Which devices across my Linux, macOS, Windows, Chromebook, and mobile fleet are out of compliance or missing patches?

queries the native OS and osquery data on each enrolled host and reports current software, settings, and policy pass/fail status by host, across every OS at once

Which hosts would fail a given security or compliance check right now?

runs the policy's SQL query live against every enrolled host and returns the pass/fail result per host, without waiting for a scheduled cycle

Can I prove to an auditor what was actually installed or configured on a device at a point in time?

pulls diagnostics straight from the native OS and osquery down to the bare metal, giving audit-grade evidence rather than a management-console summary

How do I roll out an MDM setting, application, or OS update to thousands of machines without touching a console?

expresses the change as YAML checked into git and applies it fleet-wide through GitOps, so the same change can be reviewed, diffed, and reverted like code

Are the same enrollment and configuration policies applied consistently everywhere, including mobile and cloud instances?

enforces one set of profiles and settings across Linux, macOS, Windows, Chromebooks, iOS/Android, and cloud infrastructure, so a host or account missing a policy shows up as a gap rather than being silently skipped

Who is running software with a known vulnerability across my endpoints?

tracks installed software and exposure per host and surfaces it on the dashboard, letting a gap be traced to specific machines rather than an aggregate count

Fleet release history — The Cyber Toolchain

fleet-v4.94.0 Oct 28, 2026 · issue 124

Fleet adds self-service profiles, one-time Windows enroll secrets, on-demand FileVault key rotation, and a major sweep of MDM, Android, and software-inventory capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.94.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.94.0

└──▷ USE IT

Enable per-device single-use Windows MDM enroll secrets to prevent a compromised shared secret from being reused across hosts.

fleet.yml

mdm:
  windows_one_time_enroll_secrets: true

Tune how long Fleet retains Windows MDM command history before purging it, or disable the cleanup entirely.

fleet.yml

mdm:
  windows_command_retention: 720h

Rotate a macOS host's FileVault recovery key on demand without waiting for the next scheduled escrow.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/42/encryption_key/rotate \
  -H 'Authorization: Bearer <token>'

Improves configuration profile management: adds name and description fields settable via the UI, the API, or GitOps YAML (deprecating display_name on the batch configuration profiles endpoint in favor of name), and adds a dedicated page for adding and editing configuration profiles — replacing the add and edit modals — with support for upload, paste, and inline editing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new configuration profile capabilities: mark a profile as hidden so it only appears on My device > Controls after the end user turns on the Show hidden profiles toggle, and add self-service configuration profiles for macOS hosts that end users can install from the My device page.
Add a customizable Windows end-user agreement (EULA) — upload a Markdown file up to 512 KB in Settings > Integrations > MDM > End user license agreement, or set windows_eula in GitOps YAML; Fleet renders it as the terms page during Microsoft Entra and Autopilot enrollment.
Add a BYPASS_END_USER_AUTH property to the Windows MSI built by fleetctl package, so end-user authentication can be skipped at install time with msiexec /i fleetd-base.msi BYPASS_END_USER_AUTH=true instead of baking in --bypass-end-user-auth; requires fleetd v1.60.0 or higher.
Add path/paths file-reference support to software.fleet_maintained_apps and software.app_store_apps in GitOps YAML, matching existing support for policies, labels, reports, and software.packages.

+5 more show less

Add mdm.windows_one_time_enroll_secrets server setting: when enabled, Fleet sends each Windows MDM host a per-device, single-use enroll secret instead of the shared global secret.
Add websocket.orbit_config_enabled server setting (experimental; requires websocket.transport_enabled) with websocket.orbit_config_poll_interval (default 5 minutes) and websocket.orbit_config_spread (default 30 seconds) to push orbit-config change notifications over WebSocket instead of polling every 30 seconds.
Adds configurable retention and cleanup settings to keep data from growing unbound: Windows MDM command-history retention via mdm.windows_command_retention (env: FLEET_MDM_WINDOWS_COMMAND_RETENTION, default 30 days, 0 disables cleanup), deleted-host certificate retention via server.deleted_host_certificates_retention (default 30 days), and an hourly cleanup job for completed Apple MDM commands.
Add version as a valid order_key for GET /api/v1/fleet/os_versions, with numeric version sorting by segment.
Add a Types filter (source and extension_for query parameters) to the list software titles, list software versions, get host's software, and get device's software endpoints.

Improves configuration profile management: adds name and description fields settable via the UI, the API, or GitOps YAML (deprecating display_name on the batch configuration profiles endpoint in favor of name), and adds a dedicated page for adding and editing configuration profiles — replacing the add and edit modals — with support for upload, paste, and inline editing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds new configuration profile capabilities: mark a profile as hidden so it only appears on My device > Controls after the end user turns on the Show hidden profiles toggle, and add self-service configuration profiles for macOS hosts that end users can install from the My device page.
Add a customizable Windows end-user agreement (EULA) — upload a Markdown file up to 512 KB in Settings > Integrations > MDM > End user license agreement, or set windows_eula in GitOps YAML; Fleet renders it as the terms page during Microsoft Entra and Autopilot enrollment.
Add a BYPASS_END_USER_AUTH property to the Windows MSI built by fleetctl package, so end-user authentication can be skipped at install time with msiexec /i fleetd-base.msi BYPASS_END_USER_AUTH=true instead of baking in --bypass-end-user-auth; requires fleetd v1.60.0 or higher.
Add mdm.windows_one_time_enroll_secrets server setting: when enabled, Fleet sends each Windows MDM host a per-device, single-use enroll secret instead of the shared global secret.

+2 more show less

Add websocket.orbit_config_enabled server setting (experimental; requires websocket.transport_enabled) with websocket.orbit_config_poll_interval (default 5 minutes) and websocket.orbit_config_spread (default 30 seconds) to push orbit-config change notifications over WebSocket instead of polling every 30 seconds.
Adds configurable retention and cleanup settings to keep data from growing unbound: Windows MDM command-history retention via mdm.windows_command_retention (env: FLEET_MDM_WINDOWS_COMMAND_RETENTION, default 30 days, 0 disables cleanup), deleted-host certificate retention via server.deleted_host_certificates_retention (default 30 days), and an hourly cleanup job for completed Apple MDM commands.

3 more in Everything

└──▷ BREAKING ON UPGRADE

!The s3_software_installers_signed_url server option is renamed to s3_software_installers_gcs_signed_url; the old name still works but is deprecated.
!OpenTelemetry HTTP server metrics for gorilla-routed requests now use stable semantic conventions: http.server.request.duration (seconds) replaces http.server.duration (milliseconds), and http.server.request.body.size / http.server.response.body.size replace http.server.request.size / http.server.response.size; any custom dashboards built on the old metric names require updating.
!When mdm.windows_one_time_enroll_secrets is enabled, a shared enroll secret can no longer enroll fleetd as a host that is enrolled in Fleet Windows MDM.
!Renaming a Windows, Android, or declaration (DDM) profile through GitOps now re-creates the profile.

api-docs-e9499a9c8087 Oct 19, 2026 · issue 113

Fleet login API now returns token_expires_at and available_fleets fields in the authentication response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ TRY IT

Authenticate and capture the token expiry time so your automation can refresh sessions before they lapse.

$ curl -s -X POST https://fleet.example.com/api/v1/fleet/login \
  -H 'Content-Type: application/json' \
  -d '{"email": "admin@example.com", "password": "<password>"}' \
  | jq '{token: .token, expires: .token_expires_at, fleets: .available_fleets}'

Adds token_expires_at field to the login API response, showing when the session token expires based on the server's session duration setting (default: 5 days).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds available_fleets field to the login API response.
Documents that API-only users receive token_expires_at in the response but their tokens remain valid after the indicated expiry time.

Adds token_expires_at field to the login API response, showing when the session token expires based on the server's session duration setting (default: 5 days).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds available_fleets field to the login API response.

1 more in Everything

api-docs-bb06a335f132 Oct 5, 2026 · issue 095

API change

+ DELETE /api/v1/fleet/software/titles/24/available_for_install?fleet_id=2

└──▷ TRY IT

Remove a software title from Fleet's available-for-install catalog (and auto-uninstall it from Android devices in the target fleet).

$ curl -X DELETE 'https://fleet.example.com/api/v1/fleet/software/titles/24/available_for_install?fleet_id=2' \
  -H 'Authorization: Bearer <your-api-token>'

api-docs-bb06a335f132 Oct 4, 2026 · issue 094

Fleet: Adds DELETE /api/v1/fleet/software/titles/{id}/available_for_install endpoint to remove a software title from the install catalog; on Android hosts the software is also uninstalled from the device, while other platforms are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

Fleet: Adds `DELETE /api/v1/fleet/software/titles/{id}/available_for_install` endpoint to remove a software title from the install catalog; on Android hosts the software is also uninstalled from the device, while other platforms are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ DELETE /api/v1/fleet/software/titles/24/available_for_install?fleet_id=2

└──▷ TRY IT

Remove a software title from Fleet's available-for-install catalog (and uninstall it from Android devices in the target team) without touching other platform hosts.

$ curl -X DELETE 'https://fleet.example.com/api/v1/fleet/software/titles/24/available_for_install?fleet_id=2' -H 'Authorization: Bearer <token>'

api-docs-bb06a335f132 Oct 3, 2026 · issue 093

New DELETE endpoint removes software available for install, with automatic uninstall for Android hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

New DELETE endpoint removes software available for install, with automatic uninstall for Android hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ DELETE /api/v1/fleet/software/titles/24/available_for_install?fleet_id=2

└──▷ TRY IT

Remove a software title from available-for-install for a specific Fleet team, automatically uninstalling it from Android hosts in that team.

$ curl -X DELETE 'https://fleet.example.com/api/v1/fleet/software/titles/24/available_for_install?fleet_id=2' -H 'Authorization: Bearer <token>'

4.92.2 Sep 30, 2026 · release notes

Adds server.software_install_results_retention and server.script_results_retention config keys for retention cleanup

└──▷ GET THIS VERSION

$ git clone --branch 4.92.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.92.2

api-docs-1fdadd14db01 Sep 29, 2026 · issue 089

Fleet adds installer_id for targeted package deletion, new patch-policy automation with configurable retry behaviour, and a software install trigger on policy failure.

Adds installer_id parameter to the delete-package API endpoint, allowing deletion of only the specified package rather than all packages for a software title.
Adds install software policy automation that installs an app update the next time a policy fails, regardless of whether the app is open.
Adds patch-policy automation support that runs software and script automations every time Fleet receives a failing host response when enabled, rather than only on first failure or pass-to-fail transitions.
Adds a 3-attempt retry limit for patch policy installs when the app is open, retrying again on the next policy run.

4 details in Everything

New supported platform Lost Mode disable for iOS and iPadOS

api-docs-c3a210799a17 Sep 26, 2026 · issue 086

Fleet API gains CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

Fleet API gains CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ POST /api/v1/fleet/hosts/:id/apns_ping
+ POST /api/v1/fleet/hosts/123/apns_ping
+ DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
+ DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757
+ GET /api/v1/fleet/microsoft_graph_credentials
+ GET /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ DELETE /api/v1/fleet/fleets/:id/users
⚠ Deprecated at this level.
⚠ Deprecated.
⚠ Deprecated at this level.
⚠ Deprecated at this level.

└──▷ TRY IT

Trigger an immediate MDM check-in on a macOS host that has pending profiles — useful after pushing a new configuration to confirm the device picks it up without waiting for the next scheduled sync.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/123/apns_ping \
  -H 'Authorization: Bearer <api_token>'

Cancel a lock command queued for an Apple host that was reported stolen but has since been recovered, before the command reaches the device.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757 \
  -H 'Authorization: Bearer <api_token>'

Adds severity_min and severity_max query parameters (CVSS v3.x base score, 0–10) to the vulnerability host-count chart endpoint to filter results by CVSS score range; vulnerabilities without metadata are included only when neither filter is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds POST /api/v1/fleet/hosts/:id/apns_ping to send a blank APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles.
Adds PUT /api/v1/fleet/microsoft_graph_credentials as a declarative replace endpoint for Microsoft Graph credentials; accepts tenant_id, client_id, and client_secret, validates each new/changed credential against Microsoft Graph before saving, and deletes any stored credential whose tenant_id is absent from the supplied list.
Adds has_known_exploit filter field alongside CVSS severity filters for vulnerability queries.
Adds profile-file replacement support to the update-profile endpoint: uploading a new file replaces the existing profile contents, with identifier-matching rules per profile type (Apple mobileconfig, DDM, Windows, Android) and automatic renaming based on type.

+1 more show less

Adds Android MDM command status semantics: pending maps to 'sent but not yet executed', acknowledged maps to executed successfully, and error maps to 'rejected by AMAPI or device', with the result field carrying the full AMAPI Operation response on error.

Adds severity_min and severity_max query parameters (CVSS v3.x base score, 0–10) to the vulnerability host-count chart endpoint to filter results by CVSS score range; vulnerabilities without metadata are included only when neither filter is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds POST /api/v1/fleet/hosts/:id/apns_ping to send a blank APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles.
Adds PUT /api/v1/fleet/microsoft_graph_credentials as a declarative replace endpoint for Microsoft Graph credentials; accepts tenant_id, client_id, and client_secret, validates each new/changed credential against Microsoft Graph before saving, and deletes any stored credential whose tenant_id is absent from the supplied list.
Adds has_known_exploit filter field alongside CVSS severity filters for vulnerability queries.

2 more in Everything

api-docs-c3a210799a17 Sep 25, 2026 · issue 085

Fleet: Adds severity_min and severity_max query parameters to the vulnerability host-count chart endpoint to filter results by CVSS 3.x base score range; vulnerabilities lacking metadata are included only when neither filter is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

Fleet: Adds `severity_min` and `severity_max` query parameters to the vulnerability host-count chart endpoint to filter results by CVSS 3.x base score range; vulnerabilities lacking metadata are included only when neither filter is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ POST /api/v1/fleet/hosts/:id/apns_ping
+ POST /api/v1/fleet/hosts/123/apns_ping
+ DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
+ DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757
+ GET /api/v1/fleet/microsoft_graph_credentials
+ GET /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ DELETE /api/v1/fleet/fleets/:id/users
⚠ Deprecated at this level.
⚠ Deprecated.
⚠ Deprecated at this level.
⚠ Deprecated at this level.

└──▷ TRY IT

Trigger a macOS host to immediately check in and pick up pending MDM commands without waiting for the next scheduled poll.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/123/apns_ping -H 'Authorization: Bearer <token>'

Cancel a pending lock or wipe command for an Apple host before it is delivered, using the command UUID from the host's activity feed.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757 -H 'Authorization: Bearer <token>'

Register Microsoft Graph credentials so Fleet can sync Windows Autopilot devices as pending hosts; any tenant not in the list is removed.

$ curl -X PUT https://fleet.example.com/api/v1/fleet/microsoft_graph_credentials -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"microsoft_graph_credentials": [{"tenant_id": "fec37e96-3615-4e37-8fac-445d5328af3c", "client_id": "8c8e3fd4-9b2c-4d3e-8f10-2233445566aa", "client_secret": "<secret>"}]}'

Adds DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid to cancel a pending MDM command (lock, wipe, or ClearPasscode/EnableLostMode) for Apple hosts before it is delivered.
Adds GET /api/v1/fleet/microsoft_graph_credentials to list all Microsoft Graph credentials and per-tenant Autopilot sync status, including credential_invalid, last_synced_at, and last_sync_error fields.
Adds preserve_host_activities_on_reenrollment global config field to retain host activity history after a wipe and re-enrollment for company-owned Apple (AB) and Android hosts.
Adds require_bitlocker_pin under windows_settings to require end users on Windows hosts to set a BitLocker PIN.
Adds linux_settings.enable_escrow_disk_encryption_key config field so Fleet stores the Linux disk encryption recovery key without prompting users, supporting third-party enforcement tooling.

+7 more show less

Adds enable_escrow_disk_encryption_key under mdm.linux_settings at the team level, mirroring the global setting for per-team Linux disk encryption key escrow.
Adds microsoft_graph_credential_invalid as a read-only global config field that signals when at least one Microsoft Graph credential has been rejected, halting Windows Autopilot device sync.
Adds group_tag field to Autopilot host records, returning the Windows Autopilot group tag for hosts synced from a tenant's Autopilot registry.
New endpoint documented: POST /api/v1/fleet/hosts/:id/apns_ping
New endpoint documented: DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
New endpoint documented: GET /api/v1/fleet/microsoft_graph_credentials
New endpoint documented: PUT /api/v1/fleet/microsoft_graph_credentials

12 details in Everything

api-docs-c3a210799a17 Sep 24, 2026 · issue 084

Fleet: Adds microsoft_graph_credentials.tenant_id, microsoft_graph_credentials.client_id, and microsoft_graph_credentials.client_secret fields to the PUT /api/v1/fleet/microsoft_graph_credentials request body.

API change

Fleet: Adds `microsoft_graph_credentials.tenant_id`, `microsoft_graph_credentials.client_id`, and `microsoft_graph_credentials.client_secret` fields to the `PUT /api/v1/fleet/microsoft_graph_credentials` request body.

+ POST /api/v1/fleet/hosts/:id/apns_ping
+ POST /api/v1/fleet/hosts/123/apns_ping
+ DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
+ DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757
+ GET /api/v1/fleet/microsoft_graph_credentials
+ GET /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ DELETE /api/v1/fleet/fleets/:id/users
⚠ Deprecated at this level.
⚠ Deprecated.
⚠ Deprecated at this level.
⚠ Deprecated at this level.

└──▷ TRY IT

Prompt a specific Apple host to immediately check in and pick up pending MDM commands without waiting for its next scheduled sync.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/123/apns_ping \
  -H 'Authorization: Bearer <token>'

Cancel a lock or wipe command queued for an Apple host before the device comes online and executes it.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757 \
  -H 'Authorization: Bearer <token>'

Rotate a stale Microsoft Entra client secret so Windows Autopilot device sync resumes after a microsoft_graph_credential_invalid alert.

$ curl -X PUT https://fleet.example.com/api/v1/fleet/microsoft_graph_credentials \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"microsoft_graph_credentials": [{"tenant_id": "fec37e96-3615-4e37-8fac-445d5328af3c", "client_id": "8c8e3fd4-9b2c-4d3e-8f10-2233445566aa", "client_secret": "<new-secret>"}]}'

Supports uploading a replacement profile file on existing Android and Windows configuration profiles where the new file's settings can differ completely from the ones it replaces.
Adds alternative_browser_host field to global and team settings for Fleet Desktop browser-host overrides.

Adds alternative_browser_host field to global and team settings for Fleet Desktop browser-host overrides.

1 more in Everything

api-docs-c3a210799a17 Sep 23, 2026 · issue 083

Fleet adds CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

Fleet adds CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ POST /api/v1/fleet/hosts/:id/apns_ping
+ POST /api/v1/fleet/hosts/123/apns_ping
+ DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
+ DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757
+ GET /api/v1/fleet/microsoft_graph_credentials
+ GET /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ DELETE /api/v1/fleet/fleets/:id/users
⚠ Deprecated at this level.
⚠ Deprecated.
⚠ Deprecated at this level.
⚠ Deprecated at this level.

└──▷ TRY IT

Force a managed Apple host to immediately check in and pick up pending MDM commands without waiting for its next scheduled poll.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/123/apns_ping \
  -H 'Authorization: Bearer <api_token>'

Cancel a pending lock or wipe command on an Apple host before it is delivered to the device.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757 \
  -H 'Authorization: Bearer <api_token>'

Register a Microsoft Entra tenant credential so Fleet can sync Windows Autopilot devices as pending hosts.

$ curl -X PUT https://fleet.example.com/api/v1/fleet/microsoft_graph_credentials \
  -H 'Authorization: Bearer <api_token>' \
  -H 'Content-Type: application/json' \
  -d '{"microsoft_graph_credentials": [{"tenant_id": "fec37e96-3615-4e37-8fac-445d5328af3c", "client_id": "8c8e3fd4-9b2c-4d3e-8f10-2233445566aa", "client_secret": "<client_secret>"}]}'

Adds POST /api/v1/fleet/hosts/:id/apns_ping endpoint to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or configuration profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds PUT /api/v1/fleet/microsoft_graph_credentials endpoint to declaratively replace stored Microsoft Graph credentials; accepts microsoft_graph_credentials[].tenant_id, .client_id, and .client_secret, validates each new or changed credential against Microsoft Graph before saving.
Supports replacing an existing MDM configuration profile file via upload, with type-specific identifier matching rules for Apple (mobileconfig/DDM), Windows, and Android profiles.
Adds Android MDM command status values: pending (sent to AMAPI, not yet executed), acknowledged (executed successfully), and error (rejected, with full AMAPI Operation response in the result field).
New endpoint documented: DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757

Adds POST /api/v1/fleet/hosts/:id/apns_ping endpoint to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or configuration profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds PUT /api/v1/fleet/microsoft_graph_credentials endpoint to declaratively replace stored Microsoft Graph credentials; accepts microsoft_graph_credentials[].tenant_id, .client_id, and .client_secret, validates each new or changed credential against Microsoft Graph before saving.
New endpoint documented: DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757

2 more in Everything

api-docs-43d34837c929 Sep 22, 2026 · issue 082

Fleet: Adds POST /api/v1/fleet/hosts/:id/apns_ping to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

API change

Fleet: Adds `POST /api/v1/fleet/hosts/:id/apns_ping` to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

+ POST /api/v1/fleet/hosts/:id/apns_ping
+ POST /api/v1/fleet/hosts/123/apns_ping
+ DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
+ DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757
+ GET /api/v1/fleet/microsoft_graph_credentials
+ GET /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ PUT /api/v1/fleet/microsoft_graph_credentials
+ DELETE /api/v1/fleet/fleets/:id/users
⚠ Deprecated at this level.
⚠ Deprecated.
⚠ Deprecated at this level.
⚠ Deprecated at this level.

└──▷ TRY IT

Force an offline Apple MDM host to check in and pick up pending commands without waiting for its next scheduled poll.

$ curl -X POST https://fleet.example.com/api/v1/fleet/hosts/123/apns_ping \
  -H 'Authorization: Bearer <token>'

Cancel a lock or wipe command queued for an Apple host before it reaches the device — useful when a host was targeted by mistake.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757 \
  -H 'Authorization: Bearer <token>'

Rotate a Microsoft Graph client secret after Entra rejects the old one, restoring Windows Autopilot sync without deleting the existing tenant registration.

$ curl -X PUT https://fleet.example.com/api/v1/fleet/microsoft_graph_credentials \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"microsoft_graph_credentials": [{"tenant_id": "fec37e96-3615-4e37-8fac-445d5328af3c", "client_id": "8c8e3fd4-9b2c-4d3e-8f10-2233445566aa", "client_secret": "<new-secret>"}]}'

Adds GET /api/v1/fleet/microsoft_graph_credentials to list Microsoft Graph credentials and per-tenant Autopilot sync status, including credential_invalid and last_synced_at fields.
Adds PUT /api/v1/fleet/microsoft_graph_credentials to declaratively replace stored Microsoft Graph credentials; credentials whose tenant_id is absent from the payload are deleted, and an empty array removes all credentials.
Adds severity_min and severity_max parameters (CVSS 3.x base score) to the vulnerability hosts-over-time chart endpoint to filter results to a specific CVSS score range.
Adds preserve_host_activities_on_reenrollment configuration field to preserve host activities after a wipe and re-enrollment for company-owned Apple (AB) and Android hosts.
Adds microsoft_graph_credential_invalid read-only field to the configuration API, set to true when at least one Microsoft Graph credential has been rejected, indicating Autopilot devices are no longer syncing.

+9 more show less

Adds require_bitlocker_pin field under windows_settings so end users on Windows hosts are required to set a BitLocker PIN.
Adds linux_settings.enable_escrow_disk_encryption_key field to store the disk encryption recovery key for Linux hosts without prompting users to turn on disk encryption — for use when a third-party tool handles enforcement.
Adds enable_escrow_disk_encryption_key under macos_settings (team and global config) to store the macOS disk encryption recovery key when a third-party tool handles enforcement.
Adds group_tag field to Autopilot host responses, returning the Windows Autopilot group tag for hosts synced from a tenant's Autopilot registry.
Extends the Run MDM command endpoint to support Android hosts via base64-encoded AMAPI issueCommand JSON payloads, with pending, acknowledged, and error result states.
New endpoint documented: POST /api/v1/fleet/hosts/:id/apns_ping
New endpoint documented: DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
New endpoint documented: GET /api/v1/fleet/microsoft_graph_credentials
New endpoint documented: PUT /api/v1/fleet/microsoft_graph_credentials

Adds GET /api/v1/fleet/microsoft_graph_credentials to list Microsoft Graph credentials and per-tenant Autopilot sync status, including credential_invalid and last_synced_at fields.
Adds PUT /api/v1/fleet/microsoft_graph_credentials to declaratively replace stored Microsoft Graph credentials; credentials whose tenant_id is absent from the payload are deleted, and an empty array removes all credentials.
Adds preserve_host_activities_on_reenrollment configuration field to preserve host activities after a wipe and re-enrollment for company-owned Apple (AB) and Android hosts.
Adds microsoft_graph_credential_invalid read-only field to the configuration API, set to true when at least one Microsoft Graph credential has been rejected, indicating Autopilot devices are no longer syncing.
Adds require_bitlocker_pin field under windows_settings so end users on Windows hosts are required to set a BitLocker PIN.

+6 more show less

Adds linux_settings.enable_escrow_disk_encryption_key field to store the disk encryption recovery key for Linux hosts without prompting users to turn on disk encryption — for use when a third-party tool handles enforcement.
Adds group_tag field to Autopilot host responses, returning the Windows Autopilot group tag for hosts synced from a tenant's Autopilot registry.
New endpoint documented: POST /api/v1/fleet/hosts/:id/apns_ping
New endpoint documented: DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid
New endpoint documented: GET /api/v1/fleet/microsoft_graph_credentials
New endpoint documented: PUT /api/v1/fleet/microsoft_graph_credentials

3 more in Everything

docs update Sep 22, 2026 · issue 082

Fleet adds a Reports feature with scheduling, label-based targeting, live queries, CSV export, and configurable result caps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ USE IT

Cap stored report results at 500 and disable global result persistence to protect database performance as you add more reports.

json

{
  "server_settings": {
    "report_cap": 500,
    "discard_reports_data": true
  }
}

Spread scheduled report check-ins across a wider window to reduce simultaneous host load on a large fleet.

yaml

schedule_splay_percent: 20

Adds server_settings.report_cap to control the maximum number of stored results per report (default 1,000).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds server_settings.discard_reports_data API field to globally disable stored report results.
Adds the discard_data field on the create/update report API to disable stored results per individual report.
Adds schedule_splay_percent in agent options to control how much Fleet randomizes each host's scheduled report check-in time (up to 10% by default).
Adds a Reports section with the ability to create, schedule, run live, and export reports as CSV.

+4 more show less

Adds label-based host targeting (Fleet Premium) when creating or editing a report, via a Custom target selector.
Adds a Manage automations bulk UI (admin-only) to configure which reports send data to a log destination.
Adds per-report and global Store data toggles in Advanced options to enable or disable result persistence from the UI.
Supports running SELECT * FROM osquery_schedule as a live query to determine exactly when a specific host will next check in for a scheduled report.

9 details in Everything

fleet-v4.92.0 Sep 21, 2026 · issue 082

Fleet 4.92.0 adds Android MDM commands, per-platform disk encryption, cancelable Apple MDM commands, and new osquery bandwidth-saving config options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.92.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.92.0

└──▷ USE IT

Reduce agent config bandwidth on large fleets by enabling etag-based conditional config responses so unchanged configs return only a minimal acknowledgement.

yaml

osquery:
  config_etags: true
  redis_config_etags: true

Cancel a pending Apple MDM wipe before a host receives it — useful when a wipe was sent to the wrong device.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/hosts/42/commands/a1b2c3d4-e5f6-7890-abcd-ef1234567890 -H 'Authorization: Bearer <token>'

Adds osquery.config_in_memory_cache server configuration option to control the in-memory cache of the osquery config's scheduled-report section (set to true to re-enable; disabled by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds osquery.config_etags server option (FLEET_OSQUERY_CONFIG_ETAGS, default off) to enable conditional request (etag) support on /api/osquery/config, sending a minimal {"etag":"ok"} response to agents whose configuration is unchanged.
Adds osquery.redis_config_etags server option (FLEET_OSQUERY_REDIS_CONFIG_ETAGS, default off, requires osquery.config_etags) to answer matching etag check-ins directly from a Redis-backed ETag store, skipping the config build and database reads entirely.
Adds server.endpoint_request_size_overrides configuration to set a max request body size per API endpoint.
Adds websocket.transport_enabled server configuration to enable an experimental WebSocket notification transport for fleetd agents (disabled by default).

+15 more show less

Adds mdm.is_personal_enrollment field to host API responses, reporting whether the last MDM enrollment was personal (BYOD) and persisting after unenrollment.
Adds mdm.bootstrap_token_escrowed field to the get host and get host by Fleet Desktop token API responses.
Adds DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid to cancel a pending Apple MDM lock, wipe, clear passcode, or enable lost mode command before the host receives it.
Adds per-platform disk encryption settings: enforcement and key escrow for macOS, enforcement for Windows, and key escrow for Linux.
Adds a new End user authentication setting (fleet_desktop.sso_enabled, Fleet Premium) requiring end users to sign in via SSO before accessing Fleet Desktop's My device page.
Adds a severity (CVSS score) filter to the Vulnerability exposure dashboard chart (Fleet Premium), with min/max score inputs appearing only when custom severity is selected.
Adds collection of additional Android host vitals (USB debugging, passcode set, Google Play Protect, encryption status, manufacturer, security update version, kernel and bootloader version, software update status, API level, security posture, and per-SIM phone numbers) returned by get host endpoints.
Adds automatic installation of in-house apps (.ipa) on iOS and iPadOS hosts when they enroll into Fleet.
Adds Windows devices from a connected Microsoft Entra tenant's Autopilot registry to Fleet as pending hosts before enrollment.
Adds support for resending a configuration profile on policy failure as part of a policy automation.
Adds display_name support for Fleet-maintained apps in GitOps.
Adds a QR code for the enrollment link on the Android and iOS/iPadOS tabs of the Add hosts modal.
Adds an audit activity when a deprovisioned SCIM user has no email to match a Fleet account.
Adds an Inactive status with tooltip to the Users table, with new last_login_at, last_activity_at, and server-computed status fields (active, inactive, or no_access) returned from the users API.
Adds the ability to sort the versions table by version on the Software details page.

Adds osquery.config_in_memory_cache server configuration option to control the in-memory cache of the osquery config's scheduled-report section (set to true to re-enable; disabled by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
Adds osquery.config_etags server option (FLEET_OSQUERY_CONFIG_ETAGS, default off) to enable conditional request (etag) support on /api/osquery/config, sending a minimal {"etag":"ok"} response to agents whose configuration is unchanged.
Adds osquery.redis_config_etags server option (FLEET_OSQUERY_REDIS_CONFIG_ETAGS, default off, requires osquery.config_etags) to answer matching etag check-ins directly from a Redis-backed ETag store, skipping the config build and database reads entirely.
Adds server.endpoint_request_size_overrides configuration to set a max request body size per API endpoint.
Adds websocket.transport_enabled server configuration to enable an experimental WebSocket notification transport for fleetd agents (disabled by default).

+11 more show less

Adds mdm.is_personal_enrollment field to host API responses, reporting whether the last MDM enrollment was personal (BYOD) and persisting after unenrollment.
Adds mdm.bootstrap_token_escrowed field to the get host and get host by Fleet Desktop token API responses.
Adds DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid to cancel a pending Apple MDM lock, wipe, clear passcode, or enable lost mode command before the host receives it.
Adds per-platform disk encryption settings: enforcement and key escrow for macOS, enforcement for Windows, and key escrow for Linux.
Adds a new End user authentication setting (fleet_desktop.sso_enabled, Fleet Premium) requiring end users to sign in via SSO before accessing Fleet Desktop's My device page.
Adds automatic installation of in-house apps (.ipa) on iOS and iPadOS hosts when they enroll into Fleet.
Adds Windows devices from a connected Microsoft Entra tenant's Autopilot registry to Fleet as pending hosts before enrollment.
Adds support for resending a configuration profile on policy failure as part of a policy automation.
Adds a QR code for the enrollment link on the Android and iOS/iPadOS tabs of the Add hosts modal.
Adds an audit activity when a deprovisioned SCIM user has no email to match a Fleet account.
Adds an Inactive status with tooltip to the Users table, with new last_login_at, last_activity_at, and server-computed status fields (active, inactive, or no_access) returned from the users API.

4 more in Everything

└──▷ BREAKING ON UPGRADE

!Duration fields in Fleet server logs (e.g. took) now render as human-readable strings with time units (e.g. "1.116187ms") instead of raw nanosecond numbers — log pipelines that parse these fields numerically must be updated.
!Windows user-scoped configuration profiles that already failed on an earlier Fleet version are not resent automatically after upgrading — admins must resend them once (or edit the profile) for Fleet to deliver them when a user is signed in.

advisory CVE-2026-103264 Sep 15, 2026 · issue 128

CVE-2026-103264: Unauthenticated iOS/iPadOS device API access via non-secret host identifiers (CVSS 9.1, affects < 4.87.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

api-docs-a565f2d60d3a Sep 7, 2026 · issue 067

New API endpoint to manually clear a policy's pass/fail results for custom automations.

fleet-v4.91.0 Sep 2, 2026 · issue 063

Fleet 4.91.0 adds managed local Windows admin accounts, macOS/iOS/iPadOS latest OS pinning, per-fleet activity webhooks, Adobe plugin inventory, and 29 new iOS vitals.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.91.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.91.0

└──▷ USE IT

Enforce end-user authentication for all Orbit enrollments, preventing hosts that skip MFA from joining a fleet that requires it.

yaml

mdm:
  allow_orbit_end_user_auth_bypass: false

Build a fleetd installer for a kiosk deployment where end users have already authenticated via another MDM and should not see another auth prompt.

$ fleetctl package --type=msi --fleet-url=https://fleet.example.com --enroll-secret=<secret> --bypass-end-user-auth

Disable software inventory for a specific fleet to reduce database load on a fleet used only for script execution.

$ curl -X PATCH https://fleet.example.com/api/v1/fleet/fleets/7 \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"features": {"enable_software_inventory": false}}'

Adds s3_software_installers_signed_url configuration option to serve software installers, in-house apps, and bootstrap packages via GCS presigned URLs so clients download directly from object storage instead of routing through the Fleet server.
Adds --bypass-end-user-auth flag to fleetctl package to generate fleetd installers that skip end-user authentication prompts on Linux and Windows hosts; requires fleetd v1.60.0 or higher.
Adds per-fleet software inventory toggle via PATCH /api/v1/fleet/fleets/{id} with {"features": {"enable_software_inventory": <bool>}}; omitting the key leaves the stored value unchanged.
Adds token_invalid field to ABM token API responses and dep_device_error (human-readable message) to GET /hosts/:id/dep_assignment to surface why an Apple Business Manager device lookup or ABM token is failing.
Adds host_id and host_serial fields to the mdm_enrolled activity for Apple (macOS, iOS, iPadOS) enrollments, and surfaces the activity on the host's activity timeline.

+18 more show less

Adds mdm.allow_orbit_end_user_auth_bypass server setting (enabled by default) to control whether hosts that skip end-user authentication can enroll into a fleet that requires it; set to false to strictly enforce authentication for all Orbit enrollments.
Adds support for $FLEET_HOST_VITAL_<id> custom host vital variables in Android configuration profiles, managed app configurations, and host name templates, with per-host expansion and automatic re-delivery when a vital value changes.
Adds support for Fleet built-in variables (e.g. $FLEET_VAR_HOST_END_USER_IDP_USERNAME) in software install, post-install, and uninstall scripts, resolved per host at execution time (Fleet Premium).
Adds linux as a label platform option, targeting hosts across any Linux distribution.
Adds a managed local admin account capability for Windows hosts (requires fleetd 1.60.0 or higher).
Adds a default fleet assignment for new Windows MDM enrollments (Fleet Premium), applied before the Autopilot Enrollment Status Page runs so software, scripts, and configuration profiles take effect during out-of-box setup.
Adds support for setting minimum_version to latest with deadline_days in macOS/iOS/iPadOS OS update policy to automatically track the newest Apple-published version per device (Fleet Premium).
Adds per-fleet activity automations (Fleet Premium): a webhook configured from the Hosts page that posts to a destination URL whenever an activity tied to one of the fleet's hosts is created.
Adds a Patch when closed option for patch policies that only patches an app when it is not currently running.
Adds Adobe Creative Cloud plugin detection (CEP and UXP extensions) to software inventory on macOS and Windows, listed as software type Plugin (Adobe) with version and host count.
Adds 29 new iOS/iPadOS device vitals (battery level, accessibility settings, cellular technology, cloud backup status, MDM options, device attestation, and more) collected via the existing DeviceInformation MDM refetch and exposed in the host API response and a new View all vitals modal; BYOD enrollments are excluded.
Adds support for releasing devices from Apple Business Manager inside Fleet.
Adds support for nested Entra groups in IdP vitals.
Adds a sortable Added to Fleet column to the hosts table showing when each host last enrolled.
Adds marketing name display for Apple devices (macOS, iOS, iPadOS) — the Hardware model field now shows names like MacBook Pro (16-inch, 2021) instead of raw identifiers like MacBookPro18,1.
Adds user_mfa_requested activity recorded when valid credentials are submitted for an MFA-enabled account and a verification email is sent.
Adds created_setup_experience_script and deleted_setup_experience_script activities to the audit log when a setup experience script is added, replaced, or removed via the API or GitOps.
Updates macOS CIS benchmark policies to macOS 14 Sonoma v3.1.0, macOS 15 Sequoia v2.1.0, and macOS 26 Tahoe v1.1.0.

23 details in Everything

fleet-v4.90.2 Sep 1, 2026 · issue 062

Fleet adds a configurable release budget for Fleet-initiated activities via FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.90.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.90.2

Adds FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE environment variable to throttle Fleet-initiated activities (policy-automation software installs, scripts, iOS/iPadOS scheduled app updates) to a configurable rate (default 1000 hosts/minute, 0 = unlimited), spreading install-execution and result-ingestion load when automations fire across many hosts simultaneously.
User-initiated activities (self-service installs, admin-run scripts, lock/unlock/wipe, setup experience) now take precedence over queued Fleet-initiated activities on the same host.

2 details in Everything

api-docs-e62e4648a3e0 Aug 31, 2026 · issue 060

Fleet API adds is_personal_enrollment field to distinguish BYOD (personal) MDM enrollments on host records.

└──▷ TRY IT

Query a host's MDM enrollment type to identify BYOD devices that may fall outside corporate management policies.

$ curl -sS -H 'Authorization: Bearer <token>' 'https://<fleet-url>/api/v1/fleet/hosts/<host-id>' | jq '.host.mdm.is_personal_enrollment'

api-docs-dedc3ff95d39 Aug 28, 2026 · issue 058

Fleet API adds bootstrap token escrow visibility, uninstall script detection, and installer targeting for failure policies.

└──▷ TRY IT

Check whether Fleet has escrowed a bootstrap token for a macOS host before issuing a remote wipe — only act if the field is true.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<fleet>/api/v1/fleet/hosts/<host_id>' | jq '.host.mdm.bootstrap_token_escrowed'

Before offering an Uninstall action in a custom dashboard, confirm the package actually has an uninstall script by inspecting the response field.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<fleet>/api/v1/fleet/software/titles/<title_id>/available_for_install' | jq '.software_package.has_uninstall_script'

Adds mdm.bootstrap_token_escrowed field to macOS host responses, indicating whether Fleet holds a bootstrap token that authorizes remote wipe and OS update operations without a logged-in secure-token user.
Adds software_package.has_uninstall_script field to software installer responses, signaling whether a non-empty uninstall script is configured — relevant for .tgz and script-only packages where the script is optional.
Adds software_installer_id parameter to install-on-failure policies, letting callers target a specific package rather than defaulting to the title's first-added package.

3 details in Everything

4.90.2 Aug 27, 2026 · release notes

Fleet 4.90.2 adds configurable release budget via FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE for Fleet-initiated activities

└──▷ GET THIS VERSION

$ git clone --branch 4.90.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.90.2

api-docs-91b019e489ab Aug 23, 2026 · issue 054

Fleet adds DELETE /api/v1/fleet/android_enterprise to disconnect Android Enterprise and un-enroll affected hosts.

API change

Fleet adds DELETE /api/v1/fleet/android_enterprise to disconnect Android Enterprise and un-enroll affected hosts.

+ DELETE /api/v1/fleet/android_enterprise
+ DELETE /api/v1/fleet/android_enterprise

└──▷ TRY IT

Disconnect Android Enterprise from Fleet and un-enroll all Android hosts managed under it.

$ curl -X DELETE https://fleet.example.com/api/v1/fleet/android_enterprise \
  -H 'Authorization: Bearer <your-api-token>'

Adds DELETE /api/v1/fleet/android_enterprise endpoint to remove a connected Android Enterprise integration, which un-enrolls all associated hosts and turns off Android MDM features.
Exposes user_id, user_email, fleet_initiated, and streamed fields in activity/audit log entries.
New endpoint documented: DELETE /api/v1/fleet/android_enterprise

3 details in Everything

api-docs-242c73444f82 Aug 12, 2026 · issue 043

Fleet API adds vulnerability details (CVSS scores, descriptions) via query params, and expands wipe support to company-owned Android devices.

Adds vulnerability description, CVSS score, and other details to host software responses when using Fleet Premium (triggered by query parameter).
Adds device_mapping=true query parameter support to host listing; noted as expensive — best practice is to pair with per_page=50 to avoid overloading the Fleet server.
Expands wipe support to company-owned (fully managed) Android hosts in both Fleet Free and Fleet Premium (previously this action was labeled Unenroll).
Wipe for macOS, iOS, iPadOS, Linux, Windows, and personal (BYOD) Android hosts remains available in Fleet Premium.

4 details in Everything

advisory CVE-2026-48786 Aug 11, 2026 · issue 128

CVE-2026-48786: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint (CVSS 6.5, affects < 4.87.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-54245 Aug 11, 2026 · issue 128

CVE-2026-54245: SQL injection in Okta conditional access policy evaluation allows an enrolled host to compromise the Fleet database (affects < 4.86.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

fleet-v4.90.0 Aug 6, 2026 · issue 040

Fleet 4.90.0 adds multi-package deployments, in-place profile editing, custom host vitals, host naming templates, Python packages, Splunk HEC logging, and more.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.90.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.90.0

└──▷ TRY IT

Set a host naming template for all hosts in No team so new macOS/iOS/iPadOS enrollments receive a standardized name.

$ curl -X POST https://fleet.example.com/api/v1/fleet/host_name_template \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"name_template": "CORP-$FLEET_VAR_HOST_SERIAL", "fleet_id": 0}'

Enable cross-platform custom disk encryption (FileVault + BitLocker) via environment variable on a self-hosted Fleet server.

$ FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION=true fleet serve --config /etc/fleet/config.yaml

Adds PATCH /api/v1/fleet/configuration_profiles/:profile_uuid to edit existing configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, and Android) in place.
Adds POST /api/v1/fleet/host_name_template to set or clear a host naming template; omitting fleet_id or setting it to 0 targets No team, and an empty template clears enforcement without renaming any host.
Adds name_template key under controls in GitOps for fleets and No team, included in fleetctl generate-gitops output.
Adds POST /api/v1/fleet/hosts/{id}/name_template/resend to resend the host naming template to a specific host.
Adds FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION (mdm.enable_custom_disk_encryption) as a cross-platform alias for FLEET_MDM_ENABLE_CUSTOM_FILEVAULT, enabling custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.

+32 more show less

Adds $FLEET_VAR_CERTIFICATE_RENEWAL_ID variable to enable automatic renewal for SCEP and ACME certificates issued by external CAs (Okta Conditional Access, Okta Verify, Hydrant ACME) — add it to the certificate's Subject OU.
Adds optional platform query parameter to GET /api/v1/fleet/policies and GET /api/v1/fleet/fleets/{id}/policies to filter policies by targeted platform.
Adds server_bypass_network_blocking server config option to disable all outbound network blocking protections for integration HTTP requests.
Adds the asynchronous live query endpoint POST /api/v1/fleet/reports/run to the API endpoints catalog, making it grantable to API-only users with a restricted allowlist.
Adds audit activities when secret variables are created or updated through PUT /api/latest/fleet/spec/secret_variables.
Adds custom host vitals: admins can define custom host fields, set values per host manually or via the API, and reference them as $FLEET_HOST_VITAL_<id> variables in scripts and configuration profiles.
Adds host naming template enforcement for macOS, iOS, and iPadOS under Controls > OS settings > Host names, with statuses (Enforcing, Verifying, Verified, Failed) and the edited_host_name_template audit activity.
Adds support for uploading up to 10 custom packages for the same software title on a team, enabling deployment of different versions or architectures (e.g. Arm vs. Intel) to label-scoped hosts with first-added-wins conflict resolution.
Adds support for Python (.py) script-only software packages as custom packages on macOS and Linux hosts, available via the UI, REST API, and GitOps.
Adds native Splunk HEC log destination for osquery status, result, and audit logs.
Adds support for escrowing disk encryption recovery keys from Linux hosts using TPM-backed full-disk encryption (e.g. Ubuntu 26) via a Fleet-owned snapd recovery key, silently and without end-user prompting.
Enables Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously Fleet Cloud only); gated on the Fleet Premium license tier.
Adds Zorin OS as a recognized Linux platform with platform=zorin, Linux disk-encryption summary support, .deb installs, label platform filter targeting, and CVE matching against Ubuntu LTS OVAL feeds (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04).
Adds CachyOS (Arch-based Linux) as a recognized Linux platform.
Adds vulnerability (CVE) reporting for Android OS versions on the Software > OS page, including Android security patch level folded into the OS version string (e.g. Android 16 (2026-05-01)).
Adds Targeted platforms column and platform filter dropdown to the Policies page.
Adds public IP address to host search, matching both private and public IPs.
Adds support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via Fleet Desktop on macOS 26+ hosts.
Adds UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
Adds certificates list to the host details page for Windows hosts (requires osquery 5.23.1+), showing each certificate's scope (System or User), plus a View certificate modal in Controls > OS settings > Certificates.
Surfaces hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.
Adds enrollment profile URL to the macOS tab in the Add hosts modal, with enrollment type selection (company-owned or BYOD) for MDM users.
Adds support for targeting DDM declarations to the user channel on macOS, and adds the ability to handle DDM assets and additional declaration types.
Adds an Operating systems card to the dashboard when Linux or Android is selected.
Adds installed version and available version columns to the self-service software table on the My device page.
Adds the Applications / Full inventory software filter to Fleet Desktop My device > Software tab for macOS hosts.
Enables Turn off MDM button for offline macOS hosts, queuing the unenroll command for delivery when the device reconnects.
Updated CIS Benchmark policies for Windows 10 Enterprise to align with CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0.
Removes fleetdm/bomutils Docker dependency from fleetctl package --type pkg; Bill of Materials and xar archive are now written in pure Go, removing requirements for Docker, mkbom, or xar.
Windows configuration profiles using a Fleet-proxied SCEP certificate now report Verified only after Fleet observes the issued certificate on the host, and report Failed when the SCEP proxy returns an upstream error or the certificate is missing an hour after delivery.
Restricts SCIM endpoint access to global admin users only.
Rejects empty and whitespace-only enroll secrets when creating or updating teams.

37 details in Everything

└──▷ BREAKING ON UPGRADE

!The microsoft_compliance_partner.proxy_api_key server configuration has been removed; Microsoft Entra conditional access is now gated on the Fleet Premium license tier instead.
!The /api/mdm/microsoft/auth Windows MDM STS endpoint is removed and now returns a 404 (no device ever contacted this endpoint in practice; Windows MDM enrollment via Autopilot, Settings app, and fleetd is unaffected).
!$FLEET_VAR_SCEP_RENEWAL_ID is renamed to $FLEET_VAR_CERTIFICATE_RENEWAL_ID; the legacy name still works but $FLEET_VAR_CERTIFICATE_RENEWAL_ID is the canonical name going forward.

api-docs-9c952da21d7e Aug 5, 2026 · issue 036

Fleet adds database debug endpoints, SCIM object descriptions, and new host/software API fields including CVE metadata and enrollment controls.

API change

Fleet adds database debug endpoints, SCIM object descriptions, and new host/software API fields including CVE metadata and enrollment controls.

+ GET /debug/db/process-list
+ GET /debug/pprof/cmdline

└──▷ TRY IT

Identify long-running or blocking queries on the Fleet database in real time during an incident or performance investigation.

$ curl -s -H "Authorization: Bearer $FLEET_TOKEN" https://fleet.example.com/debug/db/process-list | jq '[.[] | select(.time > 5)]'

Capture a Go CPU or heap pprof profile from the Fleet server for performance analysis.

$ curl -s -H "Authorization: Bearer $FLEET_TOKEN" "https://fleet.example.com/debug/pprof/cmdline"

Adds GET /debug/db/process-list endpoint returning active database queries with fields id, user, host, db, command, time, state, and info.
Adds GET /debug/pprof/cmdline endpoint exposing Go net/http/pprof profiling data — plain text for cmdline, binary pprof profiles for other keys.
Adds waiting_trx_id, waiting_thread, waiting_query, blocking_trx_id, blocking_thread, and blocking_query fields to the database debug response for InnoDB lock contention visibility.
Adds raw SHOW ENGINE INNODB STATUS output (as a JSON string) to the database debug API response.
Adds preserve_host_activity_on_reenrollment field to host configuration, controlling whether activity history is retained when a host re-enrolls.

+11 more show less

Adds end_user_local_account_type field (e.g. "admin") to host/enrollment configuration.
Adds cve_published timestamp field to software vulnerability responses (Fleet Premium only).
Adds cve_description field to software vulnerability responses (Fleet Premium only).
Adds software_title_id field to software API responses.
Adds repository_url field to software package responses.
Adds starts_at field to relevant API responses for time-scoped data.
Adds resolution field to vulnerability/policy responses, providing human-readable remediation instructions.
Adds description field to SCIM User and SCIM Group objects.
Adds fleet_id and team_id fields to software/team association responses, supporting multi-team software mappings.
New endpoint documented: GET /debug/db/process-list
New endpoint documented: GET /debug/pprof/cmdline

16 details in Everything

fleet-v4.89.0 Jul 15, 2026 · issue 017

Fleet 4.89.0 adds policy label targeting, setup experience policy checks, new vulnerability filtering, Google Workspace IdP integration, and more.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.89.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.89.0

└──▷ TRY IT

Filter vulnerable software by CVSS score and known exploit status on a device's self-service software tab — useful for prioritizing critical, actively exploited vulnerabilities.

$ GET /device/{token}/software?min_cvss_score=7.0&exploit=true

Reset a policy's pass/fail results and membership immediately — useful after remediating a widespread misconfiguration before the next scheduled check.

$ POST /api/v1/fleet/policies/42/reset

Adds ability to target policies to hosts using a combination of include and exclude labels.
Adds policy check before installing Windows and Linux setup experience software, skipping installs when the policy already passes to speed up end-user setup.
Changes calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure.
Adds automation runs table to the policy details page showing per-host automation outcomes with filtering, search, and a reset policy action.
Adds per-host activity log entries when policy automations (webhook, tickets, Google Calendar, and Microsoft conditional access) fail or succeed.

+23 more show less

Adds POST /api/v1/fleet/policies/:policy_id/reset endpoint to reset a policy's pass/fail results, clearing counts and membership immediately.
Adds GET /api/v1/fleet/policies/:id/automation_activities endpoint to list automation activities for a policy.
Adds ability to keep Fleet-maintained apps automatically updated, pinned to a specific version or major version, or rolled back to a previously cached version, from the UI and via GitOps (Fleet Premium).
Surfaces .sh script-only software packages on the macOS tab of Controls > Setup experience > Install software, tracked independently from the Linux tab.
Adds setup_experience_platform field on software packages in GitOps YAML for declarative per-platform setup experience selection.
Adds support for pre-install query, post-install script, and uninstall script on script-only packages (.sh and .ps1) via the UI, REST API, and GitOps.
Adds error on the Windows enrollment status page (ESP) when setup experience software fails during automatic enrollment and Cancel setup if software fails is off.
Adds ' Support' as a new default self-service software category.
Adds support for $FLEET_VAR_HOST_* variables in Android configuration profiles and managed app configuration.
Adds automatic resending of Android certificate templates and managed app configurations when IdP variable values change.
Adds support for defining the default Fleet team BYO Apple devices enroll into.
Adds a Google Workspace integration that maps IdP users to hosts, populating IdP host vitals directly from your Google Workspace directory.
Adds an activity feed entry when a user runs a custom Apple or Windows MDM command, visible in global and host activity feeds.
Adds an activity log entry when editing the managed local account setting via the update fleet endpoint or GitOps.
Enables tracking of mobile devices in the hosts online chart with default filtering that excludes mobile platforms.
Starts collecting non-critical CVEs, filtering them out of vulnerability charts by default.
Adds ability to filter vulnerable software by severity (CVSS score) and known exploit status on Fleet Desktop My device > Software tab (Fleet Premium), with min_cvss_score, max_cvss_score, and exploit query parameters added to GET /device/{token}/software.
Adds more filtering options and ability to set default filters for the Vulnerability Exposure chart via GitOps.
Adds support for all IdP variables and host platform in certificate template subject names and SANs.
Adds private network IP blocking to Fleet's HTTP client; loopback and cloud metadata addresses always blocked, RFC 1918 ranges blocked by default, with --allow_private_network_integrations to allow them for on-prem integrations.
Adds s3.carves_cleanup_disabled server setting to skip S3 file carve reconciliation for deployments relying solely on bucket lifecycle policies.
Adds s3.carves_cleanup_max_per_run and s3.carves_cleanup_concurrency server settings to tune S3 carve cleanup throughput.
Adds configurable batch size FLEET_MDM_ANDROID_BATCH_SIZE (default: 1000 hosts) for Android MDM operations to prevent overwhelming the Google Android Management API.

28 details in Everything

└──▷ BREAKING ON UPGRADE

!RFC 1918 and other private network ranges are now blocked by default in Fleet's HTTP client; deployments with on-prem integrations (e.g. EJBCA, Jira, SCEP servers on private networks) must add --allow_private_network_integrations to restore connectivity.

fleet-v4.88.0 Jul 2, 2026 · issue 007

Fleet v4.88.0 adds support for personal (BYOD) Apple MDM enrollment with per-host wipe/lock permission controls.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.88.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.88.0

advisory CVE-2026-41262 Jun 26, 2026 · issue 128

CVE-2026-41262: Cross-Team Policy Data Exposure via Global Policy Read Endpoint (CVSS 4.3, affects < 4.85.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

fleet-v4.87.0 Jun 20, 2026 · release notes

Fleet 4.87 adds Android L/W commands, W in API, GCS IAM auth, Spotlight cmd palette, trace sampler endpoint.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.87.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.87.0

└──▷ TRY IT

Retrieve AB tokens using the new canonical CLI commands.

$ fleetctl get mdm-ab

Adjust trace sampling ratios at runtime for debugging high-cardinality endpoints.

$ PATCH /debug/trace_sampler

Enable GCS IAM authentication for software installer storage using ADC.

yaml

s3_software_installers_gcs_iam_auth: true

Added fleetctl get mdm-ab and fleetctl generate mdm-ab CLI commands to work with the new Apple Business (AB) terminology replacing ABM.
Added /api/v1/fleet/ab_tokens and /api/v1/fleet/mdm/apple/ab_public_key API endpoints for managing Apple Business tokens and keys.
Added mdm.apple_business YAML key in GitOps config to replace the deprecated apple_business_manager key.
Added ability to deploy custom OS update configuration profiles for Apple and Windows hosts.
Added support for issuing Lock, Wipe, and Clear passcode commands to Android hosts via UI or API.

+7 more show less

Added the macos_applications filter for filtering host software lists in the UI and API.
Added continuous_automations_enabled field to GitOps YAML output and config for re-running automations on policy failure.
Added GCS IAM authentication support for software installers and file carving S3 storage, configurable via s3_software_installers_gcs_iam_auth and s3_carves_gcs_iam_auth.
Added route-aware head sampling for OpenTelemetry trace export with configurable ratios for agent firehose endpoints.
Added GET/PATCH /debug/trace_sampler endpoint for adjusting trace sampling ratios at runtime without restart.
Added Spotlight command palette accessible via Command + K or Control + K in the Fleet UI.
Added Self-service categories page (Premium) under Software > Library for managing custom software categories.

12 details in Everything

└──▷ BREAKING ON UPGRADE

!The ABM terminology has been renamed to Apple Business (AB); the /abm_tokens, /mdm/apple/abm_public_key endpoints, and apple_business_manager config keys are deprecated.

fleet-v4.87.0 Jun 20, 2026 · issue 007

Fleet 4.87.0 adds 963 new managed apps, Android MDM commands, Apple Business rebranding, GCS IAM auth, and a command palette.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.87.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.87.0

└──▷ USE IT

Authenticate Fleet's software-installer storage to GCS using workload identity (ADC) instead of managing HMAC keys — useful in GKE or environments with Workload Identity Federation.

yaml

s3_software_installers_gcs_iam_auth: true

Temporarily enable 100% trace sampling on a specific Fleet replica for a debug window without a restart.

$ curl -X PATCH https://fleet.example.com/debug/trace_sampler \
  -H 'Authorization: Bearer <admin-token>' \
  -H 'Content-Type: application/json' \
  -d '{"force_full": true}'

Target a configuration profile to hosts matching a label set while explicitly excluding hosts in a separate label group — combining include and exclude filters in a single profile upload.

$ fleetctl apply -f profile.yaml
# profile.yaml excerpt:
# labels_include_all: ["macOS 14+"]
# labels_exclude_any: ["Exempt from CIS benchmark"]

Adds 236 new Fleet-maintained apps for Windows, including Microsoft Office, PowerShell, PowerToys, Power BI, Git, Node.js, Python 3.13/3.14, PostgreSQL 15–18, Nessus Agent, Bitwarden, and more.
Adds 727 new Fleet-maintained apps for macOS, spanning development, security, productivity, and design tooling.
Supports issuing Lock, Wipe, and Clear Passcode MDM commands to Android hosts; Wipe is available to Fleet Free users for company-owned Android devices.
Enables deploying custom OS update configuration profiles for Apple and Windows hosts.
Adds GCS IAM authentication (via Google Application Default Credentials) for software installers S3 storage, configurable via s3_software_installers_gcs_iam_auth.

+19 more show less

Adds GCS IAM authentication for file carving S3 storage, configurable via s3_carves_gcs_iam_auth.
Supports validating Microsoft Entra v2 access tokens during Windows MDM enrollment for applications created after July 1, 2026.
Renames Apple Business Manager (ABM) to Apple Business (AB) across the API (/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key), GitOps YAML (mdm.apple_business), and CLI (fleetctl get mdm-ab / fleetctl generate mdm-ab); old aliases still work with a deprecation warning.
Adds labels_exclude_any combined filtering with labels_include_all or labels_include_any for MDM configuration profile targeting.
Adds a Continuous option to policy automations that re-runs script and software automations on every subsequent policy failure.
Adds Self-service categories page (Premium) under Software > Library for managing custom categories per fleet.
Adds Install all (n) button per self-service category on the My device page, posting to /device/{token}/software/install_all?category_id=:id.
Adds macos_applications filter for the host software list.
Introduces Fleet Spotlight — a command palette opened with Command+K / Control+K for navigating the Fleet UI.
Adds route-aware head sampling for OpenTelemetry trace export, with configurable ratios via GET/PATCH /debug/trace_sampler at runtime.
Reduces Windows MDM device management poll interval from 1 minute to 8 hours for hosts running fleetd 1.57.0+, with on-demand wake for near-real-time command delivery.
Adds Technician role ability to transfer hosts between fleets (Premium) via the Fleet UI and REST API.
Adds support for configuring an optional SES sender domain.
Adds end-user account type configuration options: standard for a non-admin user or none to skip end-user account creation.
Surfaces continuous_automations_enabled in GitOps YAML (readable and generated by fleetctl generate-gitops).
Hardens in-house iOS app distribution with a per-install token in manifest and package download URLs, valid for 6 hours and bound to the target host.
Adds each platform's percentage of total enrolled hosts to the Hosts enrolled card tooltip on the dashboard.
Rejects Windows MDM configuration profiles that lack at least one supported SyncML top-level element (<Replace>, <Add>, <Exec>, <Atomic>) or contain invalid <LocURI> values at upload time.
Raises the default FLEET_REDIS_HOST_CACHE_TTL from 60s to 180s and removes reverse-index GETs on host-update invalidation, reducing DB reader load and Redis CPU usage.

24 details in Everything

advisory CVE-2026-46371 Jun 11, 2026 · issue 128

CVE-2026-46371: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint (CVSS 6.5, affects <= 4.84.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

fleet-v4.86.0 May 29, 2026 · release notes

Fleet 4.86.0 adds iOS/iPadOS VPP installs, managed app config, CIS benchmark updates, and major dashboard and GitOps expansions.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.86.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.86.0

└──▷ USE IT

Upload custom org logos for light and dark modes via GitOps so brand assets are version-controlled alongside your Fleet config.

yaml

# In your GitOps YAML
org_settings:
  org_logo_path_light_mode: ./assets/logo-light.svg
  org_logo_path_dark_mode: ./assets/logo-dark.svg

Scope a policy to all hosts across all label groups using the new include_all label scope in GitOps.

yaml

# In your policy GitOps YAML
policies:
  - name: Ensure FileVault is enabled
    label_scope: include_all
    query: SELECT 1 FROM filevault_status WHERE status = 'on';

Retrieve MDM commands scoped to a specific host, now that --host is required.

$ fleetctl get mdm-commands --host 6A4C3B2E-1234-5678-ABCD-9F0E1D2C3B4A

Adds automatic rotation of managed local admin account passwords after they have been viewed.
Adds require_all_software_windows setting to cancel the Windows setup experience if any software install fails during Autopilot enrollment, matching existing macOS behavior.
Adds GitOps support for uploading custom org logos via org_logo_path_dark_mode and org_logo_path_light_mode keys in fleetctl gitops; fleetctl generate-gitops exports Fleet-hosted logos as local files.
Supports installing VPP and in-house (.ipa) apps on iOS and iPadOS hosts enrolled via Account-Driven User Enrollment with a Managed Apple Account.
Enables self-service software installs from the My Device page for user-enrolled iOS and iPadOS hosts.

+26 more show less

Enables setup experience software to install automatically on user-enrolled iOS and iPadOS hosts at enrollment.
Provisions a VPP client user per Managed Apple Account on first install, associating VPP licenses to the user rather than the device, supporting Apple's up-to-5-devices-per-user licensing.
Adds managed app configuration for iOS and iPadOS apps (VPP and in-house) with $FLEET_VAR_* substitution, configurable via UI, REST API, and GitOps.
Supports VPP apps purchased from non-US-based Apple Business accounts.
Adds ability to upload a custom organization logo for light and dark modes, hosted by Fleet, with SVG support and server-side sanitization.
Adds include_all label scope to policies, and include_all and include_any label scopes to reports, with GitOps and fleetctl support.
Adds a Custom target dropdown when creating or updating reports under the premium tier, with an Include all option on Policies for premium users.
Adds support for setting gitops_mode_enabled and repository_url via GitOps.
Adds output to GitOps runs for scripts, showing how many scripts would be applied (dry run) or were applied.
Adds activity entries for retried software installs and script runs from policy automations.
Adds activities when hosts fail enrollment profile renewal.
Adds created_label, edited_label, and deleted_label activity entries when users create, edit, or delete labels.
Adds Hosts online, Hosts enrolled, and Vulnerability exposure charts to the dashboard.
Adds an option to convert and return a PEM-encoded X.509 certificate instead of a PEM-encoded PKCS7 envelope from the Request a Certificate endpoint.
Releases fleetctl as a pkg for macOS and as an msi for Windows.
Enables wiping a host to cancel all of its upcoming activities.
Adds ability to download and view the applied default automatic enrollment profile.
Updates OS version reporting for iOS and iPadOS to include the Rapid Security Response suffix (e.g. (a)).
Requires the --host flag for fleetctl get mdm-commands.
Adds macOS 26 CIS Benchmark v1.0.0.
Updates CIS Windows 11 Enterprise benchmark policies from v4.0.0 to v5.0.1, adding 17 new L1 policies and updating 42 existing policy titles.
Surfaces hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command.
Adds support for the subject_alternative_name field on Android certificate templates.
Optimizes OSV vulnerability scanning to query distinct software per OS version rather than per host.
Adds a Redis-backed cache for host lookups on osquery and orbit authentication paths, reducing reader-side DB load at scale.
Adds the orbit.debug_logging_on_enroll_duration agent option to enable orbit debug logging for a specified time period after enrollment.

31 details in Everything

└──▷ BREAKING ON UPGRADE

!The --host flag is now required for fleetctl get mdm-commands; invocations without it will fail.
!The Redis-backed host lookup cache requires Redis 6.2 or later; deployments on older Redis versions are not supported.

fleet-v4.85.0 May 14, 2026 · release notes

Fleet 4.85.0 adds dark theme, Clear Passcode for iOS/iPadOS, API-only user management, DDM variable support, and new dashboard charts.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.85.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.85.0

└──▷ USE IT

Force a fresh download of a software package in GitOps regardless of whether the remote content has changed — useful when a URL serves a new binary under the same name.

yaml

# In your GitOps software YAML:
software:
  - name: MyApp
    url: https://example.com/myapp.pkg
    always_download: true

Provision an API-only user via the new REST endpoint and immediately inspect their assigned endpoint permissions.

$ curl -X POST https://fleet.example.com/api/_version_/fleet/users/api_only \
  -H "Authorization: Bearer $FLEET_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-bot", "global_role": "observer"}'

curl https://fleet.example.com/api/_version_/fleet/users/<id> \
  -H "Authorization: Bearer $FLEET_TOKEN"

Adds dark theme to the Fleet UI, selectable per-account with light, dark, and system options.
Implements Clear Passcode feature for iOS and iPadOS devices.
Adds support for Fleet variables in Apple DDM (declaration profile) configurations.
Supports passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, eliminating double-authentication prompts when EUA is enabled.
Switches to Docker as the default WiX runtime on macOS (including Apple Silicon) for generating .msi packages via fleetctl package, removing the Wine requirement.

+22 more show less

Adds new UI pages for creating and editing API-only users with fleet assignment, role selection, and per-user API endpoint access control.
Adds POST /users/api_only endpoint for creating API-only users.
Adds PATCH /users/api_only/{id} endpoint for updating existing API-only users.
Adds new middleware (APIOnlyEndpointCheck) that enforces a 403 response for API-only users accessing endpoints outside their configured restrictions.
Adds premium GET /api/_version_/fleet/rest_api endpoint returning the embedded api_endpoints.yml artifact.
Updates GET /users/{id} response to include the new api_endpoints field for API-only users.
Adds user_api_endpoints table to track per-user API endpoint permissions.
Updates fleetctl user create --api-only to remove email and password field requirements.
Adds conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed.
Adds always_download option for software in GitOps to bypass conditional download behavior.
Adds automatic escaping of JSON special characters in GitOps variables used in .json configuration profiles (Apple DDM declarations and Android profiles).
Adds Hosts online, Vulnerability exposure, and Hosts enrolled charts to the Fleet dashboard.
Adds an admin setting to control retention of vulnerability-exposure data used by the dashboard chart.
Adds a new policy details page with a read-only view of policy information.
Adds dedicated /policies/:id/live route for running policies.
Enables renewing and deleting AB tokens in the UI while in GitOps mode.
Adds ability to save policies whose SQL is flagged as a syntax error.
Withholds Android Wi-Fi configuration profiles (openNetworkConfiguration with ClientCertKeyPairAlias) until the referenced certificate is installed or terminally failed on the device.
Updates the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency.
Switches Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests, with automatic fallback to GitHub.
Updates macOS 15 CIS benchmark to include v2.0.0 changes and macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0.
Updates fleetctl gitops to process Android certificates before Android profiles.

27 details in Everything

└──▷ BREAKING ON UPGRADE

!Fleet names must now differ by more than letter case across UI, API, and GitOps paths; conflicts that were previously allowed now return a 409 error on all code paths.
!Prometheus serving is no longer enabled by default with a hard-coded username and password when the server is started with --dev.

advisory CVE-2026-46356 May 13, 2026 · issue 128

CVE-2026-46356: IP spoofing allows bypassing API rate limiting (CVSS 7.5, affects < 4.80.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-26191 May 13, 2026 · issue 128

CVE-2026-26191: OS command injection in software packages (CVSS 9.8, affects < 4.81.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

fleet-v4.84.0 Apr 25, 2026 · release notes

Fleet 4.84.0 adds Entra conditional access for Windows, ACME/hardware attestation, new vulnerability sources, and a host query-reports API.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.84.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.84.0

└──▷ TRY IT

Fetch all query reports associated with a specific host to review scheduled query results without navigating the UI.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<fleet-host>/api/v1/fleet/hosts/<id>/reports'

Pin a Fleet-maintained app to a specific major version in a GitOps manifest to control update cadence.

yaml

# gitops/teams/my-team.yml
software:
  fleet_maintained_apps:
    - name: "1Password"
      major_version: "8"

Adds Entra conditional access support for Windows devices.
Implements ACME for MDM protocol communication and hardware device attestation.
New GET /api/v1/fleet/hosts/{id}/reports endpoint (also at /hosts/{id}/queries) lists query reports for a specific host.
Adds vulnerability detection for Microsoft 365 Apps and Office products on Windows.
Adds OSV data source for Ubuntu vulnerability scanning.

+26 more show less

Adds automatic rotation of Mac recovery lock passwords 1 hour after the password is viewed via the API.
Adds ability to pin Fleet-maintained apps to a specific major version in GitOps.
Adds support for labels_include_all conditional scoping for software installers and apps.
Adds ability to specify a custom patch policy query in a Fleet-Maintained App (FMA) manifest.
Adds support for running Python scripts on macOS and Linux.
Adds a new disk_space fleetd table for macOS reporting available disk space including purgeable storage.
Adds configuration profile deletion via SyncML <Delete> commands when a Windows profile is removed or a host changes teams, bringing Windows to parity with macOS.
Adds support for outputting VPP policy automations in fleetctl generate-gitops.
Adds a Reports tab to the Host details page.
Adds activity logging when a certificate is installed or fails on an Android host.
Enables the host activity card on the Android host details page.
Adds ability to re-send Android certificates to a specific host.
Adds FLEET_MDM_CERTIFICATE_PROFILES_LIMIT server config option to throttle CA certificate profile installations per reconciler cycle.
Adds automatic retry (up to 3 times) for Android agent certificate install failures; increases Apple configuration profile retry limit from 1 to 3.
Enables Windows MDM in fleetctl preview by auto-generating WSTEP certificates on startup.
Allows specifying a Fleet-Maintained App (FMA) as a policy software automation in GitOps.
Allows clearing Windows OS update deadline and grace period fields to remove enforcement.
Increases the default SSO session validity period from 5 to 15 minutes.
Allows OTEL service name to be overridden with the standard OTEL_SERVICE_NAME environment variable.
Updates GitOps label functionality so omitting the hosts: key under a manual label preserves existing host membership instead of removing all hosts.
Adds Flatcar Container Linux and CoreOS to recognized Linux platforms.
Switches Fleet-maintained apps serving location to https://maintained-apps.fleetdm.com/manifests.
Upped the default limit for the software batch endpoint from 1 MiB to 25 MiB.
Renames Custom settings to Configuration profiles in the Fleet UI.
Adds indication in the UI when a profile command was deferred via NotNow status.
Adds support for JetBrains software with 2-part version numbers (e.g., WebStorm 2025.1) in CVE ingestion logic.

31 details in Everything

└──▷ BREAKING ON UPGRADE

!Fleet-maintained apps are now served from https://maintained-apps.fleetdm.com/manifests instead of GitHub — if you restrict outbound Fleet server traffic, you must allow access to this new URL.
!The incorrect report key has been removed from get/create/modify API responses.

fleet-v4.83.0 Apr 1, 2026 · release notes

Fleet 4.83.0 adds Android web app deployment, Mac recovery lock rotation, NDES CA support, and sweeping GitOps improvements.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.83.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.83.0

└──▷ TRY IT

Bootstrap a new GitOps repository structure without manually creating the folder layout.

$ fleetctl new

Reference a PowerShell script directly as a software package installer in a GitOps file, avoiding the need to embed the script inline.

yaml

software:
  packages:
    - path: ./installers/deploy-agent.ps1

Use glob patterns to apply all configuration profiles in a directory without listing each file individually.

yaml

configuration_profiles:
  - path: ./profiles/*.mobileconfig

Adds ability to deploy an Android web app via setup experience or self-service.
Adds ability to set and manually rotate Mac recovery lock passwords.
Adds ability to lock pre-filled user information for macOS hosts that log in via End User Authentication during Setup Experience.
Adds automatic retries for failed software installs (excluding VPP apps).
Adds retry functionality when adding software installers to Fleet via GitOps.

+17 more show less

Adds fleetctl new command to initialize a GitOps folder.
Adds support for paths: key under reports:, labels:, and policies: in GitOps files.
Adds glob support for configuration_profiles in GitOps files.
Adds support for referencing .sh or .ps1 script files directly in the GitOps path field for software packages.
Implements webhooks_and_tickets_enabled flag for policies in GitOps.
Adds server config for allowing all Apple MDM declaration types.
Adds ability to use FLEET_JIT_USER_ROLE_FLEET_ as a prefix on SAML attributes for just-in-time role assignment.
Adds fleet_name and fleet_id columns to hosts CSV export.
Adds resend button in the OS settings modal for iOS and iPadOS hosts.
Adds patch policies for Fleet-maintained apps that automatically update when the app is updated.
Adds support for NDES CA for Windows hosts.
Adds vulnerability scanning support for Windows Server 2025 hosts.
Adds OTEL instrumentation to Fleet's internal HTTP client.
Adds ability to omit secrets: in GitOps files to retain existing enroll secrets on the server.
Adds APNs expiry banner in the UI for Fleet free users.
Optimizes api/latest/fleet/software/titles endpoint.
Improves Windows profile verification to no longer rely on osquery for faster verification.

22 details in Everything

└──▷ BREAKING ON UPGRADE

!GitOps runs now fail when unknown keys are detected in files.
!Configuration key custom_settings is deprecated in favor of configuration_profiles.
!Configuration key macos_settings is deprecated in favor of apple_settings.
!Configuration key macos_setup is deprecated in favor of setup_experience.
!Configuration key macos_setup_assistant is deprecated in favor of apple_setup_assistant.
!setup_experience.bootstrap_package is deprecated in favor of setup_experience.macos_bootstrap_package.
!setup_experience.manual_agent_install is deprecated in favor of setup_experience.macos_manual_agent_install.
!setup_experience.enable_release_device_manually is deprecated in favor of setup_experience.apple_enable_release_device_manually.
!setup_experience.script is deprecated in favor of setup_experience.macos_script.

advisory CVE-2026-34391 Mar 27, 2026 · issue 128

CVE-2026-34391: Windows MDM cross-device command disclosure (CVSS 7.5, affects < 4.81.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-34388 Mar 27, 2026 · issue 128

CVE-2026-34388: Denial of Service via unhandled gRPC log type in launcher endpoint (CVSS 7.5, affects < 4.81.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-29180 Mar 27, 2026 · issue 128

CVE-2026-29180: Team maintainer can transfer hosts from any team via missing source team authorization (CVSS 8.8, affects < 4.81.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-34386 Mar 27, 2026 · issue 128

CVE-2026-34386: SQL injection in MDM bootstrap package by authenticated team or global admin (CVSS 8.8, affects < 4.81.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

advisory CVE-2026-34385 Mar 27, 2026 · issue 128

CVE-2026-34385: Second-order SQL injection in Fleet's Apple MDM profile delivery can compromise the database (CVSS 8.1, affects < 4.81.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

fleet-v4.81.3 Mar 21, 2026 · release notes

Adds configurable body size limits for osquery log and distributed write endpoints to prevent PayloadTooLargeError

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.81.3 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.81.3

4.81.3 Mar 20, 2026 · release notes

Fleet 4.81.3 adds configurable body size limits for osquery API endpoints.

└──▷ GET THIS VERSION

$ git clone --branch 4.81.3 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.81.3

fleet-v4.82.0 Mar 12, 2026 · release notes

Fleet 4.82.0 adds Android fully-managed enrollment, a new Technician role, kernel vuln scanning on RHEL, and app rollback.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.82.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.82.0

└──▷ USE IT

Export Fleet server logs to an OpenTelemetry collector for centralized observability of your Fleet deployment.

yaml

logging:
  otel_logs_enabled: true

Supports enrolling fully managed Android hosts without a work profile.
Adds automatic uninstall of Android apps on device (and removal from self-service in managed Google Play) when an app is removed from Fleet.
Adds per-policy control to allow or disallow end-users to bypass conditional access.
Adds filtering by platform and status in the Software > Add Fleet-maintained apps table.
Adds ability to roll back to previously added versions of Fleet-maintained apps.

+15 more show less

Introduces new Technician role for help desk and IT support teams, with permissions to run scripts, view results, and install or uninstall software.
Supports JIT provisioning of the Technician role via SSO SAML attributes.
Adds automatic retries for failed software operations.
Enables scanning for kernel vulnerabilities on RHEL-based hosts.
Adds AWS GovCloud RDS CA certificates to the RDS MySQL TLS bundle, enabling IAM authentication for Fleet deployments in us-gov-east-1 and us-gov-west-1.
Adds CVE alias support for the Python Visual Studio Code extension.
Adds a new activity log entry for edited enroll secrets.
Adds configurable body size limits for the /api/osquery/log and /api/osquery/distributed/write endpoints.
Adds logging.otel_logs_enabled config option to export server logs to OpenTelemetry.
Adds ability to enable or disable logs by topic.
Adds ability to specify allowed Entra tenant IDs for enrollments.
Increases maximum script execution timeout from 1 hour (3600 seconds) to 5 hours (18000 seconds).
Adds team_id to host details page URL parameter to retain team context on refresh.
Supports adding and removing multiple Microsoft Entra tenant IDs in the UI.
Surfaces Fleet-maintained app (FMA) version and out-of-date status in the UI.

20 details in Everything

└──▷ BREAKING ON UPGRADE

!Teams and queries are renamed to fleets and reports in the UI, API, CLI, and GitOps — consumers of these API fields or GitOps keys must update to the new names.
!Certain API field names are deprecated to reflect the renaming of teams to fleets and queries to reports.
!no-team.yml in GitOps is deprecated in favor of unassigned.yml — GitOps configurations using no-team.yml should migrate to unassigned.yml.

fleet-v4.81.1 Mar 3, 2026 · release notes

Fleet v4.81.1 adds configurable allowed Entra tenant IDs for enrollments and moves UI auth token from local storage to cookie.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.81.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.81.1

Added CTA to turn on Android MDM for Android software setup experience if MDM is not configured
Updated UI to enable adding/removing multiple Microsoft Entra tenant ids.
Updated storage of the auth token used in the UI; move if from local storage to a cookie.

3 details in Everything

fleet-v4.81.0 Feb 20, 2026 · release notes

Fleet 4.81.0 adds dynamic SCEP/Okta cert support, non-atomic Windows MDM profiles, configurable software installer size up to 10 GiB, and gzip API responses.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.81.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.81.0

└──▷ USE IT

Enable gzip compression on Fleet API responses to reduce bandwidth for large payloads from monitoring or automation clients.

yaml

gzip_responses: true

Check whether a specific custom software package already exists before uploading, to avoid duplicates in automation pipelines.

$ curl -s 'https://fleet.example.com/api/v1/fleet/software/titles?team_id=3&hash_sha256=<sha256>&package_name=<package_name>' -H 'Authorization: Bearer <token>'

Inspect approximate row counts for all database tables immediately after running a Fleet migration to validate schema changes.

$ fleetctl prepare db --with-table-sizes

Adds support for dynamic SCEP challenges for Okta certificates.
Adds conditional_access.cert_serial_format server option to specify the Okta conditional access certificate serial format.
Adds ability for IT admins to specify non-atomic Windows MDM profiles.
Adds GitOps support to apply display_name to software packages in fleet YAML.
Adds enrollment support for iPod touch.

+14 more show less

Adds hash_sha256 and package_name query parameters to GET /api/v1/fleet/software/titles to check if a custom software package already exists before uploading (requires team_id).
Adds ability to set a default URL for Fleet Desktop.
Makes maximum software installer size configurable; bumps the default from 3 GB to 10 GiB.
Adds gzip_responses server configuration option to enable gzip compression of API responses when the client sends Accept-Encoding: gzip.
Allows specifying an Apple Connect JWT for interacting directly with Apple APIs when retrieving VPP app metadata.
Redirects users to the device policy page when failing conditional access requirements.
Limits disk encryption key escrowing to when the global or team setting is enabled.
Adds --with-table-sizes option to the prepare command to get approximate row counts of all database tables after a migration completes.
Updates fleetctl generate-gitops to output Fleet-maintained apps in a dedicated fleet_maintained_apps section of YAML files.
Clears user sessions and password reset tokens whenever a user's password is changed.
Adds separate OpenTelemetry metrics for client vs. server errors (fleet.http.client_errors, fleet.http.server_errors) with error type attribution.
Adds logic to skip setup experience for hosts enrolled more than 1 day ago.
Adds a check to fail pending in-house app installs and cancel upcoming activities when unenrolling a host.
Disallows use of FLEET_DEV_* environment variables unless --dev is passed when serving Fleet.

19 details in Everything

fleet-v4.80.1 Feb 6, 2026 · release notes

Adds FLEET_SERVER_TRUSTED_PROXIES config key and fixes fleetctl generate-gitops panic.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.80.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.80.1

Adds the FLEET_SERVER_TRUSTED_PROXIES configuration environment variable to control trusted proxy headers.

1 detail in Everything

fleet-v4.80.0 Feb 3, 2026 · release notes

Fleet 4.80.0 adds NATS logging, iOS/iPadOS VPP auto-update scheduling, automatic MDM unenrollment app removal, and macOS binary hash ingestion.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.80.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.80.0

Adds NATS as a logging destination for Fleet server events.
Adds ability to automatically uninstall managed apps when iOS/iPadOS devices are unenrolled from MDM.
Adds scheduled automated software updates for iOS/iPadOS VPP apps via the Fleet admin UI and API.
Adds API support to get and set auto-update schedules for VPP apps.
Adds custom VPP apps to the available VPP apps listing.

+8 more show less

Ingests, persists, and serves the SHA-256 hash and path for CFBundleExecutable binaries of .app bundles on macOS.
Updates NDES SCEP proxy to auto-detect response encoding, enabling compatibility with Okta CA and other UTF-8-based CAs.
Adds support for in-house apps to use CloudFront signed URLs in their manifest when CloudFront is configured.
Surfaces Queries within the Details tab on the Host Details page.
Updates software version search to include results matching the software title name in addition to the version name.
Limits software ingestion for manually-enrolled (BYOD) iPhone/iPad devices to Fleet-installed software only.
Omits software last_opened_at in API responses when the data source does not support it.
Script and software installer policy automations now retry up to three times on failure.

13 details in Everything

fleet-v4.79.0 Jan 14, 2026 · release notes

Fleet 4.79.0 adds Android MDM management, team-specific labels, Windows SCEP renewal, and ADE OS-update enforcement.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.79.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.79.0

└──▷ TRY IT

Retrieve paginated MDM command history for auditing or review — the endpoint now returns pagination metadata alongside results.

$ curl -s -H "Authorization: Bearer <token>" \
  'https://<fleet-url>/api/latest/fleet/mdm/commands?page=0&per_page=25'

Adds ability to view past and upcoming MDM commands for a host in the Fleet UI.
Adds support for applying Android app configurations.
Adds support for resending Windows MDM profiles.
Adds support for renewal of custom SCEP profiles for Windows.
Adds team-specific labels, creatable via spec endpoints and GitOps.

+9 more show less

Adds ability to create, list, and delete Android certificates from the UI.
Adds Android agent application (auto-deployed via Android MDM) to support automated SCEP certificate installation on Android hosts.
Adds ability to indicate that new macOS hosts enrolling via ADE should be updated to the latest OS version.
Adds ability to edit Android software configuration in the UI.
Adds support for ingesting Windows certificates via osquery.
Adds audit activities for certificate template creation and deletion.
Implements streaming for the GET /hosts API to improve performance at scale.
Adds pagination metadata to the GET /mdm/commands endpoint.
Adds ability to search teams in the dropdown when transferring hosts between teams.

14 details in Everything

fleet-v4.78.0 Dec 19, 2025 · release notes

Fleet 4.78.0 adds Android setup experience, Windows manual MDM enrollment, Okta conditional access UI, and certificate template GitOps support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.78.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.78.0

└──▷ HOW TO FIND IT

Set up Okta conditional access integration so that Fleet can gate resource access based on device compliance status.

📍In the Fleet UI, go to Settings -> Integrations -> Conditional access and configure your Okta conditional access settings.

Adds Android setup experience software installation support.
Adds Android self-service app support to fleetctl gitops.
Adds Android systemUpdate profile support.
Adds ability to create, view, and delete Google Play Store software for Android in the UI.
Adds $FLEET_VAR_HOST_PLATFORM variable for Apple platforms (macos, ios, ipados) in profiles.

+15 more show less

Adds support for installing setup-experience VPP apps on manually-enrolled iOS/iPadOS devices.
Adds ability to deploy user-scoped SCEP profiles for Windows hosts.
Adds configuration option to require Windows users enroll into MDM manually via work or school account rather than automatic enrollment.
Adds UI to allow Windows hosts to manually enroll into Fleet MDM.
Adds support for $FLEET_VAR_HOST_HARDWARE_SERIAL and $FLEET_VAR_HOST_PLATFORM variables in Windows profiles.
Adds activity filtering on the Fleet dashboard page.
Adds Okta conditional access configuration to Fleet UI under Settings -> Integrations -> Conditional access.
Adds endpoint for hosts to update certificate status.
Adds detail column to host_certificate_template table and certificate_templates property with GitOps support.
Adds MDM-enrolled Android devices receiving certificate templates via managedConfigurations.
Makes host_count property optional in GET /labels API endpoints, improving performance for large label queries.
Allows users to save Fleet queries even when SQL is flagged as invalid by the Fleet UI.
Returns pre-install query output in the Install Details modal.
Translates idp to mdm_idp_accounts on API responses.
Adds Mosyle to the list of well-known MDM platforms.

20 details in Everything

└──▷ BREAKING ON UPGRADE

!Fleet is no longer verified to work with Redis 5 or below; configurations referencing Redis 5 have been switched to Redis 6. Deployments using Redis 5 or earlier must upgrade Redis before upgrading Fleet.
!The idp field in API responses is now returned as mdm_idp_accounts; any integrations parsing the idp key from API responses will need to be updated.

fleet-v4.77.0 Dec 2, 2025 · release notes

Fleet 4.77.0 adds JetBrains plugin vuln detection, Custom EST/SCEP CA support, iOS self-service IPA apps, and BYOD macOS auth improvements.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.77.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.77.0

└──▷ HOW TO FIND IT

Configure a Custom EST certificate authority so Fleet can issue certificates through your internal PKI.

📍In the Fleet UI, go to Settings › Integrations and add a Custom EST certificate authority with your EST server URL and credentials.

Detects vulnerabilities in JetBrains IDE plugins.
Adds activity log entries for host deletion, host expiration, and updating or deleting host IdP mappings.
Updates MDM enrollment flow for BYOD macOS hosts to require end-user authentication before downloading the MDM profile via the My device page.
Adds self-service install support for custom IPA apps on iOS and iPadOS.
Adds support for in-house (.ipa) apps to fleetctl gitops.

+9 more show less

Adds support for Custom EST certificate authorities.
Adds ability to deploy certificates from Custom SCEP certificate authorities on Windows.
Updates POST /setup_experience/script endpoint to allow updating the macOS setup experience script in-place (GitOps no longer calls DELETE).
Adds status counts to batch script detail page tabs.
Adds ingestion of upgrade_codes from Windows software, exposed via all relevant software endpoints.
Adds experimental FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT configuration to deploy custom OS settings including FileVault payloads and macOS/Windows update settings.
Adds ability to change software display names in the UI.
Moves end-user authentication SSO settings under Integrations > SSO in global settings.
Adds InstallAnywhere as a recognized self-extracting archive for PE metadata extraction.

14 details in Everything

fleet-v4.76.0 Nov 8, 2025 · release notes

Fleet 4.76.0 adds Android software inventory, npm/JetBrains/VSCode-fork vulnerability detection, iOS lost mode, and more.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.76.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.76.0

└──▷ HOW TO FIND IT

Lock a lost iOS or iPadOS device into lost mode directly from the Fleet UI.

📍In the Fleet console, navigate to a host's details page for an iOS or iPadOS device, then select Actions › Lock device to enable lost mode.

Adds software inventory support for Android hosts.
Adds npm package discovery and vulnerability matching for macOS and Linux hosts.
Adds JetBrains IDE inventory and vulnerability detection for JetBrains plugins on hosts.
Adds software inventory support for VSCode fork extensions: Cursor, Windsurf, VSCodium, VSCodium Insiders, and Trae.
Adds Santa tables to fleetd.

+9 more show less

Enables software installation for iOS and iPadOS hosts during the setup experience.
Enables specifying VPP apps for automatic installation during ADE iOS and iPadOS enrollment.
Adds the ability to lock iOS and iPadOS devices via lost mode, including UI support for locking and unlocking.
Adds a configuration option to halt macOS setup experience if any software install fails.
Adds gigs_all_disk_space vital collection, storage, and UI rendering for Linux hosts.
Adds a new server config flag to specify the cleanup age for completed distributed targets, improving live query response times.
Adds idp source support to the device mapping API for manually setting IDP user mappings.
Enables testing new or edited policy queries via live query while in GitOps Mode.
Improves performance of /api/latest/fleet/os_versions, /api/latest/fleet/vulnerabilities, and /api/latest/fleet/software/versions endpoints.

14 details in Everything

└──▷ BREAKING ON UPGRADE

!browser is deprecated in favor of extension_for in API responses and JSON/YAML outputs.
!The default name of Host Identity CA is changed to Fleet Host Identity CA, which may conflict with existing configurations referencing the previous default name.
!The platform field is cleared on all built-in labels via a migration, which may affect queries or workflows that relied on that field being set.

fleet-v4.75.0 Oct 17, 2025 · release notes

Fleet 4.75.0 adds Smallstep CA, Arch Linux support, Android config profiles, Santa osquery tables, and IdP-driven labels for iOS/iPadOS.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.75.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.75.0

└──▷ TRY IT

Query the new Santa tables to audit allowed and denied binaries on macOS hosts.

$ SELECT * FROM santa_denied;

Adds support for Smallstep certificate authority integration.
Adds santa_allowed, santa_denied, and santa_status osquery tables via Fleet's built-in Santa extension.
Adds false-positive filtering for Linux vulnerability scanning.
Adds support for Arch Linux hosts, including software inventory ingestion.
Adds fleetctl support to generate fleetd installers for Arch Linux (.pkg.tar.zst format).

+14 more show less

Adds configuration profile support for Android hosts, with activity logging for profile creation, modification, and deletion.
Adds support for software installation during Windows setup experience.
Adds ability to read server private_key from AWS Secrets Manager.
Adds support for vulnerabilities feed CPE translation JSON to override the sw_edition field.
Adds ability to specify a Fleet host ID when declaring a manual label in a GitOps YAML file.
Adds a dedicated labels management page with table and UI integrations.
Adds OpenTelemetry instrumentation to scheduled jobs and several API endpoints.
Adds ability to unenroll personal iOS/iPadOS devices from Fleet.
Adds support for assigning host labels based on IdP attributes for iOS and iPadOS hosts.
Adds ability to turn off MDM for iOS and iPadOS devices when the refetcher returns a device token as inactive.
Adds support for hosts enrolled with Company Portal using the legacy SSO extension for Entra conditional access.
Updates DEB and RPM packages generated by fleetctl package to be safe to upgrade in-band through the Software page.
Adds count to list host certificates API response.
Adds new rate limiting for Fleet Desktop API endpoints to support large deployments behind NAT.

19 details in Everything

└──▷ BREAKING ON UPGRADE

!If you deploy a custom Santa osquery extension (e.g., Trail of Bits) with tables named exactly santa_allowed, santa_denied, or santa_status, Fleet's agent will crash on upgrade. You must uninstall the custom extension before upgrading.

fleet-v4.74.0 Oct 6, 2025 · release notes

Fleet 4.74.0 adds Hydrant CA support, Linux setup experience, batch MDM profile APIs, and AWS IAM auth for RDS/ElastiCache.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.74.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.74.0

└──▷ USE IT

Scope a Fleet Maintained App's setup experience and self-service settings at the team level in a GitOps YAML file.

yaml

# teams/my-team.yml
software:
  packages:
    - url: https://example.com/app.pkg
      self_service: true
      labels_include_any:
        - Engineering
      setup_experience: true
      categories:
        - Productivity

Adds Hydrant as a supported Certificate Authority, plus an experimental API to request certificates from Hydrant.
Adds POST /api/v1/fleet/configuration_profiles/batch endpoint to batch-modify MDM configuration profiles.
Adds /batch/{batch_execution_id}/host-results endpoint to list hosts targeted in a batch execution.
Adds new UI page for batch script run details, with improved sorting by started/finished date.
Adds AWS RDS (MySQL) IAM authentication support.

+17 more show less

Adds AWS ElastiCache (Redis) IAM authentication support.
Adds support for hosts enrolled with Company Portal using the legacy SSO extension for Entra conditional access.
Adds setup experience software items for Linux devices, including new device and admin API endpoints (POST /api/fleet/orbit/setup_experience/init, POST /api/v1/fleet/device/{token}/setup_experience/status).
Extends PUT /api/v1/fleet/setup_experience/software and GET /api/v1/fleet/setup_experience/software with a platform argument supporting linux or macos.
Adds ability to upload custom software icons.
Adds IdP fullname attribute as a valid Fleet variable for Apple configuration profiles.
Adds username of the managed user account for user-scoped profiles on macOS host details.
Enables webhook and Jira/Zendesk ticket policy automations for No team.
Adds support for writing multiple packages in a single GitOps YAML file under software.packages.
Moves self_service, labels_include_any, labels_exclude_any, categories, and setup_experience declarations to team level for software in GitOps; setup_experience can now be set on packages, Fleet Maintained Apps, or App Store apps.
Adds a Fleet-maintained app for macOS: Omnissa Horizon Client.
Adds opening instructions to self-service macOS apps and Windows programs.
Adds FLEET_SECRET variable guard to disallow secrets in Apple configuration profile <PayloadDisplayName> fields.
Adds OpenTelemetry tracing to async tasks (host seen, labels, policies, query stats) with gzip compression and improved HTTP span naming.
Improves performance for YARA rules when modifying config with large rule sets or when large numbers of hosts fetch rules.
Updates fleetctl get mdm-command-results to display output in a vertical format instead of a table.
Adds database index to distributed_query_campaign_targets to speed up live query performance, with automatic cleanup of targets 24 hours after campaign completion.

22 details in Everything

└──▷ BREAKING ON UPGRADE

!Software YAML structure has breaking changes: self_service, labels_include_any, labels_exclude_any, categories, and setup_experience declarations have moved to team level; migration is required (see the linked migration document).

fleet-v4.73.0 Sep 9, 2025 · release notes

Fleet 4.73.0 adds batch script scheduling, secret variable APIs, CVSS filtering, and TPM PIN enforcement detection.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.73.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.73.0

└──▷ HOW TO FIND IT

Filter the software inventory to high-severity vulnerabilities before a patch cycle.

📍In the Fleet UI, go to Software › (Host or Team) › filter by Min CVSS score and Max CVSS score to narrow the list to the severity range you care about.

Schedule a batch script run in advance and monitor progress without cluttering the global activity feed.

📍In the Fleet UI, go to Controls › Scripts › Batch progress, then open Run scripts, select a script and a future run time to schedule it. Monitor started, scheduled, and finished runs under the Batch progress tab.

New detail query detects whether a BitLocker PIN protector is set, executed only when TPM PIN enforcement is required.
Automatic host identity certificate renewal for TPM-backed certificates on Linux: orbit renews certificates within 180 days of expiration using proof-of-possession.
New global activity event logged when a disk encryption key is escrowed.
Adds issuer and issued cells to the host details and My Device page certificates table.
Enables filtering host and team software by minimum and maximum CVSS score in the Fleet UI.

+16 more show less

Displays kernel vulnerabilities on the operating system details page for Linux systems.
Updates macOS CIS policies: macOS 13 to CIS Benchmark v3.1.0, macOS 14 to v2.1.0, macOS 15 to v1.1.0.
Fleet certificate ingestion now accepts non-standard country codes longer than 2 characters and truncates other oversized fields instead of failing.
New API endpoints to add, delete, and list secret variables; custom variables can also be managed in the UI.
New API endpoints to get and list batch scripts, with a cron job to launch scheduled batch script runs.
New API endpoint to cancel a scheduled batch script run; cancellation also available directly from the UI summary modal.
Ability to schedule batch script runs in advance from the Run scripts modal.
Hosts list can now be filtered to those incompatible with a script in a batch run.
New side navigation on Controls > Scripts page with a Library tab and a new Batch progress tab showing started, scheduled, and finished scripts.
Batch execution IDs added to script run activities.
IdP SSO authentication added to BYOD mobile device enrollment when enabled for the team.
GitOps now supports overriding install/uninstall scripts and specifying pre-install queries and post-install scripts for Fleet-maintained apps.
Adds support for $FLEET_VAR_HOST_UUID variable in Windows MDM configuration profiles.
Adds last-opened time tracking for Linux software (DEB & RPM packages), plus an indication when software was never opened vs. unsupported type.
Automatic install policies are now included in host software responses.
Updates fleetctl api to support sending data in the body of non-GET requests using the -F flag.

21 details in Everything

└──▷ BREAKING ON UPGRADE

!PUT /api/v1/fleet/spec/secret_variables now only accepts secret variable names containing uppercase letters, numbers, and underscores.
!DEB and RPM fleetd packages previously uploaded to the Fleet Software page for in-band upgrades must be re-generated with fleetctl v4.73.0 and re-uploaded before use, because pre-removal scripts in older packages stop Orbit unconditionally on upgrade.

fleet-v4.72.0 Aug 13, 2025 · release notes

Fleet 4.72.0 adds TPM-backed host identity via SCEP, Apple Account Driven User Enrollment, MS-MDE2 v7.0, and new Fleet-maintained macOS apps.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.72.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.72.0

└──▷ USE IT

Restrict SSO logins to a dedicated admin URL so agent and API traffic uses a separate endpoint, preventing authentication errors in dual-URL SSO configurations.

yaml

sso_server_url: https://admin.fleet.example.com

Adds support for issuing host identity certificates via SCEP (Simple Certificate Enrollment Protocol), enabling fleetd to use TPM 2.0 hardware to cryptographically sign all HTTP requests.
Adds --fleet-managed-host-identity-certificate flag to generate fleetd packages for Linux that use TPMs to sign HTTP requests.
Adds sso_server_url configuration option to support SSO setups with separate URLs for admin access vs. agent/API access.
Adds support for Apple Account Driven User Enrollment for iOS/iPadOS when end-user authentication is configured.
Adds support for MS-MDE2 v7.0 Windows MDM Enrollments.

+8 more show less

Adds four new Fleet-maintained macOS apps: iTerm2, YubiKey Manager, VNC Viewer, and Beyond Compare.
Host details > Software > Library and Fleet Desktop Self-Service now show installer status, installer actions, and available software updates based on detected software inventory.
Adds fleetd TUF extension support on Linux arm64 and Windows arm64 devices.
Switches to UpgradeCode-based uninstall scripts for MSI custom packages when an UpgradeCode can be extracted, providing more comprehensive uninstall coverage.
Changes enable_software_inventory to default to true when missing from a GitOps config.
Removes DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions (e.g., Ubuntu for an RPM).
Increases timeouts on /fleet/mdm/profiles/batch to better support workflows with large numbers of profiles.
Grants Fleet Primo mode users access to Software automations and failing policy ticket & webhook automations.

13 details in Everything

fleet-v4.71.1 Aug 4, 2025 · release notes

Fleet v4.71.1 adds MS-MDE2 v7.0 Windows MDM enrollment support and a new SSO dual-URL configuration option.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.71.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.71.1

Supports MS-MDE2 v7.0 Windows MDM Enrollments, expanding compatibility with modern Windows enrollment protocols.
New sso_server_url configuration option enables SSO setups where admin access and agent/API access use separate URLs, restricting SSO authentication to the specified URL.

2 details in Everything

fleet-v4.71.0 Jul 23, 2025 · release notes

Fleet 4.71.0 adds IdP-based labels, Apple MDM user channel, SCIM Department ingestion, and Windows app last-opened time.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.71.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.71.0

└──▷ USE IT

Inject an end user's IdP department into a macOS configuration profile so the profile can be dynamically customized per user.

yaml

In a mobileconfig profile payload, reference the variable:
  <key>Department</key>
  <string>$FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT</string>
Then deploy the profile via Fleet MDM; Fleet substitutes the value ingested from SCIM.

Retrieve the most recently archived disk encryption key for a host when the current key has been rotated or is unavailable.

$ curl -sS -H "Authorization: Bearer $FLEET_TOKEN" \
  https://fleet.example.com/api/v1/fleet/hosts/42/encryption_key

Adds support for IdP-based Host Vitals labels that update automatically, enabling dynamic host grouping based on identity provider attributes.
Adds support for the Apple MDM user channel: mobileconfig profiles with a PayloadScope of User are now delivered via the user channel when a host has an active user channel connection.
Adds ingestion of the user Department field via SCIM and exposes it as the FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT variable in configuration profiles.
Adds last opened time for Windows applications in software inventory.
Updates GET /hosts/:id/encryption_key to return the most recently archived encryption key when the current key is unavailable.

+12 more show less

Adds verification of user-scoped profiles on macOS.
Adds functionality for verifying installation of VPP apps, switching VPP apps to show as installed only after MDM confirms installation.
Increases Fleet-maintained app check frequency from once per day to once per hour.
Adds automatic refetch of host vitals and software inventory after a successful software install or uninstall.
Adds ability to configure EULA shown during setup experience via GitOps.
Adds the team_name property to the /api/v1/fleet/hosts/identifier/:id endpoint response.
Records installer URL when a Fleet-maintained app is added via the web UI or REST API.
Separates the host details software list into two sections: Inventory (installed software) and Library (software available for installation).
Updates Windows Custom OS Settings (Win32/Desktop Bridge ADMX policies) to be marked verified after the host acknowledges the MDM install command.
Moves SSO and Host status webhook settings from Settings > Organization to Settings > Integrations.
Updates CIS benchmarks for Windows 10 to version 3.
Adds api_only user property to backend activity details and a new avatar for API-only users in the activity feed.

17 details in Everything

fleet-v4.70.0 Jun 30, 2025 · release notes

Fleet 4.70.0 adds Microsoft Entra ID conditional access, Android MDM enrollment, and richer host certificate reporting.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.70.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.70.0

└──▷ TRY IT

Override the default output filename when packaging a fleetd installer, useful in CI pipelines where artifact names must be deterministic.

$ fleetctl package --type=msi --fleet-url=https://fleet.example.com --enroll-secret=<secret> --outfile fleet-agent-v4.70.msi

Enable Android MDM and enroll a BYOD device through the Fleet console.

📍In the Fleet console, go to Settings › Integrations › Mobile device management (MDM) and enable Android MDM, then share the enrollment link with the device user.

Adds Microsoft Entra ID conditional access support for both security engineers and IT admins.
Enables Android MDM support for enrolling BYOD devices.
Adds source and username fields to host certificates, reporting system or user based on keychain origin (macOS login keychain = user) and the corresponding username.
Adds a keychain column to the certificates card on host details and My Device pages.
Extends POST /api/v1/fleet/hosts/:id/wipe to allow specifying the remote wipe type for Windows hosts.

+7 more show less

Updates the vulnerabilities feed to fall back to non-primary CVSSv2/v3 sources when NVD data is unavailable, rather than omitting scores.
Updates custom SCEP proxy implementation to include one-time challenges.
Adds support for filtering the hosts page by any of the 3 batch script execution statuses.
Adds an audit log activity item for automatic install policy creation.
Adds new optional --outfile parameter to fleetctl package to override the generated filename.
Adds macOS Redis cluster support.
Implements team dropdown search in the UI.

12 details in Everything

└──▷ BREAKING ON UPGRADE

!The Open Policy Agent (OPA) upgrade to v1.4.2 drops support for YAML 1.1 in configuration files: yes/on values must be changed to true and no/off values to false in any file passed via the -c option when starting the Fleet server.
!If your server was already using Android MDM via the experimental DEV_ANDROID_ENABLED=1 flag, you must turn off Android MDM before updating your Fleet server.

fleet-v4.69.0 Jun 14, 2025 · release notes

Fleet 4.69.0 adds bulk script execution on 5,000 hosts, SCIM IdP sync for Entra ID & Authentik, and Ubuntu 24.10/25.04 OVAL vuln detection.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.69.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.69.0

└──▷ TRY IT

Resend a failing configuration profile to all hosts where delivery failed, scoped by filter, without manually retrying each host.

$ curl -s -X POST -H "Authorization: Bearer $FLEET_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"profile_uuid": "<profile_uuid>", "filters": {"team_id": 3}}' \
  "https://fleet.example.com/api/v1/fleet/configuration_profiles/resend/batch"

Adds vulnerability detection via OVAL for Ubuntu 24.10 and 25.04.
Adds ability to sync end user IdP information with Microsoft Entra ID using the SCIM protocol.
Adds ability to sync end user IdP information with Authentik using the SCIM protocol.
Updates Windows 11 Enterprise CIS policies to version 4.0.
Adds new Detail Query luks_verify to verify whether the stored LUKS key is valid.

+18 more show less

Adds additional checks to vulnerability feed validation to prevent deploying an un-enriched NVD feed.
Adds SHA256 hash of Mac applications to signature information in the host software response.
Adds FLEET_AUTH_SSO_SESSION_VALIDITY_PERIOD environment variable to override how long end users have to complete SSO.
Adds ability to execute scripts on up to 5,000 hosts at a time using filters.
Adds ability to run a script on all hosts matching the current set of supported filters.
Adds new API endpoint GET /scripts/batch/summary/:batch_execution_id for retrieving a summary of a batch script execution's current state.
Adds endpoint POST /api/v1/fleet/configuration_profiles/resend/batch to resend a profile to all hosts satisfying a filter.
Adds a starter library automatically applied to all new Fleet instances during setup.
Adds ability to uninstall software via the Self-service tab of My device.
Adds FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE environment variable to increase MDM SSO endpoint rate limit and split it into its own rate limit bucket.
Adds UI to filter hosts by config profile status.
Adds UI for viewing custom profile status and batch-resending profiles to hosts where delivery failed.
Adds filtering for host endpoints by MDM config profile and status.
Adds immediate cancellation of profile delivery when a profile is deleted.
Adds ability to turn off MDM for iPhone and iPad hosts from the host details page.
Adds Neon to the list of detected Linux distributions.
Adds ability for GitOps mode to add a custom package on the software page and copy/paste the YAML needed for packages that cannot be referenced with a URL.
Adds copyable SHA256 hash to the software details page.

23 details in Everything

└──▷ BREAKING ON UPGRADE

!GitOps users: SSO settings, SMTP settings, Features, and MDM end-user authentication settings are now cleared if omitted from YAML files in a GitOps run — ensure these settings are present in your global YAML settings file before the next GitOps run.

fleet-v4.68.1 Jun 4, 2025 · release notes

Adds FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE to configure MDM SSO rate limiting

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.68.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.68.1

fleet-v4.68.0 May 22, 2025 · release notes

Fleet 4.68.0 adds Microsoft Entra conditional access, batch script execution, GitOps YAML generation, and webhook query logging.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.68.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.68.0

└──▷ USE IT

Pin a software installer in GitOps by its SHA-256 hash to ensure the exact expected binary is used and matches any already-downloaded installer.

yaml

# In your software YAML:
software:
  - url: https://example.com/myapp-1.0.pkg
    hash_sha256: "4d9e2bdfef1dd602e758e514ddbb235b1c325f5f4699b6a80e1272fdb3c932a4"

Enable Microsoft Entra conditional access on a specific policy so hosts that fail it are blocked from SSO.

📍In the Fleet UI, go to Policies, select a policy, open its settings, and enable the Conditional access (Microsoft Entra) toggle.

Adds Microsoft Entra integration to conditionally block SSO for hosts failing policies.
Adds per-policy conditional access configuration with updated host policy UI showing conditional access data.
Adds CVE ID as a matching criterion for host software queries (in addition to software name).
Adds webhook as a logging configuration option for query automation.
Adds webhook query automation logging with query ID included in automation logs.

+17 more show less

Adds shell and PowerShell syntax highlighting in the script editor UI.
Adds ability to run a script on a batch of hosts in a single user flow.
Adds hash_sha256 field to software YAML for download validation and existing-installer matching in GitOps.
Adds hash_sha256 field to the GET /software/titles API response.
Adds fleetctl generate-gitops command to generate GitOps YAML files from the current Fleet configuration.
Enables saving Integrations > Advanced settings in GitOps mode.
Adds support for uploading and installing tarball archives (.tar.gz).
Adds support for Fleet-maintained apps (FMA) in GitOps, including via fleetctl YAML files.
Adds UI for manual agent install of a bootstrap package.
Adds categorization and filtering for self-service software on the My device page.
Adds count of policies triggering automatic software installs in the software table.
Adds support for FLEET_VAR_HOST_END_USER_IDP_USERNAME, FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART, and FLEET_VAR_HOST_END_USER_IDP_GROUPS Fleet variables in macOS MDM configuration profiles.
Adds last_mdm_enrolled_at and last_mdm_checked_in_at fields to host detail endpoints.
Adds macos_setup.manual_agent_install option in Mac setup experience to bypass automatic fleetd installation.
Allows uploading VPP apps when GitOps mode is enabled.
Allows viewing install/uninstall status details from the My device page.
Displays decimal representation of certificate serial numbers (below 2^63) alongside hex for easier macOS keychain matching.

22 details in Everything

fleet-v4.67.0 Apr 24, 2025 · release notes

Fleet 4.67.0 adds SCIM/IdP integration, policy labels via GitOps, Windows ARM64 support, and an API to cancel upcoming host activities.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.67.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.67.0

└──▷ TRY IT

Cancel a queued script run or MDM command before it executes on a host.

$ curl -X DELETE https://<fleet-url>/api/latest/fleet/hosts/<host_id>/activities/upcoming/<activity_id> -H 'Authorization: Bearer <token>'

Package a Fleet agent installer for Windows ARM64 devices (e.g., Snapdragon laptops).

$ fleetctl package --arch=arm64 --type=msi --fleet-url=https://<fleet-url> --enroll-secret=<secret>

Connect your Okta SCIM integration so Fleet can display IdP group membership on host vitals.

📍In the Fleet UI, go to Settings › Integrations › IDP and configure your Okta SCIM connection URL and token.

Adds SCIM integration (Okta) so IdP email, full name, and group data appear in host vitals and macOS setup end-user authentication.
New IDP section on the integrations page shows SCIM connection status.
New users card on host details and My Device page surfaces host end-user and IdP information.
Supports setting labels on policies via GitOps and adds backend label support for policies.
New DELETE /api/latest/fleet/hosts/:id/activities/upcoming/:activity_id endpoint to cancel a pending host activity.

+6 more show less

Adds ability to cancel upcoming host activities from the UI.
Adds native Windows ARM64 support in fleetd via fleetctl package --arch=arm64 --type=msi.
Adds support for the vmodule hidden osquery flag for granular debug logging.
Adds ABM pending host count to Fleet statistics.
Includes newly created host IDs in enrollment activity records.
Adds a 1-minute retry timeout for the Fleet desktop app if it fails to display.

11 details in Everything

fleet-v4.66.0 Apr 4, 2025 · release notes

Fleet 4.66.0 adds DigiCert & custom SCEP certificate deployment, Windows Fleet-maintained apps, and label-scoped queries.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.66.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.66.0

└──▷ HOW TO FIND IT

Scope a query to a subset of hosts using label conditions so it only runs against the intended fleet segment.

📍In the Fleet UI, open Queries › New Query, write your SQL, then under Labels select the labels to include (LabelsIncludeAny) before saving.

Adds integration with DigiCert Trust Lifecycle Manager so Fleet admins can deploy DigiCert certificates to macOS devices via configuration profiles.
Adds integration with a custom SCEP server so Fleet admins can deploy certificates from their own SCEP server to macOS devices via configuration profiles (Fleet server proxies all SCEP traffic).
Adds support for Fleet-maintained apps for Windows.
Enables filtering the host details software table by vulnerability severity and known exploit.
Adds label support when saving or editing queries in the UI, and adds backend support for queries with LabelsIncludeAny.

+13 more show less

Returns more granular data for live query and policy runs for richer display to users.
Adds platform key to software_package and app_store_app fields throughout the API.
Adds support for displaying scheduled query labels in fleetctl.
Adds H2C (forced HTTP/2) configuration option on the Fleet server to work around GCP Cloud Run upload file size limits.
Adds took field (request duration) to server logs for non-2XX responses.
Adds software URL validation in GitOps to catch URL parse errors earlier.
Adds author_id to the labels database table to track who created a label.
Updates macOS setup experience to show an error when an App Store app installation fails due to insufficient licenses.
Requires install and uninstall scripts when adding .exe packages (previously unreliable default scripts have been removed).
Adds Apple Root Certificate for HTTP requests to https://gdmf.apple.com/v2/pmv, enabling enforcement of minimum macOS version at enrollment.
Adds validation for both org logo URL fields, including acceptance of data URIs.
Allows team GitOps to run without a global config present.
Updates fleetctl to print an informative error message when authenticated as a user required to reset their password.

18 details in Everything

└──▷ BREAKING ON UPGRADE

!Default install and uninstall scripts for .exe software packages have been removed; install and uninstall scripts are now required when adding .exe packages.

fleet-v4.65.0 Mar 14, 2025 · release notes

Fleet 4.65.0 adds host certificate visibility, Android MDM (experimental), VPP auto-install policies, and a unified activity queue.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.65.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.65.0

└──▷ TRY IT

Clean up an incorrectly named software title that has a bundle ID.

$ curl -s -X PATCH -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"name": "Correct App Name"}' 'https://<fleet-host>/api/latest/fleet/software/titles/<id>/name'

Adds UI for viewing TLS/certificate details on host details and My Device pages.
Adds certificate data to host vitals for macOS, iOS, and iPadOS.
Adds list host certificates and list device certificates API endpoints.
Implements GitOps mode that locks UI settings managed by GitOps, preventing drift.
Allows VPP (App Store) apps to be automatically installed via Fleet-created policies.

+11 more show less

Adds ability for users to auto-install App Store Apps from the Fleet UI without writing a policy.
Adds experimental Android MDM support: UI to enroll Android devices via BYOD and to enable/disable Android MDM.
Adds script execution, software installs, and VPP app installs to the new upcoming_activities table for a unified activity queue.
Updates the list upcoming activities endpoint to use the new upcoming_activities table as source of truth.
Adds PATCH /api/latest/fleet/software/titles/:id/name endpoint for cleaning up incorrect software titles with a bundle ID.
Adds pagination inside each Manage Automations modal for policies.
Adds a daily sync job to keep App Store app versions in Fleet current with the actual latest version.
Adds created_at timestamp for when a VPP app was added to a specific team.
Permits setting SSO metadata and metadata_url via GitOps and the UI.
Enables Redis cluster follow-redirections by default.
Updates wine to version 10.0 to improve macOS-to-Windows installer creation on M1 chips.

16 details in Everything

└──▷ BREAKING ON UPGRADE

!The default for FLEET_VULNERABILITIES_MAX_CONCURRENCY is changed from 5 to 1; deployments relying on the previous default concurrency level will now process vulnerabilities more slowly unless the value is explicitly set.

fleet-v4.64.0 Feb 18, 2025 · release notes

Fleet 4.64.0 adds bash script execution, label-targeted app store apps, host population options, and a script-contents update API.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.64.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.64.0

└──▷ TRY IT

Exclude Fleet-maintained apps from a software titles listing to focus on custom or third-party installers only.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<fleet-server>/api/v1/fleet/software/titles?exclude_fleet_maintained_apps=true'

Retrieve the download URL for a specific Fleet-maintained app to verify the source before deployment.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<fleet-server>/api/v1/fleet/software/fleet_maintained_apps/<id>'

List hosts with their associated users and labels populated in a single API call, avoiding separate lookups.

$ curl -s -H 'Authorization: Bearer <token>' 'https://<fleet-server>/api/v1/fleet/hosts?populate_users=true&populate_labels=true'

Adds bash interpreter support for script execution on hosts.
Adds API endpoint for updating script contents.
Adds ability to target App Store apps with include/exclude labels.
Adds ability to edit targets or self-service option for App Store apps.
Adds exclude_fleet_maintained_apps option to GET /api/v1/fleet/software/titles.

+10 more show less

Adds download URL for Fleet-maintained apps as url property on GET /api/fleet/software/fleet_maintained_apps/:id.
Adds option to populate users and labels on the list hosts endpoint.
Adds fleetctl Linux ARM64 binary to releases.
Disk encryption keys are now archived (never deleted) when created or updated.
Includes current host status and pending action in lock, unlock, and wipe API responses.
Disables webhooks automatically when not present in GitOps configuration.
Adds gzip compression for static CSS and JS assets to decrease bundle download times.
Adds details modal for add, edit, and delete App Store app global activities.
Adds modal to edit script contents in the UI.
Replaces Include Fleet desktop checkbox with host-type radio buttons when adding Windows or Linux hosts.

15 details in Everything

└──▷ BREAKING ON UPGRADE

!The fleetctl binary has been removed from the fleetdm/fleet Docker image.

fleet-v4.63.0 Feb 4, 2025 · release notes

Fleet 4.63.0 adds VPP app installs on policy failure, CloudFront CDN delivery for installers, and platform-filtered software dropdowns.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.63.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.63.0

└──▷ HOW TO FIND IT

Trigger automatic VPP app installation when a host fails a policy — configure via the Fleet UI on the policy's failed-action dropdown.

📍In the Fleet console, go to Policies › <your policy> › Actions on failure, then select a VPP app from the automatic installation dropdown.

Enables delivery of bootstrap packages and software installers via signed CloudFront CDN URLs using three new server settings: s3_software_installers_cloudfront_url, s3_software_installers_cloudfront_url_signing_public_key_id, and s3_software_installers_cloudfront_url_signing_private_key.
Adds the ability to install VPP apps automatically on policy failure, with auto-install information surfaced on the VPP app details page.
Adds platform-specific filtering in the software dropdown for failed-policy auto-install, showing only software compatible with each policy's targeted platforms.
Supports filtering software titles by 'any of these platforms' in GET /api/v1/fleet/software/titles.
Adds a timestamp for host count last update time on software, OS, and vulnerability detail pages.

+4 more show less

Persists each user's column display selection for the hosts table using new user-level settings.
Includes a host's team-level queries when targeting a specific host via the host details page.
Displays command-line installation instructions when a package is generated.
Adds a fallback for extracting app names from .pkg installers with default or incorrect title attributes in their distribution file.

9 details in Everything

fleet-v4.62.0 Jan 10, 2025 · release notes

Fleet 4.62.0 adds label-scoped software deployment, Fleet secrets in scripts/profiles, and macOS 15 CIS benchmark support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.62.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.62.0

└──▷ TRY IT

Filter a query's host results to only those belonging to a specific team when viewing an inherited query.

$ curl 'https://<fleet-server>/api/latest/fleet/queries/<query_id>/report?team_id=<team_id>' \
  -H 'Authorization: Bearer <token>'

Adds support for Fleet secrets ($FLEET_SECRET_YOURNAME) in scripts and software installer scripts and profiles, with validation on ingestion and automatic profile re-push when a secret value changes.
Adds new /fleet/spec/secret_variables API endpoint for managing Fleet secret variables.
Adds label-based scoping for Fleet-maintained apps and custom packages, controllable via UI, API, and CLI (labels_include_any / labels_exclude_any).
Adds automatic skipping of software installs when the software is not scoped to the host via labels.
Adds automatic generation of trigger policies for custom software packages.

+13 more show less

Updates fleetctl gitops to support scoping software installers by labels using labels_include_any or labels_exclude_any conditions.
Updates fleetctl gitops to detect and save Fleet secrets found in scripts and profiles to the Fleet server.
Adds macOS 15 CIS benchmark support alongside updated macOS 13 and 14 benchmarks.
Updates the queries API to support platform-targeted filtering, pagination, and now returns count and meta pagination fields.
Adds searchable query targets with improved UI for environments with many teams or labels.
Adds optional team_id parameter to the queries report endpoint (GET /api/latest/fleet/queries/{query_id}/report) to filter results by team.
Allows software uninstalls and script-based host lock/unlock/wipe to run even when global scripts are disabled.
Allows maintainers to manage install software or run scripts on policy automations.
Adds SNS alerting for scheduled cron job errors, with a dedicated cron_job_failure_monitoring key in sns_topic_arns_map to route alerts to a separate topic.
Changes the script upload endpoint (POST /api/v1/fleet/scripts) to automatically normalize CRLF line endings to LF.
Adds ability to click a software row on the My Device page to view that software's installation details on the host.
Adds service annotation field to the Helm Chart and additional Helm chart customization options (e.g., Google cloud_sql_proxy in the fleet-migration job).
Increases maximum installer URL length in GitOps configurations to 4,000 characters.

18 details in Everything

fleet-v4.61.0 Dec 17, 2024 · release notes

Fleet 4.61.0 adds MFA on login, Windows MDM auto-migration, Linux encryption escrow expansion, and new Fleet-maintained app controls.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.61.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.61.0

└──▷ TRY IT

Enable automatic Windows MDM host migration on a Premium Fleet instance via the API.

$ curl -X PATCH https://<fleet-server>/api/latest/fleet/config \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"mdm": {"windows_migration_enabled": true}}'

Retrieve the full global list of Fleet-maintained apps without scoping to a team.

$ curl https://<fleet-server>/api/v1/fleet/software/fleet_maintained_apps \
  -H 'Authorization: Bearer <token>'

Fetch software versions without CVE payload to reduce response size on large inventories (Fleet Premium).

$ curl 'https://<fleet-server>/api/latest/fleet/software/versions?without_vulnerability_details=true' \
  -H 'Authorization: Bearer <token>'

Adds email verification (MFA) requirement on each login for Fleet users configured outside SSO.
Extends Linux disk-encryption key escrow support to Ubuntu 20.04.6.
Adds automatic install policy creation for Fleet-maintained apps.
Replaces Zoom Fleet-maintained app with Zoom for IT, which installs silently without opening windows.
Adds windows_migration_enabled setting (configurable via fleetctl, PATCH /api/latest/fleet/config, or UI) to enable automatic Windows MDM host migration (Premium).

+5 more show less

Adds without_vulnerability_details query parameter to the /api/latest/fleet/software/versions endpoint to truncate CVE details (Fleet Premium).
Allows /api/v1/fleet/software/fleet_maintained_apps to be called without a team ID to retrieve the full global list of maintained apps.
Allows APNS keys in unencrypted PKCS8 format, supporting migrations from other MDM solutions.
Improves label validation in live queries: passing a non-existent label now returns an error identifying the missing label(s), via both API and fleetctl query.
Improves performance of updating nano_enrollments.last_seen_at timestamps for Apple MDM devices by an order of magnitude under load.

10 details in Everything

└──▷ BREAKING ON UPGRADE

!The resend configuration profile API path changed from hosts/[hostid]/configuration_profiles/resend/{uuid} to hosts/{hostid}/configuration_profiles/{uuid}/resend.
!Live query label validation now returns an error (instead of silently ignoring them) when non-existent labels are passed via the API or fleetctl query.

fleet-v4.60.0 Nov 27, 2024 · release notes

Fleet 4.60.0 adds YARA-over-HTTPS for agents, include any label profiles, Linux disk encryption UI, and zstd deb support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.60.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.60.0

└──▷ TRY IT

Skip expensive vulnerability description lookups when fetching the hosts list — useful for large fleets where the endpoint was timing out.

$ curl -H 'Authorization: Bearer <token>' 'https://<fleet-server>/api/latest/fleet/hosts?populate_software=without_vulnerability_descriptions'

Enable include any label targeting for an MDM configuration profile so it deploys to hosts matching at least one of several labels.

yaml

# In your GitOps YAML profile definition:
profiles:
  - path: profiles/baseline.mobileconfig
    labels_include_any:
      - Contractors
      - Remote Workers

Adds support for labels_include_any in GitOps configuration.
Adds capability for Fleet to serve YARA rules to agents over HTTPS authenticated via node key (requires osquery 5.14+).
Adds activity item for fleetd enrollment showing host serial and display name.
Adds a query to let users toggle automations on/off while surfacing the current log destination.
Enables viewing scripts inline in the UI (from the scripts page and host details page) without downloading them.

+9 more show less

Adds activity feed entries when activity automations are enabled, edited, or disabled.
Cancels pending script executions when a script is edited or deleted.
Adds team_identifier signature information for Apple macOS applications to the /api/latest/fleet/hosts/:id/software endpoint.
Adds a freshness indicator for software title host and version counts on the title's details page.
Adds UI for installing custom profiles on hosts matching any of the defined labels (include any label targeting).
Adds UI features supporting disk encryption for Ubuntu and Fedora Linux.
Adds support for deb packages compressed with zstd.
Adds populate_software=without_vulnerability_descriptions parameter to GET /api/latest/fleet/hosts (Fleet Premium) to skip computationally heavy vulnerability detail population.
Adds info banner for cloud customers to assist with Windows auto-enrollment setup.

14 details in Everything

└──▷ BREAKING ON UPGRADE

!GitOps now returns an error if the deprecated apple_bm_default_team key is used and there are more than 1 ABM tokens in Fleet.
!GitOps path resolution for installer queries and scripts is now always relative to where the query file or script is referenced — existing YAML files that worked around the previous inconsistent behavior will break.

fleet-v4.59.1 Nov 18, 2024 · release notes

Fleet adds team_identifier signature info to macOS software API

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.59.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.59.1

fleet-v4.59.0 Nov 12, 2024 · release notes

Fleet 4.59.0 adds macOS Setup Experience UI, SCEP/NDES proxy for Windows cert enrollment, and expanded GitOps MDM support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.59.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.59.0

Adds UI for configuring a setup experience script to run on macOS hosts during automated enrollment.
Adds UI for selecting software to install as part of the macOS setup experience.
Adds support in fleetctl gitops for specifying a setup experience script and software installs for a team or no team.
Adds Orbit endpoint POST /orbit/setup_experience/status for checking the status of a macOS host's setup experience steps.
Adds SCEP proxy for Windows NDES (Network Device Enrollment Service) AD CS server, enabling devices to request certificates.

+11 more show less

Adds ability to connect a SCEP NDES proxy in Fleet.
Adds validation preventing removal of a software package or VPP app from a team if it is selected for setup experience installation.
Adds filtering in the Software OS view to show only OSes from a specific platform (Windows, macOS, Linux, etc.).
Adds a config field in the UI for specifying a custom MDM URL.
Adds error message on the My Device page when MDM is off for the host.
Allows FLEET_REDIS_ADDRESS to include a redis:// prefix (accepted formats: redis://host:port or host:port).
Grants GitOps users permission to run MDM commands.
Adds created_at/updated_at timestamps to the user create endpoint response.
Updates software install activities from policy automations to be authored by Fleet and store policy ID and name on each activity.
Adds capability for fleetd to report vital errors (such as Fleet Desktop startup failures) to the Fleet server.
Updates OpenTelemetry support to log MySQL spans outside of HTTPS transactions and rename spans to include the query for easier tracking.

16 details in Everything

fleet-v4.58.0 Oct 17, 2024 · release notes

Fleet 4.58.0 adds policy-triggered script runs, Fleet-maintained app APIs, RPM support, and battery status for Windows hosts.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.58.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.58.0

└──▷ TRY IT

Add a Fleet-maintained app to your software catalog programmatically, without using the UI.

$ curl -X POST https://<fleet-server>/api/latest/fleet/software/fleet_maintained_apps \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"team_id": 1, "app_id": "<app_id>"}'

Retrieve details of a specific Fleet-maintained app to inspect its metadata before deploying.

$ curl -X GET https://<fleet-server>/api/latest/fleet/software/fleet_maintained_apps/<app_id> \
  -H 'Authorization: Bearer <token>'

Configure a policy automation to run a remediation script on failure, directly from the Fleet UI.

📍In the Fleet console, go to Policies, select or create a policy, open the Automations section, and enable Run script — choosing the remediation script to execute when hosts fail the policy.

Adds built-in label for Fedora Linux, enabling automatic categorization of Fedora hosts.
Enables triggering a script run automatically on policy failure, with a corresponding activity feed event.
Adds POST /software/fleet_maintained_apps endpoint for adding Fleet-maintained apps via API.
Adds GET /software/fleet_maintained_apps/{app_id} endpoint to retrieve details of a specific Fleet-maintained app.
Adds API endpoint to list team-available Fleet-maintained apps.

+6 more show less

Adds UI for managing Fleet-maintained apps directly in the Fleet console.
Adds support for uploading RPM packages as software installers.
Adds upload progress bar to the software uploads UI.
Adds battery status (including health definitions based on cycle counts and max capacity) to Windows host details.
Improves performance for host details and Fleet Desktop in environments with high volumes of live queries.
Updates add software modal to separate pages in Fleet UI for a clearer workflow.

11 details in Everything

└──▷ BREAKING ON UPGRADE

!Migrations will fail if a pre-existing Fedora Linux label exists — delete the existing label before upgrading.
!GitOps script and software installer relative paths are now always relative to the file they're in; existing YAML files that relied on the previous inconsistent behavior (e.g. script paths in no-team.yml being relative to default.yaml one directory up) will break and must be updated.

fleet-v4.57.0 Sep 23, 2024 · release notes

Fleet 4.57.0 adds policy-driven auto-installs, BYOD MDM enrollment, OTA iOS/iPadOS enrollment, and package uninstall via Fleet.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.57.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.57.0

└──▷ TRY IT

Poll the result of an async software batch upload after submitting packages via the API.

$ curl -s -H "Authorization: Bearer <token>" https://<fleet-host>/api/latest/fleet/software/batch/<request_uuid>

Adds automatic installation of software on hosts that fail policies.
Adds ability to uninstall packages from hosts via Fleet.
Adds BYOD device enrollment into Fleet MDM for end users.
Adds OTA MDM enrollment endpoint and protocol support for iOS and iPadOS hosts, with automatic team assignment.
Adds support for configuring policy installers via GitOps.

+8 more show less

Adds support for policies scoped to No team hosts, with All teams and No team reserved as team names.
Adds software status filter for No teams on the hosts page.
Adds in-place editing of software installer packages, self-service flag, scripts, pre-install query, and self-service availability (no longer requires delete and re-add).
Adds automatic reset of install counts and cancellation of pending installs/uninstalls when GitOps installer updates change package contents.
Makes POST /api/latest/fleet/software/batch asynchronous and adds GET /api/latest/fleet/software/batch/{request_uuid} endpoint to poll batch upload results.
Adds validation of Setup Assistant profiles on upload.
Adds validation to prevent installing software on a host with a pending installation.
Allows custom SCEP CA certificates with any extendedKeyUsage attributes.

13 details in Everything

fleet-v4.56.0 Sep 7, 2024 · release notes

Fleet 4.56.0 adds multi-VPP/ABM token support, ALAS vulnerability scanning, S3 bootstrap package storage, and new software filtering APIs.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.56.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.56.0

└──▷ TRY IT

Filter software titles by exploitability and CVSS score range to prioritize patching the riskiest, actively-exploited packages across your fleet.

$ curl -sS -H 'Authorization: Bearer <token>' 'https://<fleet-server>/api/v1/fleet/software/titles?exploit=true&min_cvss_score=7.0&max_cvss_score=10.0'

Check whether a specific CVE is known to Fleet but not yet present on any enrolled host — useful for verifying scan coverage without a false not found result.

$ curl -sS -o /dev/null -w '%{http_code}' -H 'Authorization: Bearer <token>' 'https://<fleet-server>/api/v1/fleet/vulnerabilities/CVE-2024-1234'

Pass a Fleet server secret via stdin to avoid exposing it in the process list or shell history.

$ echo 'your-db-password' | fleet serve --config /etc/fleet/config.yml

Adds server support for multiple VPP tokens, including the ability to assign multiple teams to the same VPP token.
Adds new ABM page and VPP page to the Fleet UI, consolidating Automatic Enrollment and VPP settings under the MDM settings integration page.
Adds new and updated endpoints for managing multiple Apple Business Manager tokens, including per-token tracking of terms expired API errors.
Adds support for S3 to store MDM bootstrap packages (using the same bucket configuration as software installers).
Adds self-service VPP software support in the UI, backend, and gitops.

+10 more show less

Adds MDM migration support for hosts manually enrolled in a third-party MDM, plus an offline screen for the macOS MDM migration flow.
Enforces minimum OS version settings during Apple Automated Device Enrollment (ADE).
Adds ALAS bulletins as a vulnerability source for Amazon Linux 1, 2, 2022, and 2023 (replacing OVAL for Amazon Linux 2).
Adds exploit, min_cvss_score, and max_cvss_score filter parameters to the /software/titles and /software/versions API endpoints.
Updates GET /api/v1/fleet/vulnerabilities/{cve} to validate CVE format and return 204 when a known CVE is not present on any hosts.
Adds new UI empty states for vulnerability search results: invalid CVE format, known CVE not on hosts, unknown CVE, exploited vulnerability, and operating systems.
Adds support for Fleet server to accept arguments via stdin, enabling safer secret injection without exposing values in env vars, CLI args, or config files.
Adds support for MySQL 8.4.2 LTS.
Improves live query performance to accommodate higher volumes in zero-trust workflows.
Adds matching rules for July and August Microsoft 365 security updates.

15 details in Everything

fleet-v4.54.2 Sep 5, 2024 · release notes

Fleet v4.54.2 allows APNS certificates to be renewed directly in the UI.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.54.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.54.2

fleet-v4.55.0 Aug 9, 2024 · release notes

Fleet 4.55 adds full VPP support for iOS/iPadOS, Linux ARM64 fleetd packages, FileVault enforcement via Escrow Buddy, and OS updates for iOS/iPadOS.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.55.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.55.0

└──▷ TRY IT

Build a fleetd package targeting Linux ARM64 devices, such as Raspberry Pi or AWS Graviton hosts.

$ fleetctl package --type=deb --arch=arm64 --fleet-url=https://fleet.example.com --enroll-secret=<secret>

Retrieve a host's software inventory without the (potentially large) software list, useful for fast host lookups in automation.

$ curl 'https://fleet.example.com/api/latest/fleet/hosts/identifier/<identifier>?exclude_software=true' -H 'Authorization: Bearer <token>'

Adds support for generating fleetd packages for Linux ARM64 via the new --arch flag in fleetctl package.
Integrates Escrow Buddy to enforce FileVault key escrow during the macOS Setup Assistant for MDM-enrolled hosts with disk encryption enabled.
Adds OS update management support for iOS and iPadOS devices.
Adds iOS and iPadOS device details refetch via the existing POST /api/latest/fleet/hosts/:id/refetch endpoint.
Adds user-installed app inventory for iOS and iPadOS devices.

+14 more show less

Adds support for deploying Apple VPP (Volume Purchase Program) apps to iOS and iPadOS devices, including UI management for adding, removing, and disabling VPP apps.
Adds VPP support to GitOps configuration.
Adds new POST /mdm/apple/vpp_token, DELETE /mdm/apple/vpp_token, and GET /vpp endpoints for VPP token management.
Adds new GET /software/app_store_apps and POST /software/app_store_apps endpoints for App Store app management.
Exposes associated VPP apps in GET /software/titles, GET /software/titles/:id, GET /hosts/:id/software, and GET /device/:token/software endpoints.
Adds support to delete a VPP app from a team via DELETE /software/titles/:software_title_id/available_for_install.
Adds exclude_software query parameter to the Get host by identifier API to reduce payload size.
Adds a UI warning banner when the uploaded VPP token is about to expire or has expired.
Adds global activity feed entries for VPP-related actions.
Adds No Teams support across all software pages, including adding software installers.
Linux lock/unlock scripts now use pam_nologin to keep Active Directory users locked out when a host is locked.
Installed software inventory now includes Linux .deb packages that are on hold.
Increases Apple SCEP certificate renewal threshold to 180 days for MDM enrollments.
Maintenance window calendar events are now recreated within 30 seconds if deleted or moved to the past, with Fleet watching for changes up to 1 week after the original event time.

19 details in Everything

└──▷ BREAKING ON UPGRADE

!MySQL 5.7 is no longer supported; the minimum required version is MySQL 8.0.36.
!The --version flag is removed from the fleetctl package command; package version must now be controlled via the --orbit-channel flag.
!The software field is now mandatory for NO-TEAM and all TEAMs in GitOps configuration; adding software to NO-TEAM before upgrading to 4.55.0 is not supported.

4.54.1 Jul 24, 2024 · release notes

Fleet 4.54.1 removes --version flag from fleetctl package in favor of --orbit-channel

└──▷ GET THIS VERSION

$ git clone --branch 4.54.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.54.1

The fleetctl package command now uses the --orbit-channel flag to control the package version instead of the removed --version flag

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!The --version flag has been removed from the fleetctl package command, requiring migration to the --orbit-channel flag for version control.

fleet-v4.54.0 Jul 17, 2024 · release notes

Fleet 4.54.0 adds iOS/iPadOS labels, label-scoped MDM profiles, upcoming maintenance windows, and configurable script timeouts.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.54.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.54.0

└──▷ TRY IT

Filter mdm_commands output to a specific host and command type to quickly audit pending MDM commands without waiting on a slow full-table response.

$ fleetctl get mdm_commands --host <hostname> --type ProfileList

Enables fleetctl gitops to rename teams by applying the same YAML filename with an updated team name.
Expands fleetctl query --hosts to accept hostnames, host UUIDs, and/or hardware serial numbers.
Adds a host's upcoming scheduled maintenance window to the host details UI page and host API responses.
Adds TLS connection testing with the embedded certs.pem to fleetctl debug connection.
Adds host display name to calendar event descriptions.

+16 more show less

Adds .yml and .yaml file-type validation with error messaging to fleetctl apply.
Adds built-in iOS and iPadOS manual labels for MDM targeting.
Adds aggregation of iOS/iPadOS OS versions.
Adds support for renewing SCEP certificates with custom enrollment profiles.
Adds automatic install of the latest released fleetd version when a host turns on MDM.
Adds support for END_USER_EMAIL and FLEET_DESKTOP parameters to Windows MSI install packages.
Adds labels_include_all and labels_exclude_any fields to the API for targeting MDM custom profiles/settings (with labels accepted as a deprecated alias for labels_include_all).
Adds fleetctl gitops and fleetctl apply support for labels_include_all and labels_exclude_any when configuring custom settings.
Adds UI for uploading custom profiles targeted to hosts matching all/excluding any selected labels.
Makes host script execution timeout configurable via agent options using script_execution_timeout.
Switches fleetctl run-script to a polling mechanism to support longer script timeout values.
Restricts arbitrary and saved script execution to admins and maintainers only (observer and observer+ roles excluded).
Updates fleetctl get mdm_commands to return 20 rows and adds --host and --type filters for faster responses.
Adds a Vulnerable filter to the host details software table.
Allows device users to reinstall self-service software from the UI.
Increases the timeout of the upload software installer API endpoint to 4 minutes.

21 details in Everything

└──▷ BREAKING ON UPGRADE

!Before migrating to this version, delete any existing labels named iOS or iPadOS — they will conflict with the new built-in iOS/iPadOS labels.
!fleetctl gitops team-rename support requires that fleetctl gitops has been run at least once with this version or later before renames will work correctly.

fleet-v4.53.0 Jun 26, 2024 · release notes

fleetctl gitops can now create or clear enroll secrets; server setting for query report max size; S3 storage prefixes for carves and installers.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.53.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.53.0

fleetctl gitops creates teams without enroll secrets or clears them for existing teams
Server setting query_report_max_size configures the maximum query report size
S3 environment variables FLEET_S3_CARVES_* and FLEET_S3_SOFTWARE_INSTALLERS_* configure object storage prefixes

3 details in Everything

4.52.0 Jun 20, 2024 · release notes

Fleet 4.52 adds unlock_pin exposure, exclude_software param, and timeouts for Apple MDM and package uploads

└──▷ GET THIS VERSION

$ git clone --branch 4.52.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.52.0

└──▷ TRY IT

Retrieve the unlock PIN for an Apple device to allow manual unlocking via API.

$ curl -s "https://fleet.example.com/api/latest/fleet/hosts/12345/lock?view_pin=true" | jq '.unlock_pin'

/api/latest/fleet/hosts/:id/lock now returns unlock_pin for Apple hosts when the query parameter view_pin=true is set

1 detail in Everything

fleet-v4.51.1 Jun 12, 2024 · release notes

Adds prefixed S3 config variables for carves and software installers in fleet-v4.51.1.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.51.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.51.1

4.51.1 Jun 11, 2024 · release notes

Adds carves_ and software_installers_ S3 config prefixes for bucket configuration in Fleet 4.51.1

└──▷ GET THIS VERSION

$ git clone --branch 4.51.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.51.1

Adds carves_ and software_installers_ prefixed S3 config variables to configure buckets for file carves and software installers

1 detail in Everything

fleet-v4.51.0 Jun 10, 2024 · release notes

Fleet v4.51.0 adds MDM for iOS/iPadOS, software self-service, and activity webhooks.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.51.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.51.0

fleetctl gitops --dry-run now errors on duplicate (or conflicting) global/team enroll secrets
Added activities_webhook configuration option to allow for a webhook to be called when an activity is recorded.
NOTE: Added new required Fleet server config environment variable when MDM is enabled, FLEET_SERVER_PRIVATE_KEY. This variable contains the private key used to encrypt the MDM certificates and keys stored in Fleet.
Added MDM support for iPhone/iPad
Added software self-service support

+7 more show less

Added query parameter self_service to filter the list of software titles and the list of a host's software so that only those available to install via self-service are returned
Added the device-authenticated endpoint POST /device/{token}/software/install/{software_title_id} to self-install software
Added new endpoints to configure ABM keypairs and tokens
Added GET /fleet/mdm/apple/request_csr endpoint, which returns the signed APNS CSR needed to activate Apple MDM
Added the ability to automatically log off and lock out Administrator users on Windows hosts
Fleet now detects Ubuntu kernel vulnerabilities from the Canonical OVAL feed
Fleet now detects and reports vulnerabilities on Firefox ESR editions on macOS

12 details in Everything

└──▷ BREAKING ON UPGRADE

!When MDM is enabled, the FLEET_SERVER_PRIVATE_KEY environment variable is now required.

fleet-v4.50.1 May 30, 2024 · release notes

Fleet v4.50.1 adds automatic lockout for Windows Administrator accounts and filters for Bulk Host Delete/Transfer.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.50.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.50.1

Adds the ability to automatically log off and lock out Administrator users on Windows hosts
Bulk Host Delete and Transfer now support status and labelID filters together

2 details in Everything

fleet-v4.50.0 May 23, 2024 · release notes

Fleet v4.50 adds fleetctl api CLI, /api/fleet/orbit/software_install/result endpoint, OVAL scanning for newer Ubuntu versions, and software installer upload UI/API

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.50.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.50.0

Added the fleetctl api subcommand to hit any REST endpoint via the CLI.
Added POST /api/fleet/orbit/software_install/result endpoint for fleetd to send installation results.
Added GET /api/v1/fleet/hosts/{id}/software endpoint to list installed software for a host.
Added OVAL vulnerability scanning support on Ubuntu 22.10, 23.04, 23.10, and 24.04.
Added endpoints to upload, delete, and download software installers and UI feature to upload software.

+1 more show less

Added functionality to filter hosts by software installer status.

6 details in Everything

fleet-v4.49.0 Apr 24, 2024 · release notes

Fleet v4.49 adds manual label APIs, Google Calendar integration for policies, batch DDM creation, and --team flag to fleetctl run-script

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.49.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.49.0

Adds API endpoints to add or remove manual labels to/from a host
Updates POST /api/v1/fleet/labels and PATCH /api/v1/fleet/labels/{id} to support creation and update of manual labels
Enables setting host status webhook at the team level via REST API and fleetctl apply/gitops
Adds integration with Google Calendar for policy compliance events
Adds API functionality for creating DDM declarations, individually or in batch

+2 more show less

Updates fleetctl run-script to include new --team and --script-name flags
Adds the enable_release_device_manually configuration setting for teams and no team

7 details in Everything

fleet-v4.48.0 Apr 4, 2024 · release notes

Fleet v4.48.0 adds Google Calendar integration for policy remediation and DDM API support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.48.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.48.0

Added enable_release_device_manually config setting to control automatic release of macOS DEP-enrolled devices
Added API endpoints for creating DDM declarations individually or in batch
Added Windows MDM simulation via the osquery-perf host-simulation command
Added Google Calendar integration with webhook-triggered remediation for failing team policies

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The macOS automatic enrollment profile no longer sets the await_device_configured option; it is now controlled by Fleet via the enable_release_device_manually config setting.

fleet-v4.47.0 Mar 12, 2024 · release notes

Fleet v4.47.0 adds host wipe via API/CLI, team-level webhooks, populate_policies query param, and No team live query option

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.47.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.47.0

└──▷ TRY IT

Fetch hosts along with their associated policy details in a single API call.

$ curl -X GET "https://<fleet-url>/api/v1/fleet/hosts?populate_policies=true" -H "Authorization: Bearer <token>"

Execute a live query against hosts that are not part of any team.

📍In the UI, go to Queries › New Query and select No team from the target dropdown before running.

Adds the wipe subcommand to fleetctl for remotely wiping a host's disk.
Adds POST /api/v1/fleet/hosts/:id/wipe API endpoint to trigger host wipe operations.
Enables setting host status webhooks at the team level via REST API and fleetctl.
Adds populate_policies=true query parameter to GET /hosts API to include policy data in responses.
Adds a No team option when running live queries from the UI to target hosts not assigned to any team.

+1 more show less

Supports <Add> nodes in Windows MDM profiles for device management.

6 details in Everything

fleet-v4.46.1 Feb 29, 2024 · release notes

Fleet v4.46.1 adds configurable Redis timeout and a new cron cleanup flag for stale data management

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.46.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.46.1

Adds redis.conn_wait_timeout config key to control connection wait times for standalone Redis deployments.
Adds --server_frequent_cleanups_enabled CLI flag (also available as FLEET_SERVER_FREQUENT_CLEANUPS_ENABLED) to enable a cron job that cleans up stale data every 15 minutes.

2 details in Everything

fleet-v4.45.0 Feb 21, 2024 · release notes

Fleet v4.45.0 adds fleetctl mdm lock/unlock, MDM command payloads in API response, and Windows OS vulnerability version data

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.45.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.45.0

└──▷ USE IT

Lock a specific host remotely via CLI to prevent unauthorized access during incident response.

shell

fleetctl mdm lock --host-id <HOST_ID> --message 'Security Lockdown'

Retrieve MDM command results including the specific payloads sent to agents for forensic analysis.

$ curl -s -H "Authorization: Bearer <API_TOKEN>" https://<FLEET_HOST>/api/_version_/fleet/mdm/commandresults

Check the version in which a specific Windows OS vulnerability was fixed to plan patching.

$ curl -s -H "Authorization: Bearer <API_TOKEN>" https://<FLEET_HOST>/api/_version_/os_versions | jq '.results[] | select(.name=="Windows 10") | .resolved_in_version'

Adds fleetctl mdm lock and fleetctl mdm unlock commands for locking and unlocking hosts managed by Fleet MDM
Adds the host_mdm_actions DB table for MDM lock and wipe functionality
Windows OS Vulnerabilities now include a resolved_in_version field in the /os_versions API response

3 details in Everything

fleet-v4.44.1 Feb 14, 2024 · release notes

Adds fleetctl gitops command for configuration synchronization and updates API host activity count.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.44.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.44.1

Adds the fleetctl gitops subcommand to synchronize Fleet configuration with a specified file, intended for GitOps workflows
Updates GET /api/v1/fleet/hosts/:id/activities/upcoming API response to include the total count of upcoming activities for a host

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The updated_at field in mdm_windows_configuration_profiles and mdm_apple_configuration_profiles is renamed to uploaded_at

fleet-v4.44.0 Feb 5, 2024 · release notes

Fleet v4.44.0 adds host expiry configs, OS vuln detection, label-based MDM profiles, and new API endpoints

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.44.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.44.0

Teams can now configure their own host expiry settings via a new UI toggle.
Added pack_delimiter to agent settings for customizing query report pack names.
Added support for detecting operating system vulnerabilities for macOS and Windows.
Added label-based MDM profiles reconciliation, allowing profiles to target labels instead of just individual devices.
Added new endpoints GET /api/v1/fleet/mdm/manual_enrollment_profile and script activity endpoints /hosts/:id/activity and /hosts/:id/activity/upcoming.

+3 more show less

Updated host details page and GET /api/v1/fleet/hosts/:id endpoint so that failing policies are listed first.
Added UI for host details activity card, now showing Run script action and linked activity.
Added host_count_updated_at to policy API responses.

8 details in Everything

fleet-v4.43.2 Jan 22, 2024 · release notes

Fleet v4.43.2 adds free tier UI states, fixes HTTP 204 handling, and improves MDM polling reliability.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.43.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.43.2

Adds free tier UI state to the OS updates and setup experience pages
Improves HTTP client in fleetctl and fleetd to correctly handle 204 No Content responses without errors
Displays warning and info messages when downgrading or upgrading fleetd or OSQuery

3 details in Everything

fleet-v4.43.0 Jan 9, 2024 · release notes

Fleet v4.43 adds synchronous live query endpoint, device mapping APIs, and custom email bundling

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.43.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.43.0

└──▷ TRY IT

Execute a live osquery query and wait for the synchronous result set.

$ curl -X POST https://fleet-server/api/v1/fleet/queries/{query_id}/run \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"parameters": {}}'

Associate a custom email address with a host for MDM enrollment profiles.

$ curl -X PUT https://fleet-server/api/fleet/orbit/device_mapping \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"device_mapping": {"email": "user@example.com"}}'

Bundle a custom end-user email into an MSI installer using fleetctl.

$ fleetctl package --end-user-email user@example.com

Adds POST /api/v1/fleet/queries/:id/run endpoint for synchronous live queries.
Adds PUT /api/fleet/orbit/device_mapping and PUT /api/v1/fleet/hosts/{id}/device_mapping endpoints for setting or replacing custom email addresses.
Adds experimental --end-user-email flag to fleetctl package for .msi installer bundling.
Adds host_count_updated_at to policy API responses.
Adds ability to query by host display name via list hosts endpoint.

+3 more show less

Adds gigs_total_disk_space to host endpoint responses.
Adds ability to remotely configure fleetd update channels in agent options (Fleet Premium only, requires fleetd >= 1.20.0).
Extends script execution timeout to 5 minutes.

8 details in Everything

fleet-v4.42.0 Dec 21, 2023 · release notes

Fleet v4.42 adds Windows MDM profile endpoints, host health/IDP filtering APIs, and software version management.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.42.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.42.0

└──▷ TRY IT

Enroll a new device with a randomized identifier to prevent static tracking during mass deployment.

$ fleetd enroll --host-identifier=random

Query host health status directly via API for custom monitoring dashboards.

$ GET /hosts/{id}/health

Adds POST /mdm/profiles, GET /mdm/profiles/{id}, GET /mdm/profiles/summary and other endpoints for managing Windows custom MDM profiles
Enables fleetctl to configure Windows MDM profiles for teams and no team
Adds GET /hosts/{id}/health endpoint for host health data
Adds capability to look up hosts based on IdP email
Updates manage hosts UI to filter hosts by software_version_id and software_title_id

+2 more show less

Adds --host-identifier option to fleetd for enrolling with a random identifier
Enables targeting hosts by serial number in fleetctl run-script and fleetctl mdm run-command

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed the FLEET_DEV_MDM_ENABLED feature flag for Windows MDM.

fleet-v4.41.0 Nov 29, 2023 · release notes

Fleet v4.41.0 adds PowerShell script support in CLI/UI, Windows profile MDM, and NVD API 2.0 for vulnerability data.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.41.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.41.0

fleetctl and API now support deploying PowerShell (.ps1) scripts to endpoints.
UI and backend introduce database tables supporting Windows profiles via MDM.
Fleet switches from NVD API 1.0 to NVD API 2.0 for downloading CVE information.
Software inventory now includes vulnerability data for JetBrains applications.

4 details in Everything

fleet-v4.40.0 Nov 7, 2023 · release notes

Fleet v4.40.0 adds Windows MDM protocol support, new API endpoints for MDM commands, and --context/--debug CLI flags.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.40.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.40.0

Introduced support for MS-MDM management protocol on Windows hosts
Added POST /fleet/mdm/commands/run platform-agnostic endpoint for sending MDM commands
Introduced GET mdm/commandresults endpoint to retrieve MDM command results for Windows and macOS
Added --context and --debug flags to the fleetctl mdm run-command subcommand
Enabled fleetctl mdm run-command execution on Windows hosts

+3 more show less

Extended vulnerability data support for JetBrains apps with similar names (e.g., IntelliJ IDEA.app vs. IntelliJ IDEA Ultimate.app)
Added Apple Rapid Security Response version to macOS host details
Included Chrome extensions in software data for ChromeOS hosts

8 details in Everything

fleet-v4.39.0 Oct 26, 2023 · release notes

Fleet v4.39.0 adds query result reporting, host scripts tab, Windows BitLocker key support, and new MDM/encryption API endpoints

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.39.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.39.0

└──▷ USE IT

Retrieve the stored report for a specific scheduled query to analyze historical data.

shell

curl -sS --header 'Authorization: Bearer <api-token>' https://<fleet-host>/api/_version_/fleet/queries/<query-id>/report

Retrieve the status of all saved scripts for a specific host.

shell

curl -sS --header 'Authorization: Bearer <api-token>' https://<fleet-host>/api/fleet/hosts/<host-id>/scripts

Report a BitLocker encryption key from a Windows host via Orbit to Fleet.

shell

curl -sS --header 'Authorization: Bearer <api-token>' --data '{"key": "<encrypted-key>"}' https://<fleet-host>/api/fleet/orbit/disk_encryption_key

Adds server_settings.query_reports_disabled config field to disable scheduled query result storage (up to 1000 results per query).
Adds GET /api/_version_/fleet/queries/{id}/report API endpoint to retrieve stored report data for a scheduled query.
Adds discard_data boolean field to API queries endpoints and YAML config to toggle whether a specific query's results are stored.
Adds host scripts tab and table on the host details page in the UI, with activity logging for script operations.
Adds GET /hosts/{id}/scripts endpoint to retrieve status details of saved scripts for a host.

+6 more show less

Adds API endpoints for script management (add, delete, edit) supporting saved script IDs.
Adds support to return the decrypted disk encryption key of a Windows host via new endpoint.
Adds POST /api/fleet/orbit/disk_encryption_key endpoint for Windows hosts to report BitLocker encryption keys.
Adds GET /mdm/disk_encryption/summary endpoint for disk encryption summaries for macOS and Windows.
Adds mdm.os_settings field to GET /api/v1/hosts/{id} response.
Adds os_settings and os_settings_disk_encryption filters to various host filtering endpoints.

11 details in Everything

fleet-v4.38.0 Sep 25, 2023 · release notes

Fleet v4.38.0 adds labels to fleetd extensions and new API fields for software reports.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.38.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.38.0

└──▷ TRY IT

Optimize host report queries by skipping policy failure counts when they are irrelevant.

$ curl -H 'Authorization: Bearer <token>' 'https://<fleet-host>/api/v1/fleet/hosts/report?disable_failing_policies=true'

Retrieve software inventory including NVD resolution versions and CVE descriptions for Premium accounts.

$ curl -H 'Authorization: Bearer <token>' 'https://<fleet-host>/fleet/software'

labels parameter in fleetd extensions allows targeting hosts by label
disable_failing_policies flag on /api/v1/fleet/hosts/report improves performance when issues are not needed
resolved_in_version field added to /fleet/software APIs (Premium only)
CVE descriptions included in the /fleet/software API responses

4 details in Everything

fleet-v4.37.0 Sep 8, 2023 · release notes

Fleet v4.37.0 adds fleetctl run-script, Orbit script endpoints, and policy API pagination.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.37.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.37.0

Adds fleetctl run-script command to execute scripts on hosts from the CLI
Adds /scripts/run and scripts/run/sync API endpoints to send a script to a host and optionally wait for results
Adds POST /api/fleet/orbit/scripts/request and POST /api/fleet/orbit/scripts/result Orbit-specific API endpoints for pending script handling
Adds pagination support to the policies API and corresponding frontend policy count endpoints
Adds endpoint to report fleetd errors and logic to report MDM migration errors

+4 more show less

Adds JumpCloud to the list of well-known MDM solutions
Improves performance at scale when applying hundreds of policies to thousands of hosts via fleetctl apply
Adds validation to fleetctl apply for duplicate policy names in YAML and team changes
Automatically sets DEP profile for teams created using /match endpoint

9 details in Everything

fleet-v4.36.0 Aug 17, 2023 · release notes

New fleetctl upgrade-packs command for migrating legacy packs and Windows MDM enrollment UI pages.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.36.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.36.0

└──▷ TRY IT

Migrate existing legacy pack configurations to the new schedule/query model in one step.

$ fleetctl upgrade-packs

Enroll a new Windows device with automatic MDM setup via the UI.

📍In Fleet UI, navigate to Settings › Devices › Windows and open the new Automatic Enrollment page to configure settings.

fleetctl upgrade-packs subcommand to migrate 2017-style packs to the new combined schedule and query format
POST /mdm/apple/profiles/match endpoint now automatically sets bootstrap package and end user authentication settings for newly created teams based on app config
fleetctl apply now auto-generates an enroll secret for new teams when none is provided in the configuration

3 details in Everything

fleet-v4.35.0 Aug 1, 2023 · release notes

Fleet 4.35 merges scheduling into the Queries interface and adds Azure/Microsoft MDM protocol support

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.35.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.35.0

└──▷ USE IT

Check the osquery config endpoint to see scheduled queries pulled from the team's queries table

shell

curl -s https://<fleet-host>/api/v1/osquery/config | jq '.data.queries'

Merged the schedule page functionality directly into the queries page, unifying creation, scheduling, and management in a single UI
Users can now manage scheduled queries using the automations modal instead of the legacy schedule interface
The query editor now includes frequency configuration options for scheduling logic
Added support for Azure JWT tokens as an authentication method
Added MSI installer deployment support through MS-MDM for Windows hosts

+2 more show less

Added support for the Windows MDM STS Auth Endpoint protocol
Added support for the MDM TOS endpoint

7 details in Everything

fleet-v4.34.0 Jul 12, 2023 · release notes

Programmatic Windows MDM enrollment, FLEET_DEV_MDM_ENABLED env var, and CPEMatchingRule type for CVE false positives

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.34.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.34.0

└──▷ TRY IT

Check if Windows MDM is enabled for the current config via API response

$ curl -s https://<fleet-host>/api/v1/fleet/config | jq '.mdm_enabled'

Added execution of programmatic Windows MDM enrollment on eligible devices when Windows MDM is enabled.
Microsoft MDM Enrollment Protocol: Added support for the RequestSecurityToken messages.
Microsoft MDM Enrollment Protocol: Added support for the DiscoveryRequest messages.
Microsoft MDM Enrollment Protocol: Added support for the GetPolicies messages.
Added enabled_windows_mdm and disabled_windows_mdm activities when a user turns on/off Windows MDM.

+7 more show less

Added support to enable and configure Windows MDM and to notify devices that are able to programmatically enroll.
Added ability to turn Windows MDM on and off from the Fleet UI.
Added enable and disable Windows MDM activity UI.
Added notification and execution of programmatic Windows MDM unenrollment on eligible devices when Windows MDM is disabled.
Added the FLEET_DEV_MDM_ENABLED environment variable to enable the Windows MDM feature during its development and beta period.
Added the mdm_enabled feature flag information to the response payload of the PATCH /config endpoint.
Added CPEMatchingRule type, used for correcting false positives caused by incorrect entries in the NVD dataset.

12 details in Everything

fleet-v4.33.0 Jun 13, 2023 · release notes

Fleet v4.33 adds ChromeOS management, MDM profile pre-assignment API, and team spec response payload

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.33.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.33.0

Adds support for managing ChromeOS devices, including built-in labels, dashboard details, and host creation policies.
Adds the POST /fleet/mdm/apple/profiles/preassign endpoint to store Apple MDM profiles before host assignment.
Adds the POST /fleet/mdm/apple/profiles/match endpoint to match pre-assigned profiles to a team or create one during enrollment.
Adds the team_ids_by_name key to the response payload of POST /api/latest/fleet/spec/teams for programmatic team lookup.
Enables targeting ChromeOS devices in host creation policies and displaying ChromeOS-specific details in the UI.

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The enable_jit_role_sync setting is deprecated; role sync behavior changes to rely on attributes in the SAMLResponse.

fleet-v4.32.0 May 24, 2023 · release notes

Fleet v4.32.0 adds macOS MDM migration support via new config keys and API endpoint

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.32.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.32.0

Added mdm.macos_migration app config key for configuring MDM migration behavior
Added enable_end_user_authentication to mdm.macos_setup in global app config and team config objects
Added PATCH /mdm/apple/setup endpoint for managing macOS setup configurations

3 details in Everything

fleet-v4.31.0 May 1, 2023 · release notes

Fleet v4.31.0 adds gitops role, fleetctl get mdm-commands, SAML-gated MDM login, and macOS setup assistant management

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.31.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.31.0

└──▷ TRY IT

Retrieve a list of all MDM commands previously sent to agents for audit or debugging purposes.

$ fleetctl get mdm-commands

Configure the macOS Setup Assistant for a specific team via the CLI.

$ fleetctl apply --config <<EOF
kind: team
metadata:
  name: engineering
mdm:
  macos_setup:
    macos_setup_assistant:
      profile_url: https://example.com/setup.plist
EOF

Programmatic management of the global macOS enrollment profile.

$ curl -X POST https://<fleet-url>/api/latest/fleet/mdm/apple/enrollment_profile \
  -H 'Authorization: Bearer <token>' \
  -H 'Content-Type: application/json' \
  -d '{"profile": "base64_encoded_profile_data"}'

fleetctl get mdm-commands now retrieves executed MDM command history.
GET /api/latest/fleet/mdm/apple/commands endpoint added for programmatic access to MDM commands.
fleetctl apply now supports mdm.macos_setup.macos_setup_assistant key in YAML payloads for team and global config.
New API endpoints to set, get, and delete the macOS setup assistant: GET, POST, and DELETE /api/latest/fleet/mdm/apple/enrollment_profile.
Introduced gitops user role for users managing configuration via GitOps workflows.

+1 more show less

Apple MDM login can now be gated behind SAML authentication.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!MDM profile status applied has been migrated to verifying, which may affect scripts or dashboards filtering on the old status value.

fleet-v4.30.0 Apr 10, 2023 · release notes

New MDM command execution, observer_plus role, disk encryption filtering, and SES email backend in Fleet v4.30.0

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.30.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.30.0

└──▷ USE IT

List only hosts that have completed MDM enrollment on Apple devices.

shell

fleetctl get hosts --mdm

Disable HTTP Basic Auth for the internal Prometheus metrics endpoint to allow unauthenticated scraping.

config

prometheus.basic_auth.disable: true

--mdm and --mdm-pending flags on fleetctl get hosts to filter by MDM enrollment state.
New fleetctl mdm run-command subcommand for executing Apple MDM commands on hosts.
New fleetctl get mdm-command-results subcommand to retrieve results of previous MDM commands.
mdm_enrollment_status filter (supporting enrolled) and new mdm_name filter on List/Count hosts endpoints.
Disk encryption status filtering on GET /hosts, GET /hosts/count, and GET /labels/:id/hosts API endpoints.

+6 more show less

New API endpoint for disk encryption aggregate status data.
observer_plus user role allowing observers to run any live query.
Premium-only Published column in the vulnerabilities table showing first publication date.
Config option websockets_allow_unsafe_origin to disable websocket origin checks.
New config prometheus.basic_auth.disable to remove HTTP Basic Auth from Prometheus endpoint.
SES email backend configuration for sending emails directly via Amazon SES APIs.

11 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed the FLEET_MDM_APPLE_ENABLE feature flag; remove from your environment variables if set.
!Removed the FLEET_DEV_MDM_ENABLED feature flag; remove from your environment variables if set.

fleet-v4.29.0 Mar 22, 2023 · release notes

Fleet v4.29.0 adds Okta-gated DEP enrollment, Mac disk encryption controls via fleetctl and API, and new MDM/Windows CIS benchmark support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.29.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.29.0

Adds mdm.macos_settings.enable_disk_encryption config key to fleetctl apply for config and team kinds
Adds GET /hosts/{id} and GET /device/{token} status fields: mdm.macos_settings.disk_encryption and mdm.macos_settings.action_required
Adds new API endpoint GET /mdm/apple/profiles/summary for Apple MDM profile aggregation
Adds Okta integration for DEP enrollment via configuration values and gates enrollment profiles behind Okta authentication with a new gated access endpoint
Adds GET /hosts/{id} and host-list filter for aggregate status of MDM-managed macOS settings

+2 more show less

Adds Win 10 policies for CIS Benchmark 18.x, 2.3.17.x, and 2.3.10.x
Adds fleetd support for Chrome device enrollment via serial number

7 details in Everything

fleet-v4.28.0 Feb 28, 2023 · release notes

Fleet v4.28.0 adds MDM-driven macOS profile management APIs, fleetctl policy/team flags, and FileVault key ingestion

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.28.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.28.0

Added API endpoint to retrieve a host disk encryption key for macOS if Fleet's MDM is enabled.
Added API endpoints to create, delete, list, and download MDM configuration profiles.
Added --policies-team flag to fleetctl apply to easily import a group of policies into a team.
Added support for providing macos_settings.custom_settings profiles for team (with Fleet Premium) and no-team levels via fleetctl apply.
Added logic to ingest and decrypt FileVault recovery keys on macOS if Fleet's MDM is enabled.

5 details in Everything

fleet-v4.27.0 Feb 4, 2023 · release notes

Fleet v4.27 adds MDM host unenrollment API, macOS update enforcement config, and manual enrollment profile download endpoint.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.27.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.27.0

Adds POST /api/v1/fleet/mdm/apple/request_csr endpoint to trigger a Certificate Signing Request and return APNs private key and SCEP certificate
Adds the notifications.renew_enrollment_profile field in GET /api/fleet/orbit/config response to signal fleetd to renew DEP enrollment profile
Adds GET /device/{token}/mdm/apple/manual_enrollment_profile endpoint for downloading manual MDM enrollment profiles from Fleet Desktop
Adds mdm enrollment status and mdm server url fields to GET /hosts and GET /hosts/:id endpoint responses
Adds keys to GET /config and GET /device/:token endpoints to indicate if Fleet's MDM is properly configured

+1 more show less

Adds edited_macos_min_version activity type when the required minimum macOS version is updated

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Changes default hosts per page from 100 to 50

fleet-v4.26.0 Jan 14, 2023 · release notes

Fleet v4.26.0 adds mdm.apple_bm_default_team config key, MDM pending enrollment filtering, audit log plugins, and a new software_updated_at column.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.26.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.26.0

Added mdm.apple_bm_default_team to app config to set the default team for Apple Business Manager enrollments
Added pending as an option to filter hosts by MDM enrollment status in the API/UI
Added support for filesystem, firehose, kinesis, lambda, pubsub, kafkarest, and stdout log plugins for audit log generation
Added software_updated_at column to host data to denote when software was updated

4 details in Everything

fleet-v4.25.0 Dec 23, 2022 · release notes

Fleet v4.25 adds fleetctl trigger/MDM commands, APNs/SCEP/DEP key generation, and role/activity logging.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.25.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.25.0

└──▷ USE IT

Trigger an ad hoc run of jobs from a specific cron schedule immediately via CLI.

shell

fleetctl trigger <cron-schedule-id>

Retrieve current Apple MDM configuration details for a deployed host or environment.

shell

fleetctl get mdm_apple

fleetctl trigger subcommand to ad hoc run all jobs in a specified cron schedule.
fleet serve configuration flags for Apple Push Notification service (APNs) certificates and keys.
fleet serve configuration flags for Simple Certificate Enrollment Protocol (SCEP) certificates and keys.
fleet serve configuration flags for Apple Business Manager (BM).
New activity recording create/edit/delete user roles.

+12 more show less

All successful logins recorded as activity; IP logged to stderr for all login attempts.
fleetctl get mdm_apple command to retrieve Apple MDM configuration information.
fleetctl get mdm_apple_bm command to retrieve Apple Business Manager configuration information.
fleet serve configuration flag (or fleetctl command) to generate DEP public and private keys.
Ability to mark a policy as critical available with Fleet Premium.
Automation capability to run policies on all hosts already failing that policy.
Functionality to report if a carve failed along with the specific error message.
redis.username configuration option added for Redis ACL support.
counts_update_at attribute added to GET /hosts/summary/mdm response.
mdm_id and mdm_enrollment_status query params now filter results from GET /labels/:id/hosts.
mobile_device_management_solution field added to GET /labels/:id/hosts response when mdm_id is included.
API endpoint added to generate DEP public and private keys.

17 details in Everything

fleet-v4.24.0 Dec 2, 2022 · release notes

Fleet v4.24.0 adds Void Linux support, clickable software table rows, and agent flag configuration improvements

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.24.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.24.0

└──▷ HOW TO FIND IT

View all hosts running specific software by clicking directly on a row in the software inventory table

📍In the Fleet UI, navigate to Inventory › Software, locate the desired package in the list, and click any row.

Configure additional osquery flags for agents on Void Linux hosts

text

In Host settings or via the Fleet API, add OS-specific command-line flags to the agent options configuration.

Added Void Linux to the list of recognized distributions for host inventory
Added clickable rows to software tables to view all hosts filtered by software
Added support for more OS-specific osquery command-line flags in the agent options

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed the Preview payload button from the usage statistics page and its associated logic

fleet-v4.23.0 Nov 14, 2022 · release notes

Fleet v4.23.0 adds MSRC Windows vulnerability detection, low_disk_space filtering, and Jira/Zendesk vulnerability scores for Premium.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.23.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.23.0

GET /hosts/{id} API now includes disk_encryption status in the response for new ingestion of host disk encryption.
New low_disk_space filter support for GET /labels/{id}/hosts API endpoint and Hosts table UI filtering by platform.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Windows Servers are excluded from MDM lists and aggregated data.

4.23.0 Nov 14, 2022 · release notes

Fleet 4.23.0 adds MSRC Windows vulnerability scanning, host OS ingestion, disk encryption API/fields, and Jira/Zendesk ticket enhancements

└──▷ GET THIS VERSION

$ git clone --branch 4.23.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.23.0

Use operating_system_vulnerabilities table populated from MSRC security bulletins for Windows vulnerability detection
Query number of hosts enrolled by orbit version and osquery version via usage statistics payload
View public IP address in Hosts table using new UI option
Filter low disk space hosts by platform in the UI and via GET /labels/{id}/hosts endpoint

4 details in Everything

fleet-v4.22.0 Oct 21, 2022 · release notes

Fleet v4.22 adds Home page low disk/missing host widgets, inherited policies API, and device token expiration logic.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.22.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.22.0

└──▷ TRY IT

Retrieve the global policies inherited by a specific team along with pass/fail counts for their hosts.

$ curl -H 'Authorization: Bearer <TOKEN>' https://fleet.example.com/api/v1/fleet/teams/{team_id}/policies

Update agents to ensure they stay within the new one-hour device token expiration window.

shell

fleetctl package [...] --orbit-channel 1.0.0 --desktop-channel 1.1.0

GET /teams/{team_id}/policies endpoint returns inherited_policies array with global policy pass/fail counts for the team's hosts
Fleet Premium Home page displays count and list of hosts with less than 32GB available disk space
Fleet Premium Home page displays count and list of missing (offline ≥ 30 days) hosts
Device tokens expire after one hour; older Fleet Desktop versions are incompatible without manual update

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Fleet Desktop versions < v1.0.0 can no longer authenticate because device tokens now expire after one hour

fleet-v4.21.0 Oct 5, 2022 · release notes

Fleet 4.21 adds osquery table support, remote flag management, and new API routes for policy failure counts.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.21.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.21.0

└──▷ TRY IT

Automate macOS installer generation targeting a specific team without hardcoding the ID in the binary.

$ AC_TEAM_ID="<team_id>" fleetctl package --type macos

Check policy failure counts for a specific device token via the API.

$ curl -X GET https://<fleet_host>/api/v1/fleet/device/{token}/desktop -H "Authorization: Bearer <token>"

Adds AC_TEAM_ID environment variable to control team association for signed macOS installers
Adds /api/v1/fleet/device/{token}/desktop API route returning the number of failing policies for a specific host
Enables remote management of osquery flags via Orbit agent manager
Adds support for kubequery data source
Integrates es_process_file_events, password_policy, and windows_update_history osquery tables

+1 more show less

Configures validation for config and teams YAML configuration files

6 details in Everything

fleet-v4.20.0 Sep 9, 2022 · release notes

Fleet v4.20 adds Munki issue visibility, features section for canary teams, and vulnerability scores in webhooks

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.20.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.20.0

└──▷ HOW TO FIND IT

View the SQL for a specific scheduled query directly from the UI.

📍Click Show query on the Schedule page.

Munki issues are now surfaced on the Home > macOS page, Host details page, and via GET /api/v1/fleet/macadmins and GET /api/v1/fleet/hosts/{id}/macadmins API routes.
Fleet Premium: Added a features section in the YAML config to test features like software inventory on canary teams.
Fleet Premium: Vulnerability webhook payloads now include EPSS probability, CVSS scores, and CISA-known exploits.
Added a Show query button on the Schedule page to quickly view a scheduled query's SQL.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!additional_queries is removed from hosts enrolled in a team when upgrading Fleet Premium.

fleet-v4.19.0 Aug 23, 2022 · release notes

Fleet v4.19.0 adds JIT user provisioning via SSO, vendor data in software API, async query stats, and UI tables

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.19.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.19.0

Adds Just-in-time (JIT) user provisioning via SSO for Fleet Premium to automatically create accounts on login
Adds vendor field to the response of the GET /software API route for software inventory
Adds async saving of scheduled query statistics as an experimental feature controlled by config
Adds MDM solutions table to the Home > macOS page in the Fleet UI
Adds Operating systems table to the Home > Windows page in the Fleet UI

5 details in Everything

fleet-v4.18.0 Aug 1, 2022 · release notes

Fleet v4.18.0 adds CTAs to failing policy banners, rate limits device endpoints, and enforces admin-set password requirements

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.18.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.18.0

Adds a Call to Action button to the failing policy banner in Fleet Desktop, empowering end-users to manage device compliance
Introduces rate limiting for device authorized endpoints to improve Fleet Desktop security
Enforces standard password requirements when users are created by an admin

3 details in Everything

4.17.1 Jul 22, 2022 · release notes

Fleet 4.17.1 improves Battery Health processing for M1 Macs.

└──▷ GET THIS VERSION

$ git clone --branch 4.17.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.17.1

fleet-v4.17.0 Jul 9, 2022 · release notes

Fleet v4.17.0 adds battery health tracking, OVAL scanning for RHEL/Fedora, and /healthz granularity.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.17.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.17.0

/healthz?check=mysql and /healthz?check=redis endpoints added to allow separate health checks for MySQL and Redis.
Added docker_container_envs table to the osquery table schema on the Query page.
Added support for scanning RHEL-based and Fedora hosts for vulnerable software using OVAL definitions.

3 details in Everything

fleet-v4.16.0 Jun 21, 2022 · release notes

Fleet v4.16.0 adds ticket workflow for policy failures, EPSS/CVSS vulnerability scoring, OVAL support for Ubuntu, and new API endpoints.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.16.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.16.0

└──▷ TRY IT

Search for targets matching a query using the new POST search endpoint.

$ POST /targets/search
{\n  "query": "SELECT * FROM os_version"\n}

Count targets matching a query using the new POST count endpoint.

$ POST /targets/count
{\n  "query": "SELECT * FROM os_version"\n}

Added scoring to vulnerability detection, including EPSS probability score, CVSS base score, and known exploits
Added a ticket-workflow for policy automations. Configured Fleet to automatically create a Jira issue or Zendesk ticket when one or more hosts fail a specific policy
Added OVAL processing for Ubuntu hosts
Added software details page to the Fleet UI
Added support for custom headers for requests made to fleet instances by the fleetctl command

+2 more show less

Added /api/_version_/fleet/device/{token}/policies to retrieve policies for a specific device
Added POST /targets/search and POST /targets/count API endpoints

7 details in Everything

fleet-v4.15.0 May 27, 2022 · release notes

Fleet v4.15.0 adds beta Zendesk/Jira vuln integration, Fleet Desktop for Mac/Windows, and several new API fields.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.15.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.15.0

└──▷ USE IT

Generate an installer for Fleet Desktop on macOS to allow end-users to view device info

shell

fleetctl package --fleet-desktop --platform darwin

Print debug error output directly to the console for easier log parsing

shell

fleetctl debug errors -stdout

Check if CVE scores are now returned in software listings via the API

shell

curl -s https://<fleet-server>/api/v1/fleet/software | jq '.software[] | select(.cve_scores != null)',

Adds beta support for automatic vulnerability reporting to Zendesk and Jira via configuration
Expands Fleet Desktop availability to Mac and Windows hosts using fleetctl package with --fleet-desktop flag
Adds host software last-used timestamp visibility in the Host Details UI view
Enables column selection when exporting hosts to CSV from the UI
Adds device_mapping field to host information in UI and API responses

+7 more show less

Adds CVE scores to /software API endpoint responses when available
Adds all_linux_count and builtin_labels fields to GET /host_summary response
Shows Bundle identifier tooltip for macOS applications on the Software page
Improves fleetctl debug errors output and adds -stdout flag to print errors to stdout
Adds support for Docker Compose V2 in fleetctl preview
Enables asynchronous processing configuration for host_last_seen, label_membership, and policy_membership via enable_async_host_processing settings
Increases MySQL group_concat_max_len setting from 1024 to 4194304

12 details in Everything

fleet-v4.14.0 May 9, 2022 · release notes

Fleet v4.14 adds beta Jira integration, Fleet Desktop for Linux, --fleet-desktop flag, new API property, and a Postman collection.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.14.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.14.0

Add beta support for Jira integration to automatically create an issue when a new vulnerability (CVE) is detected on hosts
Add a Show query button on the live query results page in the UI
Add a Postman Collection for the Fleet API routes
Add beta support for Fleet Desktop on Linux device user information display
Add --fleet-desktop flag to the fleectl package command

+4 more show less

Add last_opened_at property for macOS software in the GET /hosts/{id} Host details API route
Improve error message returned when running fleetctl query with missing or misspelled hosts
Improve duration settings output format for fleetctl get config --include-server-config from nanoseconds to human-readable format
Improve empty states and forms on the Policies, Queries, and Host details pages in the UI

9 details in Everything

└──▷ BREAKING ON UPGRADE

!All duration settings returned by fleetctl get config --include-server-config were changed from nanoseconds to an easy to read format

fleet-v4.13.0 Apr 18, 2022 · release notes

Fleet v4.13 adds Jira beta, Windows Fleet Desktop, team webhook destinations, and new API/OS version views

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.13.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.13.0

└──▷ TRY IT

Create a Windows installer that includes Fleet Desktop so device users can see their device info

$ fleectl package --fleet-desktop

Adds --fleet-desktop flag to the fleectl package command to include Fleet Desktop in the installer for Windows devices
Adds ability to specify a team-specific Destination URL for policy automations in Fleet Premium to send webhooks to unique locations per team
Adds Beta support for integrating with Jira to automatically create an issue when a new CVE is detected on a host
Adds the GET /os_versions API route to retrieve the total number of hosts with specific macOS versions
Adds basic_auth.username and basic_auth.password configuration options to enable Prometheus endpoint authentication

+2 more show less

Adds a Vulnerabilities column to the Host details > Software page to see and search CVEs on a host
Adds ability to sort live query results directly in the Fleet UI

7 details in Everything

└──▷ BREAKING ON UPGRADE

!The GET /metrics API route is now disabled if basic_auth.username and basic_auth.password configuration options are left unspecified.

fleet-v4.12.0 Mar 25, 2022 · release notes

Fleet v4.12 adds --fleet-desktop flag, GeoIP database_path, Kafka content_type_value, and beta macOS Fleet Desktop support.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.12.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.12.0

└──▷ TRY IT

Generate a macOS installer package that includes the Beta Fleet Desktop client for device management.

$ fleectl package --fleet-desktop

fleectl package now accepts the --fleet-desktop flag to generate a macOS installer with Beta Fleet Desktop
New database_path configuration option enables custom GeoIP databases, populating geolocation on Host details and in GET /hosts/{id}
New content_type_value Kafka REST Proxy configuration option allows compatibility with different Kafka REST Proxy versions
session_duration config option default increased to 5 days for all users

4 details in Everything

fleet-v4.11.0 Mar 7, 2022 · release notes

Fleet v4.11.0 adds team-targeted query packs, per-team API retrieval, and policy activity feed.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.11.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.11.0

└──▷ USE IT

Retrieve the configuration details for a specific team using the CLI.

shell

fleetctl get team --name engineering-team

Adds a teams key to the packs YAML document for Fleet Premium users managing CI/CD with query packs
Adds fleetctl get team --name <team-name-here> command to retrieve configuration for a specific team
Removes expiration limits on API tokens for API-only users created via fleetctl user create --api-only command
Adds policy add, edit, and delete activities to the Home page activity feed
Exposes policy activity information through the GET /activities API endpoint

5 details in Everything

fleet-v4.10.0 Feb 14, 2022 · release notes

Fleet v4.10.0 adds Software page, host vulnerability counts, webhook automations for new CVEs, and fleetctl debug subcommands.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.10.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.10.0

└──▷ USE IT

Check host counts for vulnerable software via the API without opening the UI.

shell

curl -s https://<fleet-host>/api/v1/fleet/software | jq '.software[] | select(.vulnerable_hosts > 0) | {name, vulnerable_hosts}'

Run a deep debug dump including database state using the new subcommands.

shell

fleetctl debug --db-innodb-status --db-process-list --output /tmp/fleet-debug-4.10.zip

Configure a webhook automation to trigger when a new CVE is detected on hosts.

📍In the Fleet UI, go to Automations › New Automation › Vulnerability. Set the condition to New vulnerability found and specify your webhook URL.

Add aggregate software and vulnerability information on the new Software page
Add ability to see how many hosts have a specific vulnerable software installed on the Software page via GET /api/v1/fleet/software API route
Add ability to send a webhook request if a new vulnerability (CVE) is found on at least one host
Add aggregate Mobile Device Management and Munki data on the Home page
Add ability to filter software by Vulnerable on the Host details page

+7 more show less

Add db-innodb-status and db-process-list to fleetctl debug command
Add Premium feature to generate a Fleet installer and manage enroll secrets on the Team details page
Allow users with the observer role to view which platforms (macOS, Windows, Linux) a query is compatible with
Add ability to disable scheduled query performance statistics
Add ability to filter the host summary information by platform (macOS, Windows, Linux) on the Home page
Add filter software by CVE
Improve vulnerability processing for NPM packages

12 details in Everything

fleet-v4.9.1 Feb 3, 2022 · release notes

fleetctl package MSI output now supports in-place reinstallation on Windows

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.9.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.9.1

fleetctl package MSI packages can now reinstall over an existing installation on Windows without requiring a prior uninstall step.

1 detail in Everything

fleet-v4.9.0 Jan 22, 2022 · release notes

Fleet v4.9.0 adds policy YAML application for GitOps, Redis timeout configs, and pagination for large live query results.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.9.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.9.0

Add ability to apply a policy yaml document so that GitOps workflows can be used to create and modify policies
Add ability to run a live query that returns 1,000+ results in the Fleet UI by adding client-side pagination to the results table
Improve the accuracy of query platform compatibility detection by adding recognition for queries with the WITH expression
Add ability to open a page in the Fleet UI in a new tab by right-clicking an item in the navigation
Improve the live query API route (GET /api/v1/queries/run) so that it successfully return results for Fleet instances using a load balancer by reducing the wait period to 25 seconds

+2 more show less

Add read_timeout Redis configuration option to customize the maximum amount of time Fleet should wait to receive a response from a Redis server
Add write_timeout Redis configuration option to customize the maximum amount of time Fleet should wait to send a command to a Redis server

7 details in Everything

fleet-v4.8.0 Dec 31, 2021 · release notes

Fleet v4.8.0 adds webhook automations for policy failures, Chrome profile filtering, and new Macadmins API endpoints

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.8.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.8.0

Adds host_policy.failed_webhook automation to send a request when hosts fail a policy
Adds filtering hosts by chrome_profile_email in the UI and API
Adds GET /api/v1/fleet/hosts/{id}/device_mapping API route for Chrome profile info
Adds GET /api/v1/fleet/hosts/{id}/macadmins API route for MDM and Munki details
Shows MDM enrollment status, server URL, and Munki version on the Host details page

5 details in Everything

└──▷ BREAKING ON UPGRADE

!http_request_duration_microseconds is renamed to http_request_duration_seconds_bucket in /metrics
!http_request_duration_microseconds_sum is renamed to http_request_duration_seconds_sum in /metrics
!http_request_duration_microseconds_count is renamed to http_request_duration_seconds_count in /metrics
!http_request_size_bytes is renamed to http_request_size_bytes_bucket in /metrics
!http_response_size_bytes is renamed to http_response_size_bytes_bucket in /metrics

v0.0.4 Dec 23, 2021 · release notes

Fleet v0.0.4 adds automatic osquery flagfile loading and defaults to UUID host IDs for better TLS and identity stability

└──▷ GET THIS VERSION

$ git clone --branch v0.0.4 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout v0.0.4

└──▷ TRY IT

Provide a custom certificate bundle to ensure TLS compatibility when certs.pem is present in the root directory.

$ place certs.pem in the root directory of your Fleet installation

Use UUID as the default host identifier for osquery.
Add github.com/macadmins/osquery-extension tables.

2 details in Everything

fleet-v4.7.0 Dec 14, 2021 · release notes

Fleet 4.7 decouples policies from saved queries, adds vulnerability processing, and new fleetctl debug commands.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.7.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.7.0

Introduces breaking changes to the /policies API routes to separate policies from saved queries
Adds policy templates on the Policies page for standard yes or no questions
Enables vulnerability processing for all instances with software inventory enabled to view hosts with vulnerable software
Adds fleetctl debug migrations command to check for missing migrations
Changes default login session length to 24 hours

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The /policies API routes have changed; policies are no longer automatically linked to saved queries in the backend

fleet-v4.6.2 Dec 2, 2021 · release notes

Fleet v4.6.2 adds cursor pagination and a filter to the GET /hosts API

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.6.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.6.2

└──▷ TRY IT

Retrieve the next page of hosts after a specific cursor ID for large deployments.

$ curl -H 'Authorization: Bearer <token>' 'https://<fleet-host>/api/v1/fleet/hosts?after=<cursor_id>'

Fetch host list without calculating failing policy counts to reduce API latency.

$ curl -H 'Authorization: Bearer <token>' 'https://<fleet-host>/api/v1/fleet/hosts?disable_failing_policies=true'

Adds after parameter to the GET /hosts API route to allow for cursor pagination
Adds disable_failing_policies parameter to the GET /hosts API route to optimize response time

2 details in Everything

4.6.1 Nov 21, 2021 · release notes

Fleet 4.6.1 validates configuration in fleetctl apply

└──▷ GET THIS VERSION

$ git clone --branch 4.6.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.6.1

└──▷ USE IT

Verify your YAML or JSON configuration is valid before applying it to avoid deployment errors.

shell

fleetctl apply --config my_fleet_config.yaml

fleet-v4.6.0 Nov 19, 2021 · release notes

Fleet v4.6.0 adds fleetctl updates rotate, get software, and new Home/Hosts UI capabilities with breaking webhook payload change

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.6.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.6.0

└──▷ TRY IT

Rotate update server keys from the command line

$ fleetctl updates rotate

Retrieve aggregated host summary data programmatically via REST API

$ curl -s -H "Authorization: Bearer $FLEET_TOKEN" https://$FLEET_HOST/api/v1/fleet/host_summary

Configure software inventory for a new deployment via config file

json

{
  "enable_software_inventory": true
}

Add ability to filter aggregate host data (platforms, status) on the Home page; available via the [GET /host_summary API route](https://fleetdm.com/docs/using-fleet/rest-api#get-hosts-summary)
Add fleetctl updates rotate subcommand for rotation of keys in the updates system
Enable software inventory by default for new Fleet instances, controlled by the [enable_software_inventory configuration option](https://fleetdm.com/docs/using-fleet/vulnerability-processing#setup)
Add ability to see all software and filter by vulnerable software on the Home page; data available via GET /software API route and fleetctl get software command
Add ability to manage enroll secrets (add, edit, delete) on the Hosts page

+4 more show less

Move pending invited users between teams in Fleet Premium
Add Shell column to Users table on the Host details page for filtering logged-in users
See original author of a query on the Query page and scheduled queries per host on the Host details page
Package osquery flagfile with fleetctl package --osquery-flagfile and include osquery's certs.pem in packages

9 details in Everything

└──▷ BREAKING ON UPGRADE

!The host status webhook payload now uses the text property instead of the message property.

fleet-v4.5.0 Nov 1, 2021 · release notes

Fleet v4.5.0 adds Team admin role, Kafka logging, MinIO backend, live query API, and new software/policy endpoints

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.5.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.5.0

Adds Team admin user role for delegating team member management in Fleet Premium.
Adds Apache Kafka logging plugin support for external log streaming.
Adds MinIO as a supported file carving backend.
Adds GET /api/v1/fleet/queries/run API route to execute live queries via REST API.
Adds policy status (Passing or Failing) to the Host details page and GET api/v1/fleet/hosts/{id} API.

+9 more show less

Adds Issues column on the Hosts page to show total failing policies per host.
Adds query platform compatibility information (macOS, Windows, Linux) in the UI.
Adds query performance impact estimation (Minimal, Considerable, Excessive) for scheduled queries.
Adds ability to view hosts with specific software versions via Host details page; requires feature flag.
Adds GET /api/v1/fleet/software API route to list all vulnerable software across hosts.
Adds exact host count for filters on the Hosts page and GET api/v1/fleet/hosts/count API endpoint.
Adds automatic Refetch capability for host vitals without manual page reload.
Adds TLS support for Redis connections via configuration.
Adds cluster_read_from_replica config key to prefer reading from Redis replicas.

14 details in Everything

fleet-v4.4.0 Oct 6, 2021 · release notes

Fleet v4.4.0 adds host bulk deletion, inherited schedule visibility, and fleetctl get hosts enhancement for premium features.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.4.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.4.0

└──▷ TRY IT

List hosts including any associated additional queries for auditing or debugging policy assignments.

$ fleetctl get hosts --format yaml

Bulk delete selected hosts in the Fleet UI to remove machines from your inventory.

📍In the Manage Hosts page, select hosts or use filters, then click Delete Selected.

fleetctl get hosts now displays host additional queries if they are configured
Add ability to bulk delete hosts based on manual selection and applied filters

2 details in Everything

fleet-v4.3.1 Sep 22, 2021 · release notes

Fleet v4.3.1 adds vulnerability data streaming via new fleetctl commands and config keys, plus observer-only query filtering.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.3.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.3.1

└──▷ USE IT

List software with vulnerabilities for all hosts in your fleet.

shell

fleetctl get software

Manually trigger a sync of the vulnerability data streams from the CLI.

shell

fleetctl vulnerability-data-stream

fleetctl get software command added to list all software and detected vulnerabilities (Beta feature)
fleetctl vulnerability-data-stream command added to manually sync vulnerabilities processing data streams
disable_data_sync configuration option added to avoid downloading vulnerability data streams
Observers now see only the queries they have permissions to run on the Queries page
connect_retry_attempts Redis configuration option added to retry failed connections

+2 more show less

cluster_follow_redirections Redis configuration option added to follow cluster redirections
max_jitter_percent osquery configuration option added to prevent hosts from returning data simultaneously

7 details in Everything

fleet-v4.3.0 Sep 13, 2021 · release notes

Fleet v4.3.0 adds policy compliance detection, Orbit package building via fleetctl, and Redis/MySQL replication support

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.3.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.3.0

└──▷ TRY IT

Build a custom Orbit installer package for agent deployment.

$ fleetctl package

Debug why specific hosts are sending unexpected data to the Fleet server by filtering telemetry logs.

yaml

server_settings:
  debug_host_ids:
    - "host_id_1"
    - "host_id_2"

Add Policies feature for detecting device compliance with organizational policies.
Add fleetctl package subcommand for building Orbit agent packages.
Add server_settings.debug_host_ids config key to gather detailed telemetry from specified hosts.
Add support for MySQL read replicas to scale Fleet server host ingestion.
Add configurable webhook notification when a percentage of hosts remain offline beyond a specified day threshold.

+2 more show less

Expose free disk space metrics (in gigabytes and percentage) in the host dashboard UI.
Add server_settings.redis config options for connection timeout and keep-alive interval.

7 details in Everything

fleet-v4.2.3 Aug 26, 2021 · release notes

Adds fleetctl debug connection command for troubleshooting connectivity issues

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.2.3 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.2.3

fleet-v4.2.2 Aug 19, 2021 · release notes

Adds All Linux built-in label and -o flag to fleetctl convert for controlled output.

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.2.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.2.2

└──▷ USE IT

Convert YAML query definitions to JSON and write directly to a file for pipeline integration, avoiding encoding issues from shell redirection.

shell

fleetctl convert --format json queries.yaml -o queries.json

Adds -o flag to fleetctl convert command to write output to a specified file path without shell redirection
Adds All Linux as a new built-in label to target all hosts running any Linux distribution

2 details in Everything

4.2.1 Aug 14, 2021 · release notes

Fleet 4.2.1 enables observer and maintainer roles to refetch hosts within their teams.

└──▷ GET THIS VERSION

$ git clone --branch 4.2.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 4.2.1

Allows observers and maintainers to refetch a host in a team they belong to

1 detail in Everything

fleet-v4.2.0 Aug 12, 2021 · release notes

Adds host filtering by status+label, team, vulnerable software surface, scheduled query modification, and enable_host_users config key

└──▷ GET THIS VERSION

$ git clone --branch fleet-v4.2.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout fleet-v4.2.0

Add ability to simultaneously filter hosts by status (online, offline, new, mia) and by label on the Hosts page.
Add ability to filter hosts by team in the Fleet UI, fleetctl CLI tool, and Fleet API. *Available for Fleet Basic customers*.
Add Beta Vulnerable software feature which surfaces vulnerable software on the Host details page and the GET /api/v1/fleet/hosts/{id} API route.
Configured logging destination information is also available in the GET api/v1/fleet/config API route.
Add ability to disable the Users feature in Fleet by setting the new enable_host_users key to true in the config yaml, configuration file.

+1 more show less

Add ability to modify scheduled queries in your Schedule in Fleet.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Server binaries will only be published for Linux and Docker; pre-built binaries for Windows or macOS are no longer included.

v4.1.0 Jul 26, 2021 · release notes

Fleet v4.1.0 adds Schedule and Activity feed, plus CLI/API updates for teams, users, and hosts

└──▷ GET THIS VERSION

$ git clone --branch v4.1.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout v4.1.0

fleetctl get hosts now retrieves host status, display_text, and labels.
New fleetctl user delete command to remove a user from Fleet.
teams yaml document added to fleetctl for creating teams and updating agent options/enroll secrets (Fleet Basic).
user_roles yaml document added to fleetctl for managing user roles (Fleet Basic).
REST API endpoint /api/v1/fleet/hosts/{id} now exposes username, uid, type, and groupname for the Users table on Host details.

+2 more show less

fleetctl and Fleet UI support for the new *Schedule* feature to execute queries at regular intervals without configuring osquery query packs.
New *Activity feed* on the *Home* page to observe changes to queries, packs, and live queries.

7 details in Everything

v4.0.1 Jul 2, 2021 · release notes

Allows using http for localhost configurations in fleetctl

└──▷ GET THIS VERSION

$ git clone --branch v4.0.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout v4.0.1

Permits http protocol for fleetctl when connecting to localhost

1 detail in Everything

v4.0.0 Jun 29, 2021 · release notes

Fleet v4.0 adds RBAC roles (Admin/Maintainer/Observer), Teams, API-only users, and Redis cluster support

└──▷ GET THIS VERSION

$ git clone --branch v4.0.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout v4.0.0

name, maintainer, and observer roles introduced for role-based access control (RBAC) in Fleet Core
Teams feature allows separating hosts into exclusive groups for Fleet Basic customers
Team-specific enroll secrets enable enrollment to a single team per host
Manual transfer of hosts to different teams via the Fleet UI
Unique agent options can be applied to each team (replacing osquery options)

+2 more show less

API-only users who access all Fleet API endpoints and fleetctl features but cannot access the Fleet UI in Fleet Core
Redis cluster support added for Fleet Core

7 details in Everything

└──▷ BREAKING ON UPGRADE

!username login artifact removed; users must now use email to log in
!Configuration, API routes, and environment variables must use fleet instead of kolide
!SAML SSO URI must be updated from kolide to fleet
!Configuration option server_tlsprofile renamed to server_tls_compatibility
!api/v1/fleet/spec/osquery/options endpoint replaced by api/v1/fleet/config; agent options now use the agent_options key in the config yaml document
!options yaml document removed; agent options are now configured via agent_options in the config yaml document
!Enroll secrets no longer have names and are either global or team-specific
!auth_jwt_key and auth_jwt_key_file configuration keys are no longer accepted as JWT encoding is removed for session keys

3.13.0 Jun 3, 2021 · release notes

Fleet 3.13.0 adds fleetctl preview stop/reset subcommands and changes /api/v1/fleet/hosts payload scope.

└──▷ GET THIS VERSION

$ git clone --branch 3.13.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.13.0

└──▷ USE IT

Clean up simulated environment after testing host scripts

shell

fleetctl preview stop

Reset state of Docker-based simulation for a new test cycle

shell

fleetctl preview reset

Adds fleetctl preview reset subcommand to reset simulated hosts running in Docker
Adds fleetctl preview stop subcommand to stop simulated hosts running in Docker
The /api/v1/fleet/hosts API endpoint now returns only the requested additional columns

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The /api/v1/fleet/hosts API endpoint now returns only the requested additional columns (previously returned all additional columns)

3.12.0 May 19, 2021 · release notes

Fleet 3.12.0 adds scheduled query display on Host details, log field duplication to Pub/Sub attributes, and Redis live query result duplication.

└──▷ GET THIS VERSION

$ git clone --branch 3.12.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.12.0

Adds redis_duplicate_results config option to duplicate all live query results to the LQDuplicate Redis channel
Adds ability to copy log fields into Google Cloud Pub/Sub attributes for subscription filters
Adds server-side HTTP keepalive control via configuration
Adds scheduled query details (Name, Description, Frequency, Last run) display on Host details page
Adds refetch capability for host vitals data on Host details page

5 details in Everything

3.11.0 Apr 28, 2021 · release notes

Fleet 3.11.0 adds software inventory support via feature flag, Windows autoupdate for fleetctl, and host details query selection.

└──▷ GET THIS VERSION

$ git clone --branch 3.11.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.11.0

fleet updates subcommand added to fleetctl to manage agent updates on Windows
New software inventory feature available behind a feature flag
Ability to select saved queries directly from the host's _Host details_ page

3 details in Everything

3.10.0 Mar 31, 2021 · release notes

Fleet 3.10 adds agent auto-updates beta, IdP-initiated SSO, and My Account version info

└──▷ GET THIS VERSION

$ git clone --branch 3.10.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.10.0

└──▷ HOW TO FIND IT

Configure IdP-initiated SSO for your Fleet instance during authentication setup.

📍# Navigate to Settings › Authentication in the UI and select Identity Provider-Initiated (IdP-initiated) Single Sign-On (SSO)

Adds fleetctl agent auto-updates beta which introduces the ability to self-manage an agent update server for Premium customers
Adds option for Identity Provider-Initiated (IdP-initiated) Single Sign-On (SSO)
Adds Fleet version and Go version in the My Account page of the Fleet UI

3 details in Everything

3.9.0 Mar 9, 2021 · release notes

Fleet 3.9.0 adds configurable host identifier and enrollment cooldown flags to reduce database load during duplicate UUID scenarios.

└──▷ GET THIS VERSION

$ git clone --branch 3.9.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.9.0

Adds --osquery_host_identifier flag to allow configuring the host identifier used for enrollment, supporting values like instance to help with overlapping host UUIDs.
Adds --osquery_enroll_cooldown flag to enable a configurable cool-down period for host enrollment, controlling database load when hosts share identifiers (enabled when set).
Refreshes the Fleet UI with a new layout and horizontal navigation bar.

3 details in Everything

3.8.0 Feb 25, 2021 · release notes

Fleet 3.8.0 adds AWS Lambda logging plugin, hosts dashboard search/sort/selection, and host listing API search support

└──▷ GET THIS VERSION

$ git clone --branch 3.8.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.8.0

└──▷ HOW TO FIND IT

Use the hosts dashboard UI to search, sort, and select columns.

📍In the console, navigate to the hosts dashboard and use the new search bar, sorting options, and column selection menu.

└──▷ BREAKING ON UPGRADE

!Environment variable prefixes KOLIDE_ are deprecated in favor of FLEET_ prefixes (deprecated prefixes continue to work but log warnings).

3.7.0 Feb 3, 2021 · release notes

Fleet 3.7.0 adds Helm chart, denylist for scheduled queries, host details UI, and fleetctl debug/logging flags

└──▷ GET THIS VERSION

$ git clone --branch 3.7.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.7.0

add new Host details page which includes a rich view of a specific host’s attributes.
reveal live query errors in the Fleet UI and fleetctl to help target and diagnose hosts that fail.
add Helm chart to make it easier for users to deploy to Kubernetes.
add support for denylist parameter in scheduled queries.
add debug flag to fleetctl that enables logging of HTTP requests and responses to stderr.

+1 more show less

improvements to the fleetctl preview experience that include adding containerized osquery agents, displaying login information, creating a default directory, and checking for Docker daemon status.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Upgrade TLS compatibility settings to match Mozilla.

3.7.1 Feb 3, 2021 · release notes

Fleet 3.7.1 changes default --server_tls_compatibility to intermediate.

└──▷ GET THIS VERSION

$ git clone --branch 3.7.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.7.1

3.6.0 Jan 7, 2021 · release notes

Fleet 3.6.0 adds S3 file carving storage, non-root Docker container, and config file-based secrets.

└──▷ GET THIS VERSION

$ git clone --branch 3.6.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.6.0

Add the option to set up an S3 bucket as the storage backend for file carving
Build Docker container with Fleet running as non-root user
Add support to read in the MySQL password and JWT key from a file

3 details in Everything

3.5.0 Dec 10, 2020 · release notes

Fleet 3.5.0 adds fleectl.exe.zip download availability and API auth documentation

└──▷ GET THIS VERSION

$ git clone --branch 3.5.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.5.0

All future releases now include fleectl.exe.zip on the release page for easy binary retrieval.
Added documentation for the authentication endpoints in the Fleet REST API.

2 details in Everything

3.4.0 Nov 18, 2020 · release notes

Fleet 3.4.0 adds npm install support, fleetctl preview/debug, and API filters

└──▷ GET THIS VERSION

$ git clone --branch 3.4.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.4.0

└──▷ USE IT

Install fleetctl globally using npm instead of standard binaries.

shell

npm install -g osquery-fleetctl

Start a local Fleet server instance for testing via Docker using the new preview command.

shell

fleetctl preview

Use the new API parameter to filter specific fields in the additional_info response of the get hosts endpoint.

shell

curl -X GET 'https://<fleet-host>/api/v1/osquery/host?additional_info_filters=hostname,osversion' -H 'Authorization: Bearer <token>'

Adds npm install -g osquery-fleetctl installer for the fleetctl CLI.
Adds fleetctl preview subcommand to start a local Docker-based test instance of the Fleet server.
Adds fleetctl debug subcommands and corresponding API endpoints for debugging server performance.
Adds additional_info_filters parameter to the get hosts API endpoint.

4 details in Everything

3.3.0 Nov 5, 2020 · release notes

Fleet 3.3.0 adds file carving, new fleetctl user create command, and several CLI/UI improvements

└──▷ GET THIS VERSION

$ git clone --branch 3.3.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.3.0

fleetctl user create command added to the CLI for programmatic user creation
Added --pretty flag to fleetctl query for formatted output of query results
New file carving functionality enabled in the backend
fleetctl apply now supports disabling existing packs without deleting them
Admin UI now includes an osquery options editor for host configuration

+1 more show less

Improved Add New Host dialog provides step-by-step enrollment guidance

6 details in Everything

3.2.0 Aug 8, 2020 · release notes

Fleet 3.2.0 adds stdout and Kinesis logging plugins, Redis TLS, and new fleetctl output fields.

└──▷ GET THIS VERSION

$ git clone --branch 3.2.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.2.0

└──▷ TRY IT

Enable TLS for Redis connections by setting the appropriate environment variable.

$ # Set this in your system environment or fleet config to enable TLS for Redis
REDIS_TLS=1

Check available osquery versions and host details via the CLI.

$ fleetctl get hosts
# Output now includes 'osquery_version' field alongside hostname/id

Adds stdout logging plugin
Adds AWS kinesis logging plugin
Adds compression option for filesystem logging plugin
Adds support for Redis TLS connections
Adds osquery version information to output of fleetctl get hosts

+1 more show less

Adds hostname to UI delete host confirmation modal

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Removed support for (previously deprecated) old TLS profile.

3.1.0 Aug 6, 2020 · release notes

Fleet 3.1.0 adds --redis_database/--mysql_conn_max_lifetime flags and named enroll secret printing

└──▷ GET THIS VERSION

$ git clone --branch 3.1.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.1.0

Adds --redis_database config flag to set the Redis database index
Adds --mysql_conn_max_lifetime config flag to configure MySQL connection pool lifetime

2 details in Everything

3.0.0 Jul 23, 2020 · release notes

Fleet 3.0 adds fleetctl host retrieval, JSON output, manual labels, and API-driven additional queries for high-scale environments.

└──▷ GET THIS VERSION

$ git clone --branch 3.0.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 3.0.0

└──▷ TRY IT

Retrieve details for a specific host ID via CLI.

$ fleetctl get host --id <host-id>

Export host inventory as JSON for programmatic processing in CI/CD or custom dashboards.

$ fleetctl get hosts --format json > hosts.json

Adds fleetctl get host subcommand to retrieve details for a single host
Adds JSON output support for fleetctl get commands via new output options
Adds manual labels capability allowing static label assignment with fleetctl hostname lists
Adds API-returnable additional information collection for hosts via additional queries configuration

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Users previously relying on extraneous network interface information in default responses must now explicitly configure additional queries to retrieve it.

2.6.0 Mar 24, 2020 · release notes

Fleet 2.6.0 adds configurable osquery update intervals via new CLI flags

└──▷ GET THIS VERSION

$ git clone --branch 2.6.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.6.0

└──▷ TRY IT

Reduce server load in large deployments by increasing the interval between host detail and label updates.

$ fleet serve --osquery_detail_update_interval=300s --osquery_label_update_interval=600s

Adds server logging for the X-Forwarded-For header.

1 detail in Everything

2.5.0 Jan 26, 2020 · release notes

Fleet 2.5.0 adds goquery integration, saved query support in CLI, and MySQL domain socket connections

└──▷ GET THIS VERSION

$ git clone --branch 2.5.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.5.0

Adds fleetctl goquery command to bring up the github.com/AbGuthrie/goquery CLI
Adds --query-name option to fleetctl query for using SQL from a saved query
Adds --mysql-protocol flag to allow connection to MySQL by domain socket
Adds ability to disable live queries in web UI and fleetctl

4 details in Everything

2.4.0 Nov 12, 2019 · release notes

Fleet 2.4.0 adds --server_url_prefix flag, auto-expire hosts, UUID targeting, and SAML name flexibility

└──▷ GET THIS VERSION

$ git clone --branch 2.4.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.4.0

└──▷ TRY IT

Run Fleet behind a reverse-proxy on a shared hostname

$ fleet serve --server_url_prefix='/api/fleet'

Configure automatic expiration of inactive hosts

📍Navigate to App Settings › Advanced Options in the browser UI and enable auto-expire.

--server_url_prefix configures a URL prefix for all Fleet URLs to support reverse-proxy deployments
Auto-expire inactive hosts based on check-in days via App Settings UI
Search for hosts by UUID in the query targeting interface
SAML IdP names can now be as short as 4 characters

4 details in Everything

2.3.0 Aug 14, 2019 · release notes

Adds fleetctl get YAML export with pack query inclusion

└──▷ GET THIS VERSION

$ git clone --branch 2.3.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.3.0

└──▷ TRY IT

Export all packs along with their associated scheduled queries for offline review or version control.

$ fleetctl get --yaml --with-queries packs

Adds the --yaml flag to fleetctl get, allowing packs, labels, and queries to be exported in YAML format instead of JSON

1 detail in Everything

2.1.0 Apr 9, 2019 · release notes

Adds AWS Firehose logging and automatic cleanup of incomplete host enrollments.

└──▷ GET THIS VERSION

$ git clone --branch 2.1.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.1.0

Added capability to log osquery status and results to AWS Firehose
Automatically cleans up incoming hosts that do not complete enrollment

2 details in Everything

2.0.2 Jan 17, 2019 · release notes

Adds fleetctl get hosts and --timeout flag; SMTP auth support

└──▷ GET THIS VERSION

$ git clone --branch 2.0.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.0.2

Adds fleetctl get hosts command to retrieve a list of enrolled hosts
Adds --timeout flag to fleetctl query
Added support for Login SMTP authentication method (Used by Office365)

3 details in Everything

2.0.0 Oct 16, 2018 · release notes

Fleet 2.0 adds custom CA support in fleetctl, MySQL 8 auth, and INSERT queries in editor

└──▷ GET THIS VERSION

$ git clone --branch 2.0.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 2.0.0

fleetctl now supports custom certificate authorities for connecting to Fleet servers.
The fleetctl client accepts new authentication methods required by MySQL 8.

2 details in Everything

1.0.7 Mar 30, 2018 · release notes

Fleet 1.0.7 adds FileAccesses to FIM config, Windows network interface display, and MySQL connection pooling flags.

└──▷ GET THIS VERSION

$ git clone --branch 1.0.7 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 1.0.7

Adds FileAccesses support in FIM configuration to monitor file access events.
Populates network interfaces on Windows hosts in the host view UI.

2 details in Everything

1.0.6 Dec 4, 2017 · release notes

Adds remote IP logging for osqueryd/launcher requests and pagination to Host browser.

└──▷ GET THIS VERSION

$ git clone --branch 1.0.6 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 1.0.6

Added remote_ip in the logs for all osqueryd/launcher requests
Added pagination to the Host browser pages for increased performance

2 details in Everything

1.0.4 Jun 1, 2017 · release notes

Fleet 1.0.4 adds SSO support, Osquery decorator imports, and config file migration

└──▷ GET THIS VERSION

$ git clone --branch 1.0.4 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 1.0.4

└──▷ HOW TO FIND IT

Enable SAML authentication via the web interface settings

📍In the UI, go to Settings › Authentication › Enable SAML single sign on

Start the Fleet server with the required JWT authentication key

shell

fleet serve --auth_jwt_key '<your-secret-jwt-key>'

Adds SAML single sign on support for authentication
Adds support for importing existing Osquery configuration files using the external configimporter utility
Adds support for Osquery decorators to allow custom queries before/after agent execution

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The --app_token_key flag is removed; users must now provide --auth_jwt_key at startup or generate a random key printed by the server.

1.0.3 Apr 3, 2017 · release notes

Fleet 1.0.3 adds debug profiling endpoint, TLS profiles, and log rotation config

└──▷ GET THIS VERSION

$ git clone --branch 1.0.3 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 1.0.3

└──▷ USE IT

Start the service in debug mode to access performance profiling endpoints.

shell

kolide serve --debug

Adds --osquery_enable_log_rotation flag to manually enable log rotation for Osquery status and results logs (no longer default)
Adds a --debug mode with performance profiling endpoints when running kolide serve --debug, authenticated via a random token printed at startup
Adds --server_tls_compatibility=modern|intermediate|old CLI argument to select TLS configuration profiles

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Log rotation is no longer the default setting for Osquery status and results logs; it must be enabled via --osquery_enable_log_rotation.

1.0.2 Mar 14, 2017 · release notes

Fleet 1.0.2 adds SIGHUP log rotation, DB migration prompts, and SockJS fallback for distributed queries

└──▷ GET THIS VERSION

$ git clone --branch 1.0.2 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 1.0.2

└──▷ USE IT

Skip interactive confirmation during automated infrastructure provisioning

shell

kolide prepare db --no-prompt

Added kolide prepare db --no-prompt flag to skip database migration confirmation
Added support for rotating osquery status and result logs via SIGHUP signal to the kolide process
Added a SockJS fallback mechanism for distributed queries when websockets are unsupported

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The server.tls configuration now only accepts modern cipher suites; older cipher suites will no longer be accepted by the built-in TLS server

1.0.1 Feb 27, 2017 · release notes

Fleet v1.0.1 adds full-screen query results, UI double-click interaction, MySQL cert auth, and platform detection improvements

└──▷ GET THIS VERSION

$ git clone --branch 1.0.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:
$ git checkout 1.0.1

Added full screen support for distributed query results in the web UI.
Enabled double-clicking on queries and packs in the table to view details.
Now supports MySQL client certificate authentication (see configuring-the-fleet-binary docs).
Automatically decorates status and result logs with host UUID and hostname.
Improved platform detection accuracy for online hosts.

5 details in Everything

Fleet

Summary

How Fleet helps

Languages

Features

What Fleet offers you

release

release

release

release

release

example

release 7 total

example

release

example

release 7 total

release 7 total

release

command line

example

release

example

release

example

release

docs

release

docs

release

example

release

docs

example

release

example

release

command line

release

example

release

release

example

release

example

release

example

release

release

example

release

docs

release

docs

example

release

release

release

release

release

release

release

example

release

example

release

example

release

release

release

release

release

release

release

release

release

release

docs

release

release