndicator = () => {
+  return (
+    <TooltipWrapper
+      className="api-only-tooltip"
+      tipContent={
+        <>
+          This user was created using fleetctl and
+          <br /> only has API access.{" "}
+          <CustomLink
+            text="Learn more"
+            newTab
+            url="https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user"
+            variant="tooltip-link"
+          />
+        </>
+      }
+      tipOffset={14}
+      position="top"
+      showArrow
+      underline={false}
+    >
+      <span className="team-users__api-only-user">API</span>
+    </TooltipWrapper>
+  );
+};
+
 // NOTE: cellProps come from react-table
 // more info here https://react-table.tanstack.com/docs/api/useTable#cell-properties
 const generateColumnConfigs = (
@@ -72,52 +97,17 @@ const generateColumnConfigs = (
       sortType: "caseInsensitive",
       accessor: "name",
       Cell: (cellProps: ICellProps) => {
-        const formatter = (val: string) => {
-          const apiOnlyUser =
-            "api_only" in cellProps.row.original
-              ? cellProps.row.original.api_only
-              : false;
+        const apiOnlyUser =
+          "api_only" in cellProps.row.original
+            ? cellProps.row.original.api_only
+            : false;
 
-          return (
-            <>
-              {val}
-              {apiOnlyUser && (
-                <>
-                  <span
-                    className="team-users__api-only-user"
-                    data-tip
-                    data-for={`api-only-tooltip-${cellProps.row.original.id}`}
-                  >
-                    API
-                  </span>
-                  <ReactTooltip
-                    className="api-only-tooltip"
-                    place="top"
-                    type="dark"
-                    effect="solid"
-                    id={`api-only-tooltip-${cellProps.row.original.id}`}
-                    backgroundColor={COLORS["tooltip-bg"]}
-                    clickable
-                    delayHide={200} // need delay set to hover using clickable
-                  >
-                    <>
-                      This user was created using fleetctl and
-                      <br /> only has API access.{" "}
-                      <CustomLink
-                        text="Learn more"
-                        newTab
-                        url="https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user"
-                        iconColor="core-fleet-white"
-                      />
-                    </>
-                  </ReactTooltip>
-                </>
-              )}
-            </>
-          );
-        };
-
-        return <TextCell value={cellProps.cell.value} formatter={formatter} />;
+        return (
+          <TooltipTruncatedTextCell
+            value={cellProps.cell.value}
+            suffix={apiOnlyUser && renderApiUserIndicator()}
+          />
+        );
       },
     },
     {
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/_styles.scss b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/_styles.scss
index c8678711e4..33859efd1d 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/_styles.scss
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/_styles.scss
@@ -13,25 +13,17 @@
     .data-table__table {
       thead {
         .name__header {
-          width: $col-md;
+          width: initial; // Allows name to take up as much space on table as it can before truncating
         }
 
         .role__header {
-          width: $col-md;
-        }
-
-        .actions__header {
-          width: auto;
+          width: $col-sm;
         }
       }
 
       tbody {
-        .name__cell {
-          max-width: $col-md;
-        }
-
         .role__cell {
-          max-width: $col-md;
+          max-width: $col-sm;
         }
 
         .actions__cell {
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/_styles.scss b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/_styles.scss
index 77562956e0..c97ec284e8 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/_styles.scss
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/_styles.scss
@@ -26,6 +26,7 @@
     border-radius: 30px;
     margin-left: $pad-medium;
     padding: 4px 12px;
+    white-space: nowrap;
   }
 
   .react-tabs__tab-list {
@@ -39,4 +40,9 @@
       padding: 0;
     }
   }
+
+  .user-name-text {
+    text-overflow: ellipsis;
+    overflow: hidden;
+  }
 }
diff --git a/frontend/pages/admin/TeamManagementPage/_styles.scss b/frontend/pages/admin/TeamManagementPage/_styles.scss
index 32186ca753..e5f747039a 100644
--- a/frontend/pages/admin/TeamManagementPage/_styles.scss
+++ b/frontend/pages/admin/TeamManagementPage/_styles.scss
@@ -17,8 +17,16 @@
       }
 
       tbody {
-        .name__cell {
-          width: auto;
+        // Override data-table td max-width at low widths to fit screen
+        @media (max-width: ($break-md - 1)) {
+          .name__cell {
+            max-width: 430px;
+          }
+        }
+        @media (max-width: ($break-sm - 1)) {
+          .name__cell {
+            max-width: 330px;
+          }
         }
 
         .host_count__cell,
diff --git a/frontend/pages/admin/UserManagementPage/_styles.scss b/frontend/pages/admin/UserManagementPage/_styles.scss
index ae621f5b22..02a385a8cf 100644
--- a/frontend/pages/admin/UserManagementPage/_styles.scss
+++ b/frontend/pages/admin/UserManagementPage/_styles.scss
@@ -3,104 +3,108 @@
     @include grey-badge;
   }
 
-  thead {
-    // need specificity to override datatable css
-    th {
-      &.actions__header {
-        padding-left: 0;
-      }
-      &.status__header,
-      &.role__header {
-        width: 86px; // set to prevent expanding
-      }
-    }
-  }
-
-  tbody {
-    // need specificity to override datatable css
-    td.name__cell,
-    td.role__cell,
-    td.teams__cell,
-    td.status__cell,
-    td.email__cell {
-      max-width: $col-sm;
-      white-space: nowrap;
-    }
-
-    td.status__cell,
-    td.role__cell {
-      white-space: nowrap; // Prevent No access from wrapping
-    }
-
-    td.actions__cell {
-      padding-left: 0;
-    }
-  }
-
-  @media (min-width: ($break-lg)) {
-    .name__header,
-    .name__cell {
-      max-width: $col-md;
-    }
-  }
-
-  @media (max-width: ($break-sm - 1)) {
-    .email__header,
-    .email__cell {
-      display: none;
-      width: 0;
-    }
-  }
-
-  @media (max-width: ($break-xs - 1)) {
-    .status__header,
-    .status__cell {
-      display: none;
-      width: 0;
-    }
-  }
-
-  @media (max-width: ($break-mobile-md - 1)) {
-    .teams__header,
-    .teams__cell {
-      display: none;
-      width: 0;
-    }
-
-    // Splits header to 2 lines with user count on the first line
-    .table-container__header {
-      align-items: end;
-      &-left {
-        flex-direction: column;
-        width: initial;
-        align-items: start;
+  .data-table-block {
+    .data-table__table {
+      thead {
+        // need specificity to override datatable css
+        th {
+          &.actions__header {
+            padding-left: 0;
+          }
+          &.status__header,
+          &.role__header {
+            width: 86px; // set to prevent expanding
+          }
+        }
       }
 
-      .table-container__search {
-        width: 100%;
+      tbody {
+        // need specificity to override datatable css
+        td.name__cell,
+        td.role__cell,
+        td.teams__cell,
+        td.status__cell,
+        td.email__cell {
+          max-width: $col-sm;
+          white-space: nowrap;
+        }
+
+        td.status__cell,
+        td.role__cell {
+          white-space: nowrap; // Prevent No access from wrapping
+        }
+
+        td.actions__cell {
+          padding-left: 0;
+        }
       }
-    }
-  }
 
-  @media (max-width: ($break-mobile-sm - 1)) {
-    .role__header,
-    .role__cell {
-      display: none;
-      width: 0;
-    }
+      @media (min-width: ($break-lg)) {
+        .name__header,
+        .name__cell {
+          max-width: $col-md;
+        }
+      }
 
-    // Splits header to 3 lines; user count, wide add user button, wide search
-    .table-container__header {
-      flex-direction: column;
-      align-items: start;
-      width: 100%;
+      @media (max-width: ($break-sm - 1)) {
+        .email__header,
+        .email__cell {
+          display: none;
+          width: 0;
+        }
+      }
 
-      &-left {
-        width: 100%;
+      @media (max-width: ($break-xs - 1)) {
+        .status__header,
+        .status__cell {
+          display: none;
+          width: 0;
+        }
+      }
 
-        .controls,
-        .button {
+      @media (max-width: ($break-mobile-md - 1)) {
+        .teams__header,
+        .teams__cell {
+          display: none;
+          width: 0;
+        }
+
+        // Splits header to 2 lines with user count on the first line
+        .table-container__header {
+          align-items: end;
+          &-left {
+            flex-direction: column;
+            width: initial;
+            align-items: start;
+          }
+
+          .table-container__search {
+            width: 100%;
+          }
+        }
+      }
+
+      @media (max-width: ($break-mobile-sm - 1)) {
+        .role__header,
+        .role__cell {
+          display: none;
+          width: 0;
+        }
+
+        // Splits header to 3 lines; user count, wide add user button, wide search
+        .table-container__header {
+          flex-direction: column;
+          align-items: start;
           width: 100%;
+
+          &-left {
+            width: 100%;
+
+            .controls,
+            .button {
+              width: 100%;
+            }
+          }
         }
       }
     }
diff --git a/frontend/pages/admin/UserManagementPage/components/UsersTable/UsersTableConfig.tsx b/frontend/pages/admin/UserManagementPage/components/UsersTable/UsersTableConfig.tsx
index 6736927fb6..597d8d2fb8 100644
--- a/frontend/pages/admin/UserManagementPage/components/UsersTable/UsersTableConfig.tsx
+++ b/frontend/pages/admin/UserManagementPage/components/UsersTable/UsersTableConfig.tsx
@@ -1,17 +1,16 @@
 import React from "react";
 
-import ReactTooltip from "react-tooltip";
 import HeaderCell from "components/TableContainer/DataTable/HeaderCell/HeaderCell";
 import StatusIndicator from "components/StatusIndicator";
 import TextCell from "components/TableContainer/DataTable/TextCell/TextCell";
-import CustomLink from "components/CustomLink";
+import TooltipTruncatedTextCell from "components/TableContainer/DataTable/TooltipTruncatedTextCell";
 import TooltipWrapper from "components/TooltipWrapper";
 import { IInvite } from "interfaces/invite";
 import { IUser, UserRole } from "interfaces/user";
 import { IDropdownOption } from "interfaces/dropdownOption";
 import { generateRole, generateTeam, greyCell } from "utilities/helpers";
 import { DEFAULT_EMPTY_CELL_VALUE } from "utilities/constants";
-import { COLORS } from "styles/var/colors";
+import { renderApiUserIndicator } from "pages/admin/TeamManagementPage/TeamDetailsWrapper/UsersPage/UsersPageTableConfig";
 import ActionsDropdown from "../../../../../components/ActionsDropdown";
 
 interface IHeaderProps {
@@ -75,52 +74,17 @@ const generateTableHeaders = (
       disableSortBy: true,
       accessor: "name",
       Cell: (cellProps: ICellProps) => {
-        const formatter = (val: string) => {
-          const apiOnlyUser =
-            "api_only" in cellProps.row.original
-              ? cellProps.row.original.api_only
-              : false;
+        const apiOnlyUser =
+          "api_only" in cellProps.row.original
+            ? cellProps.row.original.api_only
+            : false;
 
-          return (
-            <>
-              {val}
-              {apiOnlyUser && (
-                <>
-                  <span
-                    className="user-management__api-only-user"
-                    data-tip
-                    data-for={`api-only-tooltip-${cellProps.row.original.id}`}
-                  >
-                    API
-                  </span>
-                  <ReactTooltip
-                    className="api-only-tooltip"
-                    place="top"
-                    type="dark"
-                    effect="solid"
-                    id={`api-only-tooltip-${cellProps.row.original.id}`}
-                    backgroundColor={COLORS["tooltip-bg"]}
-                    clickable
-                    delayHide={200} // need delay set to hover using clickable
-                  >
-                    <>
-                      This user was created using fleetctl and
-                      <br /> only has API access.{" "}
-                      <CustomLink
-                        text="Learn more"
-                        newTab
-                        url="https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user"
-                        iconColor="core-fleet-white"
-                      />
-                    </>
-                  </ReactTooltip>
-                </>
-              )}
-            </>
-          );
-        };
-
-        return <TextCell value={cellProps.cell.value} formatter={formatter} />;
+        return (
+          <TooltipTruncatedTextCell
+            value={cellProps.cell.value}
+            suffix={apiOnlyUser && renderApiUserIndicator()}
+          />
+        );
       },
     },
     {
diff --git a/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx b/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
index 0a86f4014f..2d35204b42 100644
--- a/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
+++ b/frontend/pages/hosts/ManageHostsPage/ManageHostsPage.tsx
@@ -149,13 +149,11 @@ const ManageHostsPage = ({
     isOnlyObserver,
     isPremiumTier,
     isFreeTier,
-    isSandboxMode,
     userSettings,
     setFilteredHostsPath,
     setFilteredPoliciesPath,
     setFilteredQueriesPath,
     setFilteredSoftwarePath,
-    setUserSettings,
   } = useContext(AppContext);
   const { renderFlash } = useContext(NotificationContext);
 
@@ -1563,7 +1561,6 @@ const ManageHostsPage = ({
         variant: "text-icon",
         iconSvg: "transfer",
         hideButton: !isPremiumTier || (!isGlobalAdmin && !isGlobalMaintainer),
-        indicatePremiumFeature: isPremiumTier && isSandboxMode,
       },
     ];
 
@@ -1704,7 +1701,7 @@ const ManageHostsPage = ({
           <div className={`${baseClass}__header-wrap`}>
             {renderHeader()}
             <div className={`${baseClass} button-wrap`}>
-              {!isSandboxMode && canEnrollHosts && !hasErrors && (
+              {canEnrollHosts && !hasErrors && (
                 <Button
                   onClick={() => setShowEnrollSecretModal(true)}
                   className={`${baseClass}__enroll-hosts button`}
diff --git a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
index 2347f7e33f..2b80885c14 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/components/DeviceUserBanners/DeviceUserBanners.tsx
@@ -88,8 +88,7 @@ const DeviceUserBanners = ({
               <CustomLink
                 url="https://fleetdm.com/learn-more-about/encrypt-linux-device"
                 text="Guide"
-                color="core-fleet-black"
-                iconColor="core-fleet-black"
+                variant="banner-link"
               />
             }
             color="yellow"
diff --git a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
index cc1b6a73f6..0488f34a60 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/components/HostDetailsBanners/HostDetailsBanners.tsx
@@ -124,8 +124,7 @@ const HostDetailsBanners = ({
               <CustomLink
                 url={`${LEARN_MORE_ABOUT_BASE_LINK}/mdm-disk-encryption`}
                 text="Guide"
-                color="core-fleet-black"
-                iconColor="core-fleet-black"
+                variant="banner-link"
                 newTab
               />
             }
diff --git a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx
index ef9626bea3..1fcc3c00fa 100644
--- a/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx
+++ b/frontend/pages/hosts/details/OSSettingsModal/OSSettingsTable/OSSettingsErrorCell/OSSettingsErrorCell.tsx
@@ -104,7 +104,7 @@ const generateErrorTooltip = (
           text="Learn more"
           url="https://fleetdm.com/learn-more-about/idp-email"
           newTab
-          iconColor="core-fleet-white"
+          variant="tooltip-link"
         />
       </>
     );

From d690997f262e937100c8252fda94e91da919e28e Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Wed, 26 Feb 2025 15:01:04 -0500
Subject: [PATCH 02/15] Disk encryption guide: using the key (#25633)

Windows instructions (comment
[here](https://github.com/fleetdm/fleet/pull/25633#issuecomment-2682320481))
will be in a separate PR because they still need to be tested. Let's
merge this PR before opening the separate PR for Windows.
---
 articles/enforce-disk-encryption.md | 30 +++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/articles/enforce-disk-encryption.md b/articles/enforce-disk-encryption.md
index c178b2fa87..fbd6c4e6f9 100644
--- a/articles/enforce-disk-encryption.md
+++ b/articles/enforce-disk-encryption.md
@@ -74,6 +74,36 @@ How to view the disk encryption key:
 
 > The disk encryption key is deleted if a host is transferred to a team with disk encryption turned off. To re-escrow they key, transfer the host back to a team with disk encryption on.
 
+## Use disk encryption key to login
+
+Disk encryption keys are used to login to workstations (hosts) when the end user forgets their password or when the host is returned to the organization after an end user leaves. 
+
+### macOS
+
+1. With the macOS host in front of you, restart the host and select the end user's account.
+
+2. Select the question mark icon **(?)** next to the password field and select **Restart and show password reset options**. If you don't see the **(?)** icon, try entering any incorrect password several times.
+
+3. Follow the instructions on the Mac to enter the disk encryption (recovery) key.
+
+### Linux 
+
+1. With the Linux host in front of you, restart it.
+
+2. When prompted to unlock the disk, enter the disk encryption key.
+
+3. On the **Host details** page in Fleet, find the local user's username in the **Users** table.
+
+4. Next, add the following script to Fleet (deletes the local password (passphrase)):
+
+```
+passwd -d <username>
+```
+
+5. Head back to the **Host details** page and select **Actions > Run script** to run the script.
+
+#### 
+
 ## Migrate macOS hosts
 
 When migrating macOS hosts from another MDM solution, in order to complete the process of encrypting the hard drive and escrowing the key in Fleet, your end users must log out or restart their Mac.

From 124fc44a3e4b946ea6383bb299563a40b0bbd537 Mon Sep 17 00:00:00 2001
From: Konstantin Sykulev <konst@sykulev.com>
Date: Wed, 26 Feb 2025 14:15:41 -0600
Subject: [PATCH 03/15] Updated python_packages osquery query (#26434)

A new feature in osquery `5.16` was created to allow for scanning of
user directories for python packages. If the new version of osquery is
detected use the new query, otherwise use the old query.

https://github.com/fleetdm/fleet/issues/26423

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
---
 .../Contributing/Understanding-host-vitals.md | 88 +++++++++++--------
 server/service/osquery.go                     |  5 ++
 server/service/osquery_test.go                | 85 +++++++++++++++---
 server/service/osquery_utils/queries.go       | 76 ++++++++--------
 server/service/osquery_utils/queries_test.go  |  2 +-
 5 files changed, 175 insertions(+), 81 deletions(-)

diff --git a/docs/Contributing/Understanding-host-vitals.md b/docs/Contributing/Understanding-host-vitals.md
index f4b6a1d362..dac415ef07 100644
--- a/docs/Contributing/Understanding-host-vitals.md
+++ b/docs/Contributing/Understanding-host-vitals.md
@@ -567,19 +567,7 @@ SELECT
   '' AS vendor,
   '' AS arch,
   path AS installed_path
-FROM cached_users CROSS JOIN firefox_addons USING (uid)
-UNION
-SELECT
-  name AS name,
-  version AS version,
-  '' AS extension_id,
-  '' AS browser,
-  'python_packages' AS source,
-  '' AS release,
-  '' AS vendor,
-  '' AS arch,
-  path AS installed_path
-FROM python_packages;
+FROM cached_users CROSS JOIN firefox_addons USING (uid);
 ```
 
 ## software_macos
@@ -604,18 +592,6 @@ SELECT
   path AS installed_path
 FROM apps
 UNION
-SELECT
-  name AS name,
-  version AS version,
-  '' AS bundle_identifier,
-  '' AS extension_id,
-  '' AS browser,
-  'python_packages' AS source,
-  '' AS vendor,
-  0 AS last_opened_at,
-  path AS installed_path
-FROM python_packages
-UNION
 SELECT
   name AS name,
   version AS version,
@@ -740,6 +716,58 @@ WITH app_paths AS (
 			WHERE apps.bundle_identifier = 'org.mozilla.firefox'
 ```
 
+## software_python_packages
+
+- Description: Prior to osquery version 5.16.0, the python_packages table did not search user directories.
+
+- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
+
+- Discovery query:
+```sql
+SELECT 1 FROM osquery_info WHERE version_compare(version, '5.16.0') < 0
+```
+
+- Query:
+```sql
+SELECT
+		  name AS name,
+		  version AS version,
+		  '' AS extension_id,
+		  '' AS browser,
+		  'python_packages' AS source,
+		  '' AS vendor,
+		  path AS installed_path
+		FROM python_packages
+```
+
+## software_python_packages_with_users_dir
+
+- Description: As of osquery version 5.16.0, the python_packages table searches user directories with support from a cross join on users. See https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table.
+
+- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
+
+- Discovery query:
+```sql
+SELECT 1 FROM osquery_info WHERE version_compare(version, '5.16.0') >= 0
+```
+
+- Query:
+```sql
+WITH cached_users AS (WITH cached_groups AS (select * from groups)
+ SELECT uid, username, type, groupname, shell
+ FROM users LEFT JOIN cached_groups USING (gid)
+ WHERE type <> 'special' AND shell NOT LIKE '%/false' AND shell NOT LIKE '%/nologin' AND shell NOT LIKE '%/shutdown' AND shell NOT LIKE '%/halt' AND username NOT LIKE '%$' AND username NOT LIKE '\_%' ESCAPE '\' AND NOT (username = 'sync' AND shell ='/bin/sync' AND directory <> ''))
+		SELECT
+		  name AS name,
+		  version AS version,
+		  '' AS extension_id,
+		  '' AS browser,
+		  'python_packages' AS source,
+		  '' AS vendor,
+		  path AS installed_path
+		FROM cached_users CROSS JOIN python_packages USING (uid)
+```
+
 ## software_vscode_extensions
 
 - Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
@@ -788,16 +816,6 @@ SELECT
   install_location AS installed_path
 FROM programs
 UNION
-SELECT
-  name AS name,
-  version AS version,
-  '' AS extension_id,
-  '' AS browser,
-  'python_packages' AS source,
-  '' AS vendor,
-  path AS installed_path
-FROM python_packages
-UNION
 SELECT
   name AS name,
   version AS version,
diff --git a/server/service/osquery.go b/server/service/osquery.go
index ec9848d467..5df874a6e0 100644
--- a/server/service/osquery.go
+++ b/server/service/osquery.go
@@ -1224,6 +1224,11 @@ func preProcessSoftwareResults(
 	vsCodeExtensionsExtraQuery := hostDetailQueryPrefix + "software_vscode_extensions"
 	preProcessSoftwareExtraResults(vsCodeExtensionsExtraQuery, host.ID, results, statuses, messages, osquery_utils.DetailQuery{}, logger)
 
+	pythonPackagesExtraQuery := hostDetailQueryPrefix + "software_python_packages"
+	preProcessSoftwareExtraResults(pythonPackagesExtraQuery, host.ID, results, statuses, messages, osquery_utils.DetailQuery{}, logger)
+	pythonPakcagesWithUsersExtraQuery := hostDetailQueryPrefix + "software_python_packages_with_users_dir"
+	preProcessSoftwareExtraResults(pythonPakcagesWithUsersExtraQuery, host.ID, results, statuses, messages, osquery_utils.DetailQuery{}, logger)
+
 	for name, query := range overrides {
 		fullQueryName := hostDetailQueryPrefix + "software_" + name
 		preProcessSoftwareExtraResults(fullQueryName, host.ID, results, statuses, messages, query, logger)
diff --git a/server/service/osquery_test.go b/server/service/osquery_test.go
index b8dfbbc636..15f389ddb2 100644
--- a/server/service/osquery_test.go
+++ b/server/service/osquery_test.go
@@ -1080,16 +1080,18 @@ func verifyDiscovery(t *testing.T, queries, discovery map[string]string) {
 	assert.Equal(t, len(queries), len(discovery))
 	// discoveryUsed holds the queries where we know use the distributed discovery feature.
 	discoveryUsed := map[string]struct{}{
-		hostDetailQueryPrefix + "google_chrome_profiles":     {},
-		hostDetailQueryPrefix + "mdm":                        {},
-		hostDetailQueryPrefix + "munki_info":                 {},
-		hostDetailQueryPrefix + "windows_update_history":     {},
-		hostDetailQueryPrefix + "kubequery_info":             {},
-		hostDetailQueryPrefix + "orbit_info":                 {},
-		hostDetailQueryPrefix + "software_vscode_extensions": {},
-		hostDetailQueryPrefix + "software_macos_firefox":     {},
-		hostDetailQueryPrefix + "battery":                    {},
-		hostDetailQueryPrefix + "software_macos_codesign":    {},
+		hostDetailQueryPrefix + "google_chrome_profiles":                  {},
+		hostDetailQueryPrefix + "mdm":                                     {},
+		hostDetailQueryPrefix + "munki_info":                              {},
+		hostDetailQueryPrefix + "windows_update_history":                  {},
+		hostDetailQueryPrefix + "kubequery_info":                          {},
+		hostDetailQueryPrefix + "orbit_info":                              {},
+		hostDetailQueryPrefix + "software_vscode_extensions":              {},
+		hostDetailQueryPrefix + "software_python_packages":                {},
+		hostDetailQueryPrefix + "software_python_packages_with_users_dir": {},
+		hostDetailQueryPrefix + "software_macos_firefox":                  {},
+		hostDetailQueryPrefix + "battery":                                 {},
+		hostDetailQueryPrefix + "software_macos_codesign":                 {},
 	}
 	for name := range queries {
 		require.NotEmpty(t, discovery[name])
@@ -3709,6 +3711,25 @@ func TestPreProcessSoftwareResults(t *testing.T) {
 		"installed_path":    "/some/override/path",
 	}
 
+	pythonPackageOne := map[string]string{
+		"name":           "cryptography",
+		"version":        "41.0.7",
+		"extension_id":   "",
+		"browser":        "",
+		"source":         "python_packages",
+		"vendor":         "",
+		"installed_path": "/usr/lib/python3/dist-packages",
+	}
+	pythonPackageTwo := map[string]string{
+		"name":           "pip",
+		"version":        "25.0.1",
+		"extension_id":   "",
+		"browser":        "",
+		"source":         "python_packages",
+		"vendor":         "",
+		"installed_path": "/Users/fleetdm/.pyenv/versions/3.13.1/lib/python3.13/site-packages",
+	}
+
 	for _, tc := range []struct {
 		name       string
 		host       *fleet.Host
@@ -3719,6 +3740,50 @@ func TestPreProcessSoftwareResults(t *testing.T) {
 
 		resultsOut fleet.OsqueryDistributedQueryResults
 	}{
+		{
+			name: "python packages using original query in extras adds results",
+
+			statusesIn: map[string]fleet.OsqueryStatus{
+				hostDetailQueryPrefix + "software_macos":           fleet.StatusOK,
+				hostDetailQueryPrefix + "software_python_packages": fleet.StatusOK,
+			},
+			resultsIn: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_macos": []map[string]string{
+					foobarApp,
+				},
+				hostDetailQueryPrefix + "software_python_packages": []map[string]string{
+					pythonPackageOne,
+				},
+			},
+			resultsOut: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_macos": []map[string]string{
+					foobarApp,
+					pythonPackageOne,
+				},
+			},
+		},
+		{
+			name: "python packages using user query in extras adds results",
+
+			statusesIn: map[string]fleet.OsqueryStatus{
+				hostDetailQueryPrefix + "software_macos":                          fleet.StatusOK,
+				hostDetailQueryPrefix + "software_python_packages_with_users_dir": fleet.StatusOK,
+			},
+			resultsIn: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_macos": []map[string]string{
+					foobarApp,
+				},
+				hostDetailQueryPrefix + "software_python_packages_with_users_dir": []map[string]string{
+					pythonPackageTwo,
+				},
+			},
+			resultsOut: fleet.OsqueryDistributedQueryResults{
+				hostDetailQueryPrefix + "software_macos": []map[string]string{
+					foobarApp,
+					pythonPackageTwo,
+				},
+			},
+		},
 		{
 			name: "software query works and there are vs code extensions in extra",
 
diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go
index 5eebde8067..3bbae325b9 100644
--- a/server/service/osquery_utils/queries.go
+++ b/server/service/osquery_utils/queries.go
@@ -840,18 +840,6 @@ SELECT
   path AS installed_path
 FROM apps
 UNION
-SELECT
-  name AS name,
-  version AS version,
-  '' AS bundle_identifier,
-  '' AS extension_id,
-  '' AS browser,
-  'python_packages' AS source,
-  '' AS vendor,
-  0 AS last_opened_at,
-  path AS installed_path
-FROM python_packages
-UNION
 SELECT
   name AS name,
   version AS version,
@@ -1024,19 +1012,7 @@ SELECT
   '' AS vendor,
   '' AS arch,
   path AS installed_path
-FROM cached_users CROSS JOIN firefox_addons USING (uid)
-UNION
-SELECT
-  name AS name,
-  version AS version,
-  '' AS extension_id,
-  '' AS browser,
-  'python_packages' AS source,
-  '' AS release,
-  '' AS vendor,
-  '' AS arch,
-  path AS installed_path
-FROM python_packages;
+FROM cached_users CROSS JOIN firefox_addons USING (uid);
 `),
 	Platforms:        fleet.HostLinuxOSs,
 	DirectIngestFunc: directIngestSoftware,
@@ -1054,16 +1030,6 @@ SELECT
   install_location AS installed_path
 FROM programs
 UNION
-SELECT
-  name AS name,
-  version AS version,
-  '' AS extension_id,
-  '' AS browser,
-  'python_packages' AS source,
-  '' AS vendor,
-  path AS installed_path
-FROM python_packages
-UNION
 SELECT
   name AS name,
   version AS version,
@@ -1108,6 +1074,44 @@ FROM chocolatey_packages
 	DirectIngestFunc: directIngestSoftware,
 }
 
+// In osquery versions < 5.16.0 use the original python_packages query, as the cross join on
+// users is not supported
+var softwarePythonPackages = DetailQuery{
+	Description: "Prior to osquery version 5.16.0, the python_packages table did not search user directories.",
+	Query: `
+		SELECT
+		  name AS name,
+		  version AS version,
+		  '' AS extension_id,
+		  '' AS browser,
+		  'python_packages' AS source,
+		  '' AS vendor,
+		  path AS installed_path
+		FROM python_packages
+	`,
+	Platforms: append(fleet.HostLinuxOSs, "darwin", "windows"),
+	Discovery: `SELECT 1 FROM osquery_info WHERE version_compare(version, '5.16.0') < 0`,
+}
+
+// In osquery versions >= 5.16.0 the python_packages table was modified to allow for a
+// cross join on users so that user directories could be searched for python packages
+var softwarePythonPackagesWithUsersDir = DetailQuery{
+	Description: "As of osquery version 5.16.0, the python_packages table searches user directories with support from a cross join on users. See https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table.",
+	Query: withCachedUsers(`WITH cached_users AS (%s)
+		SELECT
+		  name AS name,
+		  version AS version,
+		  '' AS extension_id,
+		  '' AS browser,
+		  'python_packages' AS source,
+		  '' AS vendor,
+		  path AS installed_path
+		FROM cached_users CROSS JOIN python_packages USING (uid)
+	`),
+	Platforms: append(fleet.HostLinuxOSs, "darwin", "windows"),
+	Discovery: `SELECT 1 FROM osquery_info WHERE version_compare(version, '5.16.0') >= 0`,
+}
+
 var softwareChrome = DetailQuery{
 	Query: `SELECT
   name AS name,
@@ -2244,6 +2248,8 @@ func GetDetailQueries(
 		generatedMap["software_linux"] = softwareLinux
 		generatedMap["software_windows"] = softwareWindows
 		generatedMap["software_chrome"] = softwareChrome
+		generatedMap["software_python_packages"] = softwarePythonPackages
+		generatedMap["software_python_packages_with_users_dir"] = softwarePythonPackagesWithUsersDir
 		generatedMap["software_vscode_extensions"] = softwareVSCodeExtensions
 
 		for key, query := range SoftwareOverrideQueries {
diff --git a/server/service/osquery_utils/queries_test.go b/server/service/osquery_utils/queries_test.go
index e461b2033d..1a74e3a267 100644
--- a/server/service/osquery_utils/queries_test.go
+++ b/server/service/osquery_utils/queries_test.go
@@ -307,7 +307,7 @@ func TestGetDetailQueries(t *testing.T) {
 	queriesWithUsersAndSoftware := GetDetailQueries(context.Background(), config.FleetConfig{App: config.AppConfig{EnableScheduledQueryStats: true}}, nil, &fleet.Features{EnableHostUsers: true, EnableSoftwareInventory: true})
 	qs = baseQueries
 	qs = append(qs, "users", "users_chrome", "software_macos", "software_linux", "software_windows", "software_vscode_extensions",
-		"software_chrome", "scheduled_query_stats", "software_macos_firefox", "software_macos_codesign")
+		"software_chrome", "software_python_packages", "software_python_packages_with_users_dir", "scheduled_query_stats", "software_macos_firefox", "software_macos_codesign")
 	require.Len(t, queriesWithUsersAndSoftware, len(qs))
 	sortedKeysCompare(t, queriesWithUsersAndSoftware, qs)
 

From 8a531a65d4ef4cdc84f6f31344e48dd02ee42880 Mon Sep 17 00:00:00 2001
From: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Date: Wed, 26 Feb 2025 16:00:54 -0500
Subject: [PATCH 04/15] Fleet UI: Move learn more link for auto install warning
 (#26629)

---
 .../SoftwareOptionsSelector.tsx               | 18 ++--
 .../FleetMaintainedAppDetailsPage.tsx         | 43 ---------
 frontend/pages/SoftwarePage/helpers.tsx       | 91 -------------------
 3 files changed, 7 insertions(+), 145 deletions(-)

diff --git a/frontend/components/SoftwareOptionsSelector/SoftwareOptionsSelector.tsx b/frontend/components/SoftwareOptionsSelector/SoftwareOptionsSelector.tsx
index d918ba66e0..16fee60c94 100644
--- a/frontend/components/SoftwareOptionsSelector/SoftwareOptionsSelector.tsx
+++ b/frontend/components/SoftwareOptionsSelector/SoftwareOptionsSelector.tsx
@@ -84,19 +84,15 @@ const SoftwareOptionsSelector = ({
         </Checkbox>
       )}
       {formData.automaticInstall && isCustomPackage && (
-        <InfoBanner
-          color="yellow"
-          cta={
-            <CustomLink
-              url={`${LEARN_MORE_ABOUT_BASE_LINK}/query-templates-for-automatic-software-install`}
-              text="Learn more"
-              newTab
-            />
-          }
-        >
+        <InfoBanner color="yellow">
           Installing software over existing installations might cause issues.
           Fleet&apos;s policy may not detect these existing installations.
-          Please create a test team in Fleet to verify a smooth installation.
+          Please create a test team in Fleet to verify a smooth installation.{" "}
+          <CustomLink
+            url={`${LEARN_MORE_ABOUT_BASE_LINK}/query-templates-for-automatic-software-install`}
+            text="Learn more"
+            newTab
+          />
         </InfoBanner>
       )}
     </div>
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
index 9b4f3ddf21..0d351168a2 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
@@ -9,7 +9,6 @@ import PATHS from "router/paths";
 import { buildQueryStringFromParams } from "utilities/url";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import softwareAPI from "services/entities/software";
-import teamPoliciesAPI from "services/entities/team_policies";
 import labelsAPI, { getCustomLabels } from "services/entities/labels";
 import { QueryContext } from "context/query";
 import { AppContext } from "context/app";
@@ -218,11 +217,7 @@ const FleetMaintainedAppDetailsPage = ({
           <b>{fleetApp?.name}</b> successfully added.
         </>
       );
-      // }
     } catch (error) {
-      // quick exit if there was an error adding the software. Skip the policy
-      // creation.
-
       const ae = (typeof error === "object" ? error : {}) as AxiosResponse;
 
       const errorMessage = getErrorMessage(ae);
@@ -237,46 +232,8 @@ const FleetMaintainedAppDetailsPage = ({
       } else {
         renderFlash("error", DEFAULT_ERROR_MESSAGE);
       }
-
-      setShowAddFleetAppSoftwareModal(false);
-      return;
     }
 
-    // If the install type is automatic we now need to create the new policy.
-    // if (installType === "automatic" && fleetApp) {
-    //   try {
-    //     await teamPoliciesAPI.create({
-    //       name: getFleetAppPolicyName(fleetApp.name),
-    //       description: getFleetAppPolicyDescription(fleetApp.name),
-    //       query: getFleetAppPolicyQuery(fleetApp.name),
-    //       team_id: parseInt(teamId, 10),
-    //       software_title_id: titleId,
-    //       platform: "darwin",
-    //     });
-
-    //     renderFlash(
-    //       "success",
-    //       <>
-    //         <b>{fleetApp?.name}</b> successfully added.
-    //       </>,
-    //       { persistOnPageChange: true }
-    //     );
-    //   } catch (e) {
-    //     renderFlash("error", AUTOMATIC_POLICY_ERROR_MESSAGE, {
-    //       persistOnPageChange: true,
-    //     });
-    //   }
-
-    //   // for automatic install we redirect on both a successful and error policy
-    //   // add because the software was already successfuly added.
-    //   router.push(
-    //     `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams({
-    //       team_id: teamId,
-    //       available_for_install: true,
-    //     })}`
-    //   );
-    // }
-
     setShowAddFleetAppSoftwareModal(false);
   };
 
diff --git a/frontend/pages/SoftwarePage/helpers.tsx b/frontend/pages/SoftwarePage/helpers.tsx
index 044b041849..5ff3b39b3b 100644
--- a/frontend/pages/SoftwarePage/helpers.tsx
+++ b/frontend/pages/SoftwarePage/helpers.tsx
@@ -64,97 +64,6 @@ export const generateSecretErrMsg = (err: unknown) => {
 /** Corresponds to automatic_install_policies  */
 export type InstallType = "manual" | "automatic";
 
-interface IInstallTypeSection {
-  className: string;
-  installType: InstallType;
-  onChangeInstallType: (value: string) => void;
-  isCustomPackage?: boolean;
-  isExeCustomPackage?: boolean;
-}
-
-// Used in FleetAppDetailsForm and PackageForm
-export const InstallTypeSection = ({
-  className,
-  installType,
-  onChangeInstallType,
-  isCustomPackage = false,
-  isExeCustomPackage = false,
-}: IInstallTypeSection) => {
-  const isAutomaticDisabled = isExeCustomPackage;
-  const AUTOMATIC_DISABLED_TOOLTIP = (
-    <>
-      Fleet can&apos;t create a policy to detect existing installations for
-      <br /> .exe packages. To automatically install an .exe, add a custom
-      <br /> policy and enable the install software automation on the
-      <br /> <b>Policies</b> page.
-    </>
-  );
-
-  return (
-    <fieldset>
-      <legend>Install</legend>
-      <div className={`${className}__radio-input`}>
-        <Radio
-          checked={installType === "manual"}
-          id="manual-radio-btn"
-          value="manual"
-          name="install-type"
-          label="Manual"
-          onChange={onChangeInstallType}
-          helpText={
-            <>
-              Manually install on the <b>Host details</b> page for each host.
-            </>
-          }
-        />
-        <Radio
-          checked={installType === "automatic"}
-          id="automatic-radio-btn"
-          value="automatic"
-          name="install-type"
-          label="Automatic"
-          disabled={isAutomaticDisabled}
-          tooltip={isAutomaticDisabled && AUTOMATIC_DISABLED_TOOLTIP}
-          onChange={onChangeInstallType}
-          helpText={
-            <>
-              Automatically install on each host that&apos;s{" "}
-              <TooltipWrapper
-                tipContent={
-                  <>
-                    If the host already has any version of this
-                    <br /> software, it won&apos;t be installed.
-                  </>
-                }
-              >
-                missing this software
-              </TooltipWrapper>
-              . Policy that triggers install can be customized after software is
-              added.
-            </>
-          }
-        />
-      </div>
-      {installType === "automatic" && isCustomPackage && (
-        <InfoBanner
-          color="yellow"
-          cta={
-            <CustomLink
-              url={`${LEARN_MORE_ABOUT_BASE_LINK}/query-templates-for-automatic-software-install`}
-              text="Learn more"
-              newTab
-            />
-          }
-        >
-          Installing software over existing installations might cause issues.
-          Fleet&apos;s policy may not detect these existing installations.
-          Please create a test team in Fleet to verify a smooth installation.
-        </InfoBanner>
-      )}
-    </fieldset>
-  );
-};
-
 export const getInstallType = (
   softwarePackage: ISoftwarePackage
 ): InstallType => {

From 8c7a543571b1dda93e5f9b580a14d04e3e7a43c5 Mon Sep 17 00:00:00 2001
From: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Date: Wed, 26 Feb 2025 16:07:59 -0500
Subject: [PATCH 05/15] Fleet UI: Hide more options button when at larger
 widths (#26632)

---
 frontend/components/buttons/ActionButtons/_styles.scss | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/frontend/components/buttons/ActionButtons/_styles.scss b/frontend/components/buttons/ActionButtons/_styles.scss
index 3c9a41fbda..7842642d26 100644
--- a/frontend/components/buttons/ActionButtons/_styles.scss
+++ b/frontend/components/buttons/ActionButtons/_styles.scss
@@ -35,5 +35,9 @@
         }
       }
     }
+
+    @media (min-width: $break-md) {
+      display: none;
+    }
   }
 }

From a0158af6d868ebf2d9fb80a5662860d73121e2c2 Mon Sep 17 00:00:00 2001
From: Victor Lyuboslavsky <victor.lyuboslavsky@gmail.com>
Date: Wed, 26 Feb 2025 16:20:02 -0600
Subject: [PATCH 06/15] Add SSE endpoint (#26596)

For #26218

- Added `GET /api/_version_/fleet/android_enterprise/signup_sse`
endpoint and tests
- Fixed up handling of Android status reports with a deleted device. We
don't actually expect this to happen in production since the proxy
should delete the pubSub connection when the enterprise is deleted.

# Checklist for submitter

- [x] Added/updated automated tests
- [x] Manual QA for all new/changed functionality
---
 cmd/fleet/serve.go                            |   9 ++
 server/authz/policy.rego                      |   2 +-
 server/mdm/android/pubsub.go                  |  16 ++-
 server/mdm/android/service.go                 |   1 +
 .../mdm/android/service/enterprises_test.go   |   6 +
 server/mdm/android/service/handler.go         |   1 +
 server/mdm/android/service/pubsub.go          |  32 +++--
 server/mdm/android/service/service.go         | 114 ++++++++++++++++--
 .../tests/enterprise/enterprise_test.go       |  55 +++++++++
 server/mdm/android/tests/testing_utils.go     |  28 +++--
 10 files changed, 234 insertions(+), 30 deletions(-)

diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index a98ebd05ec..b50e6ba0bd 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -1234,6 +1234,15 @@ the way that the Fleet server works.
 					}
 					req.Body = http.MaxBytesReader(rw, req.Body, fleet.MaxSoftwareInstallerSize)
 				}
+
+				if req.Method == http.MethodGet && strings.HasSuffix(req.URL.Path, "/fleet/android_enterprise/signup_sse") {
+					// When enabling Android MDM, frontend UI will wait for the admin to finish the setup in Google.
+					rc := http.NewResponseController(rw)
+					if err := rc.SetWriteDeadline(time.Now().Add(30 * time.Minute)); err != nil {
+						level.Error(logger).Log("msg", "http middleware failed to override endpoint write timeout", "err", err)
+					}
+				}
+
 				apiHandler.ServeHTTP(rw, req)
 			})
 
diff --git a/server/authz/policy.rego b/server/authz/policy.rego
index 937c73d279..55096ded00 100644
--- a/server/authz/policy.rego
+++ b/server/authz/policy.rego
@@ -1023,7 +1023,7 @@ allow {
 ##
 # Android
 ##
-# Global admins can connect enteprise.
+# Global admins can connect enterprise.
 allow {
   object.type == "android_enterprise"
   subject.global_role == admin
diff --git a/server/mdm/android/pubsub.go b/server/mdm/android/pubsub.go
index 998c7fd145..c2c188640d 100644
--- a/server/mdm/android/pubsub.go
+++ b/server/mdm/android/pubsub.go
@@ -1,10 +1,18 @@
 package android
 
+type NotificationType string
+
 const (
-	PubSubEnrollment   = "ENROLLMENT"
-	PubSubStatusReport = "STATUS_REPORT"
-	PubSubCommand      = "COMMAND"
-	PubSubUsageLogs    = "USAGE_LOGS"
+	PubSubEnrollment   NotificationType = "ENROLLMENT"
+	PubSubStatusReport NotificationType = "STATUS_REPORT"
+	PubSubCommand      NotificationType = "COMMAND"
+	PubSubUsageLogs    NotificationType = "USAGE_LOGS"
+)
+
+type DeviceState string
+
+const (
+	DeviceStateDeleted DeviceState = "DELETED"
 )
 
 type PubSubMessage struct {
diff --git a/server/mdm/android/service.go b/server/mdm/android/service.go
index 6583c4762a..72a2657e14 100644
--- a/server/mdm/android/service.go
+++ b/server/mdm/android/service.go
@@ -9,6 +9,7 @@ type Service interface {
 	EnterpriseSignupCallback(ctx context.Context, enterpriseID uint, enterpriseToken string) error
 	GetEnterprise(ctx context.Context) (*Enterprise, error)
 	DeleteEnterprise(ctx context.Context) error
+	EnterpriseSignupSSE(ctx context.Context) (chan string, error)
 
 	// CreateEnrollmentToken creates an enrollment token for a new Android device.
 	CreateEnrollmentToken(ctx context.Context, enrollSecret string) (*EnrollmentToken, error)
diff --git a/server/mdm/android/service/enterprises_test.go b/server/mdm/android/service/enterprises_test.go
index 9a99ed730c..24a8c830d9 100644
--- a/server/mdm/android/service/enterprises_test.go
+++ b/server/mdm/android/service/enterprises_test.go
@@ -97,6 +97,12 @@ func TestEnterprisesAuth(t *testing.T) {
 
 			_, err = svc.EnterpriseSignup(ctx)
 			checkAuthErr(t, tt.shouldFailWrite, err)
+
+			ctx, cancel := context.WithCancel(ctx)
+			defer cancel()
+			_, err = svc.EnterpriseSignupSSE(ctx)
+			checkAuthErr(t, tt.shouldFailRead, err)
+
 		})
 	}
 
diff --git a/server/mdm/android/service/handler.go b/server/mdm/android/service/handler.go
index a5accf6340..9ede251100 100644
--- a/server/mdm/android/service/handler.go
+++ b/server/mdm/android/service/handler.go
@@ -25,6 +25,7 @@ func attachFleetAPIRoutes(r *mux.Router, fleetSvc fleet.Service, svc android.Ser
 	ue.GET("/api/_version_/fleet/android_enterprise/signup_url", enterpriseSignupEndpoint, nil)
 	ue.GET("/api/_version_/fleet/android_enterprise", getEnterpriseEndpoint, nil)
 	ue.DELETE("/api/_version_/fleet/android_enterprise", deleteEnterpriseEndpoint, nil)
+	ue.GET("/api/_version_/fleet/android_enterprise/signup_sse", enterpriseSSE, nil)
 
 	// //////////////////////////////////////////
 	// Unauthenticated endpoints
diff --git a/server/mdm/android/service/pubsub.go b/server/mdm/android/service/pubsub.go
index 7e710d2031..0a5a497bec 100644
--- a/server/mdm/android/service/pubsub.go
+++ b/server/mdm/android/service/pubsub.go
@@ -50,7 +50,7 @@ func (svc *Service) ProcessPubSubPush(ctx context.Context, token string, message
 		}
 	}
 
-	switch notificationType {
+	switch android.NotificationType(notificationType) {
 	case android.PubSubEnrollment:
 		var device androidmanagement.Device
 		err := json.Unmarshal(rawData, &device)
@@ -59,6 +59,7 @@ func (svc *Service) ProcessPubSubPush(ctx context.Context, token string, message
 		}
 		err = svc.enrollHost(ctx, &device)
 		if err != nil {
+			level.Debug(svc.logger).Log("msg", "Error enrolling Android host", "data", rawData)
 			return ctxerr.Wrap(ctx, err, "enrolling Android host")
 		}
 	case android.PubSubStatusReport:
@@ -67,6 +68,11 @@ func (svc *Service) ProcessPubSubPush(ctx context.Context, token string, message
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "unmarshal Android status report message")
 		}
+		if device.AppliedState == string(android.DeviceStateDeleted) {
+			level.Debug(svc.logger).Log("msg", "Android device deleted from MDM", "device.name", device.Name,
+				"device.enterpriseSpecificId", device.HardwareInfo.EnterpriseSpecificId)
+			return nil
+		}
 		host, err := svc.getExistingHost(ctx, &device)
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "getting existing Android host")
@@ -77,11 +83,13 @@ func (svc *Service) ProcessPubSubPush(ctx context.Context, token string, message
 				"device.enterpriseSpecificId", device.HardwareInfo.EnterpriseSpecificId)
 			err = svc.enrollHost(ctx, &device)
 			if err != nil {
+				level.Debug(svc.logger).Log("msg", "Error re-enrolling Android host", "data", rawData)
 				return ctxerr.Wrap(ctx, err, "re-enrolling deleted Android host")
 			}
 		}
 		err = svc.updateHost(ctx, &device, host)
 		if err != nil {
+			level.Debug(svc.logger).Log("msg", "Error updating Android host", "data", rawData)
 			return ctxerr.Wrap(ctx, err, "enrolling Android host")
 		}
 	}
@@ -138,6 +146,10 @@ func (svc *Service) validateDevice(ctx context.Context, device *androidmanagemen
 }
 
 func (svc *Service) updateHost(ctx context.Context, device *androidmanagement.Device, host *fleet.AndroidHost) error {
+	err := svc.validateDevice(ctx, device)
+	if err != nil {
+		return err
+	}
 	if device.AppliedPolicyName != "" {
 		policy, err := svc.getPolicyID(ctx, device)
 		if err != nil {
@@ -147,7 +159,7 @@ func (svc *Service) updateHost(ctx context.Context, device *androidmanagement.De
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "parsing Android policy sync time")
 		}
-		host.Device.AndroidPolicyID = ptr.Uint(policy)
+		host.Device.AndroidPolicyID = policy
 		host.Device.LastPolicySyncTime = ptr.Time(policySyncTime)
 	}
 
@@ -216,7 +228,7 @@ func (svc *Service) addNewHost(ctx context.Context, device *androidmanagement.De
 		if err != nil {
 			return ctxerr.Wrap(ctx, err, "parsing Android policy sync time")
 		}
-		host.Device.AndroidPolicyID = ptr.Uint(policy)
+		host.Device.AndroidPolicyID = policy
 		host.Device.LastPolicySyncTime = ptr.Time(policySyncTime)
 	}
 	host.SetNodeKey(device.HardwareInfo.EnterpriseSpecificId)
@@ -252,14 +264,20 @@ func (svc *Service) getDeviceID(ctx context.Context, device *androidmanagement.D
 	return deviceID, nil
 }
 
-func (svc *Service) getPolicyID(ctx context.Context, device *androidmanagement.Device) (uint, error) {
+func (svc *Service) getPolicyID(ctx context.Context, device *androidmanagement.Device) (*uint, error) {
 	nameParts := strings.Split(device.AppliedPolicyName, "/")
 	if len(nameParts) != 4 {
-		return 0, ctxerr.Errorf(ctx, "invalid Android policy name: %s", device.AppliedPolicyName)
+		return nil, ctxerr.Errorf(ctx, "invalid Android policy name: %s", device.AppliedPolicyName)
+	}
+	if len(nameParts[3]) == 0 {
+		level.Error(svc.logger).Log("msg", "Empty Android policy ID", "device.name", device.Name,
+			"device.enterpriseSpecificID", device.HardwareInfo.EnterpriseSpecificId, "device.AppliedPolicyName",
+			device.AppliedPolicyName)
+		return nil, nil
 	}
 	result, err := strconv.ParseUint(nameParts[3], 10, 64)
 	if err != nil {
-		return 0, ctxerr.Wrap(ctx, err, "parsing Android policy ID")
+		return nil, ctxerr.Wrapf(ctx, err, "parsing Android policy ID from %s", device.AppliedPolicyName)
 	}
-	return uint(result), nil
+	return ptr.Uint(uint(result)), nil
 }
diff --git a/server/mdm/android/service/service.go b/server/mdm/android/service/service.go
index e786f67c83..da991dc318 100644
--- a/server/mdm/android/service/service.go
+++ b/server/mdm/android/service/service.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/fleetdm/fleet/v4/server"
 	"github.com/fleetdm/fleet/v4/server/authz"
@@ -13,11 +14,16 @@ import (
 	"github.com/fleetdm/fleet/v4/server/mdm/android"
 	"github.com/fleetdm/fleet/v4/server/mdm/android/service/proxy"
 	kitlog "github.com/go-kit/log"
+	"github.com/go-kit/log/level"
 	"google.golang.org/api/androidmanagement/v1"
 )
 
 // We use numbers for policy names for easier mapping/indexing with Fleet DB.
-const defaultAndroidPolicyID = 1
+const (
+	defaultAndroidPolicyID   = 1
+	DefaultSignupSSEInterval = 3 * time.Second
+	SignupSSESuccess         = "Android Enterprise successfully connected"
+)
 
 type Service struct {
 	logger  kitlog.Logger
@@ -25,6 +31,9 @@ type Service struct {
 	ds      android.Datastore
 	fleetDS fleet.Datastore
 	proxy   android.Proxy
+
+	// SignupSSEInterval can be overwritten in tests.
+	SignupSSEInterval time.Duration
 }
 
 func NewService(
@@ -47,11 +56,12 @@ func NewServiceWithProxy(
 	}
 
 	return &Service{
-		logger:  logger,
-		authz:   authorizer,
-		ds:      fleetDS.GetAndroidDS(),
-		fleetDS: fleetDS,
-		proxy:   proxy,
+		logger:            logger,
+		authz:             authorizer,
+		ds:                fleetDS.GetAndroidDS(),
+		fleetDS:           fleetDS,
+		proxy:             proxy,
+		SignupSSEInterval: DefaultSignupSSEInterval,
 	}, nil
 }
 
@@ -155,10 +165,10 @@ func (svc *Service) EnterpriseSignupCallback(ctx context.Context, id uint, enter
 		android.ProxyEnterprisesCreateRequest{
 			Enterprise: androidmanagement.Enterprise{
 				EnabledNotificationTypes: []string{
-					android.PubSubEnrollment,
-					android.PubSubStatusReport,
-					android.PubSubCommand,
-					android.PubSubUsageLogs,
+					string(android.PubSubEnrollment),
+					string(android.PubSubStatusReport),
+					string(android.PubSubCommand),
+					string(android.PubSubUsageLogs),
 				},
 			},
 			EnterpriseToken: enterpriseToken,
@@ -358,3 +368,87 @@ func (svc *Service) checkIfAndroidNotConfigured(ctx context.Context) (*fleet.App
 	}
 	return appConfig, nil
 }
+
+type enterpriseSSEResponse struct {
+	android.DefaultResponse
+	done chan string
+}
+
+func (r enterpriseSSEResponse) HijackRender(_ context.Context, w http.ResponseWriter) {
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("X-Accel-Buffering", "no")
+	w.Header().Set("Transfer-Encoding", "chunked")
+	if r.done == nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		_, _ = fmt.Fprint(w, "Error: No SSE data available")
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+	w.(http.Flusher).Flush()
+
+	for {
+		select {
+		case data, ok := <-r.done:
+			if ok {
+				_, _ = fmt.Fprint(w, data)
+				w.(http.Flusher).Flush()
+			}
+			return
+		case <-time.After(5 * time.Second):
+			// We send a heartbeat to prevent the load balancer from closing the (otherwise idle) connection.
+			// The leading colon indicates this is a comment, and is ignored.
+			// https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events
+			_, _ = fmt.Fprint(w, ":heartbeat\n")
+			w.(http.Flusher).Flush()
+		}
+	}
+}
+
+func enterpriseSSE(ctx context.Context, _ interface{}, svc android.Service) fleet.Errorer {
+	done, err := svc.EnterpriseSignupSSE(ctx)
+	if err != nil {
+		return android.DefaultResponse{Err: err}
+	}
+	return enterpriseSSEResponse{done: done}
+}
+
+func (svc *Service) EnterpriseSignupSSE(ctx context.Context) (chan string, error) {
+	if err := svc.authz.Authorize(ctx, &android.Enterprise{}, fleet.ActionRead); err != nil {
+		return nil, err
+	}
+
+	done := make(chan string)
+	go func() {
+		if svc.signupSSECheck(ctx, done) {
+			return
+		}
+		for {
+			select {
+			case <-ctx.Done():
+				level.Debug(svc.logger).Log("msg", "Context cancelled during Android signup SSE")
+				return
+			case <-time.After(svc.SignupSSEInterval):
+				if svc.signupSSECheck(ctx, done) {
+					return
+				}
+			}
+		}
+	}()
+
+	return done, nil
+}
+
+func (svc *Service) signupSSECheck(ctx context.Context, done chan string) bool {
+	appConfig, err := svc.fleetDS.AppConfig(ctx)
+	if err != nil {
+		done <- fmt.Sprintf("Error getting app config: %v", err)
+		return true
+	}
+	if appConfig.MDM.AndroidEnabledAndConfigured {
+		done <- SignupSSESuccess
+		return true
+	}
+	return false
+}
diff --git a/server/mdm/android/tests/enterprise/enterprise_test.go b/server/mdm/android/tests/enterprise/enterprise_test.go
index d8793239a6..0bdf6f17ba 100644
--- a/server/mdm/android/tests/enterprise/enterprise_test.go
+++ b/server/mdm/android/tests/enterprise/enterprise_test.go
@@ -1,12 +1,18 @@
 package enterprise_test
 
 import (
+	"context"
+	"io"
 	"net/http"
 	"testing"
+	"time"
 
+	"github.com/fleetdm/fleet/v4/server/fleet"
 	"github.com/fleetdm/fleet/v4/server/mdm/android"
+	"github.com/fleetdm/fleet/v4/server/mdm/android/service"
 	"github.com/fleetdm/fleet/v4/server/mdm/android/tests"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/stretchr/testify/suite"
 )
 
@@ -22,6 +28,12 @@ type enterpriseTestSuite struct {
 func (s *enterpriseTestSuite) SetupSuite() {
 	s.WithServer.SetupSuite(s.T(), "androidEnterpriseTestSuite")
 	s.Token = "bozo"
+	s.Svc.(*service.Service).SignupSSEInterval = 10 * time.Millisecond
+}
+
+func (s *enterpriseTestSuite) SetupTest() {
+	s.AppConfig.MDM.AndroidEnabledAndConfigured = false
+	s.CreateCommonDSMocks()
 }
 
 func (s *enterpriseTestSuite) TearDownSuite() {
@@ -29,6 +41,8 @@ func (s *enterpriseTestSuite) TearDownSuite() {
 }
 
 func (s *enterpriseTestSuite) TestGetEnterprise() {
+	s.SetupTest()
+
 	// Enterprise doesn't exist.
 	var resp android.GetEnterpriseResponse
 	s.DoJSON("GET", "/api/v1/fleet/android_enterprise", nil, http.StatusNotFound, &resp)
@@ -50,3 +64,44 @@ func (s *enterpriseTestSuite) TestGetEnterprise() {
 	s.Do("DELETE", "/api/v1/fleet/android_enterprise", nil, http.StatusOK)
 	s.DoJSON("GET", "/api/v1/fleet/android_enterprise", nil, http.StatusNotFound, &resp)
 }
+
+func (s *enterpriseTestSuite) TestEnterpriseSSE() {
+	s.SetupTest()
+
+	// Test happy path
+	resp := s.Do("GET", "/api/v1/fleet/android_enterprise/signup_sse", nil, http.StatusOK)
+	sseDone := make(chan struct{})
+	go func() {
+		data, err := io.ReadAll(resp.Body)
+		require.NoError(s.T(), err)
+		assert.Equal(s.T(), service.SignupSSESuccess, string(data))
+		close(sseDone)
+	}()
+
+	time.Sleep(50 * time.Millisecond)
+	s.AppConfigMu.Lock()
+	s.AppConfig.MDM.AndroidEnabledAndConfigured = true
+	s.AppConfigMu.Unlock()
+
+	select {
+	case <-sseDone:
+		s.T().Log("SSE done")
+	case <-time.After(2 * time.Second):
+		s.T().Fatal("Timed out waiting for SSE")
+	}
+
+	// Test with Android already enabled
+	resp = s.Do("GET", "/api/v1/fleet/android_enterprise/signup_sse", nil, http.StatusOK)
+	data, err := io.ReadAll(resp.Body)
+	require.NoError(s.T(), err)
+	assert.Equal(s.T(), service.SignupSSESuccess, string(data))
+
+	// Test with error
+	s.WithServer.FleetDS.AppConfigFunc = func(_ context.Context) (*fleet.AppConfig, error) {
+		return nil, assert.AnError
+	}
+	resp = s.Do("GET", "/api/v1/fleet/android_enterprise/signup_sse", nil, http.StatusOK)
+	data, err = io.ReadAll(resp.Body)
+	assert.NoError(s.T(), err)
+	assert.Contains(s.T(), string(data), assert.AnError.Error())
+}
diff --git a/server/mdm/android/tests/testing_utils.go b/server/mdm/android/tests/testing_utils.go
index acdf58378f..19c03e9ea0 100644
--- a/server/mdm/android/tests/testing_utils.go
+++ b/server/mdm/android/tests/testing_utils.go
@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"sync"
 	"testing"
 
 	"github.com/fleetdm/fleet/v4/server/config"
@@ -36,18 +37,22 @@ const (
 
 type WithServer struct {
 	suite.Suite
-	DS               *mysql.Datastore
-	FleetDS          ds_mock.Store
-	Server           *httptest.Server
-	Token            string
-	AppConfig        fleet.AppConfig
+	Svc     android.Service
+	DS      *mysql.Datastore
+	FleetDS ds_mock.Store
+	Server  *httptest.Server
+	Token   string
+
+	AppConfig   fleet.AppConfig
+	AppConfigMu sync.Mutex
+
 	Proxy            proxy_mock.Proxy
 	ProxyCallbackURL string
 }
 
 func (ts *WithServer) SetupSuite(t *testing.T, dbName string) {
 	ts.DS = CreateNamedMySQLDS(t, dbName)
-	ts.createCommonDSMocks()
+	ts.CreateCommonDSMocks()
 
 	ts.Proxy = proxy_mock.Proxy{}
 	ts.createCommonProxyMocks(t)
@@ -56,19 +61,26 @@ func (ts *WithServer) SetupSuite(t *testing.T, dbName string) {
 	logger := kitlog.NewLogfmtLogger(os.Stdout)
 	svc, err := service.NewServiceWithProxy(logger, &ts.FleetDS, &ts.Proxy)
 	require.NoError(t, err)
+	ts.Svc = svc
 
 	ts.Server = runServerForTests(t, logger, &fleetSvc, svc)
 }
 
-func (ts *WithServer) createCommonDSMocks() {
+func (ts *WithServer) CreateCommonDSMocks() {
 	ts.FleetDS.GetAndroidDSFunc = func() android.Datastore {
 		return ts.DS
 	}
 	ts.FleetDS.AppConfigFunc = func(_ context.Context) (*fleet.AppConfig, error) {
-		return &ts.AppConfig, nil
+		// Create a copy to prevent race conditions
+		ts.AppConfigMu.Lock()
+		appConfigCopy := ts.AppConfig
+		ts.AppConfigMu.Unlock()
+		return &appConfigCopy, nil
 	}
 	ts.FleetDS.SetAndroidEnabledAndConfiguredFunc = func(_ context.Context, configured bool) error {
+		ts.AppConfigMu.Lock()
 		ts.AppConfig.MDM.AndroidEnabledAndConfigured = configured
+		ts.AppConfigMu.Unlock()
 		return nil
 	}
 }

From 1a655bf89adb3322370b247154dfa60ee4207740 Mon Sep 17 00:00:00 2001
From: Gabriel Hernandez <ghernandez345@gmail.com>
Date: Thu, 27 Feb 2025 14:07:34 +0000
Subject: [PATCH 07/15] UI activites for android mdm (#26647)

---
 changes/issue-26209-android-mdm-acitivites           |  1 +
 frontend/interfaces/activity.ts                      |  2 ++
 .../GlobalActivityItem/GlobalActivityItem.tsx        | 12 ++++++++++++
 3 files changed, 15 insertions(+)
 create mode 100644 changes/issue-26209-android-mdm-acitivites

diff --git a/changes/issue-26209-android-mdm-acitivites b/changes/issue-26209-android-mdm-acitivites
new file mode 100644
index 0000000000..7c5da573cc
--- /dev/null
+++ b/changes/issue-26209-android-mdm-acitivites
@@ -0,0 +1 @@
+- add android mdm activities
diff --git a/frontend/interfaces/activity.ts b/frontend/interfaces/activity.ts
index a9dc9bb63d..7324a3ee95 100644
--- a/frontend/interfaces/activity.ts
+++ b/frontend/interfaces/activity.ts
@@ -103,6 +103,8 @@ export enum ActivityType {
   DisabledActivityAutomations = "disabled_activity_automations",
   CanceledScript = "canceled_script",
   CanceledSoftwareInstall = "canceled_software_install",
+  EnabledAndroidMdm = "enabled_android_mdm",
+  DisabledAndroidMdm = "disabled_android_mdm",
 }
 
 /** This is a subset of ActivityType that are shown only for the host past activities */
diff --git a/frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx b/frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx
index 423ea53824..39696c8899 100644
--- a/frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx
+++ b/frontend/pages/DashboardPage/cards/ActivityFeed/GlobalActivityItem/GlobalActivityItem.tsx
@@ -1076,6 +1076,12 @@ const TAGGED_TEMPLATES = {
   disabledActivityAutomations: () => {
     return <> disabled activity automations.</>;
   },
+  enabledAndroidMdm: () => {
+    return <> turned on Android MDM.</>;
+  },
+  disabledAndroidMdm: () => {
+    return <> turned off Android MDM.</>;
+  },
 };
 
 const getDetail = (activity: IActivity, isPremiumTier: boolean) => {
@@ -1314,6 +1320,12 @@ const getDetail = (activity: IActivity, isPremiumTier: boolean) => {
     case ActivityType.DisabledActivityAutomations: {
       return TAGGED_TEMPLATES.disabledActivityAutomations();
     }
+    case ActivityType.EnabledAndroidMdm: {
+      return TAGGED_TEMPLATES.enabledAndroidMdm();
+    }
+    case ActivityType.DisabledAndroidMdm: {
+      return TAGGED_TEMPLATES.disabledAndroidMdm();
+    }
 
     default: {
       return TAGGED_TEMPLATES.defaultActivityTemplate(activity);

From 7df866754e585852d430c55af797cbeb913cd76e Mon Sep 17 00:00:00 2001
From: Jordan Moore <moojo.moore@gmail.com>
Date: Thu, 27 Feb 2025 09:27:15 -0600
Subject: [PATCH 08/15] Correct a URL in the documentation so it doesn't 404
 (#26651)

The URL was pointing to a file in the fleet-terraform repo that didn't
exist causing it to 404.
---
 docs/Deploy/deploy-fleet.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/Deploy/deploy-fleet.md b/docs/Deploy/deploy-fleet.md
index bbf8f0e15c..a4e4c9444f 100644
--- a/docs/Deploy/deploy-fleet.md
+++ b/docs/Deploy/deploy-fleet.md
@@ -81,7 +81,7 @@ This workflow takes about 30 minutes to complete and supports between 10 and 350
 
 ### Instructions
 
-1. [Download](https://github.com/fleetdm/fleet-terraform/tree/mainexample/main.tf) the Fleet `main.tf` Terraform file.
+1. [Download](https://github.com/fleetdm/fleet-terraform/blob/main/example/main.tf) the Fleet `main.tf` Terraform file.
 
 2. Edit the following variables in the `main.tf` Terraform file you just downloaded to match your environment:
     

From 75bbbf67316510af503b38e68434e4e56a7f49d5 Mon Sep 17 00:00:00 2001
From: Scott Gress <scottmgress@gmail.com>
Date: Thu, 27 Feb 2025 09:43:34 -0600
Subject: [PATCH 09/15] Fix issue with policy details modal causing 500 error
 page (#26628)

For #26604

This PR fixes the way we import DOMPurify, so that we can access its
`sanitize` method.

I'm not sure why this popped up now -- the last release was a month ago.
Perhaps a new release of webpack or a related dependency in our build
chain?

**Before:**

![26604-broken](https://github.com/user-attachments/assets/629567a6-d989-45e2-a90c-eca8f69b1105)

---

**After:**

![26604-fixed](https://github.com/user-attachments/assets/4ec580f1-d189-4692-80d2-fee1d3ed8207)
---
 frontend/components/ClickableUrls/ClickableUrls.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/components/ClickableUrls/ClickableUrls.tsx b/frontend/components/ClickableUrls/ClickableUrls.tsx
index 2dffcc2d63..e3f388ec39 100644
--- a/frontend/components/ClickableUrls/ClickableUrls.tsx
+++ b/frontend/components/ClickableUrls/ClickableUrls.tsx
@@ -1,5 +1,5 @@
 import React from "react";
-import * as DOMPurify from "dompurify";
+import DOMPurify from "dompurify";
 import classnames from "classnames";
 
 interface IClickableUrls {

From 73a368a2005b71af826f8be705a73a23f0a73f0a Mon Sep 17 00:00:00 2001
From: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Date: Thu, 27 Feb 2025 10:48:08 -0500
Subject: [PATCH 10/15] Fleet UI: Clean up TabNav and TargetChipSelector
 components (#26256)

---
 .../PlatformWrapper/PlatformWrapper.tsx       |   9 +-
 .../PlatformWrapper/_styles.scss              |   2 +-
 .../components/LiveQuery/SelectTargets.tsx    |  47 +-----
 .../TargetChipSelector.stories.tsx            | 110 ++++++++++++++
 .../TargetChipSelector.tests.tsx              | 102 +++++++++++++
 .../TargetChipSelector/TargetChipSelector.tsx |  55 +++++++
 .../{ => TargetChipSelector}/_styles.scss     |   4 +-
 .../LiveQuery/TargetChipSelector/index.ts     |   1 +
 frontend/components/TabNav/TabNav.stories.tsx |  93 ++++++++++++
 frontend/components/TabNav/TabNav.tests.tsx   |  68 +++++++++
 .../TabsWrapper.tsx => TabNav/TabNav.tsx}     |  11 +-
 frontend/components/TabNav/_styles.scss       | 134 ++++++++++++++++++
 frontend/components/TabNav/index.ts           |   1 +
 frontend/components/TabText/TabText.tsx       |  47 ++++++
 frontend/components/TabText/_styles.scss      |  23 +++
 frontend/components/TabText/index.ts          |   1 +
 frontend/components/TabsWrapper/_styles.scss  |  90 ------------
 frontend/components/TabsWrapper/index.ts      |   1 -
 frontend/components/icons/Check.tsx           |   1 +
 frontend/components/icons/Plus.tsx            |   1 +
 .../pages/DashboardPage/cards/MDM/MDM.tsx     |  15 +-
 .../DashboardPage/cards/MDM/_styles.scss      |   2 +-
 .../pages/DashboardPage/cards/Munki/Munki.tsx |  15 +-
 .../DashboardPage/cards/Munki/_styles.scss    |   2 +-
 .../DashboardPage/cards/Software/Software.tsx |  15 +-
 .../DashboardPage/cards/Software/_styles.scss |   2 +-
 .../ManageControlsPage/ManageControlsPage.tsx |   9 +-
 .../components/PlatformTabs/PlatformTabs.tsx  |  17 ++-
 .../SoftwareAddPage/SoftwareAddPage.tsx       |   9 +-
 frontend/pages/SoftwarePage/SoftwarePage.tsx  |   9 +-
 frontend/pages/SoftwarePage/_styles.scss      |   2 +-
 .../components/AddSoftwareModal/_styles.scss  |   3 +-
 frontend/pages/admin/AdminWrapper.tsx         |   9 +-
 .../TeamDetailsWrapper/TeamDetailsWrapper.tsx | 128 ++++++++---------
 frontend/pages/admin/_styles.scss             |   2 +-
 .../details/DeviceUserPage/DeviceUserPage.tsx |  28 ++--
 .../HostDetailsPage/HostDetailsPage.tsx       |  26 ++--
 .../details/HostDetailsPage/_styles.scss      |   7 -
 frontend/pages/hosts/details/_styles.scss     |  13 +-
 .../hosts/details/cards/Activity/Activity.tsx |  18 ++-
 .../hosts/details/cards/Activity/_styles.scss |  15 --
 .../SoftwareDetailsModal.tsx                  |  15 +-
 .../labels/NewLabelPage/NewLabelPage.tsx      |   9 +-
 .../pages/labels/NewLabelPage/_styles.scss    |   2 +-
 .../PolicyResults/PolicyResults.tsx           |  18 +--
 .../components/QueryResults/QueryResults.tsx  |  16 +--
 46 files changed, 849 insertions(+), 358 deletions(-)
 create mode 100644 frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.stories.tsx
 create mode 100644 frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tests.tsx
 create mode 100644 frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tsx
 rename frontend/components/LiveQuery/{ => TargetChipSelector}/_styles.scss (92%)
 create mode 100644 frontend/components/LiveQuery/TargetChipSelector/index.ts
 create mode 100644 frontend/components/TabNav/TabNav.stories.tsx
 create mode 100644 frontend/components/TabNav/TabNav.tests.tsx
 rename frontend/components/{TabsWrapper/TabsWrapper.tsx => TabNav/TabNav.tsx} (65%)
 create mode 100644 frontend/components/TabNav/_styles.scss
 create mode 100644 frontend/components/TabNav/index.ts
 create mode 100644 frontend/components/TabText/TabText.tsx
 create mode 100644 frontend/components/TabText/_styles.scss
 create mode 100644 frontend/components/TabText/index.ts
 delete mode 100644 frontend/components/TabsWrapper/_styles.scss
 delete mode 100644 frontend/components/TabsWrapper/index.ts

diff --git a/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx b/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
index dbacef6bc8..e53ce0e068 100644
--- a/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
+++ b/frontend/components/AddHostsModal/PlatformWrapper/PlatformWrapper.tsx
@@ -13,10 +13,11 @@ import RevealButton from "components/buttons/RevealButton";
 // @ts-ignore
 import InputField from "components/forms/fields/InputField";
 import TooltipWrapper from "components/TooltipWrapper";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
 import InfoBanner from "components/InfoBanner/InfoBanner";
 import CustomLink from "components/CustomLink/CustomLink";
 import Radio from "components/forms/fields/Radio";
+import TabText from "components/TabText";
 
 import { isValidPemCertificate } from "../../../pages/hosts/ManageHostsPage/helpers";
 import IosIpadosPanel from "./IosIpadosPanel";
@@ -573,7 +574,7 @@ const PlatformWrapper = ({
 
   return (
     <div className={baseClass}>
-      <TabsWrapper>
+      <TabNav>
         <Tabs
           onSelect={(index) => setSelectedTabIndex(index)}
           selectedIndex={selectedTabIndex}
@@ -584,7 +585,7 @@ const PlatformWrapper = ({
               // so we add a hidden pseudo element with the same text string
               return (
                 <Tab key={navItem.name} data-text={navItem.name}>
-                  {navItem.name}
+                  <TabText>{navItem.name}</TabText>
                 </Tab>
               );
             })}
@@ -601,7 +602,7 @@ const PlatformWrapper = ({
             );
           })}
         </Tabs>
-      </TabsWrapper>
+      </TabNav>
       <div className="modal-cta-wrap">
         <Button onClick={onCancel} variant="brand">
           Done
diff --git a/frontend/components/AddHostsModal/PlatformWrapper/_styles.scss b/frontend/components/AddHostsModal/PlatformWrapper/_styles.scss
index 7ca7c255f2..e7b4474b4f 100644
--- a/frontend/components/AddHostsModal/PlatformWrapper/_styles.scss
+++ b/frontend/components/AddHostsModal/PlatformWrapper/_styles.scss
@@ -3,7 +3,7 @@
 .platform-wrapper {
   padding: 0; // different to pad sticky subnav properly
 
-  .component__tabs-wrapper {
+  .tab-nav {
     // negate problematic sticky positioning
     position: initial;
     .react-tabs {
diff --git a/frontend/components/LiveQuery/SelectTargets.tsx b/frontend/components/LiveQuery/SelectTargets.tsx
index 9afdccd0e5..ece1c0ac5a 100644
--- a/frontend/components/LiveQuery/SelectTargets.tsx
+++ b/frontend/components/LiveQuery/SelectTargets.tsx
@@ -25,29 +25,17 @@ import teamsAPI, { ILoadTeamsResponse } from "services/entities/teams";
 import { formatSelectedTargetsForApi } from "utilities/helpers";
 import { capitalize } from "lodash";
 import permissions from "utilities/permissions";
-import {
-  LABEL_DISPLAY_MAP,
-  PlatformLabelNameFromAPI,
-} from "utilities/constants";
 
 import PageError from "components/DataError";
 import TargetsInput from "components/LiveQuery/TargetsInput";
 import Button from "components/buttons/Button";
 import Spinner from "components/Spinner";
 import TooltipWrapper from "components/TooltipWrapper";
-import Icon from "components/Icon";
 import SearchField from "components/forms/fields/SearchField";
 import RevealButton from "components/buttons/RevealButton";
+import TargetPillSelector from "./TargetChipSelector";
 import { generateTableHeaders } from "./TargetsInput/TargetsInputHostsTableConfig";
 
-interface ITargetPillSelectorProps {
-  entity: ISelectLabel | ISelectTeam;
-  isSelected: boolean;
-  onClick: (
-    value: ISelectLabel | ISelectTeam
-  ) => React.MouseEventHandler<HTMLButtonElement>;
-}
-
 interface ISelectTargetsProps {
   baseClass: string;
   queryId?: number | null;
@@ -86,11 +74,6 @@ const STALE_TIME = 60000;
 const SECTION_CHARACTER_LIMIT = 600;
 
 const isLabel = (entity: ISelectTargetsEntity) => "label_type" in entity;
-const isBuiltInLabel = (
-  entity: ISelectTargetsEntity
-): entity is ISelectLabel & { label_type: "builtin" } => {
-  return "label_type" in entity && entity.label_type === "builtin";
-};
 const isAllHosts = (entity: ISelectTargetsEntity) =>
   "label_type" in entity &&
   entity.name === "All Hosts" &&
@@ -125,34 +108,6 @@ const getTruncatedEntityCount = (
   return index;
 };
 
-const TargetPillSelector = ({
-  entity,
-  isSelected,
-  onClick,
-}: ITargetPillSelectorProps): JSX.Element => {
-  const displayText = (): string => {
-    if (isBuiltInLabel(entity)) {
-      const labelName = entity.name as PlatformLabelNameFromAPI;
-      if (labelName in LABEL_DISPLAY_MAP) {
-        return LABEL_DISPLAY_MAP[labelName] || labelName;
-      }
-    }
-
-    return entity.name || "Missing display name";
-  };
-
-  return (
-    <button
-      className="target-pill-selector"
-      data-selected={isSelected}
-      onClick={(e) => onClick(entity)(e)}
-    >
-      <Icon name={isSelected ? "check" : "plus"} />
-      <span className="selector-name">{displayText()}</span>
-    </button>
-  );
-};
-
 const SelectTargets = ({
   baseClass,
   queryId,
diff --git a/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.stories.tsx b/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.stories.tsx
new file mode 100644
index 0000000000..f5ca496d71
--- /dev/null
+++ b/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.stories.tsx
@@ -0,0 +1,110 @@
+import React from "react";
+import { Meta, StoryObj } from "@storybook/react";
+import { ISelectLabel, ISelectTeam } from "interfaces/target";
+import TargetChipSelector from "./TargetChipSelector"; // Adjust the path if necessary
+
+const meta: Meta<typeof TargetChipSelector> = {
+  component: TargetChipSelector,
+  title: "Components/TargetChipSelector",
+  argTypes: {
+    entity: {
+      description: "The label or team entity to display.",
+      control: { type: "object" },
+    },
+    isSelected: {
+      description:
+        "Whether the chip is currently selected, updated by parent onClick handler.",
+      control: { type: "boolean" },
+    },
+    onClick: {
+      description: "The handler to call when the chip is clicked.",
+      action: "clicked", // Use Storybook's action to track clicks
+    },
+  },
+  parameters: {
+    backgrounds: {
+      default: "light",
+      values: [
+        { name: "light", value: "#ffffff" },
+        { name: "dark", value: "#333333" },
+      ],
+    },
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<typeof TargetChipSelector>;
+
+// Example data for labels and teams
+const mockLabel: ISelectLabel = {
+  id: 1,
+  name: "Example Label",
+  label_type: "regular",
+  description: "A test label",
+};
+
+const mockTeam: ISelectTeam = {
+  id: 2,
+  name: "Example Team",
+  description: "A test team",
+};
+
+export const LabelExample: Story = {
+  args: {
+    entity: mockLabel,
+    isSelected: false,
+    onClick: (value) => (event) => {
+      event.preventDefault();
+      console.log("Clicked label:", value);
+    },
+  },
+  render: (args) => (
+    <TargetChipSelector
+      entity={args.entity}
+      isSelected={args.isSelected}
+      onClick={args.onClick}
+    />
+  ),
+};
+
+export const TeamExample: Story = {
+  args: {
+    entity: mockTeam,
+    isSelected: true,
+    onClick: (value) => (event) => {
+      event.preventDefault();
+      console.log("Clicked team:", value);
+    },
+  },
+  render: (args) => (
+    <TargetChipSelector
+      entity={args.entity}
+      isSelected={args.isSelected}
+      onClick={args.onClick}
+    />
+  ),
+};
+
+export const BuiltInLabelExample: Story = {
+  args: {
+    entity: {
+      id: 3,
+      name: "MS Windows",
+      label_type: "builtin",
+      description: "Microsoft Windows hosts",
+    },
+    isSelected: false,
+    onClick: (value) => (event) => {
+      event.preventDefault();
+      console.log("Clicked label:", value);
+    },
+  },
+  render: (args) => (
+    <TargetChipSelector
+      entity={args.entity}
+      isSelected={args.isSelected}
+      onClick={args.onClick}
+    />
+  ),
+};
diff --git a/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tests.tsx b/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tests.tsx
new file mode 100644
index 0000000000..6259fa6490
--- /dev/null
+++ b/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tests.tsx
@@ -0,0 +1,102 @@
+import React from "react";
+import { render, screen, fireEvent } from "@testing-library/react";
+
+import { ISelectLabel, ISelectTeam } from "interfaces/target";
+import TargetChipSelector from "./TargetChipSelector";
+
+describe("TargetChipSelector", () => {
+  const mockOnClick = jest.fn();
+
+  const mockLabel: ISelectLabel = {
+    id: 1,
+    name: "Example Label",
+    label_type: "regular",
+    description: "A test label",
+  };
+
+  const mockTeam: ISelectTeam = {
+    id: 2,
+    name: "Example Team",
+    description: "A test team",
+  };
+
+  it("renders the correct display text for a label", () => {
+    render(
+      <TargetChipSelector
+        entity={mockLabel}
+        isSelected={false}
+        onClick={mockOnClick}
+      />
+    );
+
+    expect(screen.getByText("Example Label")).toBeInTheDocument();
+  });
+
+  it("renders the correct display text for a team", () => {
+    render(
+      <TargetChipSelector
+        entity={mockTeam}
+        isSelected={false}
+        onClick={mockOnClick}
+      />
+    );
+
+    expect(screen.getByText("Example Team")).toBeInTheDocument();
+  });
+
+  it("renders the correct icon when selected", () => {
+    render(
+      <TargetChipSelector entity={mockLabel} isSelected onClick={mockOnClick} />
+    );
+
+    expect(screen.getByLabelText("check")).toBeInTheDocument();
+  });
+
+  it("renders the correct icon when not selected", () => {
+    render(
+      <TargetChipSelector
+        entity={mockLabel}
+        isSelected={false}
+        onClick={mockOnClick}
+      />
+    );
+
+    expect(screen.getByLabelText("plus")).toBeInTheDocument();
+  });
+
+  it("calls the onClick handler with the correct entity when clicked", () => {
+    render(
+      <TargetChipSelector
+        entity={mockLabel}
+        isSelected={false}
+        onClick={(value) => (event) => mockOnClick(value, event)}
+      />
+    );
+
+    fireEvent.click(screen.getByRole("button"));
+
+    expect(mockOnClick).toHaveBeenCalledWith(mockLabel, expect.any(Object));
+  });
+
+  it("applies the correct data-selected attribute when selected", () => {
+    render(
+      <TargetChipSelector entity={mockLabel} isSelected onClick={mockOnClick} />
+    );
+
+    const button = screen.getByRole("button");
+    expect(button).toHaveAttribute("data-selected", "true");
+  });
+
+  it("applies the correct data-selected attribute when not selected", () => {
+    render(
+      <TargetChipSelector
+        entity={mockLabel}
+        isSelected={false}
+        onClick={mockOnClick}
+      />
+    );
+
+    const button = screen.getByRole("button");
+    expect(button).toHaveAttribute("data-selected", "false");
+  });
+});
diff --git a/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tsx b/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tsx
new file mode 100644
index 0000000000..98ad2ccc1e
--- /dev/null
+++ b/frontend/components/LiveQuery/TargetChipSelector/TargetChipSelector.tsx
@@ -0,0 +1,55 @@
+import React from "react";
+import {
+  ISelectLabel,
+  ISelectTeam,
+  ISelectTargetsEntity,
+} from "interfaces/target";
+import Icon from "components/Icon";
+import {
+  PlatformLabelNameFromAPI,
+  LABEL_DISPLAY_MAP,
+} from "utilities/constants";
+
+interface ITargetChipSelectorProps {
+  entity: ISelectLabel | ISelectTeam;
+  isSelected: boolean;
+  onClick: (
+    value: ISelectLabel | ISelectTeam
+  ) => React.MouseEventHandler<HTMLButtonElement>;
+}
+
+const isBuiltInLabel = (
+  entity: ISelectTargetsEntity
+): entity is ISelectLabel & { label_type: "builtin" } => {
+  return "label_type" in entity && entity.label_type === "builtin";
+};
+
+const TargetChipSelector = ({
+  entity,
+  isSelected,
+  onClick,
+}: ITargetChipSelectorProps): JSX.Element => {
+  const displayText = (): string => {
+    if (isBuiltInLabel(entity)) {
+      const labelName = entity.name as PlatformLabelNameFromAPI;
+      if (labelName in LABEL_DISPLAY_MAP) {
+        return LABEL_DISPLAY_MAP[labelName] || labelName;
+      }
+    }
+
+    return entity.name || "Missing display name";
+  };
+
+  return (
+    <button
+      className="target-chip-selector"
+      data-selected={isSelected}
+      onClick={(e) => onClick(entity)(e)}
+    >
+      <Icon name={isSelected ? "check" : "plus"} />
+      <span className="selector-name">{displayText()}</span>
+    </button>
+  );
+};
+
+export default TargetChipSelector;
diff --git a/frontend/components/LiveQuery/_styles.scss b/frontend/components/LiveQuery/TargetChipSelector/_styles.scss
similarity index 92%
rename from frontend/components/LiveQuery/_styles.scss
rename to frontend/components/LiveQuery/TargetChipSelector/_styles.scss
index e6e9ce0554..ca844e1354 100644
--- a/frontend/components/LiveQuery/_styles.scss
+++ b/frontend/components/LiveQuery/TargetChipSelector/_styles.scss
@@ -1,4 +1,4 @@
-.target-pill-selector {
+.target-chip-selector {
   padding: $pad-small;
   background-color: $core-white;
   border: none;
@@ -34,7 +34,7 @@
   }
 
   &:hover {
-    box-shadow: inset 0 0 0 1px $core-vibrant-blue-over;
+    background-color: $ui-vibrant-blue-10;
   }
 
   &:active {
diff --git a/frontend/components/LiveQuery/TargetChipSelector/index.ts b/frontend/components/LiveQuery/TargetChipSelector/index.ts
new file mode 100644
index 0000000000..94cc8dca7f
--- /dev/null
+++ b/frontend/components/LiveQuery/TargetChipSelector/index.ts
@@ -0,0 +1 @@
+export { default } from "./TargetChipSelector";
diff --git a/frontend/components/TabNav/TabNav.stories.tsx b/frontend/components/TabNav/TabNav.stories.tsx
new file mode 100644
index 0000000000..c86fc9ed64
--- /dev/null
+++ b/frontend/components/TabNav/TabNav.stories.tsx
@@ -0,0 +1,93 @@
+import React, { useState } from "react";
+import { Meta, StoryObj } from "@storybook/react";
+import { Tab, Tabs, TabList, TabPanel } from "react-tabs";
+import TabText from "components/TabText";
+import TabNav from "./TabNav";
+
+const meta: Meta<typeof TabNav> = {
+  component: TabNav,
+  title: "Components/TabNav",
+  parameters: {
+    backgrounds: {
+      default: "light",
+      values: [
+        {
+          name: "light",
+          value: "#ffffff",
+        },
+        {
+          name: "dark",
+          value: "#333333",
+        },
+      ],
+    },
+  },
+};
+
+export default meta;
+
+type Story = StoryObj<typeof TabNav>;
+
+export const Default: Story = {
+  render: () => {
+    const [selectedTabIndex, setSelectedTabIndex] = useState(0);
+
+    const platformSubNav = [
+      { name: <TabText>Basic tab</TabText>, type: "type1" },
+      { name: <TabText>Basic tab 2</TabText>, type: "type2" },
+      {
+        name: <TabText>Disabled tab</TabText>,
+        type: "type3",
+        disabled: true,
+      },
+      { name: <TabText count={3}>Tab with count</TabText>, type: "type4" },
+      {
+        name: (
+          <TabText count={20} isErrorCount>
+            Tab with error count
+          </TabText>
+        ),
+        type: "type5",
+      },
+    ];
+
+    const renderPanel = (type: string) => {
+      switch (type) {
+        case "type1":
+          return <div>Content for Tab 1</div>;
+        case "type2":
+          return <div>Content for Tab 2</div>;
+        case "type3":
+          return <div>Content for Tab 3</div>;
+        case "type4":
+          return <div>Content for Tab 4</div>;
+        case "type5":
+          return <div>Content for Tab 5</div>;
+        default:
+          return null;
+      }
+    };
+
+    return (
+      <TabNav>
+        <Tabs
+          onSelect={(index) => setSelectedTabIndex(index)}
+          selectedIndex={selectedTabIndex}
+        >
+          <TabList>
+            {platformSubNav.map((navItem) => (
+              <Tab disabled={navItem.disabled}>
+                <TabText>{navItem.name}</TabText>
+              </Tab>
+            ))}
+          </TabList>
+          {platformSubNav.map((navItem) => (
+            <TabPanel key={navItem.type}>
+              <div>{renderPanel(navItem.type)}</div>
+            </TabPanel>
+          ))}
+        </Tabs>
+      </TabNav>
+    );
+  },
+};
diff --git a/frontend/components/TabNav/TabNav.tests.tsx b/frontend/components/TabNav/TabNav.tests.tsx
new file mode 100644
index 0000000000..efff13cd9d
--- /dev/null
+++ b/frontend/components/TabNav/TabNav.tests.tsx
@@ -0,0 +1,68 @@
+import React from "react";
+import { render, screen, fireEvent } from "@testing-library/react";
+import { Tab, Tabs, TabList, TabPanel } from "react-tabs";
+import TabText from "components/TabText";
+import TabNav from "./TabNav";
+
+describe("TabNav", () => {
+  it("renders tabs and panels correctly", () => {
+    render(
+      <TabNav>
+        <Tabs>
+          <TabList>
+            <Tab>
+              <TabText>Tab 1</TabText>
+            </Tab>
+            <Tab>
+              <TabText>Tab 2</TabText>
+            </Tab>
+          </TabList>
+          <TabPanel>
+            <div>Content for Tab 1</div>
+          </TabPanel>
+          <TabPanel>
+            <div>Content for Tab 2</div>
+          </TabPanel>
+        </Tabs>
+      </TabNav>
+    );
+
+    // Check if tabs are rendered
+    expect(screen.getByText("Tab 1")).toBeInTheDocument();
+    expect(screen.getByText("Tab 2")).toBeInTheDocument();
+
+    // Check if the first panel content is rendered by default
+    expect(screen.getByText("Content for Tab 1")).toBeInTheDocument();
+    expect(screen.queryByText("Content for Tab 2")).not.toBeInTheDocument();
+  });
+
+  it("switches tabs and displays the correct panel content", () => {
+    render(
+      <TabNav>
+        <Tabs>
+          <TabList>
+            <Tab>
+              <TabText>Tab 1</TabText>
+            </Tab>
+            <Tab>
+              <TabText>Tab 2</TabText>
+            </Tab>
+          </TabList>
+          <TabPanel>
+            <div>Content for Tab 1</div>
+          </TabPanel>
+          <TabPanel>
+            <div>Content for Tab 2</div>
+          </TabPanel>
+        </Tabs>
+      </TabNav>
+    );
+
+    // Switch to the second tab
+    fireEvent.click(screen.getByText("Tab 2"));
+
+    // Check if the second panel content is displayed
+    expect(screen.getByText("Content for Tab 2")).toBeInTheDocument();
+    expect(screen.queryByText("Content for Tab 1")).not.toBeInTheDocument();
+  });
+});
diff --git a/frontend/components/TabsWrapper/TabsWrapper.tsx b/frontend/components/TabNav/TabNav.tsx
similarity index 65%
rename from frontend/components/TabsWrapper/TabsWrapper.tsx
rename to frontend/components/TabNav/TabNav.tsx
index d788fb4d4e..6b9f59b049 100644
--- a/frontend/components/TabsWrapper/TabsWrapper.tsx
+++ b/frontend/components/TabNav/TabNav.tsx
@@ -1,7 +1,7 @@
 import React from "react";
 import classnames from "classnames";
 
-interface ITabsWrapperProps {
+interface ITabNavProps {
   children: React.ReactChild | React.ReactChild[];
   className?: string;
 }
@@ -10,15 +10,12 @@ interface ITabsWrapperProps {
  * This component exists so we can unify the styles
  * and overwrite the loaded React Tabs styles.
  */
-const baseClass = "component__tabs-wrapper";
+const baseClass = "tab-nav";
 
-const TabsWrapper = ({
-  children,
-  className,
-}: ITabsWrapperProps): JSX.Element => {
+const TabNav = ({ children, className }: ITabNavProps): JSX.Element => {
   const classNames = classnames(baseClass, className);
 
   return <div className={classNames}>{children}</div>;
 };
 
-export default TabsWrapper;
+export default TabNav;
diff --git a/frontend/components/TabNav/_styles.scss b/frontend/components/TabNav/_styles.scss
new file mode 100644
index 0000000000..cb5d2a79b9
--- /dev/null
+++ b/frontend/components/TabNav/_styles.scss
@@ -0,0 +1,134 @@
+.tab-nav {
+  position: sticky;
+  top: 0;
+  background-color: $core-white;
+  z-index: 2;
+
+  .react-tabs {
+    &__tab-list {
+      display: inline-flex;
+      align-items: flex-start;
+      gap: $pad-xxlarge;
+      border-bottom: 1px solid $ui-fleet-black-10;
+      width: 100%;
+      height: 43px;
+    }
+    .tab-text {
+      display: flex; /* Ensure text and count are aligned horizontally */
+      align-items: center; /* Vertically align items */
+
+      .tab-text__text {
+        display: relative;
+
+        // Reserve space for bold text using a hidden pseudo-element
+        &::before {
+          content: attr(data-text); /* Same text as the visible one */
+          font-weight: bold; /* Mimic bold styling */
+          visibility: hidden; /* Keep it invisible */
+          position: absolute; /* Prevent it from affecting layout */
+        }
+      }
+    }
+
+    &__tab {
+      padding: 5px 0 $pad-medium;
+      font-size: $x-small;
+      border: none;
+      display: inline-flex;
+      flex-direction: column;
+      align-items: center;
+      line-height: 21px;
+
+      &:focus {
+        box-shadow: none;
+        outline: 0;
+        &:after {
+          left: 0;
+          bottom: 0;
+        }
+      }
+
+      // focus-visible only highlights when tabbing not clicking
+      &:focus-visible {
+        .tab-text {
+          border-radius: $border-radius;
+          // Outline used instead of border not to shift component
+          outline: 1px solid $ui-vibrant-blue-25;
+          outline-offset: -1px;
+        }
+      }
+
+      // // Bolding text when the button is active causes a layout shift
+      // // so we add a hidden pseudo element with the same text string
+      &:before {
+        content: attr(data-text);
+        height: 0;
+        visibility: hidden;
+        overflow: hidden;
+        user-select: none;
+        pointer-events: none;
+        font-weight: $bold;
+      }
+
+      &--selected {
+        font-weight: $bold;
+
+        &::after {
+          content: "";
+          width: 100%;
+          height: 0;
+          border-bottom: 2px solid $core-vibrant-blue;
+          position: absolute;
+          bottom: 0;
+          left: 0;
+        }
+      }
+
+      &:hover {
+        &::after {
+          content: "";
+          width: 100%;
+          height: 0;
+          border-bottom: 2px solid $core-vibrant-blue;
+          position: absolute;
+          bottom: 0;
+          left: 0;
+        }
+      }
+
+      &--disabled {
+        cursor: not-allowed;
+
+        &:hover {
+          &::after {
+            content: "";
+            width: 100%;
+            height: 0;
+            border-bottom: 0;
+            position: absolute;
+            bottom: 0;
+            left: 0;
+          }
+        }
+      }
+
+      &.no-count:not(.errors-empty).react-tabs__tab--selected::after {
+        bottom: -2px;
+      }
+    }
+    &__tab-panel {
+      .no-results-message {
+        margin-top: $pad-xxlarge;
+        font-size: $small;
+        font-weight: $bold;
+
+        span {
+          margin-top: $pad-medium;
+          font-size: $x-small;
+          font-weight: $regular;
+          display: block;
+        }
+      }
+    }
+  }
+}
diff --git a/frontend/components/TabNav/index.ts b/frontend/components/TabNav/index.ts
new file mode 100644
index 0000000000..bbb0fa5b23
--- /dev/null
+++ b/frontend/components/TabNav/index.ts
@@ -0,0 +1 @@
+export { default } from "./TabNav";
diff --git a/frontend/components/TabText/TabText.tsx b/frontend/components/TabText/TabText.tsx
new file mode 100644
index 0000000000..10ac42b2d5
--- /dev/null
+++ b/frontend/components/TabText/TabText.tsx
@@ -0,0 +1,47 @@
+import React from "react";
+import classnames from "classnames";
+
+interface ITabTextProps {
+  className?: string;
+  children: React.ReactNode;
+  count?: number;
+  /** Changes count badge from default purple to red */
+  isErrorCount?: boolean;
+}
+
+/*
+ * This component exists so we can unify the styles
+ * and add styles to react-tab text.
+ */
+const baseClass = "tab-text";
+
+const TabText = ({
+  className,
+  children,
+  count,
+  isErrorCount = false,
+}: ITabTextProps): JSX.Element => {
+  const classNames = classnames(baseClass, className);
+
+  const countClassNames = classnames(`${baseClass}__count`, {
+    [`${baseClass}__count--error`]: isErrorCount,
+  });
+
+  const renderCount = () => {
+    if (count && count > 0) {
+      return <div className={countClassNames}>{count.toLocaleString()}</div>;
+    }
+    return undefined;
+  };
+
+  return (
+    <div className={classNames}>
+      <div className={`${baseClass}__text}`} data-text={children}>
+        {children}
+      </div>
+      {renderCount()}
+    </div>
+  );
+};
+
+export default TabText;
diff --git a/frontend/components/TabText/_styles.scss b/frontend/components/TabText/_styles.scss
new file mode 100644
index 0000000000..d28705f3ce
--- /dev/null
+++ b/frontend/components/TabText/_styles.scss
@@ -0,0 +1,23 @@
+.tab-text {
+  display: flex;
+  flex-direction: row;
+  gap: $pad-small;
+  align-items: center;
+  height: 21px;
+
+  &__count {
+    display: flex;
+    padding: 1px 12px;
+    justify-content: center;
+    align-items: center;
+    background-color: $core-vibrant-blue;
+    border-radius: 29px;
+    color: $core-white;
+    font-weight: $bold;
+    font-size: $xx-small;
+
+    &--error {
+      background-color: $core-vibrant-red;
+    }
+  }
+}
diff --git a/frontend/components/TabText/index.ts b/frontend/components/TabText/index.ts
new file mode 100644
index 0000000000..2f260c4d2c
--- /dev/null
+++ b/frontend/components/TabText/index.ts
@@ -0,0 +1 @@
+export { default } from "./TabText";
diff --git a/frontend/components/TabsWrapper/_styles.scss b/frontend/components/TabsWrapper/_styles.scss
deleted file mode 100644
index d4e8d08caa..0000000000
--- a/frontend/components/TabsWrapper/_styles.scss
+++ /dev/null
@@ -1,90 +0,0 @@
-.component__tabs-wrapper {
-  position: sticky;
-  top: 0;
-  background-color: $core-white;
-  z-index: 2;
-
-  .react-tabs {
-    &__tab-list {
-      border-bottom: 1px solid $ui-gray;
-    }
-    &__tab {
-      padding: $pad-small 0;
-      margin-right: $pad-xxlarge;
-      font-size: $x-small;
-      border: none;
-      display: inline-flex;
-      flex-direction: column;
-      align-items: center;
-      line-height: 19px; // Fix shifty bold text
-
-      &:focus {
-        box-shadow: none;
-        outline: 0;
-        &:after {
-          left: 0;
-          bottom: 0;
-        }
-      }
-
-      // focus-visible only highlights when tabbing not clicking
-      &:focus-visible {
-        background-color: $ui-vibrant-blue-10;
-      }
-
-      // Bolding text when the button is active causes a layout shift
-      // so we add a hidden pseudo element with the same text string
-      &:before {
-        content: attr(data-text);
-        height: 0;
-        visibility: hidden;
-        overflow: hidden;
-        user-select: none;
-        pointer-events: none;
-        font-weight: $bold;
-      }
-      &--selected {
-        font-weight: $bold;
-
-        &::after {
-          content: "";
-          width: 100%;
-          height: 0;
-          border-bottom: 2px solid #6a67fe;
-          position: absolute;
-          bottom: 0;
-          left: 0;
-        }
-      }
-      &--disabled {
-        cursor: not-allowed;
-      }
-      &.no-count:not(.errors-empty).react-tabs__tab--selected::after {
-        bottom: -2px;
-      }
-      .count {
-        margin-right: $pad-small;
-        padding: $pad-xxsmall 12px;
-        background-color: $core-vibrant-red;
-        display: inline-block;
-        border-radius: 29px;
-        color: $core-white;
-        font-weight: $bold;
-      }
-    }
-    &__tab-panel {
-      .no-results-message {
-        margin-top: $pad-xxlarge;
-        font-size: $small;
-        font-weight: $bold;
-
-        span {
-          margin-top: $pad-medium;
-          font-size: $x-small;
-          font-weight: $regular;
-          display: block;
-        }
-      }
-    }
-  }
-}
diff --git a/frontend/components/TabsWrapper/index.ts b/frontend/components/TabsWrapper/index.ts
deleted file mode 100644
index 980c53aaa0..0000000000
--- a/frontend/components/TabsWrapper/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./TabsWrapper";
diff --git a/frontend/components/icons/Check.tsx b/frontend/components/icons/Check.tsx
index f84a2ffd1f..106f6e00c3 100644
--- a/frontend/components/icons/Check.tsx
+++ b/frontend/components/icons/Check.tsx
@@ -13,6 +13,7 @@ const Check = ({ color = "core-fleet-blue" }: ICheckProps) => {
       height="16"
       fill="none"
       viewBox="0 0 16 16"
+      aria-label="check"
     >
       <path
         stroke={COLORS[color]}
diff --git a/frontend/components/icons/Plus.tsx b/frontend/components/icons/Plus.tsx
index 8b83ebbae9..01cdf97f33 100644
--- a/frontend/components/icons/Plus.tsx
+++ b/frontend/components/icons/Plus.tsx
@@ -13,6 +13,7 @@ const Plus = ({ color = "core-fleet-blue" }: IPlusProps) => {
       fill="none"
       xmlns="http://www.w3.org/2000/svg"
       viewBox="0 0 16 16"
+      aria-label="plus"
     >
       <path
         d="M8 3v10M3 8h10"
diff --git a/frontend/pages/DashboardPage/cards/MDM/MDM.tsx b/frontend/pages/DashboardPage/cards/MDM/MDM.tsx
index 6824ebe5ae..98803b4acc 100644
--- a/frontend/pages/DashboardPage/cards/MDM/MDM.tsx
+++ b/frontend/pages/DashboardPage/cards/MDM/MDM.tsx
@@ -4,7 +4,8 @@ import { Row } from "react-table";
 
 import { IMdmStatusCardData, IMdmSummaryMdmSolution } from "interfaces/mdm";
 
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import TableContainer from "components/TableContainer";
 import Spinner from "components/Spinner";
 import TableDataError from "components/DataError";
@@ -139,11 +140,15 @@ const Mdm = ({
         </div>
       )}
       <div style={opacity}>
-        <TabsWrapper>
+        <TabNav>
           <Tabs selectedIndex={navTabIndex} onSelect={onTabChange}>
             <TabList>
-              <Tab>Solutions</Tab>
-              <Tab>Status</Tab>
+              <Tab>
+                <TabText>Solutions</TabText>
+              </Tab>
+              <Tab>
+                <TabText>Status</TabText>
+              </Tab>
             </TabList>
             <TabPanel>
               {error ? (
@@ -189,7 +194,7 @@ const Mdm = ({
               )}
             </TabPanel>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
       </div>
     </div>
   );
diff --git a/frontend/pages/DashboardPage/cards/MDM/_styles.scss b/frontend/pages/DashboardPage/cards/MDM/_styles.scss
index 29ba4c319c..e78a190404 100644
--- a/frontend/pages/DashboardPage/cards/MDM/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/MDM/_styles.scss
@@ -3,7 +3,7 @@
   position: relative;
   height: 100%; // centers loading spinner
 
-  .component__tabs-wrapper .table-container__header {
+  .tab-nav .table-container__header {
     display: none;
   }
 
diff --git a/frontend/pages/DashboardPage/cards/Munki/Munki.tsx b/frontend/pages/DashboardPage/cards/Munki/Munki.tsx
index 8b12f2d2a1..7ac7cf6a8a 100644
--- a/frontend/pages/DashboardPage/cards/Munki/Munki.tsx
+++ b/frontend/pages/DashboardPage/cards/Munki/Munki.tsx
@@ -6,7 +6,8 @@ import {
   IMunkiVersionsAggregate,
 } from "interfaces/macadmins";
 
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import TableContainer from "components/TableContainer";
 import Spinner from "components/Spinner";
 import TableDataError from "components/DataError";
@@ -58,11 +59,15 @@ const Munki = ({
         </div>
       )}
       <div style={opacity}>
-        <TabsWrapper>
+        <TabNav>
           <Tabs selectedIndex={navTabIndex} onSelect={onTabChange}>
             <TabList>
-              <Tab>Issues</Tab>
-              <Tab>Versions</Tab>
+              <Tab>
+                <TabText>Issues</TabText>
+              </Tab>
+              <Tab>
+                <TabText>Versions</TabText>
+              </Tab>
             </TabList>
             <TabPanel>
               {errorMacAdmins ? (
@@ -128,7 +133,7 @@ const Munki = ({
               )}
             </TabPanel>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
       </div>
     </div>
   );
diff --git a/frontend/pages/DashboardPage/cards/Munki/_styles.scss b/frontend/pages/DashboardPage/cards/Munki/_styles.scss
index a447f7aa36..39ba88050b 100644
--- a/frontend/pages/DashboardPage/cards/Munki/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/Munki/_styles.scss
@@ -5,7 +5,7 @@
   .data-table__wrapper {
     overflow-x: auto;
   }
-  .component__tabs-wrapper .table-container__header {
+  .tab-nav .table-container__header {
     display: none;
   }
   .data-table-block {
diff --git a/frontend/pages/DashboardPage/cards/Software/Software.tsx b/frontend/pages/DashboardPage/cards/Software/Software.tsx
index a8b8d98741..3aafa34a73 100644
--- a/frontend/pages/DashboardPage/cards/Software/Software.tsx
+++ b/frontend/pages/DashboardPage/cards/Software/Software.tsx
@@ -8,7 +8,8 @@ import { buildQueryStringFromParams } from "utilities/url";
 import { ISoftwareResponse } from "interfaces/software";
 
 import { ITableQueryData } from "components/TableContainer/TableContainer";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import TableContainer from "components/TableContainer";
 import TableDataError from "components/DataError";
 import Spinner from "components/Spinner";
@@ -76,11 +77,15 @@ const Software = ({
         </div>
       )}
       <div style={opacity}>
-        <TabsWrapper>
+        <TabNav>
           <Tabs selectedIndex={navTabIndex} onSelect={onTabChange}>
             <TabList>
-              <Tab>All</Tab>
-              <Tab>Vulnerable</Tab>
+              <Tab>
+                <TabText>All</TabText>
+              </Tab>
+              <Tab>
+                <TabText>Vulnerable</TabText>
+              </Tab>
             </TabList>
             <TabPanel>
               {!isSoftwareFetching && errorSoftware ? (
@@ -129,7 +134,7 @@ const Software = ({
               )}
             </TabPanel>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
       </div>
     </div>
   );
diff --git a/frontend/pages/DashboardPage/cards/Software/_styles.scss b/frontend/pages/DashboardPage/cards/Software/_styles.scss
index 3535b1f320..71ea46b649 100644
--- a/frontend/pages/DashboardPage/cards/Software/_styles.scss
+++ b/frontend/pages/DashboardPage/cards/Software/_styles.scss
@@ -19,7 +19,7 @@
   .form-field--dropdown {
     margin: 0;
   }
-  .component__tabs-wrapper .table-container__header {
+  .tab-nav .table-container__header {
     display: none;
   }
   &__empty-software {
diff --git a/frontend/pages/ManageControlsPage/ManageControlsPage.tsx b/frontend/pages/ManageControlsPage/ManageControlsPage.tsx
index c278cd5a3e..71570f209e 100644
--- a/frontend/pages/ManageControlsPage/ManageControlsPage.tsx
+++ b/frontend/pages/ManageControlsPage/ManageControlsPage.tsx
@@ -6,7 +6,8 @@ import PATHS from "router/paths";
 import { AppContext } from "context/app";
 import useTeamIdParam from "hooks/useTeamIdParam";
 
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import MainContent from "components/MainContent";
 import TeamsDropdown from "components/TeamsDropdown";
 import { parseOSUpdatesCurrentVersionsQueryParams } from "./OSUpdates/components/CurrentVersionSection/CurrentVersionSection";
@@ -112,7 +113,7 @@ const ManageControlsPage = ({
   const renderBody = () => {
     return (
       <div>
-        <TabsWrapper>
+        <TabNav>
           <Tabs
             selectedIndex={getTabIndex(location?.pathname || "")}
             onSelect={navigateToNav}
@@ -121,13 +122,13 @@ const ManageControlsPage = ({
               {controlsSubNav.map((navItem) => {
                 return (
                   <Tab key={navItem.name} data-text={navItem.name}>
-                    {navItem.name}
+                    <TabText>{navItem.name}</TabText>
                   </Tab>
                 );
               })}
             </TabList>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
         {React.cloneElement(children, {
           teamIdForApi,
           currentPage: page,
diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx
index d69a9ec838..bc02c5800f 100644
--- a/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx
+++ b/frontend/pages/ManageControlsPage/OSUpdates/components/PlatformTabs/PlatformTabs.tsx
@@ -1,6 +1,7 @@
 import React from "react";
 import { Tab, TabList, TabPanel, Tabs } from "react-tabs";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import CustomLink from "components/CustomLink";
 import { SUPPORT_LINK } from "utilities/constants";
 
@@ -62,27 +63,25 @@ const PlatformTabs = ({
 
   return (
     <div className={baseClass}>
-      <TabsWrapper>
+      <TabNav>
         <Tabs
           defaultIndex={platformByIndex.indexOf(selectedPlatform)}
           onSelect={onTabChange}
         >
           <TabList>
-            {/* Bolding text when the tab is active causes a layout shift so
-            we add a hidden pseudo element with the same text string */}
             <Tab key="macOS" data-text="macOS">
-              macOS
+              <TabText>macOS</TabText>
             </Tab>
             {isWindowsMdmEnabled && (
               <Tab key="Windows" data-text="Windows">
-                Windows
+                <TabText>Windows</TabText>
               </Tab>
             )}
             <Tab key="iOS" data-text="iOS">
-              iOS
+              <TabText>iOS</TabText>
             </Tab>
             <Tab key="iPadOS" data-text="iPadOS">
-              iPadOS
+              <TabText>iPadOS</TabText>
             </Tab>
             {isAndroidMdmEnabled && (
               <Tab key="Android" data-text="Android">
@@ -149,7 +148,7 @@ const PlatformTabs = ({
             </TabPanel>
           )}
         </Tabs>
-      </TabsWrapper>
+      </TabNav>
     </div>
   );
 };
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx
index ef9f244ab2..fa326a9a5d 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx
@@ -11,7 +11,8 @@ import { APP_CONTEXT_NO_TEAM_ID } from "interfaces/team";
 
 import MainContent from "components/MainContent";
 import BackLink from "components/BackLink";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import SidePanelContent from "components/SidePanelContent";
 import QuerySidePanel from "components/side_panels/QuerySidePanel";
 
@@ -112,7 +113,7 @@ const SoftwareAddPage = ({
             className={`${baseClass}__back-to-software`}
           />
           <h1>Add software</h1>
-          <TabsWrapper>
+          <TabNav>
             <Tabs
               selectedIndex={getTabIndex(location?.pathname || "")}
               onSelect={navigateToNav}
@@ -121,13 +122,13 @@ const SoftwareAddPage = ({
                 {addSoftwareSubNav.map((navItem) => {
                   return (
                     <Tab key={navItem.name} data-text={navItem.name}>
-                      {navItem.name}
+                      <TabText>{navItem.name}</TabText>
                     </Tab>
                   );
                 })}
               </TabList>
             </Tabs>
-          </TabsWrapper>
+          </TabNav>
           {React.cloneElement(children, {
             router,
             currentTeamId: parseInt(location.query.team_id, 10),
diff --git a/frontend/pages/SoftwarePage/SoftwarePage.tsx b/frontend/pages/SoftwarePage/SoftwarePage.tsx
index 21a8e18d55..0beceae5c3 100644
--- a/frontend/pages/SoftwarePage/SoftwarePage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwarePage.tsx
@@ -31,7 +31,8 @@ import { getNextLocationPath } from "utilities/helpers";
 import Button from "components/buttons/Button";
 import MainContent from "components/MainContent";
 import TeamsHeader from "components/TeamsHeader";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 
 import ManageAutomationsModal from "./components/ManageSoftwareAutomationsModal";
 import AddSoftwareModal from "./components/AddSoftwareModal";
@@ -412,7 +413,7 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
   const renderBody = () => {
     return (
       <div>
-        <TabsWrapper>
+        <TabNav>
           <Tabs
             selectedIndex={getTabIndex(location?.pathname || "")}
             onSelect={navigateToNav}
@@ -421,13 +422,13 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
               {softwareSubNav.map((navItem) => {
                 return (
                   <Tab key={navItem.name} data-text={navItem.name}>
-                    {navItem.name}
+                    <TabText>{navItem.name}</TabText>
                   </Tab>
                 );
               })}
             </TabList>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
         {React.cloneElement(children, {
           router,
           isSoftwareEnabled: Boolean(
diff --git a/frontend/pages/SoftwarePage/_styles.scss b/frontend/pages/SoftwarePage/_styles.scss
index fdbe0bea5d..5500c122f1 100644
--- a/frontend/pages/SoftwarePage/_styles.scss
+++ b/frontend/pages/SoftwarePage/_styles.scss
@@ -57,7 +57,7 @@
   }
 
   &__wrapper {
-    .component__tabs-wrapper {
+    .tab-nav {
       margin-bottom: $pad-xxlarge;
     }
   }
diff --git a/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss b/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss
index 706272708b..cd58cf7729 100644
--- a/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss
+++ b/frontend/pages/SoftwarePage/components/AddSoftwareModal/_styles.scss
@@ -1,7 +1,6 @@
 .add-software-modal {
-
   // have to use this selector to override the default styles
-  .component__tabs-wrapper {
+  .tab-nav {
     margin-bottom: 0;
   }
 }
diff --git a/frontend/pages/admin/AdminWrapper.tsx b/frontend/pages/admin/AdminWrapper.tsx
index 9efa69ae67..98666ac002 100644
--- a/frontend/pages/admin/AdminWrapper.tsx
+++ b/frontend/pages/admin/AdminWrapper.tsx
@@ -4,8 +4,9 @@ import { InjectedRouter } from "react-router";
 import PATHS from "router/paths";
 import { AppContext } from "context/app";
 
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
 import MainContent from "components/MainContent";
+import TabText from "components/TabText";
 import classnames from "classnames";
 
 interface ISettingSubNavItem {
@@ -77,7 +78,7 @@ const AdminWrapper = ({
   return (
     <MainContent className={classNames}>
       <div className={`${baseClass}_wrapper`}>
-        <TabsWrapper>
+        <TabNav>
           <h1>Settings</h1>
           <Tabs
             selectedIndex={getTabIndex(pathname)}
@@ -89,13 +90,13 @@ const AdminWrapper = ({
                 // so we add a hidden pseudo element with the same text string
                 return (
                   <Tab key={navItem.name} data-text={navItem.name}>
-                    {navItem.name}
+                    <TabText>{navItem.name}</TabText>
                   </Tab>
                 );
               })}
             </TabList>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
         {children}
       </div>
     </MainContent>
diff --git a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
index 3a35856f60..eaf07701c0 100644
--- a/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
+++ b/frontend/pages/admin/TeamManagementPage/TeamDetailsWrapper/TeamDetailsWrapper.tsx
@@ -24,7 +24,8 @@ import sortUtils from "utilities/sort";
 
 import ActionButtons from "components/buttons/ActionButtons/ActionButtons";
 import Spinner from "components/Spinner";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import BackLink from "components/BackLink";
 import TeamsDropdown from "components/TeamsDropdown";
 import MainContent from "components/MainContent";
@@ -387,69 +388,66 @@ const TeamDetailsWrapper = ({
   return (
     <MainContent className={baseClass}>
       <>
-        <TabsWrapper>
-          {isGlobalAdmin ? (
-            <div className={`${baseClass}__header-links`}>
-              <BackLink text="Back to teams" path={PATHS.ADMIN_TEAMS} />
-            </div>
-          ) : (
-            <></>
-          )}
-          <div className={`${baseClass}__team-header`}>
-            <div className={`${baseClass}__team-details`}>
-              {userTeams?.length === 1 ? (
-                <h1>{currentTeamDetails.name}</h1>
-              ) : (
-                <TeamsDropdown
-                  selectedTeamId={currentTeamId}
-                  currentUserTeams={userTeams || []}
-                  isDisabled={isLoadingTeams}
-                  includeAll={false}
-                  onChange={handleTeamChange}
-                />
-              )}
-              {!!hostsTotalDisplay && (
-                <span className={`${baseClass}__host-count`}>
-                  {hostsTotalDisplay}
-                </span>
-              )}
-            </div>
-            <ActionButtons
-              baseClass={baseClass}
-              actions={[
-                {
-                  type: "primary",
-                  label: "Add hosts",
-                  onClick: toggleAddHostsModal,
-                },
-                {
-                  type: "secondary",
-                  label: "Manage enroll secrets",
-                  buttonVariant: "text-icon",
-                  iconSvg: "eye",
-                  onClick: toggleManageEnrollSecretsModal,
-                  gitOpsModeCompatible: true,
-                },
-                {
-                  type: "secondary",
-                  label: "Rename team",
-                  buttonVariant: "text-icon",
-                  iconSvg: "pencil",
-                  onClick: toggleRenameTeamModal,
-                  gitOpsModeCompatible: true,
-                },
-                {
-                  type: "secondary",
-                  label: "Delete team",
-                  buttonVariant: "text-icon",
-                  iconSvg: "trash",
-                  hideAction: !isGlobalAdmin,
-                  onClick: toggleDeleteTeamModal,
-                  gitOpsModeCompatible: true,
-                },
-              ]}
-            />
+        {isGlobalAdmin ? (
+          <div className={`${baseClass}__header-links`}>
+            <BackLink text="Back to teams" path={PATHS.ADMIN_TEAMS} />
           </div>
+        ) : (
+          <></>
+        )}
+        <div className={`${baseClass}__team-header`}>
+          <div className={`${baseClass}__team-details`}>
+            {userTeams?.length === 1 ? (
+              <h1>{currentTeamDetails.name}</h1>
+            ) : (
+              <TeamsDropdown
+                selectedTeamId={currentTeamId}
+                currentUserTeams={userTeams || []}
+                isDisabled={isLoadingTeams}
+                includeAll={false}
+                onChange={handleTeamChange}
+              />
+            )}
+            {!!hostsTotalDisplay && (
+              <span className={`${baseClass}__host-count`}>
+                {hostsTotalDisplay}
+              </span>
+            )}
+          </div>
+          <ActionButtons
+            baseClass={baseClass}
+            actions={[
+              {
+                type: "primary",
+                label: "Add hosts",
+                onClick: toggleAddHostsModal,
+              },
+              {
+                type: "secondary",
+                label: "Manage enroll secrets",
+                buttonVariant: "text-icon",
+                iconSvg: "eye",
+                onClick: toggleManageEnrollSecretsModal,
+              },
+              {
+                type: "secondary",
+                label: "Rename team",
+                buttonVariant: "text-icon",
+                iconSvg: "pencil",
+                onClick: toggleRenameTeamModal,
+              },
+              {
+                type: "secondary",
+                label: "Delete team",
+                buttonVariant: "text-icon",
+                iconSvg: "trash",
+                hideAction: !isGlobalAdmin,
+                onClick: toggleDeleteTeamModal,
+              },
+            ]}
+          />
+        </div>
+        <TabNav>
           <Tabs
             selectedIndex={getTabIndex(
               location.pathname,
@@ -463,13 +461,13 @@ const TeamDetailsWrapper = ({
                 // so we add a hidden pseudo element with the same text string
                 return (
                   <Tab key={navItem.name} data-text={navItem.name}>
-                    {navItem.name}
+                    <TabText>{navItem.name}</TabText>
                   </Tab>
                 );
               })}
             </TabList>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
         {showAddHostsModal && (
           <AddHostsModal
             currentTeamName={currentTeamName}
diff --git a/frontend/pages/admin/_styles.scss b/frontend/pages/admin/_styles.scss
index 5c0624fbeb..10c4aa141c 100644
--- a/frontend/pages/admin/_styles.scss
+++ b/frontend/pages/admin/_styles.scss
@@ -22,7 +22,7 @@
     }
   }
 
-  .component__tabs-wrapper {
+  .tab-nav {
     top: $pad-xxlarge; // for sticky
     z-index: 3;
     padding-bottom: $pad-xxlarge;
diff --git a/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx b/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
index ac43bb2b30..296f7b4aec 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/DeviceUserPage.tsx
@@ -23,7 +23,8 @@ import DeviceUserError from "components/DeviceUserError";
 import OrgLogoIcon from "components/icons/OrgLogoIcon";
 import Spinner from "components/Spinner";
 import Button from "components/buttons/Button";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import Icon from "components/Icon/Icon";
 import FlashMessage from "components/FlashMessage";
 
@@ -390,25 +391,30 @@ const DeviceUserPage = ({
               osSettings={host?.mdm.os_settings}
               deviceUser
             />
-            <TabsWrapper className={`${baseClass}__tabs-wrapper`}>
+            <TabNav className={`${baseClass}__tab-nav`}>
               <Tabs
                 selectedIndex={findSelectedTab(location.pathname)}
                 onSelect={(i) => router.push(tabPaths[i])}
               >
                 <TabList>
-                  <Tab>Details</Tab>
+                  <Tab>
+                    <TabText>Details</TabText>
+                  </Tab>
                   {isPremiumTier && isSoftwareEnabled && hasSelfService && (
-                    <Tab>Self-service</Tab>
+                    <Tab>
+                      <TabText>Self-service</TabText>
+                    </Tab>
+                  )}
+                  {isSoftwareEnabled && (
+                    <Tab>
+                      <TabText>Software</TabText>
+                    </Tab>
                   )}
-                  {isSoftwareEnabled && <Tab>Software</Tab>}
                   {isPremiumTier && (
                     <Tab>
-                      <div>
-                        {failingPoliciesCount > 0 && (
-                          <span className="count">{failingPoliciesCount}</span>
-                        )}
+                      <TabText count={failingPoliciesCount} isErrorCount>
                         Policies
-                      </div>
+                      </TabText>
                     </Tab>
                   )}
                 </TabList>
@@ -461,7 +467,7 @@ const DeviceUserPage = ({
                   </TabPanel>
                 )}
               </Tabs>
-            </TabsWrapper>
+            </TabNav>
             {showInfoModal && <InfoModal onCancel={toggleInfoModal} />}
             {showEnrollMdmModal &&
               (host.dep_assigned_to_fleet ? (
diff --git a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
index 8f72c023ec..dd5d715c00 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
@@ -45,7 +45,8 @@ import {
 import { isAndroid, isIPadOrIPhone } from "interfaces/platform";
 
 import Spinner from "components/Spinner";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import MainContent from "components/MainContent";
 import BackLink from "components/BackLink";
 import RunScriptDetailsModal from "pages/DashboardPage/cards/ActivityFeed/components/RunScriptDetailsModal";
@@ -124,6 +125,7 @@ interface IHostDetailsSubNavItem {
   name: string | JSX.Element;
   title: string;
   pathname: string;
+  count?: number;
 }
 
 const DEFAULT_ACTIVITY_PAGE_SIZE = 8;
@@ -755,16 +757,10 @@ const HostDetailsPage = ({
       pathname: PATHS.HOST_QUERIES(hostIdFromURL),
     },
     {
-      name: (
-        <>
-          {failingPoliciesCount > 0 && (
-            <span className="count">{failingPoliciesCount}</span>
-          )}
-          Policies
-        </>
-      ),
+      name: "Policies",
       title: "policies",
       pathname: PATHS.HOST_POLICIES(hostIdFromURL),
+      count: failingPoliciesCount,
     },
   ];
 
@@ -844,7 +840,7 @@ const HostDetailsPage = ({
           )}
           hostMdmDeviceStatus={hostMdmDeviceStatus}
         />
-        <TabsWrapper className={`${baseClass}__tabs-wrapper`}>
+        <TabNav className={`${baseClass}__tab-nav`}>
           <Tabs
             selectedIndex={getTabIndex(location.pathname)}
             onSelect={(i) => navigateToNav(i)}
@@ -853,7 +849,13 @@ const HostDetailsPage = ({
               {hostDetailsSubNav.map((navItem) => {
                 // Bolding text when the tab is active causes a layout shift
                 // so we add a hidden pseudo element with the same text string
-                return <Tab key={navItem.title}>{navItem.name}</Tab>;
+                return (
+                  <Tab key={navItem.title}>
+                    <TabText count={navItem.count} isErrorCount>
+                      {navItem.name}
+                    </TabText>
+                  </Tab>
+                );
               })}
             </TabList>
             <TabPanel className={detailsPanelClass}>
@@ -956,7 +958,7 @@ const HostDetailsPage = ({
               />
             </TabPanel>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
         {showDeleteHostModal && (
           <DeleteHostModal
             onCancel={() => setShowDeleteHostModal(false)}
diff --git a/frontend/pages/hosts/details/HostDetailsPage/_styles.scss b/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
index 25f6e705f6..00621284c3 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
+++ b/frontend/pages/hosts/details/HostDetailsPage/_styles.scss
@@ -1,11 +1,4 @@
 .host-details {
-  &__tabs-wrapper {
-    .react-tabs__tab {
-      display: inline-flex;
-      flex-direction: row;
-    }
-  }
-
   // grid layout styles for the host details page
   &__details-panel {
     display: grid;
diff --git a/frontend/pages/hosts/details/_styles.scss b/frontend/pages/hosts/details/_styles.scss
index cd225a7577..d9efc254f5 100644
--- a/frontend/pages/hosts/details/_styles.scss
+++ b/frontend/pages/hosts/details/_styles.scss
@@ -71,24 +71,15 @@
     }
   }
 
-  &__tabs-wrapper {
+  &__tab-nav {
     background-color: $ui-off-white;
     width: 100%;
 
     // direct descendant of selector allows us to only change the first level of
     // tab styling and not change the tabs inside the cards.
     > .react-tabs > .react-tabs__tab-list {
-      .react-tabs__tab {
-        padding: 6px 0px 16px 0px;
-        margin-right: $pad-xxlarge;
-      }
       .react-tabs__tab--selected {
         background-color: $ui-off-white;
-
-        // When tabbing through the app
-        &:focus-visible {
-          background-color: $ui-vibrant-blue-10;
-        }
       }
     }
   }
@@ -160,6 +151,6 @@
 
 // we dont need the margin on the host details page as we are not using grid css
 // for the spacing.
-.host-details__tabs-wrapper .card {
+.host-details__tab-nav .card {
   margin-top: 0;
 }
diff --git a/frontend/pages/hosts/details/cards/Activity/Activity.tsx b/frontend/pages/hosts/details/cards/Activity/Activity.tsx
index 58646d7661..97739410a1 100644
--- a/frontend/pages/hosts/details/cards/Activity/Activity.tsx
+++ b/frontend/pages/hosts/details/cards/Activity/Activity.tsx
@@ -8,7 +8,8 @@ import {
 } from "services/entities/activities";
 
 import Card from "components/Card";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import Spinner from "components/Spinner";
 import TooltipWrapper from "components/TooltipWrapper";
 import { ShowActivityDetailsHandler } from "components/ActivityItem/ActivityItem";
@@ -67,20 +68,17 @@ const Activity = ({
         </div>
       )}
       <h2>Activity</h2>
-      <TabsWrapper>
+      <TabNav>
         <Tabs
           selectedIndex={activeTab === "past" ? 0 : 1}
           onSelect={onChangeTab}
         >
           <TabList>
-            <Tab>Past</Tab>
             <Tab>
-              Upcoming
-              {!!upcomingCount && (
-                <span className={`${baseClass}__upcoming-count`}>
-                  {upcomingCount}
-                </span>
-              )}
+              <TabText>Past</TabText>
+            </Tab>
+            <Tab>
+              <TabText count={upcomingCount}>Upcoming</TabText>
             </Tab>
           </TabList>
           <TabPanel>
@@ -106,7 +104,7 @@ const Activity = ({
             />
           </TabPanel>
         </Tabs>
-      </TabsWrapper>
+      </TabNav>
     </Card>
   );
 };
diff --git a/frontend/pages/hosts/details/cards/Activity/_styles.scss b/frontend/pages/hosts/details/cards/Activity/_styles.scss
index 7fc58cd091..3aee164762 100644
--- a/frontend/pages/hosts/details/cards/Activity/_styles.scss
+++ b/frontend/pages/hosts/details/cards/Activity/_styles.scss
@@ -6,21 +6,6 @@
     margin: 0 0 $pad-large;
   }
 
-  .react-tabs__tab-list {
-    li:first-of-type {
-      padding-bottom: 10px; // adds 2px to bottom padding of "Past" tab to adjust for the count badge on the "Upcoming" tab
-    }
-  }
-
-  &__upcoming-count {
-    padding: $pad-xxsmall $pad-xsmall;
-    color: $core-white;
-    background-color: $core-vibrant-blue;
-    border-radius: $border-radius;
-    font-weight: $bold;
-    margin-left: $pad-small;
-  }
-
   &__loading-overlay {
     height: 100%;
     width: 100%;
diff --git a/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx b/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx
index 74c30fd026..078d7158b3 100644
--- a/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx
+++ b/frontend/pages/hosts/details/cards/Software/SoftwareDetailsModal/SoftwareDetailsModal.tsx
@@ -11,7 +11,8 @@ import {
 } from "interfaces/software";
 
 import Modal from "components/Modal";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import Button from "components/buttons/Button";
 import DataSet from "components/DataSet";
 import { dateAgo } from "utilities/date_format";
@@ -169,11 +170,15 @@ const TabsContent = ({
   software: IHostSoftware;
 }) => {
   return (
-    <TabsWrapper>
+    <TabNav>
       <Tabs>
         <TabList>
-          <Tab>Software details</Tab>
-          <Tab>Install details</Tab>
+          <Tab>
+            <TabText>Software details</TabText>
+          </Tab>
+          <Tab>
+            <TabText>Install details</TabText>
+          </Tab>
         </TabList>
         <TabPanel>
           <SoftwareDetailsContent software={software} />
@@ -185,7 +190,7 @@ const TabsContent = ({
           />
         </TabPanel>
       </Tabs>
-    </TabsWrapper>
+    </TabNav>
   );
 };
 
diff --git a/frontend/pages/labels/NewLabelPage/NewLabelPage.tsx b/frontend/pages/labels/NewLabelPage/NewLabelPage.tsx
index 1f18639c42..10ff28f75f 100644
--- a/frontend/pages/labels/NewLabelPage/NewLabelPage.tsx
+++ b/frontend/pages/labels/NewLabelPage/NewLabelPage.tsx
@@ -6,7 +6,8 @@ import useToggleSidePanel from "hooks/useToggleSidePanel";
 
 import MainContent from "components/MainContent";
 import SidePanelContent from "components/SidePanelContent";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import QuerySidePanel from "components/side_panels/QuerySidePanel";
 
 import PATHS from "router/paths";
@@ -79,7 +80,7 @@ const NewLabelPage = ({ router, location, children }: INewLabelPageProps) => {
           Dynamic (smart) labels are assigned to hosts if the query returns
           results. Manual labels are assigned to selected hosts.
         </p>
-        <TabsWrapper className={`${baseClass}__new-label-tabs-wrapper`}>
+        <TabNav className={`${baseClass}__new-label-tab-nav`}>
           <Tabs
             selectedIndex={getTabIndex(location?.pathname || "")}
             onSelect={navigateToNav}
@@ -88,13 +89,13 @@ const NewLabelPage = ({ router, location, children }: INewLabelPageProps) => {
               {labelSubNav.map((navItem) => {
                 return (
                   <Tab key={navItem.name} data-text={navItem.name}>
-                    {navItem.name}
+                    <TabText>{navItem.name}</TabText>
                   </Tab>
                 );
               })}
             </TabList>
           </Tabs>
-        </TabsWrapper>
+        </TabNav>
         {React.cloneElement(children, {
           showOpenSidebarButton,
           onOpenSidebar,
diff --git a/frontend/pages/labels/NewLabelPage/_styles.scss b/frontend/pages/labels/NewLabelPage/_styles.scss
index 637d670a31..bb1592ba83 100644
--- a/frontend/pages/labels/NewLabelPage/_styles.scss
+++ b/frontend/pages/labels/NewLabelPage/_styles.scss
@@ -9,7 +9,7 @@
     font-size: $xx-small;
   }
 
-  &__new-label-tabs-wrapper {
+  &__new-label-tab-nav {
     margin-bottom: $pad-xxlarge;
   }
 }
diff --git a/frontend/pages/policies/PolicyPage/components/PolicyResults/PolicyResults.tsx b/frontend/pages/policies/PolicyPage/components/PolicyResults/PolicyResults.tsx
index b78ffbb171..07f2aa5c3a 100644
--- a/frontend/pages/policies/PolicyPage/components/PolicyResults/PolicyResults.tsx
+++ b/frontend/pages/policies/PolicyPage/components/PolicyResults/PolicyResults.tsx
@@ -15,7 +15,8 @@ import { ITarget } from "interfaces/target";
 
 import Button from "components/buttons/Button";
 import Icon from "components/Icon/Icon";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import InfoBanner from "components/InfoBanner";
 import ShowQueryModal from "components/modals/ShowQueryModal";
 import TooltipWrapper from "components/TooltipWrapper";
@@ -240,23 +241,22 @@ const PolicyResults = ({
         onClickRunAgain={onRunQuery}
         onClickStop={onStopQuery}
       />
-      <TabsWrapper>
+      <TabNav>
         <Tabs selectedIndex={navTabIndex} onSelect={(i) => setNavTabIndex(i)}>
           <TabList>
-            <Tab className={firstTabClass}>{NAV_TITLES.RESULTS}</Tab>
+            <Tab className={firstTabClass}>
+              <TabText>{NAV_TITLES.RESULTS}</TabText>
+            </Tab>
             <Tab disabled={!errors?.length}>
-              <span>
-                {errors?.length > 0 && (
-                  <span className="count">{errors.length}</span>
-                )}
+              <TabText count={errors?.length} isErrorCount>
                 {NAV_TITLES.ERRORS}
-              </span>
+              </TabText>
             </Tab>
           </TabList>
           <TabPanel>{renderResultsTable()}</TabPanel>
           <TabPanel>{renderErrorsTable()}</TabPanel>
         </Tabs>
-      </TabsWrapper>
+      </TabNav>
       {showQueryModal && (
         <ShowQueryModal
           query={lastEditedQueryBody}
diff --git a/frontend/pages/queries/edit/components/QueryResults/QueryResults.tsx b/frontend/pages/queries/edit/components/QueryResults/QueryResults.tsx
index 66781a13e4..5073a736b3 100644
--- a/frontend/pages/queries/edit/components/QueryResults/QueryResults.tsx
+++ b/frontend/pages/queries/edit/components/QueryResults/QueryResults.tsx
@@ -18,7 +18,8 @@ import Button from "components/buttons/Button";
 import Icon from "components/Icon/Icon";
 import TableContainer from "components/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
-import TabsWrapper from "components/TabsWrapper";
+import TabNav from "components/TabNav";
+import TabText from "components/TabText";
 import ShowQueryModal from "components/modals/ShowQueryModal";
 import QueryResultsHeading from "components/queries/queryResults/QueryResultsHeading";
 import AwaitingResults from "components/queries/queryResults/AwaitingResults";
@@ -283,25 +284,20 @@ const QueryResults = ({
           </div>
         </InfoBanner>
       )}
-      <TabsWrapper>
+      <TabNav>
         <Tabs selectedIndex={navTabIndex} onSelect={(i) => setNavTabIndex(i)}>
           <TabList>
             <Tab className={firstTabClass}>{NAV_TITLES.RESULTS}</Tab>
             <Tab disabled={!errors?.length}>
-              <span>
-                {errors?.length > 0 && (
-                  <span className="count">
-                    {errors.length.toLocaleString()}
-                  </span>
-                )}
+              <TabText count={errors?.length} isErrorCount>
                 {NAV_TITLES.ERRORS}
-              </span>
+              </TabText>
             </Tab>
           </TabList>
           <TabPanel>{renderResultsTab()}</TabPanel>
           <TabPanel>{renderErrorsTab()}</TabPanel>
         </Tabs>
-      </TabsWrapper>
+      </TabNav>
       {showQueryModal && (
         <ShowQueryModal
           query={lastEditedQueryBody}

From 769154b8219e4b0ce3d81d560aac276e9c714d72 Mon Sep 17 00:00:00 2001
From: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Date: Thu, 27 Feb 2025 10:53:34 -0500
Subject: [PATCH 11/15] Fleet UI: Fix several team ids that were dropping in
 certain flows (#26590)

---
 changes/26569-team-id-dropping-bug            |   1 +
 .../PlatformSelector/PlatformSelector.tsx     |   9 +-
 .../SandboxExpiryMessage.tsx                  |  62 --------
 .../Sandbox/SandboxExpiryMessage/_styles.scss |  34 -----
 .../Sandbox/SandboxExpiryMessage/index.ts     |   1 -
 .../ViewAllHostsLink/ViewAllHostsLink.tsx     |   6 +-
 .../top_nav/SiteTopNav/SiteTopNav.tsx         |   6 +-
 .../LowDiskSpaceHosts/LowDiskSpaceHosts.tsx   |  12 +-
 .../cards/MissingHosts/MissingHosts.tsx       |   6 +-
 .../cards/OperatingSystems/OSTableConfig.tsx  |  12 +-
 .../DashboardPage/cards/Software/Software.tsx |  11 +-
 .../cards/TotalHosts/TotalHosts.tsx           |  10 +-
 .../PlatformHostCounts/PlatformHostCounts.tsx |  37 ++---
 .../ProfileStatusAggregate.tsx                |  16 +--
 .../DiskEncryptionTable.tsx                   |   6 +-
 .../EditScriptModal/EditScriptModal.tsx       |  21 ++-
 .../ScriptDetailsModal/ScriptDetailsModal.tsx |  21 ++-
 .../SoftwareAddPage/SoftwareAddPage.tsx       |  14 +-
 .../SoftwareAppStoreVpp.tsx                   |   6 +-
 .../SoftwareCustomPackage.tsx                 |   8 +-
 .../FleetMaintainedAppDetailsPage.tsx         |  14 +-
 .../FleetMaintainedAppsTable.tsx              |  11 +-
 .../FleetMaintainedAppsTableConfig.tsx        |  11 +-
 .../SoftwareOSTable/SoftwareOSTable.tsx       |  12 +-
 frontend/pages/SoftwarePage/SoftwarePage.tsx  |  16 ++-
 .../AutomaticInstallModal.tsx                 |  12 +-
 .../SoftwareInstallerCard.tsx                 |   6 +-
 .../SoftwareTitleDetailsPage.tsx              |  12 +-
 .../SoftwareTitleDetailsTable.tsx             |  12 +-
 .../SoftwareTitleDetailsTableConfig.tsx       |  10 +-
 .../SoftwareTable/SoftwareTable.tsx           |  13 +-
 .../SoftwareTitlesTableConfig.tsx             |  10 +-
 .../SoftwareVersionsTableConfig.tsx           |  14 +-
 .../SoftwareVulnerabilitiesTable.tsx          |  14 +-
 .../VulnerabilitiesTableConfig.tsx            |  10 +-
 .../SoftwareVulnOSVersions.tsx                |  10 +-
 .../SwVulnOSTableConfig.tsx                   |  10 +-
 .../SoftwareVulnSoftwareVersions.tsx          |  18 +--
 .../SwVulnSwTableConfig.tsx                   |  10 +-
 .../SoftwareVulnerabilitiesTable.tsx          |  14 +-
 .../SoftwareVulnerabilitiesTableConfig.tsx    |  12 +-
 .../cards/Calendars/Calendars.tsx             |   7 +-
 .../HostDetailsPage/HostDetailsPage.tsx       |   1 +
 .../ScriptModalGroup/ScriptModalGroup.tsx     |   3 +
 .../SelectQueryModal/SelectQueryModal.tsx     |  15 +-
 .../HostQueryReport/HostQueryReport.tsx       |  32 +++--
 .../details/cards/Policies/HostPolicies.tsx   |  18 +--
 .../Software/HostSoftwareTableConfig.tsx      |   6 +-
 .../DynamicLabel/DynamicLabel.tsx             |   8 +-
 .../NewLabelPage/ManualLabel/ManualLabel.tsx  |   8 +-
 .../InstallSoftwareModal.tsx                  |  12 +-
 .../PoliciesTable/PoliciesTableConfig.tsx     | 134 +++++++++---------
 .../PolicyRunScriptModal.tsx                  |  11 +-
 .../pages/policies/PolicyPage/PolicyPage.tsx  |   6 +-
 .../PolicyPage/screens/QueryEditor.tsx        |  16 ++-
 .../ManageQueriesPage/ManageQueriesPage.tsx   |   9 +-
 .../components/QueriesTable/QueriesTable.tsx  |  15 +-
 .../QueriesTable/QueriesTableConfig.tsx       |  78 +++++-----
 .../QueryDetailsPage/QueryDetailsPage.tsx     |  24 +++-
 frontend/pages/queries/edit/EditQueryPage.tsx |  66 +++++----
 .../EditQueryForm/EditQueryForm.tsx           |  28 ++--
 .../live/LiveQueryPage/LiveQueryPage.tsx      |  23 +--
 frontend/router/page_titles.ts                |   2 +-
 frontend/router/paths.ts                      |  51 ++-----
 frontend/utilities/helpers.tsx                |  25 ----
 frontend/utilities/url/index.ts               |  19 +++
 frontend/utilities/url/url.tests.ts           | 124 ++++++++++------
 67 files changed, 657 insertions(+), 634 deletions(-)
 create mode 100644 changes/26569-team-id-dropping-bug
 delete mode 100644 frontend/components/Sandbox/SandboxExpiryMessage/SandboxExpiryMessage.tsx
 delete mode 100644 frontend/components/Sandbox/SandboxExpiryMessage/_styles.scss
 delete mode 100644 frontend/components/Sandbox/SandboxExpiryMessage/index.ts

diff --git a/changes/26569-team-id-dropping-bug b/changes/26569-team-id-dropping-bug
new file mode 100644
index 0000000000..378a8ff17b
--- /dev/null
+++ b/changes/26569-team-id-dropping-bug
@@ -0,0 +1 @@
+- Fleet UI: Fixed several links that were dropping team_id parameters resetting team to All teams
diff --git a/frontend/components/PlatformSelector/PlatformSelector.tsx b/frontend/components/PlatformSelector/PlatformSelector.tsx
index 54bbfbcd82..a9955c6a68 100644
--- a/frontend/components/PlatformSelector/PlatformSelector.tsx
+++ b/frontend/components/PlatformSelector/PlatformSelector.tsx
@@ -5,7 +5,7 @@ import { IPolicySoftwareToInstall } from "interfaces/policy";
 import Checkbox from "components/forms/fields/Checkbox";
 import CustomLink from "components/CustomLink";
 import TooltipWrapper from "components/TooltipWrapper";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import paths from "router/paths";
 
 interface IPlatformSelectorProps {
@@ -49,9 +49,10 @@ export const PlatformSelector = ({
     }
     const softwareName = installSoftware.name;
     const softwareId = installSoftware.software_title_id.toString();
-    const softwareLink = `${paths.SOFTWARE_TITLE_DETAILS(
-      softwareId
-    )}?${buildQueryStringFromParams({ team_id: currentTeamId })}`;
+    const softwareLink = getPathWithQueryParams(
+      paths.SOFTWARE_TITLE_DETAILS(softwareId),
+      { team_id: currentTeamId }
+    );
 
     return (
       <span className={`${baseClass}__install-software`}>
diff --git a/frontend/components/Sandbox/SandboxExpiryMessage/SandboxExpiryMessage.tsx b/frontend/components/Sandbox/SandboxExpiryMessage/SandboxExpiryMessage.tsx
deleted file mode 100644
index a8d3f130b6..0000000000
--- a/frontend/components/Sandbox/SandboxExpiryMessage/SandboxExpiryMessage.tsx
+++ /dev/null
@@ -1,62 +0,0 @@
-import React from "react";
-import { browserHistory } from "react-router";
-import PATHS from "router/paths";
-
-import Button from "components/buttons/Button";
-import Icon from "components/Icon";
-
-const baseClass = "sandbox-expiry-message";
-
-interface ISandboxExpiryMessageProps {
-  expiry: string;
-  noSandboxHosts?: boolean;
-}
-
-const SandboxExpiryMessage = ({
-  expiry,
-  noSandboxHosts,
-}: ISandboxExpiryMessageProps) => {
-  const openAddHostModal = () => {
-    browserHistory.push(PATHS.MANAGE_HOSTS_ADD_HOSTS);
-  };
-
-  if (noSandboxHosts) {
-    return (
-      <div className={baseClass}>
-        <p>Your Fleet Sandbox expires in {expiry}.</p>
-        <div className={`${baseClass}__tip`}>
-          <Icon name="lightbulb" size="large" />
-          <p>
-            <b>Quick tip: </b> Enroll a host to get started.
-          </p>
-          <form>
-            <Button
-              onClick={openAddHostModal}
-              className={`${baseClass}__add-hosts`}
-              variant="brand"
-            >
-              <span>Add hosts</span>
-            </Button>
-          </form>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <a
-      href="https://fleetdm.com/docs/using-fleet/learn-how-to-use-fleet#how-to-add-your-device-to-fleet"
-      target="_blank"
-      rel="noreferrer"
-      className={baseClass}
-    >
-      <p>Your Fleet Sandbox expires in {expiry}.</p>
-      <p>
-        <b>Learn how to use Fleet</b>{" "}
-        <Icon name="external-link" color="core-fleet-black" />
-      </p>
-    </a>
-  );
-};
-
-export default SandboxExpiryMessage;
diff --git a/frontend/components/Sandbox/SandboxExpiryMessage/_styles.scss b/frontend/components/Sandbox/SandboxExpiryMessage/_styles.scss
deleted file mode 100644
index b19dd14b30..0000000000
--- a/frontend/components/Sandbox/SandboxExpiryMessage/_styles.scss
+++ /dev/null
@@ -1,34 +0,0 @@
-.sandbox-expiry-message {
-  display: flex;
-  justify-content: space-between;
-  align-items: center;
-  padding: $pad-large $pad-xlarge;
-  margin-bottom: $pad-large;
-  background-color: $ui-vibrant-blue-10;
-  border: 1px solid $ui-vibrant-blue-50;
-  border-radius: $border-radius;
-  font-size: $x-small;
-  color: $core-fleet-black;
-  font-weight: $regular;
-  position: relative; // Position in front of settings sticky header space
-  z-index: 9; // Position in front of settings sticky header space
-
-  p {
-    margin: 0;
-  }
-
-  &__tip {
-    display: flex;
-    align-items: center;
-    gap: $pad-small;
-
-    button {
-      margin-left: $pad-small;
-    }
-  }
-
-  .button {
-    font-size: $xx-small;
-    font-weight: $bold;
-  }
-}
diff --git a/frontend/components/Sandbox/SandboxExpiryMessage/index.ts b/frontend/components/Sandbox/SandboxExpiryMessage/index.ts
deleted file mode 100644
index 6269a66378..0000000000
--- a/frontend/components/Sandbox/SandboxExpiryMessage/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { default } from "./SandboxExpiryMessage";
diff --git a/frontend/components/ViewAllHostsLink/ViewAllHostsLink.tsx b/frontend/components/ViewAllHostsLink/ViewAllHostsLink.tsx
index 9ef3a78bba..6fe25c7d91 100644
--- a/frontend/components/ViewAllHostsLink/ViewAllHostsLink.tsx
+++ b/frontend/components/ViewAllHostsLink/ViewAllHostsLink.tsx
@@ -4,7 +4,7 @@ import { Link } from "react-router";
 import classnames from "classnames";
 
 import Icon from "components/Icon";
-import { buildQueryStringFromParams, QueryParams } from "utilities/url";
+import { getPathWithQueryParams, QueryParams } from "utilities/url";
 
 interface IHostLinkProps {
   queryParams?: QueryParams;
@@ -44,9 +44,7 @@ const ViewAllHostsLink = ({
     ? PATHS.MANAGE_HOSTS_LABEL(platformLabelId)
     : PATHS.MANAGE_HOSTS;
 
-  const path = queryParams
-    ? `${endpoint}?${buildQueryStringFromParams(queryParams)}`
-    : endpoint;
+  const path = getPathWithQueryParams(endpoint, queryParams);
 
   return (
     <Link
diff --git a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
index 73f4686e02..60b0a8d3b6 100644
--- a/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
+++ b/frontend/components/top_nav/SiteTopNav/SiteTopNav.tsx
@@ -2,7 +2,7 @@ import React, { useContext } from "react";
 import { Link } from "react-router";
 import classnames from "classnames";
 
-import { QueryParams } from "utilities/url";
+import { getPathWithQueryParams, QueryParams } from "utilities/url";
 import { LEARN_MORE_ABOUT_BASE_LINK } from "utilities/constants";
 
 import { AppContext } from "context/app";
@@ -170,7 +170,9 @@ const SiteTopNav = ({
 
       const includeTeamId = (activePath: string) => {
         if (currentQueryParams.team_id !== API_ALL_TEAMS_ID) {
-          return `${path}?team_id=${currentQueryParams.team_id}`;
+          return getPathWithQueryParams(path, {
+            team_id: currentQueryParams.team_id,
+          });
         }
         return activePath;
       };
diff --git a/frontend/pages/DashboardPage/cards/LowDiskSpaceHosts/LowDiskSpaceHosts.tsx b/frontend/pages/DashboardPage/cards/LowDiskSpaceHosts/LowDiskSpaceHosts.tsx
index b921423cdb..faf7bcc4f2 100644
--- a/frontend/pages/DashboardPage/cards/LowDiskSpaceHosts/LowDiskSpaceHosts.tsx
+++ b/frontend/pages/DashboardPage/cards/LowDiskSpaceHosts/LowDiskSpaceHosts.tsx
@@ -1,7 +1,7 @@
 import React from "react";
 import PATHS from "router/paths";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import HostCountCard from "../HostCountCard";
 
@@ -24,15 +24,13 @@ const LowDiskSpaceHosts = ({
 }: ILowDiskSpaceHostsProps): JSX.Element => {
   // build the manage hosts URL filtered by low disk space only
   // currently backend cannot filter by both low disk space and label
-  const queryParams = {
-    low_disk_space: lowDiskSpaceGb,
-    team_id: currentTeamId,
-  };
-  const queryString = buildQueryStringFromParams(queryParams);
   const endpoint = selectedPlatformLabelId
     ? PATHS.MANAGE_HOSTS_LABEL(selectedPlatformLabelId)
     : PATHS.MANAGE_HOSTS;
-  const path = `${endpoint}?${queryString}`;
+  const path = getPathWithQueryParams(endpoint, {
+    low_disk_space: lowDiskSpaceGb,
+    team_id: currentTeamId,
+  });
 
   const tooltipText = notSupported
     ? "Disk space info is not available for Chromebooks."
diff --git a/frontend/pages/DashboardPage/cards/MissingHosts/MissingHosts.tsx b/frontend/pages/DashboardPage/cards/MissingHosts/MissingHosts.tsx
index 1c50408ddb..8ea0e62e28 100644
--- a/frontend/pages/DashboardPage/cards/MissingHosts/MissingHosts.tsx
+++ b/frontend/pages/DashboardPage/cards/MissingHosts/MissingHosts.tsx
@@ -1,7 +1,7 @@
 import React from "react";
 import PATHS from "router/paths";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import HostCountCard from "../HostCountCard";
 
@@ -23,11 +23,11 @@ const MissingHosts = ({
     status: "missing",
     team_id: currentTeamId,
   };
-  const queryString = buildQueryStringFromParams(queryParams);
+
   const endpoint = selectedPlatformLabelId
     ? PATHS.MANAGE_HOSTS_LABEL(selectedPlatformLabelId)
     : PATHS.MANAGE_HOSTS;
-  const path = `${endpoint}?${queryString}`;
+  const path = getPathWithQueryParams(endpoint, queryParams);
 
   return (
     <HostCountCard
diff --git a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
index 83671a0f2f..f1a9ecff18 100644
--- a/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
+++ b/frontend/pages/DashboardPage/cards/OperatingSystems/OSTableConfig.tsx
@@ -7,7 +7,7 @@ import React from "react";
 import { CellProps, Column, HeaderProps } from "react-table";
 import { InjectedRouter } from "react-router";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import PATHS from "router/paths";
 import {
   formatOperatingSystemDisplayName,
@@ -67,12 +67,10 @@ const generateDefaultTableHeaders = (
 
       const { name, os_version_id } = cellProps.row.original;
 
-      const teamQueryParam = buildQueryStringFromParams({
-        team_id: teamId,
-      });
-      const softwareOsDetailsPath = `${PATHS.SOFTWARE_OS_DETAILS(
-        os_version_id
-      )}?${teamQueryParam}`;
+      const softwareOsDetailsPath = getPathWithQueryParams(
+        PATHS.SOFTWARE_OS_DETAILS(os_version_id),
+        { team_id: teamId }
+      );
 
       const onClickSoftware = (e: React.MouseEvent) => {
         // Allows for button to be clickable in a clickable row
diff --git a/frontend/pages/DashboardPage/cards/Software/Software.tsx b/frontend/pages/DashboardPage/cards/Software/Software.tsx
index 3aafa34a73..be03fc5b53 100644
--- a/frontend/pages/DashboardPage/cards/Software/Software.tsx
+++ b/frontend/pages/DashboardPage/cards/Software/Software.tsx
@@ -4,7 +4,7 @@ import { Row } from "react-table";
 import PATHS from "router/paths";
 import { InjectedRouter } from "react-router";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { ISoftwareResponse } from "interfaces/software";
 
 import { ITableQueryData } from "components/TableContainer/TableContainer";
@@ -57,11 +57,10 @@ const Software = ({
   const tableHeaders = useMemo(() => generateTableHeaders(teamId), [teamId]);
 
   const handleRowSelect = (row: IRowProps) => {
-    const queryParams = { software_id: row.original.id, team_id: teamId };
-
-    const path = queryParams
-      ? `${PATHS.MANAGE_HOSTS}?${buildQueryStringFromParams(queryParams)}`
-      : PATHS.MANAGE_HOSTS;
+    const path = getPathWithQueryParams(PATHS.MANAGE_HOSTS, {
+      software_id: row.original.id,
+      team_id: teamId,
+    });
 
     router.push(path);
   };
diff --git a/frontend/pages/DashboardPage/cards/TotalHosts/TotalHosts.tsx b/frontend/pages/DashboardPage/cards/TotalHosts/TotalHosts.tsx
index 8c0593b644..6447a0a10e 100644
--- a/frontend/pages/DashboardPage/cards/TotalHosts/TotalHosts.tsx
+++ b/frontend/pages/DashboardPage/cards/TotalHosts/TotalHosts.tsx
@@ -1,7 +1,7 @@
 import React from "react";
 import PATHS from "router/paths";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import HostCountCard from "../HostCountCard";
 
@@ -22,14 +22,12 @@ const TotalHosts = ({
 }: ITotalHostsProps): JSX.Element => {
   // build the manage hosts URL filtered by low disk space only
   // currently backend cannot filter by both low disk space and label
-  const queryParams = {
-    team_id: currentTeamId,
-  };
-  const queryString = buildQueryStringFromParams(queryParams);
   const endpoint = selectedPlatformLabelId
     ? PATHS.MANAGE_HOSTS_LABEL(selectedPlatformLabelId)
     : PATHS.MANAGE_HOSTS;
-  const path = `${endpoint}?${queryString}`;
+  const path = getPathWithQueryParams(endpoint, {
+    team_id: currentTeamId,
+  });
 
   return (
     <HostCountCard
diff --git a/frontend/pages/DashboardPage/sections/PlatformHostCounts/PlatformHostCounts.tsx b/frontend/pages/DashboardPage/sections/PlatformHostCounts/PlatformHostCounts.tsx
index a9676b3a1f..7d556352ec 100644
--- a/frontend/pages/DashboardPage/sections/PlatformHostCounts/PlatformHostCounts.tsx
+++ b/frontend/pages/DashboardPage/sections/PlatformHostCounts/PlatformHostCounts.tsx
@@ -1,6 +1,7 @@
 import React, { useCallback } from "react";
 import PATHS from "router/paths";
 
+import { getPathWithQueryParams } from "utilities/url";
 import { PLATFORM_NAME_TO_LABEL_NAME } from "pages/DashboardPage/helpers";
 
 import { IHostSummary } from "interfaces/host_summary";
@@ -71,9 +72,9 @@ const PlatformHostCounts = ({
         iconName="darwin"
         count={macCount}
         title="macOS"
-        path={PATHS.MANAGE_HOSTS_LABEL(macLabelId).concat(
-          teamId !== undefined ? `?team_id=${teamId}` : ""
-        )}
+        path={getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(macLabelId), {
+          team_id: teamId,
+        })}
       />
     );
   };
@@ -93,9 +94,9 @@ const PlatformHostCounts = ({
         iconName="windows"
         count={windowsCount}
         title="Windows"
-        path={PATHS.MANAGE_HOSTS_LABEL(windowsLabelId).concat(
-          teamId !== undefined ? `?team_id=${teamId}` : ""
-        )}
+        path={getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(windowsLabelId), {
+          team_id: teamId,
+        })}
       />
     );
   };
@@ -115,9 +116,9 @@ const PlatformHostCounts = ({
         iconName="linux"
         count={linuxCount}
         title="Linux"
-        path={PATHS.MANAGE_HOSTS_LABEL(linuxLabelId).concat(
-          teamId !== undefined ? `?team_id=${teamId}` : ""
-        )}
+        path={getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(linuxLabelId), {
+          team_id: teamId,
+        })}
       />
     );
   };
@@ -138,9 +139,9 @@ const PlatformHostCounts = ({
         iconName="chrome"
         count={chromeCount}
         title="Chromebooks"
-        path={PATHS.MANAGE_HOSTS_LABEL(chromeLabelId).concat(
-          teamId !== undefined ? `?team_id=${teamId}` : ""
-        )}
+        path={getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(chromeLabelId), {
+          team_id: teamId,
+        })}
       />
     );
   };
@@ -161,9 +162,9 @@ const PlatformHostCounts = ({
         iconName="iOS"
         count={iosCount}
         title="iPhones"
-        path={PATHS.MANAGE_HOSTS_LABEL(iosLabelId).concat(
-          teamId !== undefined ? `?team_id=${teamId}` : ""
-        )}
+        path={getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(iosLabelId), {
+          team_id: teamId,
+        })}
       />
     );
   };
@@ -184,9 +185,9 @@ const PlatformHostCounts = ({
         iconName="iPadOS"
         count={ipadosCount}
         title="iPads"
-        path={PATHS.MANAGE_HOSTS_LABEL(ipadosLabelId).concat(
-          teamId !== undefined ? `?team_id=${teamId}` : ""
-        )}
+        path={getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(ipadosLabelId), {
+          team_id: teamId,
+        })}
       />
     );
   };
diff --git a/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregate.tsx b/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregate.tsx
index 51de764120..eb7ae767d5 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregate.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/ProfileStatusAggregate/ProfileStatusAggregate.tsx
@@ -1,7 +1,7 @@
 import React from "react";
 
 import paths from "router/paths";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { MdmProfileStatus } from "interfaces/mdm";
 import { HOSTS_QUERY_PARAMS } from "services/entities/hosts";
 import { ProfileStatusSummaryResponse } from "services/entities/mdm";
@@ -33,12 +33,12 @@ const ProfileStatusCount = ({
   hostCount,
   tooltipText,
 }: IProfileStatusCountProps) => {
-  const linkHostsByStatus = `${paths.MANAGE_HOSTS}?${buildQueryStringFromParams(
-    {
-      team_id: teamId,
-      [HOSTS_QUERY_PARAMS.OS_SETTINGS]: statusValue,
-    }
-  )}`;
+  const hostsByStatusParams = {
+    team_id: teamId,
+    [HOSTS_QUERY_PARAMS.OS_SETTINGS]: statusValue,
+  };
+
+  const path = getPathWithQueryParams(paths.MANAGE_HOSTS, hostsByStatusParams);
 
   return (
     <div className={`${baseClass}__profile-status-count`}>
@@ -49,7 +49,7 @@ const ProfileStatusCount = ({
         layout="vertical"
         valueClassName={`${baseClass}__status-indicator-value`}
       />
-      <a href={linkHostsByStatus}>{hostCount} hosts</a>
+      <a href={path}>{hostCount} hosts</a>
     </div>
   );
 };
diff --git a/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/DiskEncryptionTable.tsx b/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/DiskEncryptionTable.tsx
index ae267d3ad1..8b6d6fe5cb 100644
--- a/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/DiskEncryptionTable.tsx
+++ b/frontend/pages/ManageControlsPage/OSSettings/cards/DiskEncryption/components/DiskEncryptionTable/DiskEncryptionTable.tsx
@@ -5,7 +5,7 @@ import { InjectedRouter } from "react-router";
 
 import PATHS from "router/paths";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import diskEncryptionAPI, {
   IDiskEncryptionSummaryResponse,
@@ -60,8 +60,8 @@ const DiskEncryptionTable = ({
         [HOSTS_QUERY_PARAMS.DISK_ENCRYPTION]: status?.value,
         team_id: teamId,
       };
-      const endpoint = PATHS.MANAGE_HOSTS;
-      const path = `${endpoint}?${buildQueryStringFromParams(queryParams)}`;
+      const path = getPathWithQueryParams(PATHS.MANAGE_HOSTS, queryParams);
+
       router.push(path);
     },
     [router]
diff --git a/frontend/pages/ManageControlsPage/Scripts/components/EditScriptModal/EditScriptModal.tsx b/frontend/pages/ManageControlsPage/Scripts/components/EditScriptModal/EditScriptModal.tsx
index 8ee18058ad..c70cbcde9f 100644
--- a/frontend/pages/ManageControlsPage/Scripts/components/EditScriptModal/EditScriptModal.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/components/EditScriptModal/EditScriptModal.tsx
@@ -2,6 +2,8 @@ import React, { useContext, useState } from "react";
 import { useQuery } from "react-query";
 
 import { NotificationContext } from "context/notification";
+import { AppContext } from "context/app";
+import { getPathWithQueryParams } from "utilities/url";
 import scriptAPI from "services/entities/scripts";
 
 import Button from "components/buttons/Button";
@@ -38,6 +40,7 @@ const EditScriptModal = ({
   onExit,
 }: IEditScriptModal) => {
   const { renderFlash } = useContext(NotificationContext);
+  const { currentTeam } = useContext(AppContext);
 
   // Editable script content
   const [scriptFormData, setScriptFormData] = useState("");
@@ -115,11 +118,23 @@ const EditScriptModal = ({
           />
           <div className="form-field__help-text">
             To run this script on a host, go to the{" "}
-            <CustomLink text="Hosts" url={paths.MANAGE_HOSTS} /> page and select
-            a host.
+            <CustomLink
+              text="Hosts"
+              url={getPathWithQueryParams(paths.MANAGE_HOSTS, {
+                team_id: currentTeam?.id,
+              })}
+            />{" "}
+            page and select a host.
             <br />
             To run the script across multiple hosts, add a policy automation on
-            the <CustomLink text="Policies" url={paths.MANAGE_POLICIES} /> page.
+            the{" "}
+            <CustomLink
+              text="Policies"
+              url={getPathWithQueryParams(paths.MANAGE_POLICIES, {
+                team_id: currentTeam?.id,
+              })}
+            />{" "}
+            page.
           </div>
         </form>
         <ModalFooter
diff --git a/frontend/pages/ManageControlsPage/Scripts/components/ScriptDetailsModal/ScriptDetailsModal.tsx b/frontend/pages/ManageControlsPage/Scripts/components/ScriptDetailsModal/ScriptDetailsModal.tsx
index abbd3d324d..77bcd3f554 100644
--- a/frontend/pages/ManageControlsPage/Scripts/components/ScriptDetailsModal/ScriptDetailsModal.tsx
+++ b/frontend/pages/ManageControlsPage/Scripts/components/ScriptDetailsModal/ScriptDetailsModal.tsx
@@ -32,6 +32,7 @@ import paths from "router/paths";
 import ActionsDropdown from "components/ActionsDropdown";
 import { generateActionDropdownOptions } from "pages/hosts/details/HostDetailsPage/modals/RunScriptModal/ScriptsTableConfig";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
+import { getPathWithQueryParams } from "utilities/url";
 
 const baseClass = "script-details-modal";
 
@@ -58,6 +59,7 @@ interface IScriptDetailsModalProps {
   isScriptContentError?: Error | null;
   isHidden?: boolean;
   onClickRunDetails?: (scriptExecutionId: string) => void;
+  teamIdForApi?: number;
 }
 
 const ScriptDetailsModal = ({
@@ -75,6 +77,7 @@ const ScriptDetailsModal = ({
   isScriptContentError,
   isHidden = false,
   onClickRunDetails,
+  teamIdForApi,
 }: IScriptDetailsModalProps) => {
   // For scrollable modal
   const [isTopScrolling, setIsTopScrolling] = useState(false);
@@ -272,11 +275,23 @@ const ScriptDetailsModal = ({
         {runScriptHelpText && (
           <div className="form-field__help-text">
             To run this script on a host, go to the{" "}
-            <CustomLink text="Hosts" url={paths.MANAGE_HOSTS} /> page and select
-            a host.
+            <CustomLink
+              text="Hosts"
+              url={getPathWithQueryParams(paths.MANAGE_HOSTS, {
+                team_id: teamIdForApi,
+              })}
+            />{" "}
+            page and select a host.
             <br />
             To run the script across multiple hosts, add a policy automation on
-            the <CustomLink text="Policies" url={paths.MANAGE_POLICIES} /> page.
+            the{" "}
+            <CustomLink
+              text="Policies"
+              url={getPathWithQueryParams(paths.MANAGE_POLICIES, {
+                team_id: teamIdForApi,
+              })}
+            />{" "}
+            page.
           </div>
         )}
       </div>
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx
index fa326a9a5d..08ff83270a 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAddPage.tsx
@@ -4,7 +4,7 @@ import { InjectedRouter } from "react-router";
 import { Location } from "history";
 
 import PATHS from "router/paths";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { QueryContext } from "context/query";
 import useToggleSidePanel from "hooks/useToggleSidePanel";
 import { APP_CONTEXT_NO_TEAM_ID } from "interfaces/team";
@@ -73,11 +73,9 @@ const SoftwareAddPage = ({
     (i: number): void => {
       setSidePanelOpen(false);
       // Only query param to persist between tabs is team id
-      const teamIdParam = buildQueryStringFromParams({
+      const navPath = getPathWithQueryParams(addSoftwareSubNav[i].pathname, {
         team_id: location.query.team_id,
       });
-
-      const navPath = addSoftwareSubNav[i].pathname.concat(`?${teamIdParam}`);
       router.replace(navPath);
     },
     [location.query.team_id, router, setSidePanelOpen]
@@ -88,9 +86,9 @@ const SoftwareAddPage = ({
   // is not provieded.
   if (!location.query.team_id) {
     router.replace(
-      `${location.pathname}?${buildQueryStringFromParams({
+      getPathWithQueryParams(location.pathname, {
         team_id: APP_CONTEXT_NO_TEAM_ID,
-      })}`
+      })
     );
     return null;
   }
@@ -99,9 +97,9 @@ const SoftwareAddPage = ({
     setSelectedOsqueryTable(tableName);
   };
 
-  const backUrl = `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams({
+  const backUrl = getPathWithQueryParams(PATHS.SOFTWARE_TITLES, {
     team_id: location.query.team_id,
-  })}`;
+  });
 
   return (
     <>
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAppStoreVpp/SoftwareAppStoreVpp.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAppStoreVpp/SoftwareAppStoreVpp.tsx
index b5c8280c0c..6aabab0e70 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAppStoreVpp/SoftwareAppStoreVpp.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareAppStoreVpp/SoftwareAppStoreVpp.tsx
@@ -22,7 +22,7 @@ import Spinner from "components/Spinner";
 import PremiumFeatureMessage from "components/PremiumFeatureMessage";
 import Button from "components/buttons/Button";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import SoftwareVppForm from "./SoftwareVppForm";
 import { getErrorMessage, teamHasVPPToken } from "./helpers";
 import { ISoftwareVppFormData } from "./SoftwareVppForm/SoftwareVppForm";
@@ -150,9 +150,7 @@ const SoftwareAppStoreVpp = ({
       ...(showAvailableForInstallOnly && { available_for_install: true }),
     };
 
-    router.push(
-      `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams(queryParams)}`
-    );
+    router.push(getPathWithQueryParams(PATHS.SOFTWARE_TITLES, queryParams));
   };
 
   const onAddSoftware = async (formData: ISoftwareVppFormData) => {
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareCustomPackage/SoftwareCustomPackage.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareCustomPackage/SoftwareCustomPackage.tsx
index 2196f25058..e7d5e26619 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareCustomPackage/SoftwareCustomPackage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareCustomPackage/SoftwareCustomPackage.tsx
@@ -5,7 +5,7 @@ import { useQuery } from "react-query";
 import PATHS from "router/paths";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import { getFileDetails, IFileDetails } from "utilities/file/fileUtils";
-import { buildQueryStringFromParams, QueryParams } from "utilities/url";
+import { getPathWithQueryParams, QueryParams } from "utilities/url";
 import softwareAPI, {
   MAX_FILE_SIZE_BYTES,
   MAX_FILE_SIZE_MB,
@@ -84,9 +84,9 @@ const SoftwareCustomPackage = ({
 
   const onCancel = () => {
     router.push(
-      `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams({
+      getPathWithQueryParams(PATHS.SOFTWARE_TITLES, {
         team_id: currentTeamId,
-      })}`
+      })
     );
   };
 
@@ -130,7 +130,7 @@ const SoftwareCustomPackage = ({
         newQueryParams.available_for_install = true;
       }
       router.push(
-        `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams(newQueryParams)}`
+        getPathWithQueryParams(PATHS.SOFTWARE_TITLES, newQueryParams)
       );
 
       renderFlash(
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
index 0d351168a2..1cbabcbfed 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppDetailsPage/FleetMaintainedAppDetailsPage.tsx
@@ -6,7 +6,7 @@ import { InjectedRouter } from "react-router";
 import { useErrorHandler } from "react-error-boundary";
 
 import PATHS from "router/paths";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 import softwareAPI from "services/entities/software";
 import labelsAPI, { getCustomLabels } from "services/entities/labels";
@@ -180,9 +180,10 @@ const FleetMaintainedAppDetailsPage = ({
     setShowAppDetailsModal(true);
   };
 
-  const backToAddSoftwareUrl = `${
-    PATHS.SOFTWARE_ADD_FLEET_MAINTAINED
-  }?${buildQueryStringFromParams({ team_id: teamId })}`;
+  const backToAddSoftwareUrl = getPathWithQueryParams(
+    PATHS.SOFTWARE_ADD_FLEET_MAINTAINED,
+    { team_id: teamId }
+  );
 
   const onCancel = () => {
     router.push(backToAddSoftwareUrl);
@@ -206,11 +207,12 @@ const FleetMaintainedAppDetailsPage = ({
       titleId = res.software_title_id;
 
       router.push(
-        `${PATHS.SOFTWARE_TITLES}?${buildQueryStringFromParams({
+        getPathWithQueryParams(PATHS.SOFTWARE_TITLES, {
           team_id: teamId,
           available_for_install: true,
-        })}`
+        })
       );
+
       renderFlash(
         "success",
         <>
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTable.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTable.tsx
index 29aae9ea0c..40dac18ee7 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTable.tsx
@@ -4,7 +4,7 @@ import { InjectedRouter } from "react-router";
 import PATHS from "router/paths";
 import { ISoftwareFleetMaintainedAppsResponse } from "services/entities/software";
 import { getNextLocationPath } from "utilities/helpers";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { IFleetMaintainedApp } from "interfaces/software";
 
 import TableContainer from "components/TableContainer";
@@ -123,11 +123,10 @@ const FleetMaintainedAppsTable = ({
   );
 
   const handleRowClick = (row: IRowProps) => {
-    const path = `${PATHS.SOFTWARE_FLEET_MAINTAINED_DETAILS(
-      row.original.id
-    )}?${buildQueryStringFromParams({
-      team_id: teamId,
-    })}`;
+    const path = getPathWithQueryParams(
+      PATHS.SOFTWARE_FLEET_MAINTAINED_DETAILS(row.original.id),
+      { team_id: teamId }
+    );
 
     router.push(path);
   };
diff --git a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTableConfig.tsx
index 42f2012a87..55500fc87a 100644
--- a/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareAddPage/SoftwareFleetMaintained/FleetMaintainedAppsTable/FleetMaintainedAppsTableConfig.tsx
@@ -6,7 +6,7 @@ import PATHS from "router/paths";
 import { IHeaderProps, IStringCellProps } from "interfaces/datatable_config";
 import { APPLE_PLATFORM_DISPLAY_NAMES } from "interfaces/platform";
 import { IFleetMaintainedApp } from "interfaces/software";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import TextCell from "components/TableContainer/DataTable/TextCell";
 import HeaderCell from "components/TableContainer/DataTable/HeaderCell";
@@ -31,11 +31,10 @@ export const generateTableConfig = (
       Cell: (cellProps: ITableStringCellProps) => {
         const { name, id } = cellProps.row.original;
 
-        const path = `${PATHS.SOFTWARE_FLEET_MAINTAINED_DETAILS(
-          id
-        )}?${buildQueryStringFromParams({
-          team_id: teamId,
-        })}`;
+        const path = getPathWithQueryParams(
+          PATHS.SOFTWARE_FLEET_MAINTAINED_DETAILS(id),
+          { team_id: teamId }
+        );
 
         return <SoftwareNameCell name={name} path={path} router={router} />;
       },
diff --git a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
index 633a6d98c4..81b928efdb 100644
--- a/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareOS/SoftwareOSTable/SoftwareOSTable.tsx
@@ -21,7 +21,7 @@ import EmptySoftwareTable from "pages/SoftwarePage/components/EmptySoftwareTable
 import { IOSVersionsResponse } from "services/entities/operating_systems";
 
 import generateTableConfig from "pages/DashboardPage/cards/OperatingSystems/OSTableConfig";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 import { SelectedPlatform } from "interfaces/platform";
 
@@ -162,12 +162,10 @@ const SoftwareOSTable = ({
   }, [data, router, teamId]);
 
   const handleRowSelect = (row: IRowProps) => {
-    const teamQueryParam = buildQueryStringFromParams({
-      team_id: teamId,
-    });
-    const path = `${PATHS.SOFTWARE_OS_DETAILS(
-      Number(row.original.os_version_id)
-    )}?${teamQueryParam}`;
+    const path = getPathWithQueryParams(
+      PATHS.SOFTWARE_OS_DETAILS(Number(row.original.os_version_id)),
+      { team_id: teamId }
+    );
 
     router.push(path);
   };
diff --git a/frontend/pages/SoftwarePage/SoftwarePage.tsx b/frontend/pages/SoftwarePage/SoftwarePage.tsx
index 0beceae5c3..635d2c48bb 100644
--- a/frontend/pages/SoftwarePage/SoftwarePage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwarePage.tsx
@@ -23,8 +23,8 @@ import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
 import useTeamIdParam from "hooks/useTeamIdParam";
 import {
-  buildQueryStringFromParams,
   convertParamsToSnakeCase,
+  getPathWithQueryParams,
 } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 
@@ -299,7 +299,9 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
       setShowAddSoftwareModal(true);
     } else {
       router.push(
-        `${PATHS.SOFTWARE_ADD_FLEET_MAINTAINED}?team_id=${currentTeamId}`
+        getPathWithQueryParams(PATHS.SOFTWARE_ADD_FLEET_MAINTAINED, {
+          team_id: currentTeamId,
+        })
       );
     }
   }, [currentTeamId, router]);
@@ -345,12 +347,16 @@ const SoftwarePage = ({ children, router, location }: ISoftwarePageProps) => {
       setResetPageIndex(true); // Fixes flakey page reset in table state when switching between tabs
 
       // Only query param to persist between tabs is team id
-      const teamIdParam = buildQueryStringFromParams({
+      const teamIdParam = {
         team_id: location?.query.team_id,
         page: 0, // Fixes flakey page reset in API call when switching between tabs
-      });
+      };
+
+      const navPath = getPathWithQueryParams(
+        softwareSubNav[i].pathname,
+        teamIdParam
+      );
 
-      const navPath = softwareSubNav[i].pathname.concat(`?${teamIdParam}`);
       router.replace(navPath);
     },
     [location, router]
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AutomaticInstallModal/AutomaticInstallModal.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AutomaticInstallModal/AutomaticInstallModal.tsx
index f056ad34ce..9f9889382c 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AutomaticInstallModal/AutomaticInstallModal.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/AutomaticInstallModal/AutomaticInstallModal.tsx
@@ -1,11 +1,13 @@
 import React from "react";
 
+import { Link } from "react-router";
+import paths from "router/paths";
 import { ISoftwareInstallPolicy } from "interfaces/software";
+import { getPathWithQueryParams } from "utilities/url";
 
 import Modal from "components/Modal";
 import Button from "components/buttons/Button";
 import CustomLink from "components/CustomLink";
-import { Link } from "react-router";
 
 const baseClass = "automatic-install-modal";
 
@@ -17,7 +19,13 @@ interface IPoliciesListItemProps {
 const PoliciesListItem = ({ teamId, policy }: IPoliciesListItemProps) => {
   return (
     <li key={policy.id} className={`${baseClass}__list-item`}>
-      <Link to={`/policies/${policy.id}?team_id=${teamId}`}>{policy.name}</Link>
+      <Link
+        to={getPathWithQueryParams(paths.EDIT_POLICY(policy.id), {
+          team_id: teamId,
+        })}
+      >
+        {policy.name}
+      </Link>
     </li>
   );
 };
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareInstallerCard/SoftwareInstallerCard.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareInstallerCard/SoftwareInstallerCard.tsx
index 8d49bd5292..da85f13f13 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareInstallerCard/SoftwareInstallerCard.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareInstallerCard/SoftwareInstallerCard.tsx
@@ -10,7 +10,7 @@ import {
 } from "interfaces/software";
 import softwareAPI from "services/entities/software";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import Card from "components/Card";
 
@@ -101,11 +101,11 @@ const InstallerStatusCount = ({
   teamId,
 }: IInstallerStatusCountProps) => {
   const displayData = STATUS_DISPLAY_OPTIONS[status];
-  const linkUrl = `${PATHS.MANAGE_HOSTS}?${buildQueryStringFromParams({
+  const linkUrl = getPathWithQueryParams(PATHS.MANAGE_HOSTS, {
     software_title_id: softwareId,
     software_status: status,
     team_id: teamId,
-  })}`;
+  });
 
   return (
     <DataSet
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
index 5ddb553628..e495d3eb90 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsPage.tsx
@@ -23,7 +23,7 @@ import {
   APP_CONTEXT_ALL_TEAMS_ID,
   APP_CONTEXT_NO_TEAM_ID,
 } from "interfaces/team";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
 
 import Spinner from "components/Spinner";
@@ -112,12 +112,12 @@ const SoftwareTitleDetailsPage = ({
       return;
     }
 
-    const queryParams: string = buildQueryStringFromParams({
-      team_id: teamIdForApi,
-    });
-
     // redirect to software titles page if no versions are available
-    router.push(`${paths.SOFTWARE_TITLES}?${queryParams}`);
+    router.push(
+      getPathWithQueryParams(paths.SOFTWARE_TITLES, {
+        team_id: teamIdForApi,
+      })
+    );
   }, [refetchSoftwareTitle, router, softwareTitle, teamIdForApi]);
 
   const onTeamChange = useCallback(
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
index eacb527017..19833cbbd7 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTable.tsx
@@ -7,7 +7,7 @@ import PATHS from "router/paths";
 
 import { ISoftwareTitleVersion } from "interfaces/software";
 import { GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import TableContainer from "components/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
@@ -92,12 +92,10 @@ const SoftwareTitleDetailsTable = ({
     if (row.original.id) {
       const softwareVersionId = row.original.id;
 
-      const teamQueryParam = buildQueryStringFromParams({
-        team_id: teamIdForApi,
-      });
-      const softwareVersionDetailsPath = `${PATHS.SOFTWARE_VERSION_DETAILS(
-        softwareVersionId.toString()
-      )}?${teamQueryParam}`;
+      const softwareVersionDetailsPath = getPathWithQueryParams(
+        PATHS.SOFTWARE_VERSION_DETAILS(softwareVersionId.toString()),
+        { team_id: teamIdForApi }
+      );
 
       router.push(softwareVersionDetailsPath);
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx
index 778f203a11..fbf62b67b6 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitleDetailsPage/SoftwareTitleDetailsTable/SoftwareTitleDetailsTableConfig.tsx
@@ -6,7 +6,7 @@ import {
   ISoftwareVulnerability,
 } from "interfaces/software";
 import PATHS from "router/paths";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import TextCell from "components/TableContainer/DataTable/TextCell";
 import ViewAllHostsLink from "components/ViewAllHostsLink";
@@ -63,10 +63,10 @@ const generateSoftwareTitleDetailsTableConfig = ({
           return <TextCell />;
         }
         const { id } = cellProps.row.original;
-        const teamQueryParam = buildQueryStringFromParams({ team_id: teamId });
-        const softwareVersionDetailsPath = `${PATHS.SOFTWARE_VERSION_DETAILS(
-          id.toString()
-        )}?${teamQueryParam}`;
+        const softwareVersionDetailsPath = getPathWithQueryParams(
+          PATHS.SOFTWARE_VERSION_DETAILS(id.toString()),
+          { team_id: teamId }
+        );
 
         return (
           <LinkCell
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
index 12df546715..00c5a0b23f 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTable.tsx
@@ -11,8 +11,8 @@ import PATHS from "router/paths";
 import { getNextLocationPath } from "utilities/helpers";
 import { GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
 import {
-  buildQueryStringFromParams,
   convertParamsToSnakeCase,
+  getPathWithQueryParams,
 } from "utilities/url";
 import {
   ISoftwareApiParams,
@@ -248,13 +248,10 @@ const SoftwareTable = ({
 
   const handleRowSelect = (row: IRowProps) => {
     if (row.original.id) {
-      const teamQueryParam = buildQueryStringFromParams({
-        team_id: teamId,
-      });
-
-      const path = `${PATHS.SOFTWARE_TITLE_DETAILS(
-        row.original.id.toString()
-      )}?${teamQueryParam}`;
+      const path = getPathWithQueryParams(
+        PATHS.SOFTWARE_TITLE_DETAILS(row.original.id.toString()),
+        { team_id: teamId }
+      );
 
       router.push(path);
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
index 5082286681..0ca69132b4 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareTitlesTableConfig.tsx
@@ -9,7 +9,7 @@ import {
 } from "interfaces/software";
 import PATHS from "router/paths";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { IHeaderProps, IStringCellProps } from "interfaces/datatable_config";
 
 import HeaderCell from "components/TableContainer/DataTable/HeaderCell";
@@ -62,10 +62,10 @@ const getSoftwareNameCellData = (
   softwareTitle: ISoftwareTitle,
   teamId?: number
 ) => {
-  const teamQueryParam = buildQueryStringFromParams({ team_id: teamId });
-  const softwareTitleDetailsPath = `${PATHS.SOFTWARE_TITLE_DETAILS(
-    softwareTitle.id.toString()
-  )}?${teamQueryParam}`;
+  const softwareTitleDetailsPath = getPathWithQueryParams(
+    PATHS.SOFTWARE_TITLE_DETAILS(softwareTitle.id.toString()),
+    { team_id: teamId }
+  );
 
   const { software_package, app_store_app } = softwareTitle;
   let hasPackage = false;
diff --git a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx
index 0be57bf962..b46b0419ad 100644
--- a/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareTitles/SoftwareTable/SoftwareVersionsTableConfig.tsx
@@ -2,7 +2,7 @@ import React from "react";
 import { CellProps, Column } from "react-table";
 import { InjectedRouter } from "react-router";
 
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import {
   formatSoftwareType,
   ISoftwareVersion,
@@ -45,12 +45,12 @@ const generateTableHeaders = (
       Cell: (cellProps: ITableStringCellProps) => {
         const { id, name, source } = cellProps.row.original;
 
-        const teamQueryParam = buildQueryStringFromParams({
-          team_id: teamId,
-        });
-        const softwareVersionDetailsPath = `${PATHS.SOFTWARE_VERSION_DETAILS(
-          id.toString()
-        )}?${teamQueryParam}`;
+        const softwareVersionDetailsPath = getPathWithQueryParams(
+          PATHS.SOFTWARE_VERSION_DETAILS(id.toString()),
+          {
+            team_id: teamId,
+          }
+        );
 
         return (
           <SoftwareNameCell
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
index 5e076c63d8..7357b5f50e 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
@@ -28,7 +28,7 @@ import {
   IVulnerabilitiesResponse,
   IVulnerabilitiesEmptyStateReason,
 } from "services/entities/vulnerabilities";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { getNextLocationPath } from "utilities/helpers";
 
 import generateTableConfig from "./VulnerabilitiesTableConfig";
@@ -187,13 +187,13 @@ const SoftwareVulnerabilitiesTable = ({
   const handleRowSelect = (row: IRowProps) => {
     if (row.original.cve) {
       const cveName = row.original.cve.toString();
-      const teamQueryParam = buildQueryStringFromParams({
-        team_id: teamId,
-      });
 
-      const softwareVulnerabilityDetailsPath = `${PATHS.SOFTWARE_VULNERABILITY_DETAILS(
-        cveName
-      )}?${teamQueryParam}`;
+      const softwareVulnerabilityDetailsPath = getPathWithQueryParams(
+        PATHS.SOFTWARE_VULNERABILITY_DETAILS(cveName),
+        {
+          team_id: teamId,
+        }
+      );
 
       router.push(softwareVulnerabilityDetailsPath);
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/VulnerabilitiesTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/VulnerabilitiesTableConfig.tsx
index 92881a3c47..36660acc4e 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/VulnerabilitiesTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilities/SoftwareVulnerabilitiesTable/VulnerabilitiesTableConfig.tsx
@@ -4,7 +4,7 @@ import { InjectedRouter } from "react-router";
 
 import PATHS from "router/paths";
 import { formatSeverity } from "utilities/helpers";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { formatOperatingSystemDisplayName } from "interfaces/operating_system";
 import { IVulnerability } from "interfaces/vulnerability";
 
@@ -78,10 +78,10 @@ const generateTableHeaders = (
 
         const { cve } = cellProps.row.original;
 
-        const teamQueryParam = buildQueryStringFromParams({ team_id: teamId });
-        const softwareVulnerabilitiesDetailsPath = `${PATHS.SOFTWARE_VULNERABILITY_DETAILS(
-          cve
-        )}?${teamQueryParam}`;
+        const softwareVulnerabilitiesDetailsPath = getPathWithQueryParams(
+          PATHS.SOFTWARE_VULNERABILITY_DETAILS(cve),
+          { team_id: teamId }
+        );
 
         const onClickVulnerability = (e: React.MouseEvent) => {
           // Allows for button to be clickable in a clickable row
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SoftwareVulnOSVersions.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SoftwareVulnOSVersions.tsx
index 342192f973..1565c492bd 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SoftwareVulnOSVersions.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SoftwareVulnOSVersions.tsx
@@ -5,6 +5,7 @@ import { Row } from "react-table";
 import { InjectedRouter } from "react-router";
 
 import PATHS from "router/paths";
+import { getPathWithQueryParams } from "utilities/url";
 import { IVulnerabilityResponse } from "services/entities/vulnerabilities";
 import Card from "components/Card";
 import TableContainer from "components/TableContainer";
@@ -42,11 +43,10 @@ const SoftwareVulnOSVersions = ({
     if (row.original.os_version_id) {
       const softwareOsVersionId = Number(row.original.os_version_id);
 
-      const endpoint = PATHS.SOFTWARE_OS_DETAILS(softwareOsVersionId);
-      // since No Teams not supported on this page, falsiness of 0 is okay
-      const softwareOsDetailsPath = teamIdForApi
-        ? `${endpoint}?team_id=${teamIdForApi}`
-        : endpoint;
+      const softwareOsDetailsPath = getPathWithQueryParams(
+        PATHS.SOFTWARE_OS_DETAILS(softwareOsVersionId),
+        { team_id: teamIdForApi }
+      );
 
       router.push(softwareOsDetailsPath);
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SwVulnOSTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SwVulnOSTableConfig.tsx
index 2ac119dd25..10007a56b5 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SwVulnOSTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnOSVersions/SwVulnOSTableConfig.tsx
@@ -15,6 +15,7 @@ import {
   INumberCellProps,
   IStringCellProps,
 } from "interfaces/datatable_config";
+import { getPathWithQueryParams } from "utilities/url";
 
 type ISWVulnTableColumnConfig = Column<IVulnerabilityOSVersion>;
 
@@ -34,11 +35,12 @@ const generateColumnConfigs = (
       accessor: "name_only",
       Cell: ({ row }: ITableStringCellProps) => {
         const { name, os_version_id, platform } = row.original;
-        const endpoint = PATHS.SOFTWARE_OS_DETAILS(os_version_id);
         // since No Teams not supported on this page, falsiness of 0 is okay
-        const path = teamIdForApi
-          ? `${endpoint}?team_id=${teamIdForApi}`
-          : endpoint;
+        const path = getPathWithQueryParams(
+          PATHS.SOFTWARE_OS_DETAILS(os_version_id),
+          { team_id: teamIdForApi }
+        );
+
         return (
           <LinkCell
             path={path}
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SoftwareVulnSoftwareVersions.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SoftwareVulnSoftwareVersions.tsx
index 228fd5e675..94facfee91 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SoftwareVulnSoftwareVersions.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SoftwareVulnSoftwareVersions.tsx
@@ -8,7 +8,7 @@ import { Row } from "react-table";
 import { IVulnerabilityResponse } from "services/entities/vulnerabilities";
 
 import PATHS from "router/paths";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 
 import Card from "components/Card";
 import TableContainer from "components/TableContainer";
@@ -45,17 +45,13 @@ const SoftwareVulnSoftwareVersions = ({
   const handleRowSelect = (row: IRowProps) => {
     if (row.original.id) {
       const softwareVersionId = row.original.id;
-      const teamQueryParam = buildQueryStringFromParams({
-        team_id: teamIdForApi,
-      });
-      const endpoint = PATHS.SOFTWARE_VERSION_DETAILS(
-        softwareVersionId.toString()
-      );
 
-      // since No Teams not supported on this page, falsiness of 0 is okay
-      const softwareVersionDetailsPath = teamIdForApi
-        ? `${endpoint}?${teamQueryParam}`
-        : endpoint;
+      const softwareVersionDetailsPath = getPathWithQueryParams(
+        PATHS.SOFTWARE_VERSION_DETAILS(softwareVersionId.toString()),
+        {
+          team_id: teamIdForApi,
+        }
+      );
 
       router.push(softwareVersionDetailsPath);
     }
diff --git a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SwVulnSwTableConfig.tsx b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SwVulnSwTableConfig.tsx
index 3de15eebb3..9d94c43787 100644
--- a/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SwVulnSwTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/SoftwareVulnerabilityDetailsPage/SoftwareVulnSoftwareVersions/SwVulnSwTableConfig.tsx
@@ -11,6 +11,7 @@ import TextCell from "components/TableContainer/DataTable/TextCell";
 import ViewAllHostsLink from "components/ViewAllHostsLink";
 import SoftwareIcon from "pages/SoftwarePage/components/icons/SoftwareIcon";
 import { InjectedRouter } from "react-router";
+import { getPathWithQueryParams } from "utilities/url";
 
 type SwVulnTableColumnConfig = Column<IVulnerabilitySoftware>;
 
@@ -33,11 +34,12 @@ const generateColumnConfigs = (
       accessor: "name",
       Cell: ({ row }: ITableStringCellProps) => {
         const { name, id } = row.original;
-        const endpoint = PATHS.SOFTWARE_VERSION_DETAILS(id.toString());
         // since No Teams not supported on this page, falsiness of 0 is okay
-        const path = teamIdForApi
-          ? `${endpoint}?team_id=${teamIdForApi}`
-          : endpoint;
+        const path = getPathWithQueryParams(
+          PATHS.SOFTWARE_VERSION_DETAILS(id.toString()),
+          { team_id: teamIdForApi }
+        );
+
         return (
           <LinkCell
             path={path}
diff --git a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
index 24ee28b51e..94fc524118 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
+++ b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTable.tsx
@@ -13,7 +13,7 @@ import { AppContext } from "context/app";
 import { ISoftwareVulnerability } from "interfaces/software";
 import { CONTACT_FLEET_LINK, GITHUB_NEW_ISSUE_LINK } from "utilities/constants";
 import { DisplayPlatform } from "interfaces/platform";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import TableContainer from "components/TableContainer";
 import TableCount from "components/TableContainer/TableCount";
 import EmptyTable from "components/EmptyTable";
@@ -94,13 +94,13 @@ const SoftwareVulnerabilitiesTable = ({
   const handleRowSelect = (row: IRowProps) => {
     if (row.original.cve) {
       const cveName = row.original.cve.toString();
-      const teamQueryParam = buildQueryStringFromParams({
-        team_id: teamIdForApi,
-      });
 
-      const softwareVulnerabilityDetailsPath = `${PATHS.SOFTWARE_VULNERABILITY_DETAILS(
-        cveName
-      )}?${teamQueryParam}`;
+      const softwareVulnerabilityDetailsPath = getPathWithQueryParams(
+        PATHS.SOFTWARE_VULNERABILITY_DETAILS(cveName),
+        {
+          team_id: teamIdForApi,
+        }
+      );
 
       router.push(softwareVulnerabilityDetailsPath);
     }
diff --git a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTableConfig.tsx b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTableConfig.tsx
index df0f85a698..34848e9ed0 100644
--- a/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTableConfig.tsx
+++ b/frontend/pages/SoftwarePage/components/SoftwareVulnerabilitiesTable/SoftwareVulnerabilitiesTableConfig.tsx
@@ -2,7 +2,7 @@ import React from "react";
 import { InjectedRouter } from "react-router";
 
 import { formatSeverity } from "utilities/helpers";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { ISoftwareVulnerability } from "interfaces/software";
 
 import paths from "router/paths";
@@ -59,13 +59,11 @@ const generateTableConfig = (
       Header: "Vulnerability",
       Cell: ({ cell: { value } }: ITextCellProps) => {
         const cveName = value.toString();
-        const teamQueryParam = buildQueryStringFromParams({
-          team_id: teamId,
-        });
 
-        const softwareVulnerabilityDetailsPath = `${paths.SOFTWARE_VULNERABILITY_DETAILS(
-          cveName
-        )}?${teamQueryParam}`;
+        const softwareVulnerabilityDetailsPath = getPathWithQueryParams(
+          paths.SOFTWARE_VULNERABILITY_DETAILS(cveName),
+          { team_id: teamId }
+        );
 
         return (
           <LinkCell value={cveName} path={softwareVulnerabilityDetailsPath} />
diff --git a/frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars.tsx b/frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars.tsx
index a3f82ade0f..114c6292a5 100644
--- a/frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars.tsx
+++ b/frontend/pages/admin/IntegrationsPage/cards/Calendars/Calendars.tsx
@@ -20,6 +20,7 @@ import PremiumFeatureMessage from "components/PremiumFeatureMessage/PremiumFeatu
 import Icon from "components/Icon";
 import Card from "components/Card";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
+import { getPathWithQueryParams } from "utilities/url";
 
 const CREATING_SERVICE_ACCOUNT =
   "https://www.fleetdm.com/learn-more-about/creating-service-accounts";
@@ -75,7 +76,7 @@ const baseClass = "calendars-integration";
 
 const Calendars = (): JSX.Element => {
   const { renderFlash } = useContext(NotificationContext);
-  const { isPremiumTier } = useContext(AppContext);
+  const { currentTeam, isPremiumTier } = useContext(AppContext);
 
   const [formData, setFormData] = useState<ICalendarsFormData>({
     domain: "",
@@ -422,7 +423,9 @@ const Calendars = (): JSX.Element => {
           <p>
             Now head over to{" "}
             <CustomLink
-              url={paths.MANAGE_POLICIES}
+              url={getPathWithQueryParams(paths.MANAGE_POLICIES, {
+                team_id: currentTeam?.id,
+              })}
               text="Policies &gt; Manage automations"
             />{" "}
             to finish setup.
diff --git a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
index dd5d715c00..b87069f8a8 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/HostDetailsPage.tsx
@@ -982,6 +982,7 @@ const HostDetailsPage = ({
             host={host}
             currentUser={currentUser}
             onCloseScriptModalGroup={onCloseScriptModalGroup}
+            teamIdForApi={currentTeam?.id}
           />
         )}
         {!!host && showTransferHostModal && (
diff --git a/frontend/pages/hosts/details/HostDetailsPage/modals/ScriptModalGroup/ScriptModalGroup.tsx b/frontend/pages/hosts/details/HostDetailsPage/modals/ScriptModalGroup/ScriptModalGroup.tsx
index d6a6744d07..543d45597f 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/modals/ScriptModalGroup/ScriptModalGroup.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/modals/ScriptModalGroup/ScriptModalGroup.tsx
@@ -20,6 +20,7 @@ interface IScriptsProps {
   currentUser: IUser | null;
   host: IHost;
   onCloseScriptModalGroup: () => void;
+  teamIdForApi?: number;
 }
 
 type ScriptGroupModals =
@@ -33,6 +34,7 @@ const ScriptModalGroup = ({
   currentUser,
   host,
   onCloseScriptModalGroup,
+  teamIdForApi,
 }: IScriptsProps) => {
   const [previousModal, setPreviousModal] = useState<ScriptGroupModals>(null);
   const [currentModal, setCurrentModal] = useState<ScriptGroupModals>(
@@ -163,6 +165,7 @@ const ScriptModalGroup = ({
         isScriptContentError={isSelectedScriptContentError}
         isHidden={currentModal !== "view-script"}
         showHostScriptActions
+        teamIdForApi={teamIdForApi}
       />
       <DeleteScriptModal
         scriptId={selectedScriptDetails?.script_id || 1}
diff --git a/frontend/pages/hosts/details/HostDetailsPage/modals/SelectQueryModal/SelectQueryModal.tsx b/frontend/pages/hosts/details/HostDetailsPage/modals/SelectQueryModal/SelectQueryModal.tsx
index f2f7276811..a0e98b4a7a 100644
--- a/frontend/pages/hosts/details/HostDetailsPage/modals/SelectQueryModal/SelectQueryModal.tsx
+++ b/frontend/pages/hosts/details/HostDetailsPage/modals/SelectQueryModal/SelectQueryModal.tsx
@@ -3,8 +3,6 @@ import { useQuery } from "react-query";
 import { filter, includes } from "lodash";
 import { InjectedRouter } from "react-router";
 
-import { TAGGED_TEMPLATES } from "utilities/helpers";
-
 import PATHS from "router/paths";
 
 import permissions from "utilities/permissions";
@@ -27,6 +25,7 @@ import {
 } from "interfaces/schedulable_query";
 import { API_ALL_TEAMS_ID } from "interfaces/team";
 import { DEFAULT_TARGETS_BY_TYPE } from "interfaces/target";
+import { getPathWithQueryParams } from "utilities/url";
 
 export interface ISelectQueryModalProps {
   onCancel: () => void;
@@ -75,16 +74,20 @@ const SelectQueryModal = ({
   const onQueryHostCustom = () => {
     setSelectedQueryTargetsByType(DEFAULT_TARGETS_BY_TYPE);
     router.push(
-      PATHS.NEW_QUERY() +
-        TAGGED_TEMPLATES.queryByHostRoute(hostId, currentTeamId)
+      getPathWithQueryParams(PATHS.NEW_QUERY, {
+        host_id: hostId,
+        team_id: currentTeamId,
+      })
     );
   };
 
   const onQueryHostSaved = (selectedQuery: ISchedulableQuery) => {
     setSelectedQueryTargetsByType(DEFAULT_TARGETS_BY_TYPE);
     router.push(
-      PATHS.EDIT_QUERY(selectedQuery.id) +
-        TAGGED_TEMPLATES.queryByHostRoute(hostId, currentTeamId)
+      getPathWithQueryParams(PATHS.EDIT_QUERY(selectedQuery.id), {
+        host_id: hostId,
+        team_id: currentTeamId,
+      })
     );
   };
 
diff --git a/frontend/pages/hosts/details/HostQueryReport/HostQueryReport.tsx b/frontend/pages/hosts/details/HostQueryReport/HostQueryReport.tsx
index 4ab02ae45f..13ca6264f8 100644
--- a/frontend/pages/hosts/details/HostQueryReport/HostQueryReport.tsx
+++ b/frontend/pages/hosts/details/HostQueryReport/HostQueryReport.tsx
@@ -1,21 +1,24 @@
-import BackLink from "components/BackLink";
-import Icon from "components/Icon";
-import MainContent from "components/MainContent";
-import ShowQueryModal from "components/modals/ShowQueryModal";
-import Spinner from "components/Spinner";
-import { AppContext } from "context/app";
-import {
-  IGetQueryResponse,
-  ISchedulableQuery,
-} from "interfaces/schedulable_query";
 import React, { useCallback, useContext, useState } from "react";
 import { useQuery } from "react-query";
 import { browserHistory, InjectedRouter, Link } from "react-router";
 import { Params } from "react-router/lib/Router";
 import PATHS from "router/paths";
+import { AppContext } from "context/app";
+
+import { DOCUMENT_TITLE_SUFFIX } from "utilities/constants";
+import { getPathWithQueryParams } from "utilities/url";
 import hqrAPI, { IGetHQRResponse } from "services/entities/host_query_report";
 import queryAPI from "services/entities/queries";
-import { DOCUMENT_TITLE_SUFFIX } from "utilities/constants";
+import {
+  IGetQueryResponse,
+  ISchedulableQuery,
+} from "interfaces/schedulable_query";
+
+import BackLink from "components/BackLink";
+import Icon from "components/Icon";
+import MainContent from "components/MainContent";
+import ShowQueryModal from "components/modals/ShowQueryModal";
+import Spinner from "components/Spinner";
 import HQRTable from "./HQRTable";
 
 const baseClass = "host-query-report";
@@ -29,7 +32,7 @@ const HostQueryReport = ({
   router,
   params: { host_id, query_id },
 }: IHostQueryReportProps) => {
-  const { config } = useContext(AppContext);
+  const { config, currentTeam } = useContext(AppContext);
   const globalReportsDisabled = config?.server_settings.query_reports_disabled;
   const hostId = Number(host_id);
   const queryId = Number(query_id);
@@ -105,7 +108,10 @@ const HostQueryReport = ({
   }
 
   const HQRHeader = useCallback(() => {
-    const fullReportPath = PATHS.QUERY_DETAILS(queryId);
+    const fullReportPath = getPathWithQueryParams(
+      PATHS.QUERY_DETAILS(queryId),
+      { team_id: currentTeam?.id }
+    );
     return (
       <div className={`${baseClass}__header`}>
         <div className={`${baseClass}__header__row1`}>
diff --git a/frontend/pages/hosts/details/cards/Policies/HostPolicies.tsx b/frontend/pages/hosts/details/cards/Policies/HostPolicies.tsx
index 70e70d515a..ec6e3fa0bb 100644
--- a/frontend/pages/hosts/details/cards/Policies/HostPolicies.tsx
+++ b/frontend/pages/hosts/details/cards/Policies/HostPolicies.tsx
@@ -3,10 +3,11 @@ import { InjectedRouter } from "react-router";
 import { Row } from "react-table";
 import { noop } from "lodash";
 
+import paths from "router/paths";
 import { isAndroid } from "interfaces/platform";
 import { IHostPolicy } from "interfaces/policy";
 import { PolicyResponse, SUPPORT_LINK } from "utilities/constants";
-import { createHostsByPolicyPath } from "utilities/helpers";
+import { getPathWithQueryParams } from "utilities/url";
 import TableContainer from "components/TableContainer";
 import EmptyTable from "components/EmptyTable";
 import Card from "components/Card";
@@ -61,13 +62,14 @@ const Policies = ({
     (row: IHostPoliciesRowProps) => {
       const { id: policyId, response: policyResponse } = row.original;
 
-      const viewAllHostPath = createHostsByPolicyPath(
-        policyId,
-        policyResponse === "pass"
-          ? PolicyResponse.PASSING
-          : PolicyResponse.FAILING,
-        currentTeamId
-      );
+      const viewAllHostPath = getPathWithQueryParams(paths.MANAGE_HOSTS, {
+        policy_id: policyId,
+        policy_response:
+          policyResponse === "pass"
+            ? PolicyResponse.PASSING
+            : PolicyResponse.FAILING,
+        team_id: currentTeamId,
+      });
 
       router.push(viewAllHostPath);
     },
diff --git a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
index ebe9d09272..c4a2d2ff2c 100644
--- a/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
+++ b/frontend/pages/hosts/details/cards/Software/HostSoftwareTableConfig.tsx
@@ -19,6 +19,7 @@ import {
 } from "interfaces/datatable_config";
 import { IDropdownOption } from "interfaces/dropdownOption";
 import PATHS from "router/paths";
+import { getPathWithQueryParams } from "utilities/url";
 
 import HeaderCell from "components/TableContainer/DataTable/HeaderCell/HeaderCell";
 import TextCell from "components/TableContainer/DataTable/TextCell";
@@ -183,8 +184,9 @@ export const generateSoftwareTableHeaders = ({
       Cell: (cellProps: ITableStringCellProps) => {
         const { id, name, source, app_store_app } = cellProps.row.original;
 
-        const softwareTitleDetailsPath = PATHS.SOFTWARE_TITLE_DETAILS(
-          id.toString().concat(`?team_id=${teamId}`)
+        const softwareTitleDetailsPath = getPathWithQueryParams(
+          PATHS.SOFTWARE_TITLE_DETAILS(id.toString()),
+          { team_id: teamId }
         );
 
         return (
diff --git a/frontend/pages/labels/NewLabelPage/DynamicLabel/DynamicLabel.tsx b/frontend/pages/labels/NewLabelPage/DynamicLabel/DynamicLabel.tsx
index f22ef4c858..3afc357882 100644
--- a/frontend/pages/labels/NewLabelPage/DynamicLabel/DynamicLabel.tsx
+++ b/frontend/pages/labels/NewLabelPage/DynamicLabel/DynamicLabel.tsx
@@ -5,7 +5,7 @@ import PATHS from "router/paths";
 import labelsAPI from "services/entities/labels";
 import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { IApiError } from "interfaces/errors";
 
 import DynamicLabelForm from "pages/labels/components/DynamicLabelForm";
@@ -37,9 +37,9 @@ const DynamicLabel = ({
         .create(formData)
         .then((res) => {
           router.push(
-            `${PATHS.MANAGE_HOSTS_LABEL(
-              res.label.id
-            )}?${buildQueryStringFromParams({ team_id: currentTeam?.id })}`
+            getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(res.label.id), {
+              team_id: currentTeam?.id,
+            })
           );
           renderFlash("success", "Label added successfully.");
         })
diff --git a/frontend/pages/labels/NewLabelPage/ManualLabel/ManualLabel.tsx b/frontend/pages/labels/NewLabelPage/ManualLabel/ManualLabel.tsx
index 5b3aee1c2d..6c15f726ee 100644
--- a/frontend/pages/labels/NewLabelPage/ManualLabel/ManualLabel.tsx
+++ b/frontend/pages/labels/NewLabelPage/ManualLabel/ManualLabel.tsx
@@ -5,7 +5,7 @@ import PATHS from "router/paths";
 import labelsAPI from "services/entities/labels";
 import { AppContext } from "context/app";
 import { NotificationContext } from "context/notification";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import { IApiError } from "interfaces/errors";
 
 import ManualLabelForm from "pages/labels/components/ManualLabelForm";
@@ -28,9 +28,9 @@ const ManualLabel = ({ router }: IManualLabelProps) => {
         .create(formData)
         .then((res) => {
           router.push(
-            `${PATHS.MANAGE_HOSTS_LABEL(
-              res.label.id
-            )}?${buildQueryStringFromParams({ team_id: currentTeam?.id })}`
+            getPathWithQueryParams(PATHS.MANAGE_HOSTS_LABEL(res.label.id), {
+              team_id: currentTeam?.id,
+            })
           );
           renderFlash("success", "Label added successfully.");
         })
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
index 66e2faa46e..a4bad2eec9 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/InstallSoftwareModal/InstallSoftwareModal.tsx
@@ -3,6 +3,7 @@ import React, { useCallback, useMemo, useState } from "react";
 import { useQuery } from "react-query";
 import { omit } from "lodash";
 
+import paths from "router/paths";
 import { IPolicyStats } from "interfaces/policy";
 import {
   CommaSeparatedPlatformString,
@@ -14,6 +15,7 @@ import softwareAPI, {
   ISoftwareTitlesResponse,
 } from "services/entities/software";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import { getPathWithQueryParams } from "utilities/url";
 
 // @ts-ignore
 import Dropdown from "components/forms/fields/Dropdown";
@@ -296,8 +298,14 @@ const InstallSoftwareModal = ({
         <div className={`${baseClass}__no-software`}>
           <b>No software available for install</b>
           <div>
-            Go to <a href={`/software/titles?team_id=${teamId}`}>Software</a> to
-            add software to this team.
+            Go to{" "}
+            <CustomLink
+              url={getPathWithQueryParams(paths.SOFTWARE_TITLES, {
+                team_id: teamId,
+              })}
+              text="Software"
+            />{" "}
+            to add software to this team.
           </div>
         </div>
       );
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx b/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx
index cb6cf1da05..be80402a4f 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/PoliciesTable/PoliciesTableConfig.tsx
@@ -11,9 +11,11 @@ import LinkCell from "components/TableContainer/DataTable/LinkCell/LinkCell";
 import Icon from "components/Icon";
 import { IPolicyStats } from "interfaces/policy";
 import PATHS from "router/paths";
+
+import { getPathWithQueryParams } from "utilities/url";
 import sortUtils from "utilities/sort";
 import { PolicyResponse } from "utilities/constants";
-import { createHostsByPolicyPath } from "utilities/helpers";
+
 import InheritedBadge from "components/InheritedBadge";
 import { getConditionalSelectHeaderCheckboxProps } from "components/TableContainer/utilities/config_utils";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
@@ -104,47 +106,51 @@ const generateTableHeaders = (
         />
       ),
       accessor: "name",
-      Cell: (cellProps: ICellProps): JSX.Element => (
-        <LinkCell
-          className="w250 policy-name-cell"
-          value={
-            <>
-              <div className="policy-name-text">{cellProps.cell.value}</div>
-              {isPremiumTier && cellProps.row.original.critical && (
-                <div className="critical-badge">
-                  <span
-                    className="critical-badge-icon"
-                    data-tooltip-id={`critical-tooltip-${cellProps.row.original.id}`}
-                  >
-                    <Icon
-                      className="critical-policy-icon"
-                      name="policy"
-                      size="small"
-                      color="core-fleet-blue"
-                    />
-                  </span>
-                  <ReactTooltip5
-                    className="critical-tooltip"
-                    disableStyleInjection
-                    place="top"
-                    opacity={1}
-                    id={`critical-tooltip-${cellProps.row.original.id}`}
-                    offset={8}
-                    positionStrategy="fixed"
-                  >
-                    This policy has been marked as critical.
-                  </ReactTooltip5>
-                </div>
-              )}
-              {viewingTeamPolicies &&
-                cellProps.row.original.team_id === null && (
+      Cell: (cellProps: ICellProps): JSX.Element => {
+        const { critical, id, team_id } = cellProps.row.original;
+        return (
+          <LinkCell
+            className="w250 policy-name-cell"
+            value={
+              <>
+                <div className="policy-name-text">{cellProps.cell.value}</div>
+                {isPremiumTier && critical && (
+                  <div className="critical-badge">
+                    <span
+                      className="critical-badge-icon"
+                      data-tooltip-id={`critical-tooltip-${id}`}
+                    >
+                      <Icon
+                        className="critical-policy-icon"
+                        name="policy"
+                        size="small"
+                        color="core-fleet-blue"
+                      />
+                    </span>
+                    <ReactTooltip5
+                      className="critical-tooltip"
+                      disableStyleInjection
+                      place="top"
+                      opacity={1}
+                      id={`critical-tooltip-${id}`}
+                      offset={8}
+                      positionStrategy="fixed"
+                    >
+                      This policy has been marked as critical.
+                    </ReactTooltip5>
+                  </div>
+                )}
+                {viewingTeamPolicies && team_id === null && (
                   <InheritedBadge tooltipContent="This policy runs on all hosts." />
                 )}
-            </>
-          }
-          path={PATHS.EDIT_POLICY(cellProps.row.original)}
-        />
-      ),
+              </>
+            }
+            path={getPathWithQueryParams(PATHS.EDIT_POLICY(id), {
+              team_id,
+            })}
+          />
+        );
+      },
       sortType: "caseInsensitive",
     },
     {
@@ -157,37 +163,35 @@ const generateTableHeaders = (
       ),
       accessor: "passing_host_count",
       Cell: (cellProps: ICellProps): JSX.Element => {
-        if (cellProps.row.original.has_run) {
+        const { has_run, id, next_update_ms } = cellProps.row.original;
+
+        if (has_run) {
           return (
             <LinkCell
               value={`${cellProps.cell.value} host${
                 cellProps.cell.value.toString() === "1" ? "" : "s"
               }`}
-              path={createHostsByPolicyPath(
-                cellProps.row.original.id,
-                PolicyResponse.PASSING,
-                selectedTeamId
-              )}
+              path={getPathWithQueryParams(PATHS.MANAGE_HOSTS, {
+                policy_id: id,
+                policy_response: PolicyResponse.PASSING,
+                team_id: selectedTeamId,
+              })}
             />
           );
         }
         return (
           <div className="policy-has-not-run">
-            <span
-              data-tooltip-id={`passing_${cellProps.row.original.id.toString()}`}
-            >
-              ---
-            </span>
+            <span data-tooltip-id={`passing_${id.toString()}`}>---</span>
             <ReactTooltip5
               className="policy-has-not-run-tooltip"
               disableStyleInjection
               place="top"
               opacity={1}
-              id={`passing_${cellProps.row.original.id.toString()}`}
+              id={`passing_${id.toString()}`}
               offset={8}
               positionStrategy="fixed"
             >
-              {getTooltip(cellProps.row.original.next_update_ms)}
+              {getTooltip(next_update_ms)}
             </ReactTooltip5>
           </div>
         );
@@ -203,37 +207,35 @@ const generateTableHeaders = (
       ),
       accessor: "failing_host_count",
       Cell: (cellProps: ICellProps): JSX.Element => {
-        if (cellProps.row.original.has_run) {
+        const { has_run, id, next_update_ms } = cellProps.row.original;
+
+        if (has_run) {
           return (
             <LinkCell
               value={`${cellProps.cell.value} host${
                 cellProps.cell.value.toString() === "1" ? "" : "s"
               }`}
-              path={createHostsByPolicyPath(
-                cellProps.row.original.id,
-                PolicyResponse.FAILING,
-                selectedTeamId
-              )}
+              path={getPathWithQueryParams(PATHS.MANAGE_HOSTS, {
+                policy_id: id,
+                policy_response: PolicyResponse.FAILING,
+                team_id: selectedTeamId,
+              })}
             />
           );
         }
         return (
           <div className="policy-has-not-run">
-            <span
-              data-tooltip-id={`passing_${cellProps.row.original.id.toString()}`}
-            >
-              ---
-            </span>
+            <span data-tooltip-id={`passing_${id.toString()}`}>---</span>
             <ReactTooltip5
               className="policy-has-not-run-tooltip"
               disableStyleInjection
               place="top"
               opacity={1}
-              id={`passing_${cellProps.row.original.id.toString()}`}
+              id={`passing_${id.toString()}`}
               offset={8}
               positionStrategy="fixed"
             >
-              {getTooltip(cellProps.row.original.next_update_ms)}
+              {getTooltip(next_update_ms)}
             </ReactTooltip5>
           </div>
         );
diff --git a/frontend/pages/policies/ManagePoliciesPage/components/PolicyRunScriptModal/PolicyRunScriptModal.tsx b/frontend/pages/policies/ManagePoliciesPage/components/PolicyRunScriptModal/PolicyRunScriptModal.tsx
index 947a30bff9..5d748498f1 100644
--- a/frontend/pages/policies/ManagePoliciesPage/components/PolicyRunScriptModal/PolicyRunScriptModal.tsx
+++ b/frontend/pages/policies/ManagePoliciesPage/components/PolicyRunScriptModal/PolicyRunScriptModal.tsx
@@ -2,7 +2,9 @@ import React, { useCallback, useState } from "react";
 import { useQuery } from "react-query";
 import { omit } from "lodash";
 
+import paths from "router/paths";
 import { DEFAULT_USE_QUERY_OPTIONS } from "utilities/constants";
+import { getPathWithQueryParams } from "utilities/url";
 
 import scriptsAPI, {
   IListScriptsQueryKey,
@@ -183,9 +185,12 @@ const PolicyRunScriptModal = ({
           <b>No scripts available for install</b>
           <div>
             Go to{" "}
-            <a href={`/controls/scripts?team_id=${teamId}`}>
-              Controls &gt; Scripts
-            </a>{" "}
+            <CustomLink
+              url={getPathWithQueryParams(paths.CONTROLS_SCRIPTS, {
+                team_id: teamId,
+              })}
+              text="Controls &gt; Scripts"
+            />{" "}
             to add scripts to this team.
           </div>
         </div>
diff --git a/frontend/pages/policies/PolicyPage/PolicyPage.tsx b/frontend/pages/policies/PolicyPage/PolicyPage.tsx
index 48a39cb2c5..235f5b150d 100644
--- a/frontend/pages/policies/PolicyPage/PolicyPage.tsx
+++ b/frontend/pages/policies/PolicyPage/PolicyPage.tsx
@@ -24,6 +24,7 @@ import teamPoliciesAPI from "services/entities/team_policies";
 import hostAPI from "services/entities/hosts";
 import statusAPI from "services/entities/status";
 import { DOCUMENT_TITLE_SUFFIX, LIVE_POLICY_STEPS } from "utilities/constants";
+import { getPathWithQueryParams } from "utilities/url";
 
 import QuerySidePanel from "components/side_panels/QuerySidePanel";
 import QueryEditor from "pages/policies/PolicyPage/screens/QueryEditor";
@@ -215,7 +216,9 @@ const PolicyPage = ({
     !(storedPolicy?.team_id?.toString() === location.query.team_id)
   ) {
     router.push(
-      `${location.pathname}?team_id=${storedPolicy?.team_id?.toString()}`
+      getPathWithQueryParams(location.pathname, {
+        team_id: storedPolicy?.team_id?.toString(),
+      })
     );
   }
 
@@ -304,6 +307,7 @@ const PolicyPage = ({
       goToSelectTargets: () => setStep(LIVE_POLICY_STEPS[2]),
       onOpenSchemaSidebar,
       renderLiveQueryWarning,
+      teamIdForApi,
     };
 
     const step2Opts = {
diff --git a/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx b/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx
index 553209818e..4af79a18ec 100644
--- a/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx
+++ b/frontend/pages/policies/PolicyPage/screens/QueryEditor.tsx
@@ -10,6 +10,7 @@ import { NotificationContext } from "context/notification";
 import PATHS from "router/paths";
 import debounce from "utilities/debounce";
 import deepDifference from "utilities/deep_difference";
+import { getPathWithQueryParams } from "utilities/url";
 import { IPolicyFormData, IPolicy } from "interfaces/policy";
 
 import BackLink from "components/BackLink";
@@ -30,6 +31,7 @@ interface IQueryEditorProps {
   goToSelectTargets: () => void;
   onOpenSchemaSidebar: () => void;
   renderLiveQueryWarning: () => JSX.Element | null;
+  teamIdForApi?: number;
 }
 
 const QueryEditor = ({
@@ -46,6 +48,7 @@ const QueryEditor = ({
   goToSelectTargets,
   onOpenSchemaSidebar,
   renderLiveQueryWarning,
+  teamIdForApi,
 }: IQueryEditorProps): JSX.Element | null => {
   const { currentUser, isPremiumTier, filteredPoliciesPath } = useContext(
     AppContext
@@ -161,7 +164,11 @@ const QueryEditor = ({
         (data) => data.policy
       );
       setIsUpdatingPolicy(false);
-      router.push(PATHS.EDIT_POLICY(policy));
+      router.push(
+        getPathWithQueryParams(PATHS.EDIT_POLICY(policy.id), {
+          team_id: policy.team_id,
+        })
+      );
       renderFlash("success", "Policy created!");
     } catch (createError: any) {
       console.error(createError);
@@ -234,7 +241,12 @@ const QueryEditor = ({
 
   // Function instead of constant eliminates race condition with filteredPoliciesPath
   const backToPoliciesPath = () => {
-    return filteredPoliciesPath || PATHS.MANAGE_POLICIES;
+    const queryParams = { team_id: teamIdForApi };
+
+    return (
+      filteredPoliciesPath ||
+      getPathWithQueryParams(PATHS.MANAGE_POLICIES, queryParams)
+    );
   };
 
   return (
diff --git a/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx b/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx
index 558428939d..38be850b6b 100644
--- a/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx
+++ b/frontend/pages/queries/ManageQueriesPage/ManageQueriesPage.tsx
@@ -7,7 +7,10 @@ import { AppContext } from "context/app";
 import { QueryContext } from "context/query";
 import { TableContext } from "context/table";
 import { NotificationContext } from "context/notification";
+import { DEFAULT_QUERY } from "utilities/constants";
 import { getPerformanceImpactDescription } from "utilities/helpers";
+import { getPathWithQueryParams } from "utilities/url";
+
 import {
   isQueryablePlatform,
   QueryablePlatform,
@@ -22,7 +25,7 @@ import { DEFAULT_TARGETS_BY_TYPE } from "interfaces/target";
 import { API_ALL_TEAMS_ID } from "interfaces/team";
 import queriesAPI, { IQueriesResponse } from "services/entities/queries";
 import PATHS from "router/paths";
-import { DEFAULT_QUERY } from "utilities/constants";
+
 import Button from "components/buttons/Button";
 import TableDataError from "components/DataError";
 import MainContent from "components/MainContent";
@@ -181,7 +184,9 @@ const ManageQueriesPage = ({
 
   const onCreateQueryClick = useCallback(() => {
     setLastEditedQueryBody(DEFAULT_QUERY.query);
-    router.push(PATHS.NEW_QUERY(currentTeamId));
+    router.push(
+      getPathWithQueryParams(PATHS.NEW_QUERY, { team_id: currentTeamId })
+    );
   }, [currentTeamId, router, setLastEditedQueryBody]);
 
   const toggleDeleteQueryModal = useCallback(() => {
diff --git a/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx b/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx
index 3c5bb98d5c..cde2a68b61 100644
--- a/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx
+++ b/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTable.tsx
@@ -2,17 +2,18 @@
 import React, { useContext, useCallback, useMemo } from "react";
 import { InjectedRouter } from "react-router";
 import { Row } from "react-table";
+import { SingleValue } from "react-select-5";
 
+import PATHS from "router/paths";
 import { AppContext } from "context/app";
 import { IEmptyTableProps } from "interfaces/empty_table";
 import { APP_CONTEXT_ALL_TEAMS_ID } from "interfaces/team";
 import { isQueryablePlatform, SelectedPlatform } from "interfaces/platform";
 import { IEnhancedQuery } from "interfaces/schedulable_query";
-import { ITableQueryData } from "components/TableContainer/TableContainer";
-import PATHS from "router/paths";
 import { getNextLocationPath } from "utilities/helpers";
+import { getPathWithQueryParams } from "utilities/url";
 
-import { SingleValue } from "react-select-5";
+import { ITableQueryData } from "components/TableContainer/TableContainer";
 import DropdownWrapper from "components/forms/fields/DropdownWrapper";
 import { CustomOptionType } from "components/forms/fields/DropdownWrapper/DropdownWrapper";
 import TableContainer from "components/TableContainer";
@@ -227,9 +228,11 @@ const QueriesTable = ({
 
   const handleRowSelect = (row: IRowProps) => {
     if (row.original.id) {
-      const path = PATHS.QUERY_DETAILS(row.original.id, currentTeamId);
-
-      router && router.push(path);
+      router?.push(
+        getPathWithQueryParams(PATHS.QUERY_DETAILS(row.original.id), {
+          team_id: currentTeamId,
+        })
+      );
     }
   };
 
diff --git a/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTableConfig.tsx b/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTableConfig.tsx
index b2208e632d..c698325893 100644
--- a/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTableConfig.tsx
+++ b/frontend/pages/queries/ManageQueriesPage/components/QueriesTable/QueriesTableConfig.tsx
@@ -7,19 +7,21 @@ import PATHS from "router/paths";
 
 import { Tooltip as ReactTooltip5 } from "react-tooltip-5";
 
-import permissionsUtils from "utilities/permissions";
-import { IUser } from "interfaces/user";
 import { secondsToDhms } from "utilities/helpers";
-import {
-  IEnhancedQuery,
-  ISchedulableQuery,
-} from "interfaces/schedulable_query";
+import permissionsUtils from "utilities/permissions";
+import { getPathWithQueryParams } from "utilities/url";
+
 import {
   isScheduledQueryablePlatform,
   ScheduledQueryablePlatform,
   CommaSeparatedPlatformString,
 } from "interfaces/platform";
+import {
+  IEnhancedQuery,
+  ISchedulableQuery,
+} from "interfaces/schedulable_query";
 import { API_ALL_TEAMS_ID } from "interfaces/team";
+import { IUser } from "interfaces/user";
 
 import Icon from "components/Icon";
 import Checkbox from "components/forms/fields/Checkbox";
@@ -32,7 +34,6 @@ import PerformanceImpactCell from "components/TableContainer/DataTable/Performan
 import TooltipWrapper from "components/TooltipWrapper";
 import InheritedBadge from "components/InheritedBadge";
 import GitOpsModeTooltipWrapper from "components/GitOpsModeTooltipWrapper";
-
 import QueryAutomationsStatusIndicator from "../QueryAutomationsStatusIndicator";
 
 interface IQueryRow {
@@ -137,50 +138,49 @@ const generateColumnConfigs = ({
       ),
       accessor: "name",
       Cell: (cellProps: ICellProps): JSX.Element => {
+        const { id, team_id, observer_can_run } = cellProps.row.original;
         return (
           <LinkCell
             className="w400 query-name-cell"
             value={
               <>
                 <div className="query-name-text">{cellProps.cell.value}</div>
-                {!isCurrentTeamObserverOrGlobalObserver &&
-                  cellProps.row.original.observer_can_run && (
-                    <div className="observer-can-run-badge">
-                      <span
-                        className="observer-can-run-icon"
-                        data-tooltip-id={`observer-can-run-tooltip-${cellProps.row.original.id}`}
-                      >
-                        <Icon
-                          className="observer-can-run-query-icon"
-                          name="query"
-                          size="small"
-                          color="core-fleet-blue"
-                        />
-                      </span>
-                      <ReactTooltip5
-                        className="observer-can-run-tooltip"
-                        disableStyleInjection
-                        place="top"
-                        opacity={1}
-                        id={`observer-can-run-tooltip-${cellProps.row.original.id}`}
-                        offset={8}
-                        positionStrategy="fixed"
-                      >
-                        Observers can run this query.
-                      </ReactTooltip5>
-                    </div>
-                  )}
+                {!isCurrentTeamObserverOrGlobalObserver && observer_can_run && (
+                  <div className="observer-can-run-badge">
+                    <span
+                      className="observer-can-run-icon"
+                      data-tooltip-id={`observer-can-run-tooltip-${id}`}
+                    >
+                      <Icon
+                        className="observer-can-run-query-icon"
+                        name="query"
+                        size="small"
+                        color="core-fleet-blue"
+                      />
+                    </span>
+                    <ReactTooltip5
+                      className="observer-can-run-tooltip"
+                      disableStyleInjection
+                      place="top"
+                      opacity={1}
+                      id={`observer-can-run-tooltip-${id}`}
+                      offset={8}
+                      positionStrategy="fixed"
+                    >
+                      Observers can run this query.
+                    </ReactTooltip5>
+                  </div>
+                )}
                 {viewingTeamScope &&
                   // inherited
-                  cellProps.row.original.team_id !== currentTeamId && (
+                  team_id !== currentTeamId && (
                     <InheritedBadge tooltipContent="This query runs on all hosts." />
                   )}
               </>
             }
-            path={PATHS.QUERY_DETAILS(
-              cellProps.row.original.id,
-              cellProps.row.original.team_id ?? currentTeamId
-            )}
+            path={getPathWithQueryParams(PATHS.QUERY_DETAILS(id), {
+              team_id: team_id ?? currentTeamId,
+            })}
           />
         );
       },
diff --git a/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx b/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx
index 123dc8fefd..b2a88ce54e 100644
--- a/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx
+++ b/frontend/pages/queries/details/QueryDetailsPage/QueryDetailsPage.tsx
@@ -22,7 +22,7 @@ import {
   isTeamObserver,
 } from "utilities/permissions/permissions";
 import { DOCUMENT_TITLE_SUFFIX, SUPPORT_LINK } from "utilities/constants";
-import { buildQueryStringFromParams } from "utilities/url";
+import { getPathWithQueryParams } from "utilities/url";
 import useTeamIdParam from "hooks/useTeamIdParam";
 
 import Spinner from "components/Spinner/Spinner";
@@ -179,7 +179,9 @@ const QueryDetailsPage = ({
     !(storedQuery?.team_id?.toString() === location.query.team_id)
   ) {
     router.push(
-      `${location.pathname}?team_id=${storedQuery?.team_id?.toString()}`
+      getPathWithQueryParams(location.pathname, {
+        team_id: storedQuery?.team_id?.toString(),
+      })
     );
   }
 
@@ -249,9 +251,9 @@ const QueryDetailsPage = ({
     const backToQueriesPath = () => {
       return (
         filteredQueriesPath ||
-        `${PATHS.MANAGE_QUERIES}?${buildQueryStringFromParams({
+        getPathWithQueryParams(PATHS.MANAGE_QUERIES, {
           team_id: currentTeamId,
-        })}`
+        })
       );
     };
 
@@ -283,7 +285,11 @@ const QueryDetailsPage = ({
                   <Button
                     onClick={() => {
                       queryId &&
-                        router.push(PATHS.EDIT_QUERY(queryId, currentTeamId));
+                        router.push(
+                          getPathWithQueryParams(PATHS.EDIT_QUERY(queryId), {
+                            team_id: currentTeamId,
+                          })
+                        );
                     }}
                     className={`${baseClass}__manage-automations button`}
                     variant="brand"
@@ -307,7 +313,13 @@ const QueryDetailsPage = ({
                         onClick={() => {
                           queryId &&
                             router.push(
-                              PATHS.LIVE_QUERY(queryId, currentTeamId, hostId)
+                              getPathWithQueryParams(
+                                PATHS.LIVE_QUERY(queryId),
+                                {
+                                  host_id: hostId,
+                                  team_id: currentTeamId,
+                                }
+                              )
                             );
                         }}
                         disabled={isLiveQueryDisabled}
diff --git a/frontend/pages/queries/edit/EditQueryPage.tsx b/frontend/pages/queries/edit/EditQueryPage.tsx
index f5ccae21b4..3e52d4212b 100644
--- a/frontend/pages/queries/edit/EditQueryPage.tsx
+++ b/frontend/pages/queries/edit/EditQueryPage.tsx
@@ -2,9 +2,16 @@ import React, { useState, useEffect, useContext } from "react";
 import { useQuery } from "react-query";
 import { useErrorHandler } from "react-error-boundary";
 import { InjectedRouter, Params } from "react-router/lib/Router";
+import PATHS from "router/paths";
 
 import { AppContext } from "context/app";
+import { NotificationContext } from "context/notification";
 import { QueryContext } from "context/query";
+import useTeamIdParam from "hooks/useTeamIdParam";
+
+import debounce from "utilities/debounce";
+import deepDifference from "utilities/deep_difference";
+import { getPathWithQueryParams } from "utilities/url";
 import {
   DEFAULT_QUERY,
   DOCUMENT_TITLE_SUFFIX,
@@ -28,16 +35,6 @@ import SidePanelContent from "components/SidePanelContent";
 import CustomLink from "components/CustomLink";
 import BackLink from "components/BackLink";
 import InfoBanner from "components/InfoBanner";
-
-import useTeamIdParam from "hooks/useTeamIdParam";
-
-import { NotificationContext } from "context/notification";
-
-import PATHS from "router/paths";
-import debounce from "utilities/debounce";
-import deepDifference from "utilities/deep_difference";
-import { buildQueryStringFromParams } from "utilities/url";
-
 import EditQueryForm from "./components/EditQueryForm";
 
 interface IEditQueryPageProps {
@@ -58,6 +55,9 @@ const EditQueryPage = ({
   location,
 }: IEditQueryPageProps): JSX.Element => {
   const queryId = paramsQueryId ? parseInt(paramsQueryId, 10) : null;
+  const hostId = location.query.host_id
+    ? parseInt(location.query.host_id as string, 10)
+    : undefined;
 
   const {
     currentTeamName: teamNameForQuery,
@@ -176,7 +176,9 @@ const EditQueryPage = ({
     !(storedQuery?.team_id?.toString() === location.query.team_id)
   ) {
     router.push(
-      `${location.pathname}?team_id=${storedQuery?.team_id?.toString()}`
+      getPathWithQueryParams(location.pathname, {
+        team_id: storedQuery?.team_id?.toString(),
+      })
     );
   }
 
@@ -212,13 +214,12 @@ const EditQueryPage = ({
       !canEditExistingQuery
     ) {
       // Reroute to query report page still maintains query params for live query purposes
-      const baseUrl = PATHS.QUERY_DETAILS(queryId);
-      const queryParams = buildQueryStringFromParams({
-        host_id: location.query.host_id,
-        team_id: location.query.team_id,
-      });
-
-      router.push(queryParams ? `${baseUrl}?${queryParams}` : baseUrl);
+      router.push(
+        getPathWithQueryParams(PATHS.QUERY_DETAILS(queryId), {
+          host_id: location.query.host_id,
+          team_id: location.query.team_id,
+        })
+      );
     }
   }, [queryId, isTeamMaintainerOrTeamAdmin, isStoredQueryLoading]);
 
@@ -264,7 +265,11 @@ const EditQueryPage = ({
       setIsQuerySaving(true);
       try {
         const { query } = await queryAPI.create(formData);
-        router.push(PATHS.QUERY_DETAILS(query.id, query.team_id));
+        router.push(
+          getPathWithQueryParams(PATHS.QUERY_DETAILS(query.id), {
+            team_id: query.team_id,
+          })
+        );
         renderFlash("success", "Query created!");
         setBackendValidators({});
       } catch (createError: any) {
@@ -365,17 +370,16 @@ const EditQueryPage = ({
   };
 
   // Function instead of constant eliminates race condition
-  const backToQueriesPath = () => {
-    const manageQueryPage =
-      filteredQueriesPath ||
-      `${PATHS.MANAGE_QUERIES}?${buildQueryStringFromParams({
-        team_id: currentTeamId,
-      })}`;
-
-    return queryId
-      ? PATHS.QUERY_DETAILS(queryId, currentTeamId)
-      : manageQueryPage;
-  };
+  // Returns to queries details page, manage queries page with filters, or default manage queries page
+  const backToQueriesPath = () =>
+    queryId
+      ? getPathWithQueryParams(PATHS.QUERY_DETAILS(queryId), {
+          team_id: currentTeamId,
+        })
+      : filteredQueriesPath ||
+        getPathWithQueryParams(PATHS.MANAGE_QUERIES, {
+          team_id: currentTeamId,
+        });
 
   const showSidebar =
     isSidebarOpen &&
@@ -412,7 +416,7 @@ const EditQueryPage = ({
             backendValidators={backendValidators}
             isQuerySaving={isQuerySaving}
             isQueryUpdating={isQueryUpdating}
-            hostId={parseInt(location.query.host_id as string, 10)}
+            hostId={hostId}
             queryReportsDisabled={
               appConfig?.server_settings.query_reports_disabled
             }
diff --git a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx
index 57f38a93c4..0012431fb1 100644
--- a/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx
+++ b/frontend/pages/queries/edit/components/EditQueryForm/EditQueryForm.tsx
@@ -26,7 +26,6 @@ import {
   addGravatarUrlToResource,
   getCustomDropdownOptions,
   secondsToDhms,
-  TAGGED_TEMPLATES,
 } from "utilities/helpers";
 import {
   FREQUENCY_DROPDOWN_OPTIONS,
@@ -36,6 +35,7 @@ import {
   INVALID_PLATFORMS_REASON,
   INVALID_PLATFORMS_FLASH_MESSAGE,
 } from "utilities/constants";
+import { getPathWithQueryParams } from "utilities/url";
 
 import usePlatformCompatibility from "hooks/usePlatformCompatibility";
 
@@ -341,10 +341,9 @@ const EditQueryForm = ({
         .then((response: { query: ISchedulableQuery }) => {
           setIsSaveAsNewLoading(false);
           router.push(
-            PATHS.QUERY_DETAILS(
-              response.query.id,
-              response.query.team_id ?? undefined
-            )
+            getPathWithQueryParams(PATHS.QUERY_DETAILS(response.query.id), {
+              team_id: response.query.team_id,
+            })
           );
           renderFlash("success", `Successfully added query.`);
         })
@@ -366,7 +365,11 @@ const EditQueryForm = ({
               })
               .then((response: { query: ISchedulableQuery }) => {
                 setIsSaveAsNewLoading(false);
-                router.push(PATHS.EDIT_QUERY(response.query.id));
+                router.push(
+                  getPathWithQueryParams(PATHS.EDIT_QUERY(response.query.id), {
+                    team_id: apiTeamIdForQuery,
+                  })
+                );
                 renderFlash(
                   "success",
                   `Successfully added query as "Copy of ${lastEditedQueryName}".`
@@ -657,8 +660,10 @@ const EditQueryForm = ({
               variant="blue-green"
               onClick={() => {
                 router.push(
-                  PATHS.LIVE_QUERY(queryIdForEdit) +
-                    TAGGED_TEMPLATES.queryByHostRoute(hostId, apiTeamIdForQuery)
+                  getPathWithQueryParams(PATHS.LIVE_QUERY(queryIdForEdit), {
+                    host_id: hostId,
+                    team_id: apiTeamIdForQuery,
+                  })
                 );
               }}
               disabled={disabledLiveQuery}
@@ -732,6 +737,7 @@ const EditQueryForm = ({
     const disableSaveFormErrors =
       (lastEditedQueryName === "" && !!lastEditedQueryId) || !!size(errors);
 
+    console.log("hostId", hostId);
     return (
       <>
         <form className={`${baseClass}`} autoComplete="off">
@@ -941,8 +947,10 @@ const EditQueryForm = ({
                     setEditingExistingQuery(true); // Persists edited query data through live query flow
                   }
                   router.push(
-                    PATHS.LIVE_QUERY(queryIdForEdit) +
-                      TAGGED_TEMPLATES.queryByHostRoute(hostId, currentTeamId)
+                    getPathWithQueryParams(PATHS.LIVE_QUERY(queryIdForEdit), {
+                      host_id: hostId,
+                      team_id: currentTeamId,
+                    })
                   );
                 }}
                 disabled={disabledLiveQuery}
diff --git a/frontend/pages/queries/live/LiveQueryPage/LiveQueryPage.tsx b/frontend/pages/queries/live/LiveQueryPage/LiveQueryPage.tsx
index d4edf59c1a..cbcb91abf9 100644
--- a/frontend/pages/queries/live/LiveQueryPage/LiveQueryPage.tsx
+++ b/frontend/pages/queries/live/LiveQueryPage/LiveQueryPage.tsx
@@ -8,6 +8,7 @@ import useTeamIdParam from "hooks/useTeamIdParam";
 import { AppContext } from "context/app";
 import { QueryContext } from "context/query";
 import { LIVE_QUERY_STEPS, DOCUMENT_TITLE_SUFFIX } from "utilities/constants";
+import { getPathWithQueryParams } from "utilities/url";
 import queryAPI from "services/entities/queries";
 import hostAPI from "services/entities/hosts";
 import { IHost, IHostResponse } from "interfaces/host";
@@ -85,9 +86,13 @@ const RunQueryPage = ({
 
   // Reroute users out of live flow when live queries are globally disabled
   if (disabledLiveQuery) {
-    queryId
-      ? router.push(PATHS.QUERY_DETAILS(queryId, currentTeamId))
-      : router.push(PATHS.NEW_QUERY(currentTeamId));
+    const path = queryId ? PATHS.QUERY_DETAILS(queryId) : PATHS.NEW_QUERY;
+
+    router.push(
+      getPathWithQueryParams(path, {
+        team_id: currentTeamId,
+      })
+    );
   }
 
   // disabled on page load so we can control the number of renders
@@ -155,13 +160,11 @@ const RunQueryPage = ({
     }
   }, [location.pathname, storedQuery?.name]);
 
-  const goToQueryEditor = useCallback(
-    () =>
-      queryId
-        ? router.push(PATHS.EDIT_QUERY(queryId, currentTeamId))
-        : router.push(PATHS.NEW_QUERY(currentTeamId)),
-    []
-  );
+  const goToQueryEditor = useCallback(() => {
+    const path = queryId ? PATHS.EDIT_QUERY(queryId) : PATHS.NEW_QUERY;
+
+    router.push(getPathWithQueryParams(path, { team_id: currentTeamId }));
+  }, []);
 
   const renderScreen = () => {
     const step1Props = {
diff --git a/frontend/router/page_titles.ts b/frontend/router/page_titles.ts
index 0b53cb8f42..ec6c89e0aa 100644
--- a/frontend/router/page_titles.ts
+++ b/frontend/router/page_titles.ts
@@ -19,7 +19,7 @@ export default [
     path: PATHS.MANAGE_QUERIES,
     title: `Queries | ${DOCUMENT_TITLE_SUFFIX}`,
   },
-  { path: PATHS.NEW_QUERY(), title: `New query | ${DOCUMENT_TITLE_SUFFIX}` },
+  { path: PATHS.NEW_QUERY, title: `New query | ${DOCUMENT_TITLE_SUFFIX}` },
   {
     path: PATHS.MANAGE_POLICIES,
     title: `Policies | ${DOCUMENT_TITLE_SUFFIX}`,
diff --git a/frontend/router/paths.ts b/frontend/router/paths.ts
index f7093ac7a9..8683447023 100644
--- a/frontend/router/paths.ts
+++ b/frontend/router/paths.ts
@@ -1,6 +1,5 @@
 import { buildQueryStringFromParams } from "utilities/url";
 
-import { IPolicy } from "../interfaces/policy";
 import URL_PREFIX from "./url_prefix";
 
 // Note: changes to paths.ts should change page_titles.ts respectively
@@ -97,39 +96,16 @@ export default {
   EDIT_PACK: (packId: number): string => {
     return `${URL_PREFIX}/packs/${packId}/edit`;
   },
-  PACK: (packId: number): string => {
-    return `${URL_PREFIX}/packs/${packId}`;
-  },
-  EDIT_LABEL: (labelId: number): string => {
-    return `${URL_PREFIX}/labels/${labelId}`;
-  },
-  EDIT_QUERY: (queryId: number, teamId?: number): string => {
-    return `${URL_PREFIX}/queries/${queryId}/edit${
-      teamId ? `?team_id=${teamId}` : ""
-    }`;
-  },
-  LIVE_QUERY: (
-    queryId: number | null,
-    teamId?: number,
-    hostId?: number
-  ): string => {
-    const baseUrl = `${URL_PREFIX}/queries/${queryId || "new"}/live`;
-    const queryParams = buildQueryStringFromParams({
-      team_id: teamId,
-      host_id: hostId,
-    });
-    return queryParams ? `${baseUrl}?${queryParams}` : baseUrl;
-  },
-  QUERY_DETAILS: (queryId: number, teamId?: number): string => {
-    return `${URL_PREFIX}/queries/${queryId}${
-      teamId ? `?team_id=${teamId}` : ""
-    }`;
-  },
-  EDIT_POLICY: (policy: IPolicy): string => {
-    return `${URL_PREFIX}/policies/${policy.id}${
-      policy.team_id !== undefined ? `?team_id=${policy.team_id}` : ""
-    }`;
-  },
+  PACK: (packId: number): string => `${URL_PREFIX}/packs/${packId}`,
+  EDIT_LABEL: (labelId: number): string => `${URL_PREFIX}/labels/${labelId}`,
+  EDIT_QUERY: (queryId: number): string =>
+    `${URL_PREFIX}/queries/${queryId}/edit`,
+  LIVE_QUERY: (queryId: number | null): string =>
+    `${URL_PREFIX}/queries/${queryId || "new"}/live`,
+  QUERY_DETAILS: (queryId: number): string =>
+    `${URL_PREFIX}/queries/${queryId}`,
+  EDIT_POLICY: (policyId: number): string =>
+    `${URL_PREFIX}/policies/${policyId}`,
   FORGOT_PASSWORD: `${URL_PREFIX}/login/forgot`,
   MFA: `${URL_PREFIX}/login/mfa`,
   NO_ACCESS: `${URL_PREFIX}/login/denied`,
@@ -143,7 +119,6 @@ export default {
   LOGIN: `${URL_PREFIX}/login`,
   LOGOUT: `${URL_PREFIX}/logout`,
   MANAGE_HOSTS: `${URL_PREFIX}/hosts/manage`,
-  MANAGE_HOSTS_ADD_HOSTS: `${URL_PREFIX}/hosts/manage/?add_hosts=true`,
   MANAGE_HOSTS_LABEL: (labelId: number | string): string => {
     return `${URL_PREFIX}/hosts/manage/labels/${labelId}`;
   },
@@ -199,14 +174,10 @@ export default {
   NEW_PACK: `${URL_PREFIX}/packs/new`,
   MANAGE_QUERIES: `${URL_PREFIX}/queries/manage`,
   MANAGE_SCHEDULE: `${URL_PREFIX}/schedule/manage`,
-  MANAGE_TEAM_SCHEDULE: (teamId: number): string => {
-    return `${URL_PREFIX}/schedule/manage?team_id=${teamId}`;
-  },
   MANAGE_POLICIES: `${URL_PREFIX}/policies/manage`,
   NEW_LABEL: `${URL_PREFIX}/labels/new`,
   NEW_POLICY: `${URL_PREFIX}/policies/new`,
-  NEW_QUERY: (teamId?: number) =>
-    `${URL_PREFIX}/queries/new${teamId ? `?team_id=${teamId}` : ""}`,
+  NEW_QUERY: `${URL_PREFIX}/queries/new`,
   RESET_PASSWORD: `${URL_PREFIX}/login/reset`,
   SETUP: `${URL_PREFIX}/setup`,
   ACCOUNT: `${URL_PREFIX}/account`,
diff --git a/frontend/utilities/helpers.tsx b/frontend/utilities/helpers.tsx
index 1e68d7322a..615b825a32 100644
--- a/frontend/utilities/helpers.tsx
+++ b/frontend/utilities/helpers.tsx
@@ -86,18 +86,6 @@ export const addGravatarUrlToResource = (resource: any): any => {
   };
 };
 
-export const createHostsByPolicyPath = (
-  policyId: number,
-  policyResponse: PolicyResponse,
-  teamId?: number | null
-) => {
-  return `${PATHS.MANAGE_HOSTS}?${buildQueryStringFromParams({
-    policy_id: policyId,
-    policy_response: policyResponse,
-    team_id: teamId,
-  })}`;
-};
-
 /** Removes Apple OS Prefix from host.os_version. */
 export const removeOSPrefix = (version: string): string => {
   return version.replace(/^(macOS |iOS |iPadOS )/i, "");
@@ -848,17 +836,6 @@ export const getSoftwareBundleTooltipJSX = (bundle: string) => (
   </span>
 );
 
-export const TAGGED_TEMPLATES = {
-  queryByHostRoute: (hostId?: number | null, teamId?: number | null) => {
-    const queryString = buildQueryStringFromParams({
-      host_id: hostId || undefined,
-      team_id: teamId,
-    });
-
-    return queryString && `?${queryString}`;
-  },
-};
-
 export const internallyTruncateText = (
   original: string,
   prefixLength = 280,
@@ -917,7 +894,6 @@ export default {
   addGravatarUrlToResource,
   removeOSPrefix,
   compareVersions,
-  createHostsByPolicyPath,
   formatLabelResponse,
   formatFloatAsPercentage,
   formatSeverity,
@@ -956,5 +932,4 @@ export default {
   normalizeEmptyValues,
   wait,
   wrapFleetHelper,
-  TAGGED_TEMPLATES,
 };
diff --git a/frontend/utilities/url/index.ts b/frontend/utilities/url/index.ts
index c15a910a98..a3002c84c4 100644
--- a/frontend/utilities/url/index.ts
+++ b/frontend/utilities/url/index.ts
@@ -92,6 +92,7 @@ const filterEmptyParams = (queryParams: QueryParams) => {
  * creates a query string from a query params object. If a value is undefined, null,
  * or an empty string on the queryParams object, that key-value pair will be
  * excluded from the query string.
+ * TODO: For UI elements, replace all instances of buildQueryStringFromParams with getPathWithQueryParams
  */
 export const buildQueryStringFromParams = <T>(queryParams: QueryParams2<T>) => {
   const filteredParams = filterEmptyParams(queryParams);
@@ -107,6 +108,24 @@ export const buildQueryStringFromParams = <T>(queryParams: QueryParams2<T>) => {
   return queryString;
 };
 
+/**
+ * creates a path string from the root path and optional query params
+ * @param endpoint
+ * @param queryParams
+ * @returns string
+ */
+export const getPathWithQueryParams = <T>(
+  endpoint: string,
+  queryParams?: QueryParams2<T>
+) => {
+  if (!queryParams) {
+    return endpoint;
+  }
+
+  const queryString = buildQueryStringFromParams(queryParams);
+  return queryString ? `${endpoint}?${queryString}` : endpoint;
+};
+
 export const reconcileSoftwareParams = ({
   teamId,
   softwareId,
diff --git a/frontend/utilities/url/url.tests.ts b/frontend/utilities/url/url.tests.ts
index cdf84fa5f8..18e71b3a08 100644
--- a/frontend/utilities/url/url.tests.ts
+++ b/frontend/utilities/url/url.tests.ts
@@ -1,8 +1,91 @@
 import {
   buildQueryStringFromParams,
+  getPathWithQueryParams,
   reconcileMutuallyInclusiveHostParams,
 } from ".";
 
+describe("url utilites > buildQueryStringFromParams", () => {
+  it("creates a query string from a params object", () => {
+    const params = {
+      query: "test",
+      page: 1,
+      order: "asc",
+      isNew: true,
+    };
+    expect(buildQueryStringFromParams(params)).toBe(
+      "query=test&page=1&order=asc&isNew=true"
+    );
+  });
+
+  it("filters out undefined values", () => {
+    const params = {
+      query: undefined,
+      page: 1,
+      order: "asc",
+    };
+    expect(buildQueryStringFromParams(params)).toBe("page=1&order=asc");
+  });
+
+  it("filters out empty string values", () => {
+    const params = {
+      query: "",
+      page: 1,
+      order: "asc",
+    };
+    expect(buildQueryStringFromParams(params)).toBe("page=1&order=asc");
+  });
+
+  it("filters out null values", () => {
+    const params = {
+      query: null,
+      page: 1,
+      order: "asc",
+    };
+    expect(buildQueryStringFromParams(params)).toBe("page=1&order=asc");
+  });
+});
+
+describe("url utilities > getPathWithQueryParams", () => {
+  it("returns the endpoint when no query params are provided", () => {
+    expect(getPathWithQueryParams("/api/users")).toBe("/api/users");
+  });
+
+  it("appends query string when query params are provided", () => {
+    const endpoint = "/hosts/manage";
+    const queryParams = {
+      software_id: 25,
+      team_id: 10,
+      order_key: "issues",
+    };
+    expect(getPathWithQueryParams(endpoint, queryParams)).toBe(
+      "/hosts/manage?software_id=25&team_id=10&order_key=issues"
+    );
+  });
+
+  it("filters out undefined, null, and empty string values from query params", () => {
+    const endpoint = "/hosts/manage";
+    const queryParams = {
+      software_id: undefined,
+      team_id: null,
+      policy_response: "",
+      policy_id: 4,
+    };
+    expect(getPathWithQueryParams(endpoint, queryParams)).toBe(
+      "/hosts/manage?policy_id=4"
+    );
+  });
+
+  it("returns only the endpoint when all query params are filtered out", () => {
+    const endpoint = "/hosts/manage";
+    const queryParams = {
+      software_id: undefined,
+      team_id: null,
+      policy_response: "",
+    };
+    expect(getPathWithQueryParams(endpoint, queryParams)).toBe("/hosts/manage");
+  });
+});
+
 describe("url utilities > reconcileMutuallyInclusiveHostParams", () => {
   it("leaves macSettingsStatus and teamId unchanged when both are present", () => {
     const [macSettingsStatus, teamId] = ["pending" as const, 1];
@@ -75,44 +158,3 @@ describe("url utilities > reconcileMutuallyInclusiveHostParams", () => {
     });
   });
 });
-
-describe("url utilites > buildQueryStringFromParams", () => {
-  it("creates a query string from a params object", () => {
-    const params = {
-      query: "test",
-      page: 1,
-      order: "asc",
-      isNew: true,
-    };
-    expect(buildQueryStringFromParams(params)).toBe(
-      "query=test&page=1&order=asc&isNew=true"
-    );
-  });
-
-  it("filters out undefined values", () => {
-    const params = {
-      query: undefined,
-      page: 1,
-      order: "asc",
-    };
-    expect(buildQueryStringFromParams(params)).toBe("page=1&order=asc");
-  });
-
-  it("filters out empty string values", () => {
-    const params = {
-      query: "",
-      page: 1,
-      order: "asc",
-    };
-    expect(buildQueryStringFromParams(params)).toBe("page=1&order=asc");
-  });
-
-  it("filters out null values", () => {
-    const params = {
-      query: null,
-      page: 1,
-      order: "asc",
-    };
-    expect(buildQueryStringFromParams(params)).toBe("page=1&order=asc");
-  });
-});

From 208d4e704db6d1e132b40e9eaa5c6763327c10a9 Mon Sep 17 00:00:00 2001
From: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Date: Thu, 27 Feb 2025 10:36:23 -0600
Subject: [PATCH 12/15] Update instructions for manually turning on MDM
 (#26557)

---
 .../ManualEnrollMdmModal/ManualEnrollMdmModal.tsx               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx b/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx
index 54211dd005..d8e71fa229 100644
--- a/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx
+++ b/frontend/pages/hosts/details/DeviceUserPage/ManualEnrollMdmModal/ManualEnrollMdmModal.tsx
@@ -92,7 +92,7 @@ const ManualEnrollMdmModal = ({
             )}
           </li>
           <li>
-            Select <b>Enroll</b> then enter your password.
+            Select <b>Install</b> then enter your password.
           </li>
           <li>
             Select <b>Done</b> to close this window and select <b>Refetch</b> on

From d87439faacfd8a3f1c859cc731f5669f7bebf128 Mon Sep 17 00:00:00 2001
From: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Date: Thu, 27 Feb 2025 13:37:07 -0300
Subject: [PATCH 13/15] Remove proposals (unused) (#26646)

The proposals/ directory approach is not used and hasn't been used in 2
years.
Removing it to reduce repository clutter.
---
 proposals/001-controlled-rollout.md       | 115 ------------------
 proposals/Fleet-Windows-OS-vulns.md       | 139 ----------------------
 proposals/Fleetctl-Docker-Image.md        |  51 --------
 proposals/Fleetctl-trigger.md             |  95 ---------------
 proposals/fips/fleet-server-fips.md       |  63 ----------
 proposals/fleet-desktop-token-rotation.md |  64 ----------
 proposals/improv-mac-os-vuln-detection.md | 117 ------------------
 7 files changed, 644 deletions(-)
 delete mode 100644 proposals/001-controlled-rollout.md
 delete mode 100644 proposals/Fleet-Windows-OS-vulns.md
 delete mode 100644 proposals/Fleetctl-Docker-Image.md
 delete mode 100644 proposals/Fleetctl-trigger.md
 delete mode 100644 proposals/fips/fleet-server-fips.md
 delete mode 100644 proposals/fleet-desktop-token-rotation.md
 delete mode 100644 proposals/improv-mac-os-vuln-detection.md

diff --git a/proposals/001-controlled-rollout.md b/proposals/001-controlled-rollout.md
deleted file mode 100644
index a970297a8c..0000000000
--- a/proposals/001-controlled-rollout.md
+++ /dev/null
@@ -1,115 +0,0 @@
-# Controlled Rollout proposal
-
-## Why
-
-New features are great, everybody loves them. However, new features come by the hand of new code. New code can have bugs 
-or it can have performance regressions.
-
-Features aren't perfect for all users. Sometimes they are perfect for some users and not others. Sometimes they are 
-perfect for some hosts and not others.
-
-Rolling out a feature shouldn't always be a binary choice: enabled/disabled. In an ideal world, all features would be 
-enabled by default, everybody would love them all, and they would work flawlessly for all possible use cases.
-
-We are in the real world, though, which is not ideal. So we should give people running Fleet tools to rollout features 
-slowly, so that they can update infrastructure if needed, or only use a feature within the scope that is useful for 
-them.
-
-This is a proposal on how this tool could look like and work.
-
-## How
-
-We would create a new type of boolean value in our `AppConfig` called `RolloutBoolean`.
-
-`RolloutBoolean` will have a function `Get(h *fleet.Host) bool`. So instead of doing this:
-
-```go 
-if ac.HostSettings.EnableHostUsers {
-    ...
-}
-```
-
-We would do:
-
-```go 
-if ac.HostSettings.EnableHostUsers.Get(host) {
-    ...
-}
-```
-
-In yaml terms, this is what `RolloutBoolean` would be able to parse:
-
-1. Regular true/false, 0/1, yes/no values
-
-```yaml
----
-apiVersion: v1
-kind: config
-spec:
-  host_settings:
-    enable_software_inventory: false
-```
-
-2. Only enable a feature for certain teams:
-
-```yaml
----
-apiVersion: v1
-kind: config
-spec:
-  host_settings:
-    enable_software_inventory:
-      default: false
-      overrides:
-        teams:
-        - team1: true
-        - team2: true
-```
-
-2. Enabled for all except a specified team:
-
-```yaml
----
-apiVersion: v1
-kind: config
-spec:
-  host_settings:
-    enable_software_inventory:
-      default: true
-      overrides:
-        teams:
-        - team1: false
-```
-
-3. Enabled only for specific hosts:
-
-```yaml
----
-apiVersion: v1
-kind: config
-spec:
-  host_settings:
-    enable_software_inventory:
-      default: false
-      overrides:
-        host_ids:
-        - 3214: true
-```
-
-4. Enabled for hosts on a specific platform (as reported by osquery, not in terms of label membership):
-
-```yaml
----
-apiVersion: v1
-kind: config
-spec:
-  host_settings:
-    enable_software_inventory:
-      default: false
-      overrides:
-        platforms:
-        - linux: true
-```
-
-The `Get(h *Host) bool` function will use the provided host to define whether the feature is enabled or not based on
-how it's defined in the configuration.
\ No newline at end of file
diff --git a/proposals/Fleet-Windows-OS-vulns.md b/proposals/Fleet-Windows-OS-vulns.md
deleted file mode 100644
index 3c85a6b70e..0000000000
--- a/proposals/Fleet-Windows-OS-vulns.md
+++ /dev/null
@@ -1,139 +0,0 @@
-# Detecting Windows OS vulnerabilities
-
-The first step in detecting Windows vulnerabilities is understanding how they are remediated. Using
-the CISA list of know vulnerabilities as a sample, it was determined that all vulnerability
-remediations follow the form of *applying some software patch* and then *following some
-steps (if any)* so it follows that to determine if a system is susceptible to a vulnerability we will need to
-check whether a specific software patch was applied and also if the provided steps were followed. So
-basically we have three problems we need to solve: 
-1. We need a list of vulnerabilities + remediations. Each remediation is composed of a patch + some steps.
-2. For a given vulnerability we need to determine whether the proper patch was applied.
-3. For a given vulnerability we need to determine whether the steps (if any) were followed.
-
-## List of vulnerabilities
-
-To get the list of vulnerabilities we can use the [Microsoft Security Updates API](https://api.msrc.microsoft.com/cvrf/v2.0/swagger/index). This [endpoint](api.msrc.microsoft.com/cvrf/v2.0/document/yyyy-mm) in particular exposes all the security updates released for yyyy-mmm formatted according to the [Common Vulnerability Reporting Framework](http://docs.oasis-open.org/csaf/csaf-cvrf/v1.2/csaf-cvrf-v1.2.html#:~:text=The%20CSAF%20Common%20Vulnerability%20Reporting,impact%20and%20remediation%20among%20interested) (cvrf) format, this cvrf document will include entries for vulnerabilities, how to patch them and what products are affected. 
-
-For example, say we have a host running *Windows 10 Version 21H2 x64* and we want to determine whether that host is susceptible to *CVE-2022-26925*. Looking at https://api.msrc.microsoft.com/cvrf/v2.0/document/2022-May we can see that  *Windows 10 Version 21H2 for x64* is assigned the Product ID **11931**:
-
-```
-...
-<prod:ProductTree>
-    ...
-    <prod:Branch Type="Product Family" Name="Windows">
-    ...
-        <prod:FullProductName ProductID="11931">Windows 10 Version 21H2 for x64-based Systems</prod:FullProductName>
-        ...
-    </prod:Branch>
-    …
-<prod:ProductTree>
-…
-```
-
-Looking at the matching vulnerability element (`<vuln:Vulnerability Ordinal="47">`) *CVE-2022-26925*, we can see that
-*Windows 10 Version 21H2 x64* is indeed affected by it:
-
-```
-<vuln:ProductStatuses>
-    <vuln:Status Type="Known Affected">
-    ...
-        <vuln:ProductID>11931</vuln:ProductID>
-    ...
-    </vuln:Status>
-</vuln:ProductStatuses>
-```
-
-And also the remediation steps:
-
-```
-<vuln:Remediations>
-…
-    <vuln:Remediation Type="Vendor Fix">
-        <vuln:Description>5013942</vuln:Description>
-        <vuln:URL>https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5013942</vuln:URL>
-        <vuln:Supercedence>5012599</vuln:Supercedence>
-        ..
-        <vuln:ProductID>11931</vuln:ProductID>
-        ...
-        <vuln:RestartRequired>Yes</vuln:RestartRequired>
-        …
-    </vuln:Remediation>
-    <vuln:Remediation Type="Known Issue">
-        <vuln:Description>5013942</vuln:Description>
-        <vuln:URL>https://support.microsoft.com/help/5013942</vuln:URL>
-        ...
-        <vuln:ProductID>11931</vuln:ProductID>
-    </vuln:Remediation>
-</vuln:Remediations>
-```
-
-For the previous extract we can determine four things:
-1. The vulnerability was patched (‘Vendor Fix’) on the **KB5013942** update.
-2. **KB5013942** supersedes **KB5012599** (this is useful for handling cumulative updates).
-3. After applying **KB5013942** the system will need to be restarted (which can be viewed as an extra step).
-4. There is also some more info about the vulnerability that might include some extra steps to follow (‘Known Issue’).
-
-
-## Determine whether the proper patch was applied
-
-Luckily for us [osquery 5.4](https://github.com/osquery/osquery/pull/7407) will include a new table
-that exposes windows updates, so we won’t need to do much on the osquery data collection side of
-things. Here’s what I get when selecting all from the new table on my Windows test machine (Windows 10 Version 21H2 x64):
-
-| client_app_id                                                       | date       | description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              | hresult     | operation    | result_code | server_selection | service_id                           | support_url                                    | title                                                                                                            | update_id                            | update_revision |
-|---------------------------------------------------------------------|------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|--------------|-------------|------------------|--------------------------------------|------------------------------------------------|------------------------------------------------------------------------------------------------------------------|--------------------------------------|-----------------|
-| MoUpdateOrchestrator                                                | 1658271402 | Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?LinkId=52661  | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.371.442.0)                  | 688fe8b8-e59d-44c8-b083-7ab25a4317f4 | 200             |
-| MoUpdateOrchestrator                                                | 1658270728 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | -2145116140 | Installation | InProgress  | Others           | 8b24b027-1dee-babb-9a95-3517dfb9c552 | https://support.microsoft.com/help/5015807     | 2022-07 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5015807)                          | 3a328459-dd2c-4af7-97db-8424da0d3e72 | 1               |
-| MoUpdateOrchestrator                                                | 1658230218 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | -2147024784 | Installation | Failed      | Others           | 8b24b027-1dee-babb-9a95-3517dfb9c552 | https://support.microsoft.com/help/5015807     | 2022-07 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5015807)                          | 3a328459-dd2c-4af7-97db-8424da0d3e72 | 1               |
-| Windows Defender                                                    | 1658228495 | Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?LinkId=52661  | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.371.415.0)                  | a0620c31-004f-4e4f-a15c-5172a3d2f3a6 | 200             |
-| MoUpdateOrchestrator                                                | 1658226954 | After the download, this tool runs one time to check your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you start your computer. A new version of the tool will be offered every month. If you want to manually run the tool on your computer, you can download a copy from the Microsoft Download Center, or you can run an online version from microsoft.com. This tool is not a replacement for an antivirus product. To help protect your computer, you should use an antivirus product. | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | http://support.microsoft.com                   | Windows Malicious Software Removal Tool x64 - v5.103 (KB890830)                                                  | 675d532b-cdd5-4f87-a918-72af430c86a9 | 200             |
-| MoUpdateOrchestrator                                                | 1658226800 | After the download, this tool runs one time to check your computer for infection by specific, prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection that is found. If an infection is found, the tool will display a status report the next time that you start your computer. A new version of the tool will be offered every month. If you want to manually run the tool on your computer, you can download a copy from the Microsoft Download Center, or you can run an online version from microsoft.com. This tool is not a replacement for an antivirus product. To help protect your computer, you should use an antivirus product. | -2145124341 | Installation | Aborted     | WindowsUpdate    |                                      | http://support.microsoft.com                   | Windows Malicious Software Removal Tool x64 - v5.103 (KB890830)                                                  | 675d532b-cdd5-4f87-a918-72af430c86a9 | 200             |
-| MoUpdateOrchestrator                                                | 1658225364 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-06 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 21H2 for x64 (KB5013887)         | 17b120c7-57a2-47d3-9128-3b8fa9a22c42 | 200             |
-| MoUpdateOrchestrator                                                | 1658225234 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | -2145124341 | Installation | Aborted     | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-06 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10 Version 21H2 for x64 (KB5013887)         | 17b120c7-57a2-47d3-9128-3b8fa9a22c42 | 200             |
-| MoUpdateOrchestrator                                                | 1658225225 | A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.                                                                                                                                                                                                                                                                                                           | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-04 Update for Windows 10 Version 21H2 for x64-based Systems (KB5005463)                                     | 9151c073-854c-474e-8e4c-3b7b067824b1 | 200             |
-| MoUpdateOrchestrator                                                | 1658225201 | A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.                                                                                                                                                                                                                                                                                                           | -2145124341 | Installation | Aborted     | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-04 Update for Windows 10 Version 21H2 for x64-based Systems (KB5005463)                                     | 9151c073-854c-474e-8e4c-3b7b067824b1 | 200             |
-| MoUpdateOrchestrator                                                | 1658224963 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-02 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10 Version 21H2 for x64 (KB5010472) | 89858baf-a5ff-4c7e-b81b-037c0c17155a | 200             |
-| MoUpdateOrchestrator                                                | 1658224904 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | -2145124341 | Installation | Aborted     | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-02 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10 Version 21H2 for x64 (KB5010472) | 89858baf-a5ff-4c7e-b81b-037c0c17155a | 200             |
-| MoUpdateOrchestrator                                                | 1658224899 | A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.                                                                                                                                                                                                                                                                                                           | -2145116140 | Installation | InProgress  | Others           | 8b24b027-1dee-babb-9a95-3517dfb9c552 | https://support.microsoft.com/help/4023057     | 2022-04 Update for Windows 10 Version 21H2 for x64-based Systems (KB4023057)                                     | a329b681-ce8c-431d-99f7-052e2901adcb | 1               |
-| MoUpdateOrchestrator                                                | 1658224892 | Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.                                                                                                                                                                                                                                                                                                                                                                                                                   | -2145124341 | Installation | Aborted     | WindowsUpdate    |                                      | http://support.microsoft.com                   | 2022-02 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10 Version 21H2 for x64 (KB5010472) | 89858baf-a5ff-4c7e-b81b-037c0c17155a | 200             |
-| Windows Defender                                                    | 1658222131 | Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?LinkId=52661  | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.371.400.0)                  | e73cc969-7675-4d5f-a635-0dd5511a266b | 200             |
-| Update;ScanForUpdates                                               | 1658190023 | 9NBLGGH3FRZM-1152921505694106457                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         | -2145124300 | Installation | Failed      | Others           | 855e8a7c-ecb4-4ca3-b045-1dfa50104289 |                                                | 9NBLGGH3FRZM-Microsoft.VCLibs.140.00                                                                             | d82f41c1-893a-4a90-ac94-8f83da52a274 | 1               |
-| MoUpdateOrchestrator                                                | 1658189063 | Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?LinkId=52661  | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.371.376.0)                  | 2b325cd4-4ff1-4ba2-aca7-8a2cb19e4633 | 200             |
-| MoUpdateOrchestrator                                                | 1658185542 | Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?LinkId=52661  | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.371.386.0)                  | 821547ac-9c27-4397-93bc-d51f0aeb2059 | 200             |
-| Microsoft Defender Antivirus (77BDAF73-B396-481F-9042-AD358843EC24) | 1657929544 | This package will update Microsoft Defender Antivirus antimalware platformΓÇÖs components on the user machine.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?linkid=862339 | Update for Microsoft Defender Antivirus antimalware platform - KB4052623 (Version 4.18.2205.7)                   | 2dd6d08b-6754-46b5-bfc8-cde6ad24152f | 200             |
-| MoUpdateOrchestrator                                                | 1657929207 | Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | 0           | Installation | Succeeded   | WindowsUpdate    |                                      | https://go.microsoft.com/fwlink/?LinkId=52661  | Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.371.203.0)                  | 8325b53b-d4a4-4459-849f-5892c92404ae | 200             |
-
-
-While playing around with this, I did notice what seems to be a bug. There are two entries for **KB5015807**: one marked as Failed which is true, because the first time I tried to install this patch it failed and the other marked as InProgress which is false because the patch was installed correctly.
-
-We can store all the props if we want, but I would say that the two most important ones are:
-
-- date: To determine when the patch was applied.
-- result_code: To determine whether the update was applied or not.
-- title: To extract the update id.
-
-The major complication here will be dealing with the fact that windows updates are cumulative.
-Looking back at our previous example, given the entries in the windows_updates_history table, we
-want to determine whether the system is susceptible to *CVE-2022-26925*, we know that vulnerability
-was patched in **KB5013942**  alas, there are no entries matching **KB5013942** in the
-*windows_updates_history* table but, if we look at the security updates for the next month
-https://api.msrc.microsoft.com/cvrf/v2.0/document/2022-Jun we can see that  **KB5013942** was
-superseded by **KB5014699** and then if we look at the security updates for the following month 
-https://api.msrc.microsoft.com/cvrf/v2.0/document/2022-Jul we can see that  **KB5014699** was in
-turn superseded by **KB5015807** which is contained in the windows_updates_history table and thus we can
-say that the host is not susceptible to *CVE-2022-26925*. 
-
-Given the graph nature of the data, we might want to consider storing the parsed list of vulnerabilities as graph instead of a relational table as we typically do.
-
-## Determine whether the steps (if any) were followed
-
-This is the hardest part of the problem and probably the bit we might not be able to solve at the
-moment. Not all vulnerability remediations include extra steps, but if they do, they are written in
-natural language as a 
-series of steps intended to be followed by a human operator not as a series of
-declarative statements about the system state (like the OVAL definitions we use for detecting
-vulnerabilities in Linux). 
-
-AFAIK the only step we will be able to check is whether the system was restarted after a patch was
-applied, other types of steps will require either some kind of natural language processing or having
-a human in the middle translating the steps into a parsable format. 
\ No newline at end of file
diff --git a/proposals/Fleetctl-Docker-Image.md b/proposals/Fleetctl-Docker-Image.md
deleted file mode 100644
index d5f462aa45..0000000000
--- a/proposals/Fleetctl-Docker-Image.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Goal
-
-We need `fleetctl package` functionality to generate all types of packages (PKG, MSI, DEB and RPM) from Linux.
-
-# How
-
-Create a new Docker image `fleetdm/fleetctl` that will contain `fleetctl` and all the dependencies ready to create packages.
-
-Users can then use the image to generate packages
-```sh
-$ docker run ... fleetdm/fleetctl:latest package --type={pkg|msi|deb|rpm} ...
-```
-
-## DEB and RPM
-
-DEB and RPM package generation is already native and no extra dependencies are required (uses https://github.com/goreleaser/nfpm).
-
-## MSI
-
-### Packaging
-
-We will need the same dependencies from `fleetdm/wix:latest` on the new `fleetdm/fleetctl:latest` image.
-
-### Signing (stretch goal)
-
-For `.msi` signing functionality:
-- The [relic](https://github.com/sassoftware/relic) tool seems to allow `.msi` signing (in Pure Go).
-- Alternatively, the [osslsigncode](https://github.com/mtrojnar/osslsigncode) tool could be embedded on the image.
-
-This is mentioned as a stretch goal because we currently don't have `.msi` signing functionality in `fleetctl package`.
-
-## PKG
-
-### Packaging
-
-To generate a `.pkg` we will need the same dependencies from `fleetdm/bomutils:latest` on the new `fleetdm/fleetctl:latest` image.
-
-### Signing
-
-The [relic](https://github.com/sassoftware/relic) tool seems to allow `.pkg` signing (in Pure Go).
-
-### Notarization
-
-#### Upload
-
-We can implement a Go package that uses the new [Notary API](https://developer.apple.com/documentation/notaryapi) to upload and notarize a `.pkg` (pure Go solution).
-
-#### No Stapling
-
-The Notary API currently does not offer a way to "staple" a package, and the `stapler` tool that allows this is only available on macOS.
-It seems stapling is recommended but not a must, see [#116812](https://developer.apple.com/forums/thread/116812).
\ No newline at end of file
diff --git a/proposals/Fleetctl-trigger.md b/proposals/Fleetctl-trigger.md
deleted file mode 100644
index bd50b3028a..0000000000
--- a/proposals/Fleetctl-trigger.md
+++ /dev/null
@@ -1,95 +0,0 @@
-# Fleetctl trigger
-
-## Goal
-
-As a user, I would like to trigger a set of async jobs using `fleetctl`. For example, I’d like to
-trigger a vuln scan, or an MDM dep sync. 
-
-The proposed solution to accomplish this goal enables a new CLI command: 
-`fleetctl trigger --name <NAME>`.   
-
-## Background
-
-Currently, the Fleet server uses the `schedule` package to create sets of defined jobs that are run
-serially at defined intervals. The initial schedule interval must be specified at the point the
-schedule is instantiated via `schedule.New`. Optionally, `schedule. WithConfigReloadInterval`
-accepts a reload interval function. If specified, the reload interval function is periodically
-called and its return value becomes the new the schedule interval. This mechanism allows the
-schedule interval to be modified by user, for example, by changing the app config; however, there no
-mechanism currently to trigger async jobs on an ad hoc basis.
-
-## Proposal
-
-### New CLI command `fleetctl trigger --name <NAME>`
-- Upon this command, the CLI client makes a request to a new authenticated endpoint (see below) to
-  trigger an ad hoc run of the named schedule. 
-
-### New `schedule` option `WithTrigger` 
-- This option adds a `trigger` channel on the `schedule` struct that will trigger an ad hoc run of
-  the scheduled jobs.
-- The trigger channel for each `schedule` is exposed via a new `schedules` map on the `Service` struct. 
-
-### New endpoint `GET /trigger?name={:name}` 
-- The request handler first calls `ds.Lock` to check if the named schedule is locked.
-- If the named schedule is unlocked, request handler sends a trigger signal on the schedule's
-  trigger channel and the server responds with status `202 Accepted`.  
-- If the named schedule is locked (presumably because the schedule is currently running), the server
-  responds with status `409 Conflict` and includes a message indicating the schedule is currently
-  locked. It is up to the user to retry. To facilitate retries, the response message could be expanded to
-  include additional status information, such as the expiration time of the current lock.
-
-### Schedule locks
-- Currently, lock duration is based on the schedule interval. 
-  - Once an instance takes the lock, it will hold the lock for the duration of the interval, even
-    after it has completed the jobs in the schedule. 
-  - For long-running jobs, the lock may expire before the current instance completes its run,
-    meaning that it is currently possible for another instance to start an overlapping job.
-  - If the lockholder instance is terminated or killed, locks are not released, which may frustrate
-    a user's attempt to configure a shorter schedule interval before the lock held by the dead
-    instance expires.
-
-- Under this proposal, locks become more dynamic.
-  - Current lockholder releases its lock once it finishes running the schedule.
-  - Graceful shutdown process handles release of locks upon termination signals. Jobs are
-    preemptable and an interrupt function must be specified for each job, 
-    e.g., `schedule.New(...).WithJob("job_name", jobFn, interruptFn)`.
-  - As a fallback for cases that can't be handled via graceful shutdown (e.g., `SIGKILL`), the
-    expiration for a lock is initially set to a relatively short default duration (e.g., 5 minutes).
-    The expiration is then periodically extended by the current instance so long as scheduled jobs
-    are running.  If the current instance dies without graceful shutdown, the lock will only be held
-    by the dead instance for a short period.
-
-### Additional UX considerations 
-- What are some potential options that would be useful for the `fleetctl trigger` command?
-  - Request the current status of the the named schedule without triggering a new run.
-    For example, `--status` could provide the user with the running time of the schedule (this would
-    require that we expand the `locks` table to include additional timestamp information, such as
-    lock start time and lock release time).
-  - Other useful options?
-
-- What rules should determine when the interval ticker resets? Consider the following cases where
-  `s.scheduleInterval = 1*time.Hour`: 
-  - The schedule is triggered at 55 minutes into the 1-hour interval and takes 1 minute to complete.
-    When should the schedule run again? 
-    (a) after 4 minutes; 
-    (b) after 1 hour; 
-    (c) after 1 hour plus 4 minutes; 
-    (d) other  
-  - The schedule is triggered at 55 minutes into the 1-hour interval and takes 11 minutes to complete.
-    When should the schedule run again? 
-    (a) immediately; 
-    (b) after 1 hour; 
-    (c) after 54 minutes;
-    (d) other
-
-- What should be logged?
-  - Debug log if schedule runtime exceeds schedule interval to aid detection/troubleshooting of
-    long-running jobs.
-  - Other useful logs? 
-
-
-
-
-
-
-
diff --git a/proposals/fips/fleet-server-fips.md b/proposals/fips/fleet-server-fips.md
deleted file mode 100644
index 66b9d5dfe0..0000000000
--- a/proposals/fips/fleet-server-fips.md
+++ /dev/null
@@ -1,63 +0,0 @@
-# Planning for a FIPS Compliant Fleet Server for Linux
-
-This document outlines the steps involved in building a version of the Fleet server that meets the requirements of the Federal Information Processing Standards (FIPS) 140-2 security standard.
-
-## Summary of cryptographic operations in Fleet
-
-To make the Fleet server FIPS 140-2 compliant, all cryptographic operations must use a FIPS 140-2 certified cryptographic library.
-
-Fleet uses cryptographic operations in the following features:
-- Fleet uses TLS as a client for the following features:
-    - Fleet can conect to MySQL and Redis using TLS.
-    - Vulnerability processing uses TLS client to retrieve data from different sources.
-    - Automations: Webhooks, JIRA and Zendesk integrations make use of a TLS client.
-    - Single Sign On uses TLS to retrieve IdP metadata (from the configured MetadataURL).
-    - MDM functionality connects via TLS to Apple servers (DEP enrollment configuration).
-    - Fleet uses TLS to stream logs to many data stream systems (Kafka, Lambda, Kinesis, Firehose, etc.).
-- Fleet can act as a TLS server (can terminate TLS).
-- User authentication: Fleet uses password hashing to store and authenticate user credentials. 
-- The Single Sign On (SSO) feature in Fleet performs cryptographic verification of `SAMLResponse`s signatures. Fleet uses [goxmldsig](https://github.com/russellhaering/goxmldsig) which uses golang's stdlib crypto (`crypto/x509`, `crypto/rsa`, `crypto/sha256`, `crypto/tls` which are all compliant primitives)
-- Fleet uses `crypto/rand` to generate secrets for authentication ("session tokens" and "node keys" which are used for authenticating users and devices respectively).
-- MDM functionality (for Windows and macOS) makes use of cryptographic operations (e.g. Fleet acts as a SCEP CA server for authenticating devices)
-- Fleet license check code uses `JWT` which uses `ECDSA` for public signatures (ECDSA is a FIPS-compliant primitive).
-
-All these operations (except password hashing, see [Password hashing](#password-hashing) below) make use of Go's `crypto` standard library.
-
-## Building Go with BoringSSL as cryptographic backend
-
-As of today, the recommended way to make your Go application be FIPS 140-2 compliant is to use the BoringSSL crypto backend instead of the standard library `crypto` packages.
-
-Since we use Go 1.19, we only need to build fleet with `CGO_ENABLED=1` (already the case because of our sqlite3 dependency) and with `GOEXPERIMENT=boringcrypto`. This will automatically make Fleet use the BoringSSL cryptographic primitives instead of the stdlib `crypto` implementation (without requiring any code changes).
-
-See the [POC]https://github.com/fleetdm/fleet/compare/13288-poc-fleet-fips?expand=1()).
-
-> Source: https://kupczynski.info/posts/fips-golang/
-
-## Password hashing
-
-For password hashing Fleet currently uses the [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) function.
-To be FIPS 140-2 compliant, Fleet will have to use [PBKDF2](https://en.wikipedia.org/wiki/PBKDF2] instead (with SHA-256 as hashing primitive).
-
-> Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf
-
-## Summary of tasks
-
-Assumptions around the first customer using the FIPS build:
-- All MDM funtionality will be disabled/not-used.
-- The Fleet server won't be doing TLS termination. Thus we don't need to verify/test such feature.
-- This build will be used as part of a new deployment (not migrating an existing one). This is important because we have to change the password hashing algorithm thus to reduce complexity on the first iteration we don't need to worry about migrating from old to new password hashing.
-- The `fleetctl` command is outside the scope.
-
-Tasks:
-
-- Double check if any cryptographic operations in Fleet were missed in this analysis. // 1 pt.
-- Add a new target `fleet-fips` to the `Makefile` to build Fleet in FIPS mode. (Would set `GOEXPERIMENT=boringcrypto CGO_ENABLED=1`.) Smoke test the Fleet server when built this way. (See the [POC]https://github.com/fleetdm/fleet/compare/13288-poc-fleet-fips?expand=1()) // 1 pt.
-- Make changes in goreleaser yamls to create a new docker image fleetdm/fleet-fips // 2 pt.
-- Perform full QA of the Feet docker image FIPS build (by full QA we mean: we need to test ALL Fleet features). This should be performed by a QA engineer. // 5 pt.
-- Perform any code changes to fleetd (and add documentation for vanilla osquery) to be able to connect (via TLS) to a FIPS-compliant Fleet. We will know if this is necessary from the previous task (QA). // 2 pt.
-- Add tests to make sure the Fleet server TLS client is using the FIPS approved ciphers when connecting to TLS servers (SSO, users, vuln processing, webhooks). E.g. by using TLS servers that will fail the connection if the FIPS ciphers are not used. // 3 pt.
-- Replace bcrypt with PBKDF2 for password hashing (when compiling in FIPS mode) // 5 pt. (assumming we don't need to migrate from bcrypt)
-- Terminate the Fleet sever if MDM or TLS server is enabled when running the FIPS build (security measure). // 1 pt.
-- Check if `crypto/subtle` (used by the `/metrics` endpoint for HTTP basic auth) is implemented by BoringSSL. // 1 pt.
-- Loadtest the Fleet server with expected number of devices. // 5 pt. (depends on number of hosts)
-- Deploy the Fleet FIPS docker image and dependencies to a FIPS enabled AWS endpoint // 5 pt.
diff --git a/proposals/fleet-desktop-token-rotation.md b/proposals/fleet-desktop-token-rotation.md
deleted file mode 100644
index 40ac3a6429..0000000000
--- a/proposals/fleet-desktop-token-rotation.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# Token Rotation for Fleet Desktop
-
-This file is based on the original proposal described at [#6348](https://github.com/fleetdm/fleet/issues/6348) modified based on a few lessons we learned and the new communication channel between Orbit and the Fleet server introduced in https://github.com/fleetdm/fleet/issues/6851
-
-**Compatibility**
-
-|                | Fleet Desktop < v1.0.0            | Fleet Destkop >= v1.0.0 |
-| -------------- | --------------------------------- | ----------------------- |
-| Server < 4.21  | OK/Rotation disabled              | OK/Rotation disabled    |
-| Server >= 4.21 | Fleet Destkop breaks after 1 hour | OK/Rotation enabled     |
-
-
-## Fleet Server
-
-1. Add a new endpoint `POST /orbit/<orbit_node_key>/device_token` to create/update device tokens
-    1. Add `created_at` and `updated_at` columns to the `host_device_auth` table.
-    2. Do `INSERT ON DUPLICATE KEY token=token` and not `update updated_at` if the token didn't change.
-1. Condsider a token expired if `now - updated_at > 1h`, APIs will return the usual authentication error when a token is expired.
-1. The server doesn't need to make the `orbit_info` in the "extra detail queries" set anymore.
-    
-## Orbit
-
-1. When Orbit starts
-    1. If we have a token, load and verify its validity by making a request to the Fleet Server
-    1. If we don't have a token or if the token is invalid, [rotate the token](#token-rotation)
-
-1. Orbit will have two tickers running:
-    - **Ticker I**: runs every 5 minutes and verifies that the current token is still valid by making a request to the Fleet Server. This is to guard against the server invalidating the token (eg: DB restored from back-up, token `updated_at` manually changed, clocks out of sync etc.) If the token is invalid, it [starts a rotation](#token-rotation).
-    -  **Ticker II**: runs every 30 seconds and verifies the `mtime` of the identifier file, if `now - mtime > 1h` [starts a rotation](#token-rotation). A short interval (could be even shorter) is needed in case the computer was shut-down or went to sleep.
-
-**Token Rotation**
-
-To rotate a token, Orbit will generate a valid UUID and:
-
-1. Write the value to the `identifier` file, we do this first to signal to Fleet Desktop that a rotation is happening and we can ensure it never operates on an invalid token during the exchange.
-2. Do a `POST /orbit/<orbit_node_key>/device_token` with the new token value, retry three times in case of failure.
-
-**Compatibility**
-
-1. Keep returning `device_auth_token` in the `orbit_info` table, we might want to do this forever anyway to support live queries.
-2. When Orbit starts, check if the server supports creating tokens via the API, if it doesn't:
-    1. Don't do any kind of check or rotation
-    2. Start a goroutine using `oklog.Group` to ping the server every 10 minutes and see if it supports token rotation. If it does, return from the group actor, which will make Orbit restart.
-3. Orbit will keep sending the `FLEET_DESKTOP_DEVICE_URL` variable to accomodate old Fleet Destkop versions.
-
-## Fleet Desktop
-
-1. Fleet Desktop will receive the path to the identifier file as an environment variable.
-2. As soon as Flet Desktop starts, it reads the identifier file and caches the `mtime` value in memory.
-3. Fleet Desktop will have a ticker running every ~5 seconds to check for the `mtime` of the identifier file, if the value differs from the one stored in memory:
-    1. Disable all tray items and show "Connecting..."
-    2. Initialize a ticker to check for the validity of the token, enable the tray items again once we have a valid token.
-
-**Misc**
-
-- As soon as any request fails, disable the tray items and show "Connecting..."
-
-## Release order
-
-After things have been tested on unstable channels and Dogfood, it's important to release in the following order:
-
-1. Orbit to the stable channel
-2. Fleet Desktop to the stable channel
-3. Fleet Server
diff --git a/proposals/improv-mac-os-vuln-detection.md b/proposals/improv-mac-os-vuln-detection.md
deleted file mode 100644
index 778d4578c4..0000000000
--- a/proposals/improv-mac-os-vuln-detection.md
+++ /dev/null
@@ -1,117 +0,0 @@
-# Improving vulnerability detection for MacOS
-
-[6001](https://github.com/fleetdm/fleet/issues/6001) identified some problems with our
-current approach to vulnerability detection on MacOS:
-
-- The version reported by software does not fit the standard format. For example, Zoom reports the version as 5.8.3 (2240).
-- The app name includes extra terms that don't appear in the title. For example, zoom.us is treated
-  as zoom us (2 terms) and does not match the title commonly used for zoom eg "Zoom 4.6.9 for macOS"
-  or "Zoom Meetings 5.8.0 for macOS".
-- Sometimes the CPE dictionary is incomplete. For example, CVE-2021-24043 should have a matching CPE `cpe:2.3:a:whatsapp:whatsapp:2.2145.0:*:*:*:desktop:*:*:*`, but it is absent. Also not that it would not match on windows because target_sw is empty, but we try to match on windows*. Removing the target_sw would lead to many false positives.
-
-Our current approach to CPE binding consists of matching the `software name` against the `CPE title` along with the `software version`. Instead, I propose we
-try to match the software vendor and name parts against the CPE vendor and product parts (standardizing the values when
-needed) and then we can programmatically look at the version (and the rest of the CPE parts) to
-determine what CVEs match a given CPE. In other words, instead of looking at CPEs as just strings,
-we should be looking at them as sets:
-
-So this:
-
-```
-cpe:2.3:a:microsoft:edge:79.0.309.68:*:*:*:*:*:*:*
-cpe:2.3:a:microsoft:edge:80.0.361.48:*:*:*:*:*:*:*
-cpe:2.3:a:microsoft:edge:80.0.361.50:*:*:*:*:*:*:*
-cpe:2.3:a:microsoft:edge:80.0.361.50:*:*:*:*:windows:*:*
-```
-Can be visualized as this:
-
-```mermaid
-flowchart TD 
-    id1((vendor: microsoft)) --> id2((product: edge))
-    id2((product: edge)) --> id3((version: 79.0.309.68))
-    id2((product: edge)) --> id4((version: 80.0.361.48))
-    id2((product: edge)) --> id5((version: 80.0.361.50))
-    id3((version: 79.0.309.68)) --> id6((cve_1))
-    id3((version: 79.0.309.68)) --> id7((cve_2))
-    id4((version: 80.0.361.48)) --> id8((cve_3))
-    id5((version: 80.0.361.50)) --> id9((cve_4))
-    id5((version: 80.0.361.50)) --> id10((target_sw: windows))
-    id10((target_sw: windows)) --> id11((cve_5))
-```
-
-So having version `80.0.361.50` of `Edge` installed on MacOS should only return `cve_4` but having
-the same program in Windows should return both `cve_4` and `cve_5`.
-
-So basically our vulnerability detection problem can be broken down into two sub-problems:
-1. Binding the software `vendor` and `name` attributes to known CPE `vendor` and `product` attributes (a.k.a the
-   binding problem).
-2. Once we have the `vendor` and `product`, we will need to match that along with the version and other
-   characteristics (like language, platform, etc) to one or more target CPEs contained in the NVD
-   dataset (a.k.a the matching problem).
-
-## Binding the vendor portion
-
-For binding the `vendor`, we can use the `bundle_identifier` - using
-[this](https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor) as a
-guideline - we can extract a 'pseudo vendor id' and filter out any top level domain names (since
-the `bundle_identifier` is assumed to be in reverse-DNS format) and finally, transform the resulting
-value if necessary.
-
-```mermaid
-flowchart LR 
-    bundle_identifier --> vendor_id
-    vendor_id --> remove_top_lv_domains
-    remove_top_lv_domains --> map_values
-```
-Using the data [in
-here](https://docs.google.com/spreadsheets/d/1D6Ub8_6YhLpVkmxLwTdGP8VWTH7rMS6-ZoBmJcrDDLE/edit?usp=sharing)
-the following vendor translations where required (this list is not exhaustive):
-
-| bundle_identifier | extracted vendor | mapped vendor |
-|---|---|---|
-| com.postmanlabs.mac | postmanlabs | getpostman |
-| com.tinyspeck.slackmacgap | tinyspeck | slack |
-| com.getdropbox.dropbox | getdropbox | dropbox |
-| ru.keepcoder.Telegram | keepcoder | telegram |
-| org.virtualbox.app.VirtualBox | virtualbox | oracle |
-| org.virtualbox.app.VirtualBox | Cisco-Systems | cisco |
-| net.kovidgoyal.calibre | kovidgoyal | calibre-ebook |
-
-We will need to host and maintain some kind of metadata like this somewhere.
-
-## Binding the product portion
-
-For binding the `product`, we can use both the `bundle_executable` and the `bundle_name`
-(sometimes we get matches with the `bundle_executable` sometimes we get matches with the
-`bundle_name`) - the data processing pipeline would look something like this:
-
-```mermaid
-flowchart LR 
-    bundle_executable --> map_values
-    map_values --> to_lower
-    to_lower --> replace_spaces
-```
-Again, like with the vendor portion, some translation was required. When testing this approach the
-following translation were used:
-
-| vendor | bundle name/ executable | translation |
-|---|---|---|
-| oracle | VirtualBox| vm_virtualbox|
-| agilebits | 1Password 7| 1password|
-| zoom | zoom.us | zoom |
-| microsoft | Microsoft AutoUpdate | autoupdate |
-| microsoft | Microsoft Edge | edge |
-| microsoft | Code | visual_studio_code |
-| osquery | oqueryd | osquery |
-
-## Reference
-To test this approach I used
-[this](https://docs.google.com/spreadsheets/d/1D6Ub8_6YhLpVkmxLwTdGP8VWTH7rMS6-ZoBmJcrDDLE/edit?usp=sharing)
-data as input (the apps sheet). Both the not_found and found sheets contain the apps that were not
-found and found in the NVD dataset respectively. I checked that all entries in the `not_found` sheet
-did have entries in the NVD dataset.
-
-For extracting the vendor and product portions from the NVD dataset I used the [following
-script](https://gist.github.com/juan-fdz-hawa/52a9a54646a1cdc26359104d4f1a57e3).
-
-To determine matches/mismatches I used [following script](https://gist.github.com/juan-fdz-hawa/a3eb1cf33f149f7473a37469ecb9feda)
\ No newline at end of file

From d03e5893cb068ae4c53a7e4469a1f1f55528ff69 Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Thu, 27 Feb 2025 12:07:23 -0500
Subject: [PATCH 14/15] All user stories go through user story review (#26539)

---
 handbook/company/product-groups.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/handbook/company/product-groups.md b/handbook/company/product-groups.md
index e4e17fc68a..d17954f534 100644
--- a/handbook/company/product-groups.md
+++ b/handbook/company/product-groups.md
@@ -709,7 +709,7 @@ Here are some tips for making this meeting effective:
 
 ### User story reviews
 
-User story reviews [happen weekly](https://fleetdm.com/handbook/product-design#rituals) between the [Head of Product Design](https://fleetdm.com/handbook/product-design#team) and the each product group's Product Designer, Engineering Manager (EM), and Quality Assurance (QA) Engineer. During the call, the Product Designer presents all user stories that have completed product design in the past week and are in the "In review" column. The Product Designer is the DRI for completing all product checklist items before bringing to review.
+User story reviews [happen weekly](https://fleetdm.com/handbook/product-design#rituals) between the [Head of Product Design](https://fleetdm.com/handbook/product-design#team) and each product group's Product Designer (PD), Engineering Manager (EM), and Quality Assurance (QA) Engineer. During the call, contributors (PD and EM) present all user stories that are in the "In review" column. The PD is the DRI for completing all product checklist items before bringing to review. For [engineer-initiated stories](https://fleetdm.com/handbook/engineering#create-an-engineering-initiated-story), the EM is the DRI for completing all engineering checklist items before bringing to review.
 
 The purpose of the review is to familiarize the EM and QA Engineer with the user story, and provide an opportunity to ask questions, clarify requirements, and highlight potential implementation issues. The first draft of the test plan produced by the Product Designer is reviewed and revised as needed during the call. The QA Engineer is the DRI for finalizing the test plan.
 

From db2778ea5adae99acb398b57b6c5a8c85904f513 Mon Sep 17 00:00:00 2001
From: Ian Littman <iansltx@gmail.com>
Date: Thu, 27 Feb 2025 11:21:23 -0600
Subject: [PATCH 15/15] Exclude released PowerShell versions on CVE-2025-21171,
 all PowerShell versions on CVE-2023-48795 (#26659)

For #26073.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

<!-- Note that API documentation changes are now addressed by the
product design team. -->

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Committing-Changes.md#changes-files)
for more information.
- [x] Added/updated automated tests
- [x] A detailed QA plan exists on the associated ticket (if it isn't
there, work with the product group's QA engineer to add it)
- [x] Manual QA for all new/changed functionality
---
 .../vulnerabilities/nvd/cpe_matching_rules.go | 19 +++++++++++++++
 server/vulnerabilities/nvd/cve_test.go        | 24 +++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/server/vulnerabilities/nvd/cpe_matching_rules.go b/server/vulnerabilities/nvd/cpe_matching_rules.go
index b1eaa68813..e1776c2991 100644
--- a/server/vulnerabilities/nvd/cpe_matching_rules.go
+++ b/server/vulnerabilities/nvd/cpe_matching_rules.go
@@ -209,6 +209,25 @@ func GetKnownNVDBugRules() (CPEMatchingRules, error) {
 				return cpeMeta.Product == "visual_studio_code" && cpeMeta.TargetSW == wfn.Any
 			},
 		},
+		// CVE-2023-48795 in NVD incorrectly mentions PowerShell as vulnerable when the issue is actually with OpenSSH,
+		// which is packaged separately. It also includes a bogus resolved-in version number. See #26073.
+		CPEMatchingRule{
+			CVEs: map[string]struct{}{
+				"CVE-2023-48795": {},
+			},
+			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
+				return cpeMeta.Vendor == "microsoft" && cpeMeta.Product == "powershell"
+			},
+		},
+		// CVE-2025-21171 only affects RC versions of PowerShell, see https://github.com/PowerShell/Announcements/issues/72
+		CPEMatchingRule{
+			CVEs: map[string]struct{}{
+				"CVE-2025-21171": {},
+			},
+			IgnoreIf: func(cpeMeta *wfn.Attributes) bool {
+				return cpeMeta.Vendor == "microsoft" && cpeMeta.Product == "powershell" && cpeMeta.Update == ""
+			},
+		},
 		// Old macos CPEs without version constraints that should be ignored
 		CPEMatchingRule{
 			CVEs: map[string]struct{}{
diff --git a/server/vulnerabilities/nvd/cve_test.go b/server/vulnerabilities/nvd/cve_test.go
index 51da562008..811bcc6fb6 100644
--- a/server/vulnerabilities/nvd/cve_test.go
+++ b/server/vulnerabilities/nvd/cve_test.go
@@ -367,6 +367,30 @@ func TestTranslateCPEToCVE(t *testing.T) {
 			excludedCVEs:      []string{"CVE-2024-10327"},
 			continuesToUpdate: true,
 		},
+		// CVE-2023-48795 false positive and true positive checks (see #26073)
+		"cpe:2.3:a:microsoft:powershell:7.4.3:*:*:*:*:*:*:*": {
+			excludedCVEs:      []string{"CVE-2023-48795", "CVE-2025-21171"},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*": {
+			includedCVEs:      []cve{{ID: "CVE-2023-48795", resolvedInVersion: "9.6"}},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:openbsd:openssh:9.6:*:*:*:*:*:*": {
+			excludedCVEs:      []string{"CVE-2023-48795"},
+			continuesToUpdate: true,
+		},
+		// end of CVE-2023-48795 checks
+		// CVE-2025-21171 handling
+		"cpe:2.3:a:microsoft:powershell:7.5.0:*:*:*:*:macos:*:*": {
+			excludedCVEs:      []string{"CVE-2025-21171"},
+			continuesToUpdate: true,
+		},
+		"cpe:2.3:a:microsoft:powershell:7.5.0:rc.1:*:*:*:macos:*:*": {
+			includedCVEs:      []cve{{ID: "CVE-2025-21171"}},
+			continuesToUpdate: true,
+		},
+		// end of CVE-2025-21171 checks
 		"cpe:2.3:a:jetbrains:goland:2022.3.99.123.456:*:*:*:*:macos:*:*": {
 			includedCVEs:      []cve{{ID: "CVE-2024-37051", resolvedInVersion: "2023.1.6"}},
 			continuesToUpdate: true,