While working on some GitOps updates I noticed that our current
`default.yml` file is invalid, because it has a duplicate
`volume_purchasing_program` section. It looks like it was accidentally
copied during an update to rename some teams.
This pull request updates how Keynote installations are tracked and
referenced in configuration files. The main change is to replace the
generic "Keynote installed" label with a more specific "Keynote 14
installed" label, which targets only Keynote versions 14.x on macOS
hosts. This ensures more precise software deployment and management.
**Label changes:**
* Replaced the reference to `keynote-installed.yml` with
`keynote-14-installed.yml` in the `labels` list in `default.yml`,
ensuring only hosts with Keynote version 14.x are matched.
* Removed the old `keynote-installed.yml` label definition, which
matched any version of Keynote, and added a new
`keynote-14-installed.yml` label that matches only Keynote versions
>=14.0.0 and <15.0.0.
[[1]](diffhunk://#diff-f62defade24f2883bff5a996c85446043674cbf31a8b8b32a1e4ab4e16482671L1-L5)
[[2]](diffhunk://#diff-b711956ba5690f7b5b69ce80b81e40d1d18f22f32ff95e5154031daad5e2884fR1-R5)
**Software deployment updates:**
* Updated the `labels_include_any` field for the Fleet Keynote theme in
`workstations.yml` to use "Keynote 14 installed" instead of the generic
"Keynote installed", ensuring the theme is offered only to hosts with
Keynote 14.x.
This pull request makes a minor configuration change to the
`it-and-security/default.yml` file, specifically in the `org_settings`
section. The Google Calendar integration configuration has been
commented out, which means it will no longer be active but is preserved
for reference.
* Google Calendar integration in
`org_settings.integrations.google_calendar` has been commented out,
disabling it while keeping the configuration for potential future use.
This pull request updates the naming and configuration for mobile device
teams and associated settings, primarily shifting references from
"Company-owned mobile devices" to "Employee-issued mobile devices"
across configuration files. It also introduces new team and organization
mappings and updates app store app ID formatting for consistency.
**Team and naming updates:**
* Renamed the team from "📱🏢 Company-owned mobile devices" to "📱🏢
Employee-issued mobile devices" in `company-owned-mobile-devices.yml`
and updated all related references in `default.yml`.
[[1]](diffhunk://#diff-b86f7c2a3c8266d5f17dc1cbb37b248bee72ce749c7e0c7f7d16f69c7265b821L1-R1)
[[2]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L28-R29)
[[3]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L38-R53)
**Configuration and mapping enhancements:**
* Added new organization and team mappings for both Fleet Device
Management Inc. and Mactivate LLC, including updates to `macos_team`,
`ios_team`, and `ipados_team` assignments.
[[1]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L28-R29)
[[2]](diffhunk://#diff-381910c0ec6788e1ad9a97eb1065cd37c6510f67d4c45d1fc93b2ca2d9fce0f3L38-R53)
* Expanded the list of teams under the Fleet Device Management Inc.
location and introduced a new `volume_purchasing_program` section with
appropriate team assignments.
**Formatting consistency:**
* Standardized App Store app IDs to use double quotes instead of single
quotes in the `app_store_apps` section of
`company-owned-mobile-devices.yml`.
This pull request introduces several updates to the configuration for
the Workstations team, primarily to support conditional access testing,
enhance device management, and expand policy coverage. The changes
include enabling conditional access, adding new configuration profiles
and scripts, and updating policies and software deployments.
**Conditional Access and Device Management Enhancements:**
- Enabled conditional access for the Workstations team by setting
`conditional_access_enabled: true` in the integrations section.
- Added new configuration profiles for conditional access and Santa
(macOS security tool), targeting specific test groups via labels.
[[1]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR49-R51)
[[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R83)
- Included new scripts to support conditional access and device
security, such as creating allow files, installing/uninstalling security
tools, and enabling Windows Defender.
**Policy and Query Expansion:**
- Introduced new policies to check for Company Portal installation and
Entra conditional access compliance.
- Added a query to collect Santa denied logs for improved security
monitoring.
**Software Deployment Updates:**
- Added Company Portal for macOS as a self-service app for the
"Conditional access test group".
- Minor formatting update for the Keynote app store ID.
**Other Notable Changes:**
- Removed the "💻🐣 Workstations (canary)" entry from the organization
settings, streamlining team categorization.
- Cleaned up comments related to update channels in agent options for
clarity.
This pull request introduces new department-based host labels to the IT
and Security configuration, allowing hosts to be categorized according
to the department of their end user. The main change is the addition of
seven new label definitions and their inclusion in the `default.yml`
configuration.
**Department label additions:**
* Updated `it-and-security/default.yml` to include references to seven
new department label files, enabling department-based host
categorization.
**New department label definitions:**
* Added `department-information-technology.yml` to define a label for
hosts belonging to the Information Technology department.
* Added `department-sales.yml`, `department-marketing.yml`,
`department-engineering.yml`, `department-people.yml`,
`department-finance.yml`, and `department-product-design.yml` to define
labels for hosts in Sales, Marketing, Engineering, People, Finance, and
Product Design departments, respectively.
[[1]](diffhunk://#diff-dd6b63c2483cf179831fd7b3192a75f25d9eadfcba8309737ce3406912df74eaR1-R6)
[[2]](diffhunk://#diff-aec6aaa00d0b092d0a427d819f61a4df9c00b5ba67d8438757c5f038860697f2R1-R6)
[[3]](diffhunk://#diff-060b9bf1ab3202940dadc644616890ab99bcd81e37808ec099ff29ba064687adR1-R6)
[[4]](diffhunk://#diff-ef0c2b34df74cf1cd1c32165d3c88f85b29a8d67a02e2b837f2f544e02ad2573R1-R6)
[[5]](diffhunk://#diff-f491ad729d54f56ac51eaa4576f2a2c8a077a16c4abe623198ed6f3b14d03004R1-R6)
[[6]](diffhunk://#diff-ce077a969811b6e57400a23a7d6cb3d40b8ebd6b6733ebd4f3f1fe7558f5fe2dR1-R6)
This pull request adds a new organization, Mactivate LLC, to the
`org_settings` section in the `it-and-security/default.yml`
configuration file. The new organization is assigned to the "🧪 Testing &
QA" team for all device types.
Organizational configuration updates:
* Added `Mactivate LLC` to the list of organizations, assigning the "🧪
Testing & QA" team for `macos_team`, `ios_team`, and `ipados_team`
settings in `it-and-security/default.yml`.
Configuring Entra conditional access:
- Test group label created
- SSO extension mobileconfig
- Policy to auto-install Company Portal app
- Company Portal software title defined
- Added a new `Keynote installed` label so that the Keynote theme
installer will only show up for devices with Keynote installed
- Added a new `refetch_host.sh` to use to trigger an immediate refetch
- Updated the support contact URL to point to #help-dogfood instead of
the customer support portal.
Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>
- `issuer_uri` and `enable_jit_role_sync` are deprecated (see
https://github.com/fleetdm/fleet/issues/10688)
- Setting `enable_sso_idp_login` to allow testing logins initiated from
Google.
Created a new policy with the calendaring automation for when I update
the APNs certificate being used.
---------
Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
Switched from metadata_url to metadata for end user authentication.
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Added query to all teams to collect operating system information for
dashboarding.
Copied Slack update policy to from Workstations (canary) to Workstations
team.
