Fleet — The Cyber Toolchain

Fleet fleet-v4.94.0

Wed, 28 Oct 2026 23:54:13 GMT

Fleet adds self-service profiles, one-time Windows enroll secrets, on-demand FileVault key rotation, and a major sweep of MDM, Android, and software-inventory capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves configuration profile management: adds `name` and `description` fields settable via the UI, the API, or GitOps YAML (deprecating `display_name` on the batch configuration profiles endpoint in favor of `name`), and adds a dedicated page for adding and editing configuration profiles — replacing the add and edit modals — with support for upload, paste, and inline editing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new configuration profile capabilities: mark a profile as `hidden` so it only appears on My device > Controls after the end user turns on the 'Show hidden profiles' toggle, and add self-service configuration profiles for macOS hosts that end users can install from the My device page. • Add a customizable Windows end-user agreement (EULA) — upload a Markdown file up to 512 KB in Settings > Integrations > MDM > End user license agreement, or set `windows_eula` in GitOps YAML; Fleet renders it as the terms page during Microsoft Entra and Autopilot enrollment. • Add a `BYPASS_END_USER_AUTH` property to the Windows MSI built by `fleetctl package`, so end-user authentication can be skipped at install time with `msiexec /i fleetd-base.msi BYPASS_END_USER_AUTH=true` instead of baking in `--bypass-end-user-auth`; requires fleetd v1.60.0 or higher. • Add `path`/`paths` file-reference support to `software.fleet_maintained_apps` and `software.app_store_apps` in GitOps YAML, matching existing support for `policies`, `labels`, `reports`, and `software.packages`. • Add `mdm.windows_one_time_enroll_secrets` server setting: when enabled, Fleet sends each Windows MDM host a per-device, single-use enroll secret instead of the shared global secret. • Add `websocket.orbit_config_enabled` server setting (experimental; requires `websocket.transport_enabled`) with `websocket.orbit_config_poll_interval` (default 5 minutes) and `websocket.orbit_config_spread` (default 30 seconds) to push orbit-config change notifications over WebSocket instead of polling every 30 seconds. • Adds configurable retention and cleanup settings to keep data from growing unbound: Windows MDM command-history retention via `mdm.windows_command_retention` (env: `FLEET_MDM_WINDOWS_COMMAND_RETENTION`, default 30 days, `0` disables cleanup), deleted-host certificate retention via `server.deleted_host_certificates_retention` (default 30 days), and an hourly cleanup job for completed Apple MDM commands. • Add `version` as a valid `order_key` for `GET /api/v1/fleet/os_versions`, with numeric version sorting by segment. • Add a 'Types' filter (`source` and `extension_for` query parameters) to the list software titles, list software versions, get host's software, and get device's software endpoints. Breaking changes: • The `s3_software_installers_signed_url` server option is renamed to `s3_software_installers_gcs_signed_url`; the old name still works but is deprecated. • OpenTelemetry HTTP server metrics for gorilla-routed requests now use stable semantic conventions: `http.server.request.duration` (seconds) replaces `http.server.duration` (milliseconds), and `http.server.request.body.size` / `http.server.response.body.size` replace `http.server.request.size` / `http.server.response.size`; any custom dashboards built on the old metric names require updating. • When `mdm.windows_one_time_enroll_secrets` is enabled, a shared enroll secret can no longer enroll fleetd as a host that is enrolled in Fleet Windows MDM. • Renaming a Windows, Android, or declaration (DDM) profile through GitOps now re-creates the profile. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-e9499a9c8087

Mon, 19 Oct 2026 08:00:57 GMT

Fleet login API now returns `token_expires_at` and `available_fleets` fields in the authentication response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `token_expires_at` field to the login API response, showing when the session token expires based on the server's session duration setting (default: 5 days).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `available_fleets` field to the login API response. • Documents that API-only users receive `token_expires_at` in the response but their tokens remain valid after the indicated expiry time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-bb06a335f132

Mon, 05 Oct 2026 08:18:24 GMT

Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-bb06a335f132

Sun, 04 Oct 2026 14:00:07 GMT

Fleet: Adds `DELETE /api/v1/fleet/software/titles/{id}/available_for_install` endpoint to remove a software title from the install catalog; on Android hosts the software is also uninstalled from the device, while other platforms are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-bb06a335f132

Sat, 03 Oct 2026 13:07:30 GMT

New DELETE endpoint removes software available for install, with automatic uninstall for Android hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint documented: DELETE /api/v1/fleet/software/titles/24/available_for_install?fleet_id=2⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-1fdadd14db01

Tue, 29 Sep 2026 14:36:30 GMT

Fleet API gains `installer_id` param to delete a single package without removing all packages for a title.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `installer_id` parameter to the delete-package API endpoint, allowing deletion of only the specified package rather than all packages for a software title.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds install software policy automation that installs an app update the next time a policy fails, regardless of whether the app is open. • Adds patch-policy automation support that runs software and script automations every time Fleet receives a failing host response when enabled, rather than only on first failure or pass-to-fail transitions. • Adds Lost Mode disable action for iOS and iPadOS devices. • Adds a 3-attempt retry limit for patch policy installs when the app is open, retrying again on the next policy run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-c3a210799a17

Sat, 26 Sep 2026 12:58:56 GMT

Fleet API gains CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `severity_min` and `severity_max` query parameters (CVSS v3.x base score, 0–10) to the vulnerability host-count chart endpoint to filter results by CVSS score range; vulnerabilities without metadata are included only when neither filter is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/v1/fleet/hosts/:id/apns_ping` to send a blank APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles. • Adds `PUT /api/v1/fleet/microsoft_graph_credentials` as a declarative replace endpoint for Microsoft Graph credentials; accepts `tenant_id`, `client_id`, and `client_secret`, validates each new/changed credential against Microsoft Graph before saving, and deletes any stored credential whose `tenant_id` is absent from the supplied list. • Adds `has_known_exploit` filter field alongside CVSS severity filters for vulnerability queries. • Adds profile-file replacement support to the update-profile endpoint: uploading a new file replaces the existing profile contents, with identifier-matching rules per profile type (Apple mobileconfig, DDM, Windows, Android) and automatic renaming based on type. • Adds Android MDM command status semantics: `pending` maps to 'sent but not yet executed', `acknowledged` maps to 'executed successfully', and `error` maps to 'rejected by AMAPI or device', with the `result` field carrying the full AMAPI `Operation` response on error. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-c3a210799a17

Fri, 25 Sep 2026 13:25:42 GMT

Fleet: Adds `severity_min` and `severity_max` query parameters to the vulnerability host-count chart endpoint to filter results by CVSS 3.x base score range; vulnerabilities lacking metadata are included only when neither filter is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid` to cancel a pending MDM command (`lock`, `wipe`, or `ClearPasscode`/`EnableLostMode`) for Apple hosts before it is delivered. • Adds `GET /api/v1/fleet/microsoft_graph_credentials` to list all Microsoft Graph credentials and per-tenant Autopilot sync status, including `credential_invalid`, `last_synced_at`, and `last_sync_error` fields. • Adds `preserve_host_activities_on_reenrollment` global config field to retain host activity history after a wipe and re-enrollment for company-owned Apple (AB) and Android hosts. • Adds `require_bitlocker_pin` under `windows_settings` to require end users on Windows hosts to set a BitLocker PIN. • Adds `linux_settings.enable_escrow_disk_encryption_key` config field so Fleet stores the Linux disk encryption recovery key without prompting users, supporting third-party enforcement tooling. • Adds `enable_escrow_disk_encryption_key` under `mdm.linux_settings` at the team level, mirroring the global setting for per-team Linux disk encryption key escrow. • Adds `microsoft_graph_credential_invalid` as a read-only global config field that signals when at least one Microsoft Graph credential has been rejected, halting Windows Autopilot device sync. • Adds `group_tag` field to Autopilot host records, returning the Windows Autopilot group tag for hosts synced from a tenant's Autopilot registry. • New endpoint documented: POST /api/v1/fleet/hosts/:id/apns_ping • New endpoint documented: DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid • New endpoint documented: GET /api/v1/fleet/microsoft_graph_credentials • New endpoint documented: PUT /api/v1/fleet/microsoft_graph_credentials Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-c3a210799a17

Thu, 24 Sep 2026 13:20:26 GMT

Fleet: Adds `microsoft_graph_credentials.tenant_id`, `microsoft_graph_credentials.client_id`, and `microsoft_graph_credentials.client_secret` fields to the `PUT /api/v1/fleet/microsoft_graph_credentials` request body. • Supports uploading a replacement profile file on existing Android and Windows configuration profiles where the new file's settings can differ completely from the ones it replaces. • Adds `alternative_browser_host` field to global and team settings for Fleet Desktop browser-host overrides. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-c3a210799a17

Wed, 23 Sep 2026 13:25:44 GMT

Fleet adds CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST /api/v1/fleet/hosts/:id/apns_ping` endpoint to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or configuration profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `PUT /api/v1/fleet/microsoft_graph_credentials` endpoint to declaratively replace stored Microsoft Graph credentials; accepts `microsoft_graph_credentials[].tenant_id`, `.client_id`, and `.client_secret`, validates each new or changed credential against Microsoft Graph before saving. • Supports replacing an existing MDM configuration profile file via upload, with type-specific identifier matching rules for Apple (mobileconfig/DDM), Windows, and Android profiles. • Adds Android MDM command status values: `pending` (sent to AMAPI, not yet executed), `acknowledged` (executed successfully), and `error` (rejected, with full AMAPI `Operation` response in the `result` field). • New endpoint documented: DELETE /api/v1/fleet/hosts/12/commands/81e10a70-730b-4c45-9b40-b14373e04757 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-43d34837c929

Tue, 22 Sep 2026 13:07:31 GMT

Fleet: Adds `POST /api/v1/fleet/hosts/:id/apns_ping` to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `GET /api/v1/fleet/microsoft_graph_credentials` to list Microsoft Graph credentials and per-tenant Autopilot sync status, including `credential_invalid` and `last_synced_at` fields. • Adds `PUT /api/v1/fleet/microsoft_graph_credentials` to declaratively replace stored Microsoft Graph credentials; credentials whose `tenant_id` is absent from the payload are deleted, and an empty array removes all credentials. • Adds `severity_min` and `severity_max` parameters (CVSS 3.x base score) to the vulnerability hosts-over-time chart endpoint to filter results to a specific CVSS score range. • Adds `preserve_host_activities_on_reenrollment` configuration field to preserve host activities after a wipe and re-enrollment for company-owned Apple (AB) and Android hosts. • Adds `microsoft_graph_credential_invalid` read-only field to the configuration API, set to `true` when at least one Microsoft Graph credential has been rejected, indicating Autopilot devices are no longer syncing. • Adds `require_bitlocker_pin` field under `windows_settings` so end users on Windows hosts are required to set a BitLocker PIN. • Adds `linux_settings.enable_escrow_disk_encryption_key` field to store the disk encryption recovery key for Linux hosts without prompting users to turn on disk encryption — for use when a third-party tool handles enforcement. • Adds `enable_escrow_disk_encryption_key` under `macos_settings` (team and global config) to store the macOS disk encryption recovery key when a third-party tool handles enforcement. • Adds `group_tag` field to Autopilot host responses, returning the Windows Autopilot group tag for hosts synced from a tenant's Autopilot registry. • Extends the Run MDM command endpoint to support Android hosts via base64-encoded AMAPI `issueCommand` JSON payloads, with `pending`, `acknowledged`, and `error` result states. • New endpoint documented: POST /api/v1/fleet/hosts/:id/apns_ping • New endpoint documented: DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid • New endpoint documented: GET /api/v1/fleet/microsoft_graph_credentials • New endpoint documented: PUT /api/v1/fleet/microsoft_graph_credentials Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.92.0

Mon, 21 Sep 2026 17:09:21 GMT

Fleet 4.92.0 adds Android MDM commands, per-platform disk encryption, cancelable Apple MDM commands, and new osquery bandwidth-saving config options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `osquery.config_in_memory_cache` server configuration option to control the in-memory cache of the osquery config's scheduled-report section (set to `true` to re-enable; disabled by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `osquery.config_etags` server option (`FLEET_OSQUERY_CONFIG_ETAGS`, default off) to enable conditional request (etag) support on `/api/osquery/config`, sending a minimal `{"etag":"ok"}` response to agents whose configuration is unchanged. • Adds `osquery.redis_config_etags` server option (`FLEET_OSQUERY_REDIS_CONFIG_ETAGS`, default off, requires `osquery.config_etags`) to answer matching etag check-ins directly from a Redis-backed ETag store, skipping the config build and database reads entirely. • Adds `server.endpoint_request_size_overrides` configuration to set a max request body size per API endpoint. • Adds `websocket.transport_enabled` server configuration to enable an experimental WebSocket notification transport for fleetd agents (disabled by default). • Adds `mdm.is_personal_enrollment` field to host API responses, reporting whether the last MDM enrollment was personal (BYOD) and persisting after unenrollment. • Adds `mdm.bootstrap_token_escrowed` field to the get host and get host by Fleet Desktop token API responses. • Adds `DELETE /api/v1/fleet/hosts/:id/commands/:command_uuid` to cancel a pending Apple MDM lock, wipe, clear passcode, or enable lost mode command before the host receives it. • Adds per-platform disk encryption settings: enforcement and key escrow for macOS, enforcement for Windows, and key escrow for Linux. • Adds a new 'End user authentication' setting (`fleet_desktop.sso_enabled`, Fleet Premium) requiring end users to sign in via SSO before accessing Fleet Desktop's 'My device' page. • Adds a severity (CVSS score) filter to the Vulnerability exposure dashboard chart (Fleet Premium), with min/max score inputs appearing only when custom severity is selected. • Adds collection of additional Android host vitals (USB debugging, passcode set, Google Play Protect, encryption status, manufacturer, security update version, kernel and bootloader version, software update status, API level, security posture, and per-SIM phone numbers) returned by get host endpoints. • Adds automatic installation of in-house apps (`.ipa`) on iOS and iPadOS hosts when they enroll into Fleet. • Adds Windows devices from a connected Microsoft Entra tenant's Autopilot registry to Fleet as pending hosts before enrollment. • Adds support for resending a configuration profile on policy failure as part of a policy automation. • Adds `display_name` support for Fleet-maintained apps in GitOps. • Adds a QR code for the enrollment link on the Android and iOS/iPadOS tabs of the Add hosts modal. • Adds an audit activity when a deprovisioned SCIM user has no email to match a Fleet account. • Adds an 'Inactive' status with tooltip to the Users table, with new `last_login_at`, `last_activity_at`, and server-computed `status` fields (`active`, `inactive`, or `no_access`) returned from the users API. • Adds the ability to sort the versions table by version on the Software details page. Breaking changes: • Duration fields in Fleet server logs (e.g. `took`) now render as human-readable strings with time units (e.g. `"1.116187ms"`) instead of raw nanosecond numbers — log pipelines that parse these fields numerically must be updated. • Windows user-scoped configuration profiles that already failed on an earlier Fleet version are not resent automatically after upgrading — admins must resend them once (or edit the profile) for Fleet to deliver them when a user is signed in. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-a565f2d60d3a

Mon, 07 Sep 2026 13:54:12 GMT

New API endpoint to manually clear a policy's pass/fail results for custom automations. • Adds an API endpoint to clear a policy's pass/fail results, enabling custom automations to reset policy status outside of Fleet's automatic triggers (query edits, script swaps, software package or VPP app changes). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.91.0

Wed, 02 Sep 2026 22:28:05 GMT

Fleet 4.91.0 adds managed local Windows admin accounts, macOS/iOS/iPadOS 'latest' OS pinning, per-fleet activity webhooks, Adobe plugin inventory, and 29 new iOS vitals. • Adds `s3_software_installers_signed_url` configuration option to serve software installers, in-house apps, and bootstrap packages via GCS presigned URLs so clients download directly from object storage instead of routing through the Fleet server. • Adds `--bypass-end-user-auth` flag to `fleetctl package` to generate fleetd installers that skip end-user authentication prompts on Linux and Windows hosts; requires fleetd v1.60.0 or higher. • Adds per-fleet software inventory toggle via `PATCH /api/v1/fleet/fleets/{id}` with `{"features": {"enable_software_inventory": }}`; omitting the key leaves the stored value unchanged. • Adds `token_invalid` field to ABM token API responses and `dep_device_error` (human-readable message) to `GET /hosts/:id/dep_assignment` to surface why an Apple Business Manager device lookup or ABM token is failing. • Adds `host_id` and `host_serial` fields to the `mdm_enrolled` activity for Apple (macOS, iOS, iPadOS) enrollments, and surfaces the activity on the host's activity timeline. • Adds `mdm.allow_orbit_end_user_auth_bypass` server setting (enabled by default) to control whether hosts that skip end-user authentication can enroll into a fleet that requires it; set to `false` to strictly enforce authentication for all Orbit enrollments. • Adds support for `$FLEET_HOST_VITAL_` custom host vital variables in Android configuration profiles, managed app configurations, and host name templates, with per-host expansion and automatic re-delivery when a vital value changes. • Adds support for Fleet built-in variables (e.g. `$FLEET_VAR_HOST_END_USER_IDP_USERNAME`) in software install, post-install, and uninstall scripts, resolved per host at execution time (Fleet Premium). • Adds `linux` as a label platform option, targeting hosts across any Linux distribution. • Adds a managed local admin account capability for Windows hosts (requires fleetd 1.60.0 or higher). • Adds a default fleet assignment for new Windows MDM enrollments (Fleet Premium), applied before the Autopilot Enrollment Status Page runs so software, scripts, and configuration profiles take effect during out-of-box setup. • Adds support for setting `minimum_version` to `latest` with `deadline_days` in macOS/iOS/iPadOS OS update policy to automatically track the newest Apple-published version per device (Fleet Premium). • Adds per-fleet activity automations (Fleet Premium): a webhook configured from the Hosts page that posts to a destination URL whenever an activity tied to one of the fleet's hosts is created. • Adds a 'Patch when closed' option for patch policies that only patches an app when it is not currently running. • Adds Adobe Creative Cloud plugin detection (CEP and UXP extensions) to software inventory on macOS and Windows, listed as software type 'Plugin (Adobe)' with version and host count. • Adds 29 new iOS/iPadOS device vitals (battery level, accessibility settings, cellular technology, cloud backup status, MDM options, device attestation, and more) collected via the existing `DeviceInformation` MDM refetch and exposed in the host API response and a new 'View all' vitals modal; BYOD enrollments are excluded. • Adds support for releasing devices from Apple Business Manager inside Fleet. • Adds support for nested Entra groups in IdP vitals. • Adds a sortable 'Added to Fleet' column to the hosts table showing when each host last enrolled. • Adds marketing name display for Apple devices (macOS, iOS, iPadOS) — the 'Hardware model' field now shows names like 'MacBook Pro (16-inch, 2021)' instead of raw identifiers like 'MacBookPro18,1'. • Adds `user_mfa_requested` activity recorded when valid credentials are submitted for an MFA-enabled account and a verification email is sent. • Adds `created_setup_experience_script` and `deleted_setup_experience_script` activities to the audit log when a setup experience script is added, replaced, or removed via the API or GitOps. • Updates macOS CIS benchmark policies to macOS 14 Sonoma v3.1.0, macOS 15 Sequoia v2.1.0, and macOS 26 Tahoe v1.1.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.90.2

Tue, 01 Sep 2026 17:05:54 GMT

Fleet adds a configurable release budget for Fleet-initiated activities via `FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE` • Adds `FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE` environment variable to throttle Fleet-initiated activities (policy-automation software installs, scripts, iOS/iPadOS scheduled app updates) to a configurable rate (default 1000 hosts/minute, 0 = unlimited), spreading install-execution and result-ingestion load when automations fire across many hosts simultaneously. • User-initiated activities (self-service installs, admin-run scripts, lock/unlock/wipe, setup experience) now take precedence over queued Fleet-initiated activities on the same host. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-e62e4648a3e0

Mon, 31 Aug 2026 20:54:15 GMT

Fleet API adds `is_personal_enrollment` field to distinguish BYOD (personal) MDM enrollments on host records. • Adds `mdm.is_personal_enrollment` field to host API responses, indicating whether the last MDM enrollment Fleet recorded was personal (BYOD); persists for unenrolled Android and Apple mobile hosts, and resets on macOS/Windows once the enrollment profile is removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-dedc3ff95d39

Fri, 28 Aug 2026 19:49:41 GMT

Fleet API adds bootstrap token escrow visibility, uninstall script detection, and installer targeting for failure policies. • Adds `mdm.bootstrap_token_escrowed` field to macOS host responses, indicating whether Fleet holds a bootstrap token that authorizes remote wipe and OS update operations without a logged-in secure-token user. • Adds `software_package.has_uninstall_script` field to software installer responses, signaling whether a non-empty uninstall script is configured — relevant for `.tgz` and script-only packages where the script is optional. • Adds `software_installer_id` parameter to install-on-failure policies, letting callers target a specific package rather than defaulting to the title's first-added package. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-91b019e489ab

Sun, 23 Aug 2026 09:44:25 GMT

Fleet adds DELETE /api/v1/fleet/android_enterprise to disconnect Android Enterprise and un-enroll affected hosts. • Adds `DELETE /api/v1/fleet/android_enterprise` endpoint to remove a connected Android Enterprise integration, which un-enrolls all associated hosts and turns off Android MDM features. • Exposes `user_id`, `user_email`, `fleet_initiated`, and `streamed` fields in activity/audit log entries. • New endpoint documented: DELETE /api/v1/fleet/android_enterprise Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-242c73444f82

Wed, 12 Aug 2026 10:29:51 GMT

Fleet API adds vulnerability details (CVSS scores, descriptions) via query params, and expands wipe support to company-owned Android devices. • Adds vulnerability description, CVSS score, and other details to host software responses when using Fleet Premium (triggered by query parameter). • Adds `device_mapping=true` query parameter support to host listing; noted as expensive — best practice is to pair with `per_page=50` to avoid overloading the Fleet server. • Expands wipe support to company-owned (fully managed) Android hosts in both Fleet Free and Fleet Premium (previously this action was labeled 'Unenroll'). • Wipe for macOS, iOS, iPadOS, Linux, Windows, and personal (BYOD) Android hosts remains available in Fleet Premium. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.90.0

Thu, 06 Aug 2026 01:58:44 GMT

Fleet 4.90.0 adds multi-package deployments, in-place profile editing, custom host vitals, host naming templates, Python packages, Splunk HEC logging, and more. • Adds `PATCH /api/v1/fleet/configuration_profiles/:profile_uuid` to edit existing configuration profiles (Apple `.mobileconfig`, Apple DDM declarations, Windows, and Android) in place. • Adds `POST /api/v1/fleet/host_name_template` to set or clear a host naming template; omitting `fleet_id` or setting it to `0` targets 'No team', and an empty template clears enforcement without renaming any host. • Adds `name_template` key under `controls` in GitOps for fleets and 'No team', included in `fleetctl generate-gitops` output. • Adds `POST /api/v1/fleet/hosts/{id}/name_template/resend` to resend the host naming template to a specific host. • Adds `FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION` (`mdm.enable_custom_disk_encryption`) as a cross-platform alias for `FLEET_MDM_ENABLE_CUSTOM_FILEVAULT`, enabling custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker. • Adds `$FLEET_VAR_CERTIFICATE_RENEWAL_ID` variable to enable automatic renewal for SCEP and ACME certificates issued by external CAs (Okta Conditional Access, Okta Verify, Hydrant ACME) — add it to the certificate's Subject OU. • Adds optional `platform` query parameter to `GET /api/v1/fleet/policies` and `GET /api/v1/fleet/fleets/{id}/policies` to filter policies by targeted platform. • Adds `server_bypass_network_blocking` server config option to disable all outbound network blocking protections for integration HTTP requests. • Adds the asynchronous live query endpoint `POST /api/v1/fleet/reports/run` to the API endpoints catalog, making it grantable to API-only users with a restricted allowlist. • Adds audit activities when secret variables are created or updated through `PUT /api/latest/fleet/spec/secret_variables`. • Adds custom host vitals: admins can define custom host fields, set values per host manually or via the API, and reference them as `$FLEET_HOST_VITAL_` variables in scripts and configuration profiles. • Adds host naming template enforcement for macOS, iOS, and iPadOS under Controls > OS settings > Host names, with statuses (Enforcing, Verifying, Verified, Failed) and the `edited_host_name_template` audit activity. • Adds support for uploading up to 10 custom packages for the same software title on a team, enabling deployment of different versions or architectures (e.g. Arm vs. Intel) to label-scoped hosts with first-added-wins conflict resolution. • Adds support for Python (`.py`) script-only software packages as custom packages on macOS and Linux hosts, available via the UI, REST API, and GitOps. • Adds native Splunk HEC log destination for osquery status, result, and audit logs. • Adds support for escrowing disk encryption recovery keys from Linux hosts using TPM-backed full-disk encryption (e.g. Ubuntu 26) via a Fleet-owned snapd recovery key, silently and without end-user prompting. • Enables Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously Fleet Cloud only); gated on the Fleet Premium license tier. • Adds Zorin OS as a recognized Linux platform with `platform=zorin`, Linux disk-encryption summary support, `.deb` installs, label platform filter targeting, and CVE matching against Ubuntu LTS OVAL feeds (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). • Adds CachyOS (Arch-based Linux) as a recognized Linux platform. • Adds vulnerability (CVE) reporting for Android OS versions on the Software > OS page, including Android security patch level folded into the OS version string (e.g. 'Android 16 (2026-05-01)'). • Adds 'Targeted platforms' column and platform filter dropdown to the Policies page. • Adds public IP address to host search, matching both private and public IPs. • Adds support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via Fleet Desktop on macOS 26+ hosts. • Adds UI for configuring Apple account provisioning (FPSSO) in the integrations settings. • Adds certificates list to the host details page for Windows hosts (requires osquery 5.23.1+), showing each certificate's scope (System or User), plus a 'View certificate' modal in Controls > OS settings > Certificates. • Surfaces hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM `CertificateList` command when an ACME-bearing configuration profile is installed or re-installed. • Adds enrollment profile URL to the macOS tab in the 'Add hosts' modal, with enrollment type selection (company-owned or BYOD) for MDM users. • Adds support for targeting DDM declarations to the user channel on macOS, and adds the ability to handle DDM assets and additional declaration types. • Adds an 'Operating systems' card to the dashboard when Linux or Android is selected. • Adds installed version and available version columns to the self-service software table on the My device page. • Adds the 'Applications' / 'Full inventory' software filter to Fleet Desktop My device > Software tab for macOS hosts. • Enables 'Turn off MDM' button for offline macOS hosts, queuing the unenroll command for delivery when the device reconnects. • Updated CIS Benchmark policies for Windows 10 Enterprise to align with CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0. • Removes `fleetdm/bomutils` Docker dependency from `fleetctl package --type pkg`; Bill of Materials and xar archive are now written in pure Go, removing requirements for Docker, `mkbom`, or `xar`. • Windows configuration profiles using a Fleet-proxied SCEP certificate now report 'Verified' only after Fleet observes the issued certificate on the host, and report 'Failed' when the SCEP proxy returns an upstream error or the certificate is missing an hour after delivery. • Restricts SCIM endpoint access to global admin users only. • Rejects empty and whitespace-only enroll secrets when creating or updating teams. Breaking changes: • The `microsoft_compliance_partner.proxy_api_key` server configuration has been removed; Microsoft Entra conditional access is now gated on the Fleet Premium license tier instead. • The `/api/mdm/microsoft/auth` Windows MDM STS endpoint is removed and now returns a 404 (no device ever contacted this endpoint in practice; Windows MDM enrollment via Autopilot, Settings app, and fleetd is unaffected). • `$FLEET_VAR_SCEP_RENEWAL_ID` is renamed to `$FLEET_VAR_CERTIFICATE_RENEWAL_ID`; the legacy name still works but `$FLEET_VAR_CERTIFICATE_RENEWAL_ID` is the canonical name going forward. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet api-docs-9c952da21d7e

Wed, 05 Aug 2026 11:27:08 GMT

Fleet adds database debug endpoints, SCIM object descriptions, and new host/software API fields including CVE metadata and enrollment controls. • Adds `GET /debug/db/process-list` endpoint returning active database queries with fields `id`, `user`, `host`, `db`, `command`, `time`, `state`, and `info`. • Adds `GET /debug/pprof/cmdline` endpoint exposing Go `net/http/pprof` profiling data — plain text for cmdline, binary pprof profiles for other keys. • Adds `waiting_trx_id`, `waiting_thread`, `waiting_query`, `blocking_trx_id`, `blocking_thread`, and `blocking_query` fields to the database debug response for InnoDB lock contention visibility. • Adds raw `SHOW ENGINE INNODB STATUS` output (as a JSON string) to the database debug API response. • Adds `preserve_host_activity_on_reenrollment` field to host configuration, controlling whether activity history is retained when a host re-enrolls. • Adds `end_user_local_account_type` field (e.g. `"admin"`) to host/enrollment configuration. • Adds `cve_published` timestamp field to software vulnerability responses (Fleet Premium only). • Adds `cve_description` field to software vulnerability responses (Fleet Premium only). • Adds `software_title_id` field to software API responses. • Adds `repository_url` field to software package responses. • Adds `starts_at` field to relevant API responses for time-scoped data. • Adds `resolution` field to vulnerability/policy responses, providing human-readable remediation instructions. • Adds `description` field to SCIM User and SCIM Group objects. • Adds `fleet_id` and `team_id` fields to software/team association responses, supporting multi-team software mappings. • New endpoint documented: GET /debug/db/process-list • New endpoint documented: GET /debug/pprof/cmdline Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.89.0

Wed, 15 Jul 2026 18:06:10 GMT

Fleet 4.89.0 adds policy label targeting, setup experience policy checks, new vulnerability filtering, Google Workspace IdP integration, and more. • Adds ability to target policies to hosts using a combination of 'include' and 'exclude' labels. • Adds policy check before installing Windows and Linux setup experience software, skipping installs when the policy already passes to speed up end-user setup. • Changes calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure. • Adds automation runs table to the policy details page showing per-host automation outcomes with filtering, search, and a reset policy action. • Adds per-host activity log entries when policy automations (webhook, tickets, Google Calendar, and Microsoft conditional access) fail or succeed. • Adds `POST /api/v1/fleet/policies/:policy_id/reset` endpoint to reset a policy's pass/fail results, clearing counts and membership immediately. • Adds `GET /api/v1/fleet/policies/:id/automation_activities` endpoint to list automation activities for a policy. • Adds ability to keep Fleet-maintained apps automatically updated, pinned to a specific version or major version, or rolled back to a previously cached version, from the UI and via GitOps (Fleet Premium). • Surfaces `.sh` script-only software packages on the macOS tab of Controls > Setup experience > Install software, tracked independently from the Linux tab. • Adds `setup_experience_platform` field on software packages in GitOps YAML for declarative per-platform setup experience selection. • Adds support for pre-install query, post-install script, and uninstall script on script-only packages (`.sh` and `.ps1`) via the UI, REST API, and GitOps. • Adds error on the Windows enrollment status page (ESP) when setup experience software fails during automatic enrollment and 'Cancel setup if software fails' is off. • Adds ' Support' as a new default self-service software category. • Adds support for `$FLEET_VAR_HOST_*` variables in Android configuration profiles and managed app configuration. • Adds automatic resending of Android certificate templates and managed app configurations when IdP variable values change. • Adds support for defining the default Fleet team BYO Apple devices enroll into. • Adds a Google Workspace integration that maps IdP users to hosts, populating IdP host vitals directly from your Google Workspace directory. • Adds an activity feed entry when a user runs a custom Apple or Windows MDM command, visible in global and host activity feeds. • Adds an activity log entry when editing the managed local account setting via the update fleet endpoint or GitOps. • Enables tracking of mobile devices in the 'hosts online' chart with default filtering that excludes mobile platforms. • Starts collecting non-critical CVEs, filtering them out of vulnerability charts by default. • Adds ability to filter vulnerable software by severity (CVSS score) and known exploit status on Fleet Desktop My device > Software tab (Fleet Premium), with `min_cvss_score`, `max_cvss_score`, and `exploit` query parameters added to `GET /device/{token}/software`. • Adds more filtering options and ability to set default filters for the Vulnerability Exposure chart via GitOps. • Adds support for all IdP variables and host platform in certificate template subject names and SANs. • Adds private network IP blocking to Fleet's HTTP client; loopback and cloud metadata addresses always blocked, RFC 1918 ranges blocked by default, with `--allow_private_network_integrations` to allow them for on-prem integrations. • Adds `s3.carves_cleanup_disabled` server setting to skip S3 file carve reconciliation for deployments relying solely on bucket lifecycle policies. • Adds `s3.carves_cleanup_max_per_run` and `s3.carves_cleanup_concurrency` server settings to tune S3 carve cleanup throughput. • Adds configurable batch size `FLEET_MDM_ANDROID_BATCH_SIZE` (default: 1000 hosts) for Android MDM operations to prevent overwhelming the Google Android Management API. Breaking changes: • RFC 1918 and other private network ranges are now blocked by default in Fleet's HTTP client; deployments with on-prem integrations (e.g. EJBCA, Jira, SCEP servers on private networks) must add `--allow_private_network_integrations` to restore connectivity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.88.0

Thu, 02 Jul 2026 00:21:34 GMT

Fleet v4.88.0 adds support for personal (BYOD) Apple MDM enrollment with per-host wipe/lock permission controls. • Supports personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions to prevent remote wipe or lock of personal devices, with permissions preserved across SCEP/ACME certificate renewal. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.87.0

Sat, 20 Jun 2026 01:11:57 GMT

Fleet 4.87 adds Android L/W commands, W in API, GCS IAM auth, Spotlight cmd palette, trace sampler endpoint. • Added `fleetctl get mdm-ab` and `fleetctl generate mdm-ab` CLI commands to work with the new Apple Business (AB) terminology replacing ABM. • Added `/api/v1/fleet/ab_tokens` and `/api/v1/fleet/mdm/apple/ab_public_key` API endpoints for managing Apple Business tokens and keys. • Added `mdm.apple_business` YAML key in GitOps config to replace the deprecated `apple_business_manager` key. • Added ability to deploy custom OS update configuration profiles for Apple and Windows hosts. • Added support for issuing Lock, Wipe, and Clear passcode commands to Android hosts via UI or API. • Added the `macos_applications` filter for filtering host software lists in the UI and API. • Added `continuous_automations_enabled` field to GitOps YAML output and config for re-running automations on policy failure. • Added GCS IAM authentication support for software installers and file carving S3 storage, configurable via `s3_software_installers_gcs_iam_auth` and `s3_carves_gcs_iam_auth`. • Added route-aware head sampling for OpenTelemetry trace export with configurable ratios for agent firehose endpoints. • Added `GET`/`PATCH /debug/trace_sampler` endpoint for adjusting trace sampling ratios at runtime without restart. • Added 'Spotlight' command palette accessible via Command + K or Control + K in the Fleet UI. • Added Self-service categories page (Premium) under Software > Library for managing custom software categories. Breaking changes: • The ABM terminology has been renamed to Apple Business (AB); the `/abm_tokens`, `/mdm/apple/abm_public_key` endpoints, and `apple_business_manager` config keys are deprecated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.87.0

Sat, 20 Jun 2026 01:11:57 GMT

Fleet 4.87.0 adds 963 new managed apps, Android MDM commands, Apple Business rebranding, GCS IAM auth, and a command palette. • Adds 236 new Fleet-maintained apps for Windows, including Microsoft Office, PowerShell, PowerToys, Power BI, Git, Node.js, Python 3.13/3.14, PostgreSQL 15–18, Nessus Agent, Bitwarden, and more. • Adds 727 new Fleet-maintained apps for macOS, spanning development, security, productivity, and design tooling. • Supports issuing Lock, Wipe, and Clear Passcode MDM commands to Android hosts; Wipe is available to Fleet Free users for company-owned Android devices. • Enables deploying custom OS update configuration profiles for Apple and Windows hosts. • Adds GCS IAM authentication (via Google Application Default Credentials) for software installers S3 storage, configurable via `s3_software_installers_gcs_iam_auth`. • Adds GCS IAM authentication for file carving S3 storage, configurable via `s3_carves_gcs_iam_auth`. • Supports validating Microsoft Entra v2 access tokens during Windows MDM enrollment for applications created after July 1, 2026. • Renames Apple Business Manager (ABM) to Apple Business (AB) across the API (`/api/v1/fleet/ab_tokens`, `/api/v1/fleet/mdm/apple/ab_public_key`), GitOps YAML (`mdm.apple_business`), and CLI (`fleetctl get mdm-ab` / `fleetctl generate mdm-ab`); old aliases still work with a deprecation warning. • Adds `labels_exclude_any` combined filtering with `labels_include_all` or `labels_include_any` for MDM configuration profile targeting. • Adds a 'Continuous' option to policy automations that re-runs script and software automations on every subsequent policy failure. • Adds Self-service categories page (Premium) under Software > Library for managing custom categories per fleet. • Adds 'Install all (n)' button per self-service category on the My device page, posting to `/device/{token}/software/install_all?category_id=:id`. • Adds `macos_applications` filter for the host software list. • Introduces Fleet Spotlight — a command palette opened with Command+K / Control+K for navigating the Fleet UI. • Adds route-aware head sampling for OpenTelemetry trace export, with configurable ratios via `GET`/`PATCH /debug/trace_sampler` at runtime. • Reduces Windows MDM device management poll interval from 1 minute to 8 hours for hosts running fleetd 1.57.0+, with on-demand wake for near-real-time command delivery. • Adds Technician role ability to transfer hosts between fleets (Premium) via the Fleet UI and REST API. • Adds support for configuring an optional SES sender domain. • Adds end-user account type configuration options: `standard` for a non-admin user or `none` to skip end-user account creation. • Surfaces `continuous_automations_enabled` in GitOps YAML (readable and generated by `fleetctl generate-gitops`). • Hardens in-house iOS app distribution with a per-install token in manifest and package download URLs, valid for 6 hours and bound to the target host. • Adds each platform's percentage of total enrolled hosts to the 'Hosts enrolled' card tooltip on the dashboard. • Rejects Windows MDM configuration profiles that lack at least one supported SyncML top-level element (``, ``, ``, ``) or contain invalid `` values at upload time. • Raises the default `FLEET_REDIS_HOST_CACHE_TTL` from 60s to 180s and removes reverse-index GETs on host-update invalidation, reducing DB reader load and Redis CPU usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.86.0

Fri, 29 May 2026 22:53:47 GMT

Fleet 4.86.0 adds iOS/iPadOS VPP installs, managed app config, CIS benchmark updates, and major dashboard and GitOps expansions. • Adds automatic rotation of managed local admin account passwords after they have been viewed. • Adds `require_all_software_windows` setting to cancel the Windows setup experience if any software install fails during Autopilot enrollment, matching existing macOS behavior. • Adds GitOps support for uploading custom org logos via `org_logo_path_dark_mode` and `org_logo_path_light_mode` keys in `fleetctl gitops`; `fleetctl generate-gitops` exports Fleet-hosted logos as local files. • Supports installing VPP and in-house (`.ipa`) apps on iOS and iPadOS hosts enrolled via Account-Driven User Enrollment with a Managed Apple Account. • Enables self-service software installs from the My Device page for user-enrolled iOS and iPadOS hosts. • Enables setup experience software to install automatically on user-enrolled iOS and iPadOS hosts at enrollment. • Provisions a VPP client user per Managed Apple Account on first install, associating VPP licenses to the user rather than the device, supporting Apple's up-to-5-devices-per-user licensing. • Adds managed app configuration for iOS and iPadOS apps (VPP and in-house) with `$FLEET_VAR_*` substitution, configurable via UI, REST API, and GitOps. • Supports VPP apps purchased from non-US-based Apple Business accounts. • Adds ability to upload a custom organization logo for light and dark modes, hosted by Fleet, with SVG support and server-side sanitization. • Adds `include_all` label scope to policies, and `include_all` and `include_any` label scopes to reports, with GitOps and `fleetctl` support. • Adds a 'Custom' target dropdown when creating or updating reports under the premium tier, with an 'Include all' option on Policies for premium users. • Adds support for setting `gitops_mode_enabled` and `repository_url` via GitOps. • Adds output to GitOps runs for scripts, showing how many scripts would be applied (dry run) or were applied. • Adds activity entries for retried software installs and script runs from policy automations. • Adds activities when hosts fail enrollment profile renewal. • Adds `created_label`, `edited_label`, and `deleted_label` activity entries when users create, edit, or delete labels. • Adds 'Hosts online', 'Hosts enrolled', and 'Vulnerability exposure' charts to the dashboard. • Adds an option to convert and return a PEM-encoded X.509 certificate instead of a PEM-encoded PKCS7 envelope from the Request a Certificate endpoint. • Releases `fleetctl` as a `pkg` for macOS and as an `msi` for Windows. • Enables wiping a host to cancel all of its upcoming activities. • Adds ability to download and view the applied default automatic enrollment profile. • Updates OS version reporting for iOS and iPadOS to include the Rapid Security Response suffix (e.g. (a)). • Requires the `--host` flag for `fleetctl get mdm-commands`. • Adds macOS 26 CIS Benchmark v1.0.0. • Updates CIS Windows 11 Enterprise benchmark policies from v4.0.0 to v5.0.1, adding 17 new L1 policies and updating 42 existing policy titles. • Surfaces hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM `CertificateList` command. • Adds support for the `subject_alternative_name` field on Android certificate templates. • Optimizes OSV vulnerability scanning to query distinct software per OS version rather than per host. • Adds a Redis-backed cache for host lookups on osquery and orbit authentication paths, reducing reader-side DB load at scale. • Adds the `orbit.debug_logging_on_enroll_duration` agent option to enable orbit debug logging for a specified time period after enrollment. Breaking changes: • The `--host` flag is now required for `fleetctl get mdm-commands`; invocations without it will fail. • The Redis-backed host lookup cache requires Redis 6.2 or later; deployments on older Redis versions are not supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.85.0

Thu, 14 May 2026 15:36:31 GMT

Fleet 4.85.0 adds dark theme, Clear Passcode for iOS/iPadOS, API-only user management, DDM variable support, and new dashboard charts. • Adds dark theme to the Fleet UI, selectable per-account with light, dark, and system options. • Implements Clear Passcode feature for iOS and iPadOS devices. • Adds support for Fleet variables in Apple DDM (declaration profile) configurations. • Supports passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, eliminating double-authentication prompts when EUA is enabled. • Switches to Docker as the default WiX runtime on macOS (including Apple Silicon) for generating `.msi` packages via `fleetctl package`, removing the Wine requirement. • Adds new UI pages for creating and editing API-only users with fleet assignment, role selection, and per-user API endpoint access control. • Adds `POST /users/api_only` endpoint for creating API-only users. • Adds `PATCH /users/api_only/{id}` endpoint for updating existing API-only users. • Adds new middleware (`APIOnlyEndpointCheck`) that enforces a 403 response for API-only users accessing endpoints outside their configured restrictions. • Adds premium `GET /api/_version_/fleet/rest_api` endpoint returning the embedded `api_endpoints.yml` artifact. • Updates `GET /users/{id}` response to include the new `api_endpoints` field for API-only users. • Adds `user_api_endpoints` table to track per-user API endpoint permissions. • Updates `fleetctl user create --api-only` to remove email and password field requirements. • Adds conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed. • Adds `always_download` option for software in GitOps to bypass conditional download behavior. • Adds automatic escaping of JSON special characters in GitOps variables used in `.json` configuration profiles (Apple DDM declarations and Android profiles). • Adds 'Hosts online', 'Vulnerability exposure', and 'Hosts enrolled' charts to the Fleet dashboard. • Adds an admin setting to control retention of vulnerability-exposure data used by the dashboard chart. • Adds a new policy details page with a read-only view of policy information. • Adds dedicated `/policies/:id/live` route for running policies. • Enables renewing and deleting AB tokens in the UI while in GitOps mode. • Adds ability to save policies whose SQL is flagged as a syntax error. • Withholds Android Wi-Fi configuration profiles (`openNetworkConfiguration` with `ClientCertKeyPairAlias`) until the referenced certificate is installed or terminally failed on the device. • Updates the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency. • Switches Fleet-maintained apps serving location from GitHub to `https://maintained-apps.fleetdm.com/manifests`, with automatic fallback to GitHub. • Updates macOS 15 CIS benchmark to include v2.0.0 changes and macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0. • Updates `fleetctl gitops` to process Android certificates before Android profiles. Breaking changes: • Fleet names must now differ by more than letter case across UI, API, and GitOps paths; conflicts that were previously allowed now return a 409 error on all code paths. • Prometheus serving is no longer enabled by default with a hard-coded username and password when the server is started with `--dev`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.84.0

Sat, 25 Apr 2026 01:13:33 GMT

Fleet 4.84.0 adds Entra conditional access for Windows, ACME/hardware attestation, new vulnerability sources, and a host query-reports API. • Adds Entra conditional access support for Windows devices. • Implements ACME for MDM protocol communication and hardware device attestation. • New `GET /api/v1/fleet/hosts/{id}/reports` endpoint (also at `/hosts/{id}/queries`) lists query reports for a specific host. • Adds vulnerability detection for Microsoft 365 Apps and Office products on Windows. • Adds OSV data source for Ubuntu vulnerability scanning. • Adds automatic rotation of Mac recovery lock passwords 1 hour after the password is viewed via the API. • Adds ability to pin Fleet-maintained apps to a specific major version in GitOps. • Adds support for `labels_include_all` conditional scoping for software installers and apps. • Adds ability to specify a custom patch policy query in a Fleet-Maintained App (FMA) manifest. • Adds support for running Python scripts on macOS and Linux. • Adds a new `disk_space` fleetd table for macOS reporting available disk space including purgeable storage. • Adds configuration profile deletion via SyncML `` commands when a Windows profile is removed or a host changes teams, bringing Windows to parity with macOS. • Adds support for outputting VPP policy automations in `fleetctl generate-gitops`. • Adds a Reports tab to the Host details page. • Adds activity logging when a certificate is installed or fails on an Android host. • Enables the host activity card on the Android host details page. • Adds ability to re-send Android certificates to a specific host. • Adds `FLEET_MDM_CERTIFICATE_PROFILES_LIMIT` server config option to throttle CA certificate profile installations per reconciler cycle. • Adds automatic retry (up to 3 times) for Android agent certificate install failures; increases Apple configuration profile retry limit from 1 to 3. • Enables Windows MDM in `fleetctl preview` by auto-generating WSTEP certificates on startup. • Allows specifying a Fleet-Maintained App (FMA) as a policy software automation in GitOps. • Allows clearing Windows OS update deadline and grace period fields to remove enforcement. • Increases the default SSO session validity period from 5 to 15 minutes. • Allows OTEL service name to be overridden with the standard `OTEL_SERVICE_NAME` environment variable. • Updates GitOps label functionality so omitting the `hosts:` key under a manual label preserves existing host membership instead of removing all hosts. • Adds Flatcar Container Linux and CoreOS to recognized Linux platforms. • Switches Fleet-maintained apps serving location to `https://maintained-apps.fleetdm.com/manifests`. • Upped the default limit for the software batch endpoint from 1 MiB to 25 MiB. • Renames 'Custom settings' to 'Configuration profiles' in the Fleet UI. • Adds indication in the UI when a profile command was deferred via `NotNow` status. • Adds support for JetBrains software with 2-part version numbers (e.g., WebStorm 2025.1) in CVE ingestion logic. Breaking changes: • Fleet-maintained apps are now served from `https://maintained-apps.fleetdm.com/manifests` instead of GitHub — if you restrict outbound Fleet server traffic, you must allow access to this new URL. • The incorrect `report` key has been removed from get/create/modify API responses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.83.0

Wed, 01 Apr 2026 16:16:39 GMT

Fleet 4.83.0 adds Android web app deployment, Mac recovery lock rotation, NDES CA support, and sweeping GitOps improvements. • Adds ability to deploy an Android web app via setup experience or self-service. • Adds ability to set and manually rotate Mac recovery lock passwords. • Adds ability to lock pre-filled user information for macOS hosts that log in via End User Authentication during Setup Experience. • Adds automatic retries for failed software installs (excluding VPP apps). • Adds retry functionality when adding software installers to Fleet via GitOps. • Adds `fleetctl new` command to initialize a GitOps folder. • Adds support for `paths:` key under `reports:`, `labels:`, and `policies:` in GitOps files. • Adds glob support for `configuration_profiles` in GitOps files. • Adds support for referencing `.sh` or `.ps1` script files directly in the GitOps `path` field for software packages. • Implements `webhooks_and_tickets_enabled` flag for policies in GitOps. • Adds server config for allowing all Apple MDM declaration types. • Adds ability to use `FLEET_JIT_USER_ROLE_FLEET_` as a prefix on SAML attributes for just-in-time role assignment. • Adds `fleet_name` and `fleet_id` columns to hosts CSV export. • Adds resend button in the OS settings modal for iOS and iPadOS hosts. • Adds patch policies for Fleet-maintained apps that automatically update when the app is updated. • Adds support for NDES CA for Windows hosts. • Adds vulnerability scanning support for Windows Server 2025 hosts. • Adds OTEL instrumentation to Fleet's internal HTTP client. • Adds ability to omit `secrets:` in GitOps files to retain existing enroll secrets on the server. • Adds APNs expiry banner in the UI for Fleet free users. • Optimizes `api/latest/fleet/software/titles` endpoint. • Improves Windows profile verification to no longer rely on osquery for faster verification. Breaking changes: • GitOps runs now fail when unknown keys are detected in files. • Configuration key `custom_settings` is deprecated in favor of `configuration_profiles`. • Configuration key `macos_settings` is deprecated in favor of `apple_settings`. • Configuration key `macos_setup` is deprecated in favor of `setup_experience`. • Configuration key `macos_setup_assistant` is deprecated in favor of `apple_setup_assistant`. • `setup_experience.bootstrap_package` is deprecated in favor of `setup_experience.macos_bootstrap_package`. • `setup_experience.manual_agent_install` is deprecated in favor of `setup_experience.macos_manual_agent_install`. • `setup_experience.enable_release_device_manually` is deprecated in favor of `setup_experience.apple_enable_release_device_manually`. • `setup_experience.script` is deprecated in favor of `setup_experience.macos_script`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.81.3

Sat, 21 Mar 2026 12:28:25 GMT

Adds configurable body size limits for osquery log and distributed write endpoints to prevent PayloadTooLargeError • Adds configurable body size limits for the `/api/osquery/log` and `/api/osquery/distributed/write` endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet 4.81.3

Fri, 20 Mar 2026 00:00:00 GMT

Fleet 4.81.3 adds configurable body size limits for osquery API endpoints. • Adds configurable body size limits to the `/api/osquery/log` and `/api/osquery/distributed/write` endpoints. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.82.0

Thu, 12 Mar 2026 14:58:55 GMT

Fleet 4.82.0 adds Android fully-managed enrollment, a new Technician role, kernel vuln scanning on RHEL, and app rollback. • Supports enrolling fully managed Android hosts without a work profile. • Adds automatic uninstall of Android apps on device (and removal from self-service in managed Google Play) when an app is removed from Fleet. • Adds per-policy control to allow or disallow end-users to bypass conditional access. • Adds filtering by platform and status in the Software > Add Fleet-maintained apps table. • Adds ability to roll back to previously added versions of Fleet-maintained apps. • Introduces new Technician role for help desk and IT support teams, with permissions to run scripts, view results, and install or uninstall software. • Supports JIT provisioning of the Technician role via SSO SAML attributes. • Adds automatic retries for failed software operations. • Enables scanning for kernel vulnerabilities on RHEL-based hosts. • Adds AWS GovCloud RDS CA certificates to the RDS MySQL TLS bundle, enabling IAM authentication for Fleet deployments in us-gov-east-1 and us-gov-west-1. • Adds CVE alias support for the Python Visual Studio Code extension. • Adds a new activity log entry for edited enroll secrets. • Adds configurable body size limits for the `/api/osquery/log` and `/api/osquery/distributed/write` endpoints. • Adds `logging.otel_logs_enabled` config option to export server logs to OpenTelemetry. • Adds ability to enable or disable logs by topic. • Adds ability to specify allowed Entra tenant IDs for enrollments. • Increases maximum script execution timeout from 1 hour (3600 seconds) to 5 hours (18000 seconds). • Adds `team_id` to host details page URL parameter to retain team context on refresh. • Supports adding and removing multiple Microsoft Entra tenant IDs in the UI. • Surfaces Fleet-maintained app (FMA) version and out-of-date status in the UI. Breaking changes: • Teams and queries are renamed to fleets and reports in the UI, API, CLI, and GitOps — consumers of these API fields or GitOps keys must update to the new names. • Certain API field names are deprecated to reflect the renaming of 'teams' to 'fleets' and 'queries' to 'reports'. • `no-team.yml` in GitOps is deprecated in favor of `unassigned.yml` — GitOps configurations using `no-team.yml` should migrate to `unassigned.yml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.81.1

Tue, 03 Mar 2026 01:36:11 GMT

Fleet v4.81.1 adds configurable allowed Entra tenant IDs for enrollments and moves UI auth token from local storage to cookie. • `Added CTA to turn on Android MDM for Android software setup experience if MDM is not configured` • `Updated UI to enable adding/removing multiple Microsoft Entra tenant ids.` • `Updated storage of the auth token used in the UI; move if from local storage to a cookie.` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.81.0

Fri, 20 Feb 2026 23:41:19 GMT

Fleet 4.81.0 adds dynamic SCEP/Okta cert support, non-atomic Windows MDM profiles, configurable software installer size up to 10 GiB, and gzip API responses. • Adds support for dynamic SCEP challenges for Okta certificates. • Adds `conditional_access.cert_serial_format` server option to specify the Okta conditional access certificate serial format. • Adds ability for IT admins to specify non-atomic Windows MDM profiles. • Adds GitOps support to apply `display_name` to software packages in fleet YAML. • Adds enrollment support for iPod touch. • Adds `hash_sha256` and `package_name` query parameters to `GET /api/v1/fleet/software/titles` to check if a custom software package already exists before uploading (requires `team_id`). • Adds ability to set a default URL for Fleet Desktop. • Makes maximum software installer size configurable; bumps the default from 3 GB to 10 GiB. • Adds `gzip_responses` server configuration option to enable gzip compression of API responses when the client sends `Accept-Encoding: gzip`. • Allows specifying an Apple Connect JWT for interacting directly with Apple APIs when retrieving VPP app metadata. • Redirects users to the device policy page when failing conditional access requirements. • Limits disk encryption key escrowing to when the global or team setting is enabled. • Adds `--with-table-sizes` option to the `prepare` command to get approximate row counts of all database tables after a migration completes. • Updates `fleetctl generate-gitops` to output Fleet-maintained apps in a dedicated `fleet_maintained_apps` section of YAML files. • Clears user sessions and password reset tokens whenever a user's password is changed. • Adds separate OpenTelemetry metrics for client vs. server errors (`fleet.http.client_errors`, `fleet.http.server_errors`) with error type attribution. • Adds logic to skip setup experience for hosts enrolled more than 1 day ago. • Adds a check to fail pending in-house app installs and cancel upcoming activities when unenrolling a host. • Disallows use of `FLEET_DEV_*` environment variables unless `--dev` is passed when serving Fleet. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.80.1

Fri, 06 Feb 2026 23:17:07 GMT

Adds `FLEET_SERVER_TRUSTED_PROXIES` config key and fixes `fleetctl generate-gitops` panic. • Adds the `FLEET_SERVER_TRUSTED_PROXIES` configuration environment variable to control trusted proxy headers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.80.0

Tue, 03 Feb 2026 00:22:47 GMT

Fleet 4.80.0 adds NATS logging, iOS/iPadOS VPP auto-update scheduling, automatic MDM unenrollment app removal, and macOS binary hash ingestion. • Adds NATS as a logging destination for Fleet server events. • Adds ability to automatically uninstall managed apps when iOS/iPadOS devices are unenrolled from MDM. • Adds scheduled automated software updates for iOS/iPadOS VPP apps via the Fleet admin UI and API. • Adds API support to get and set auto-update schedules for VPP apps. • Adds custom VPP apps to the available VPP apps listing. • Ingests, persists, and serves the SHA-256 hash and path for CFBundleExecutable binaries of .app bundles on macOS. • Updates NDES SCEP proxy to auto-detect response encoding, enabling compatibility with Okta CA and other UTF-8-based CAs. • Adds support for in-house apps to use CloudFront signed URLs in their manifest when CloudFront is configured. • Surfaces Queries within the Details tab on the Host Details page. • Updates software version search to include results matching the software title name in addition to the version name. • Limits software ingestion for manually-enrolled (BYOD) iPhone/iPad devices to Fleet-installed software only. • Omits software `last_opened_at` in API responses when the data source does not support it. • Script and software installer policy automations now retry up to three times on failure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.79.0

Wed, 14 Jan 2026 21:35:58 GMT

Fleet 4.79.0 adds Android MDM management, team-specific labels, Windows SCEP renewal, and ADE OS-update enforcement. • Adds ability to view past and upcoming MDM commands for a host in the Fleet UI. • Adds support for applying Android app configurations. • Adds support for resending Windows MDM profiles. • Adds support for renewal of custom SCEP profiles for Windows. • Adds team-specific labels, creatable via spec endpoints and GitOps. • Adds ability to create, list, and delete Android certificates from the UI. • Adds Android agent application (auto-deployed via Android MDM) to support automated SCEP certificate installation on Android hosts. • Adds ability to indicate that new macOS hosts enrolling via ADE should be updated to the latest OS version. • Adds ability to edit Android software configuration in the UI. • Adds support for ingesting Windows certificates via osquery. • Adds audit activities for certificate template creation and deletion. • Implements streaming for the `GET /hosts` API to improve performance at scale. • Adds pagination metadata to the `GET /mdm/commands` endpoint. • Adds ability to search teams in the dropdown when transferring hosts between teams. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.78.0

Fri, 19 Dec 2025 23:08:37 GMT

Fleet 4.78.0 adds Android setup experience, Windows manual MDM enrollment, Okta conditional access UI, and certificate template GitOps support. • Adds Android setup experience software installation support. • Adds Android self-service app support to `fleetctl gitops`. • Adds Android `systemUpdate` profile support. • Adds ability to create, view, and delete Google Play Store software for Android in the UI. • Adds `$FLEET_VAR_HOST_PLATFORM` variable for Apple platforms (`macos`, `ios`, `ipados`) in profiles. • Adds support for installing setup-experience VPP apps on manually-enrolled iOS/iPadOS devices. • Adds ability to deploy user-scoped SCEP profiles for Windows hosts. • Adds configuration option to require Windows users enroll into MDM manually via work or school account rather than automatic enrollment. • Adds UI to allow Windows hosts to manually enroll into Fleet MDM. • Adds support for `$FLEET_VAR_HOST_HARDWARE_SERIAL` and `$FLEET_VAR_HOST_PLATFORM` variables in Windows profiles. • Adds activity filtering on the Fleet dashboard page. • Adds Okta conditional access configuration to Fleet UI under Settings -> Integrations -> Conditional access. • Adds endpoint for hosts to update certificate status. • Adds `detail` column to `host_certificate_template` table and `certificate_templates` property with GitOps support. • Adds MDM-enrolled Android devices receiving certificate templates via `managedConfigurations`. • Makes `host_count` property optional in `GET /labels` API endpoints, improving performance for large label queries. • Allows users to save Fleet queries even when SQL is flagged as invalid by the Fleet UI. • Returns pre-install query output in the Install Details modal. • Translates `idp` to `mdm_idp_accounts` on API responses. • Adds Mosyle to the list of well-known MDM platforms. Breaking changes: • Fleet is no longer verified to work with Redis 5 or below; configurations referencing Redis 5 have been switched to Redis 6. Deployments using Redis 5 or earlier must upgrade Redis before upgrading Fleet. • The `idp` field in API responses is now returned as `mdm_idp_accounts`; any integrations parsing the `idp` key from API responses will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.77.0

Tue, 02 Dec 2025 23:32:11 GMT

Fleet 4.77.0 adds JetBrains plugin vuln detection, Custom EST/SCEP CA support, iOS self-service IPA apps, and BYOD macOS auth improvements. • Detects vulnerabilities in JetBrains IDE plugins. • Adds activity log entries for host deletion, host expiration, and updating or deleting host IdP mappings. • Updates MDM enrollment flow for BYOD macOS hosts to require end-user authentication before downloading the MDM profile via the 'My device' page. • Adds self-service install support for custom IPA apps on iOS and iPadOS. • Adds support for in-house ('.ipa') apps to `fleetctl gitops`. • Adds support for Custom EST certificate authorities. • Adds ability to deploy certificates from Custom SCEP certificate authorities on Windows. • Updates `POST /setup_experience/script` endpoint to allow updating the macOS setup experience script in-place (GitOps no longer calls `DELETE`). • Adds status counts to batch script detail page tabs. • Adds ingestion of `upgrade_code`s from Windows software, exposed via all relevant software endpoints. • Adds experimental `FLEET_MDM_ENABLE_CUSTOM_OS_UPDATES_AND_FILEVAULT` configuration to deploy custom OS settings including FileVault payloads and macOS/Windows update settings. • Adds ability to change software display names in the UI. • Moves end-user authentication SSO settings under Integrations > SSO in global settings. • Adds `InstallAnywhere` as a recognized self-extracting archive for PE metadata extraction. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.76.0

Sat, 08 Nov 2025 00:19:53 GMT

Fleet 4.76.0 adds Android software inventory, npm/JetBrains/VSCode-fork vulnerability detection, iOS lost mode, and more. • Adds software inventory support for Android hosts. • Adds npm package discovery and vulnerability matching for macOS and Linux hosts. • Adds JetBrains IDE inventory and vulnerability detection for JetBrains plugins on hosts. • Adds software inventory support for VSCode fork extensions: Cursor, Windsurf, VSCodium, VSCodium Insiders, and Trae. • Adds Santa tables to fleetd. • Enables software installation for iOS and iPadOS hosts during the setup experience. • Enables specifying VPP apps for automatic installation during ADE iOS and iPadOS enrollment. • Adds the ability to lock iOS and iPadOS devices via lost mode, including UI support for locking and unlocking. • Adds a configuration option to halt macOS setup experience if any software install fails. • Adds `gigs_all_disk_space` vital collection, storage, and UI rendering for Linux hosts. • Adds a new server config flag to specify the cleanup age for completed distributed targets, improving live query response times. • Adds `idp` source support to the device mapping API for manually setting IDP user mappings. • Enables testing new or edited policy queries via live query while in GitOps Mode. • Improves performance of `/api/latest/fleet/os_versions`, `/api/latest/fleet/vulnerabilities`, and `/api/latest/fleet/software/versions` endpoints. Breaking changes: • `browser` is deprecated in favor of `extension_for` in API responses and JSON/YAML outputs. • The default name of Host Identity CA is changed to 'Fleet Host Identity CA', which may conflict with existing configurations referencing the previous default name. • The `platform` field is cleared on all built-in labels via a migration, which may affect queries or workflows that relied on that field being set. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.75.0

Fri, 17 Oct 2025 22:51:09 GMT

Fleet 4.75.0 adds Smallstep CA, Arch Linux support, Android config profiles, Santa osquery tables, and IdP-driven labels for iOS/iPadOS. • Adds support for Smallstep certificate authority integration. • Adds `santa_allowed`, `santa_denied`, and `santa_status` osquery tables via Fleet's built-in Santa extension. • Adds false-positive filtering for Linux vulnerability scanning. • Adds support for Arch Linux hosts, including software inventory ingestion. • Adds `fleetctl` support to generate `fleetd` installers for Arch Linux (`.pkg.tar.zst` format). • Adds configuration profile support for Android hosts, with activity logging for profile creation, modification, and deletion. • Adds support for software installation during Windows setup experience. • Adds ability to read server `private_key` from AWS Secrets Manager. • Adds support for vulnerabilities feed CPE translation JSON to override the `sw_edition` field. • Adds ability to specify a Fleet host ID when declaring a manual label in a GitOps YAML file. • Adds a dedicated labels management page with table and UI integrations. • Adds OpenTelemetry instrumentation to scheduled jobs and several API endpoints. • Adds ability to unenroll personal iOS/iPadOS devices from Fleet. • Adds support for assigning host labels based on IdP attributes for iOS and iPadOS hosts. • Adds ability to turn off MDM for iOS and iPadOS devices when the refetcher returns a device token as inactive. • Adds support for hosts enrolled with Company Portal using the legacy SSO extension for Entra conditional access. • Updates DEB and RPM packages generated by `fleetctl package` to be safe to upgrade in-band through the Software page. • Adds count to list host certificates API response. • Adds new rate limiting for Fleet Desktop API endpoints to support large deployments behind NAT. Breaking changes: • If you deploy a custom Santa osquery extension (e.g., Trail of Bits) with tables named exactly `santa_allowed`, `santa_denied`, or `santa_status`, Fleet's agent will crash on upgrade. You must uninstall the custom extension before upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.74.0

Mon, 06 Oct 2025 22:07:04 GMT

Fleet 4.74.0 adds Hydrant CA support, Linux setup experience, batch MDM profile APIs, and AWS IAM auth for RDS/ElastiCache. • Adds Hydrant as a supported Certificate Authority, plus an experimental API to request certificates from Hydrant. • Adds `POST /api/v1/fleet/configuration_profiles/batch` endpoint to batch-modify MDM configuration profiles. • Adds `/batch/{batch_execution_id}/host-results` endpoint to list hosts targeted in a batch execution. • Adds new UI page for batch script run details, with improved sorting by started/finished date. • Adds AWS RDS (MySQL) IAM authentication support. • Adds AWS ElastiCache (Redis) IAM authentication support. • Adds support for hosts enrolled with Company Portal using the legacy SSO extension for Entra conditional access. • Adds setup experience software items for Linux devices, including new device and admin API endpoints (`POST /api/fleet/orbit/setup_experience/init`, `POST /api/v1/fleet/device/{token}/setup_experience/status`). • Extends `PUT /api/v1/fleet/setup_experience/software` and `GET /api/v1/fleet/setup_experience/software` with a `platform` argument supporting `linux` or `macos`. • Adds ability to upload custom software icons. • Adds IdP `fullname` attribute as a valid Fleet variable for Apple configuration profiles. • Adds username of the managed user account for user-scoped profiles on macOS host details. • Enables webhook and Jira/Zendesk ticket policy automations for 'No team'. • Adds support for writing multiple packages in a single GitOps YAML file under `software.packages`. • Moves `self_service`, `labels_include_any`, `labels_exclude_any`, `categories`, and `setup_experience` declarations to team level for software in GitOps; `setup_experience` can now be set on packages, Fleet Maintained Apps, or App Store apps. • Adds a Fleet-maintained app for macOS: Omnissa Horizon Client. • Adds opening instructions to self-service macOS apps and Windows programs. • Adds FLEET_SECRET variable guard to disallow secrets in Apple configuration profile `` fields. • Adds OpenTelemetry tracing to async tasks (host seen, labels, policies, query stats) with gzip compression and improved HTTP span naming. • Improves performance for YARA rules when modifying config with large rule sets or when large numbers of hosts fetch rules. • Updates `fleetctl get mdm-command-results` to display output in a vertical format instead of a table. • Adds database index to `distributed_query_campaign_targets` to speed up live query performance, with automatic cleanup of targets 24 hours after campaign completion. Breaking changes: • Software YAML structure has breaking changes: `self_service`, `labels_include_any`, `labels_exclude_any`, `categories`, and `setup_experience` declarations have moved to team level; migration is required (see the linked migration document). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.73.0

Tue, 09 Sep 2025 00:27:11 GMT

Fleet 4.73.0 adds batch script scheduling, secret variable APIs, CVSS filtering, and TPM PIN enforcement detection. • New detail query detects whether a BitLocker PIN protector is set, executed only when TPM PIN enforcement is required. • Automatic host identity certificate renewal for TPM-backed certificates on Linux: orbit renews certificates within 180 days of expiration using proof-of-possession. • New global activity event logged when a disk encryption key is escrowed. • Adds issuer and issued cells to the host details and My Device page certificates table. • Enables filtering host and team software by minimum and maximum CVSS score in the Fleet UI. • Displays kernel vulnerabilities on the operating system details page for Linux systems. • Updates macOS CIS policies: macOS 13 to CIS Benchmark v3.1.0, macOS 14 to v2.1.0, macOS 15 to v1.1.0. • Fleet certificate ingestion now accepts non-standard country codes longer than 2 characters and truncates other oversized fields instead of failing. • New API endpoints to add, delete, and list secret variables; custom variables can also be managed in the UI. • New API endpoints to get and list batch scripts, with a cron job to launch scheduled batch script runs. • New API endpoint to cancel a scheduled batch script run; cancellation also available directly from the UI summary modal. • Ability to schedule batch script runs in advance from the 'Run scripts' modal. • Hosts list can now be filtered to those incompatible with a script in a batch run. • New side navigation on Controls > Scripts page with a 'Library' tab and a new 'Batch progress' tab showing started, scheduled, and finished scripts. • Batch execution IDs added to script run activities. • IdP SSO authentication added to BYOD mobile device enrollment when enabled for the team. • GitOps now supports overriding install/uninstall scripts and specifying pre-install queries and post-install scripts for Fleet-maintained apps. • Adds support for `$FLEET_VAR_HOST_UUID` variable in Windows MDM configuration profiles. • Adds last-opened time tracking for Linux software (DEB & RPM packages), plus an indication when software was never opened vs. unsupported type. • Automatic install policies are now included in host software responses. • Updates `fleetctl api` to support sending data in the body of non-GET requests using the `-F` flag. Breaking changes: • `PUT /api/v1/fleet/spec/secret_variables` now only accepts secret variable names containing uppercase letters, numbers, and underscores. • DEB and RPM fleetd packages previously uploaded to the Fleet Software page for in-band upgrades must be re-generated with fleetctl v4.73.0 and re-uploaded before use, because pre-removal scripts in older packages stop Orbit unconditionally on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.72.0

Wed, 13 Aug 2025 23:53:51 GMT

Fleet 4.72.0 adds TPM-backed host identity via SCEP, Apple Account Driven User Enrollment, MS-MDE2 v7.0, and new Fleet-maintained macOS apps. • Adds support for issuing host identity certificates via SCEP (Simple Certificate Enrollment Protocol), enabling `fleetd` to use TPM 2.0 hardware to cryptographically sign all HTTP requests. • Adds `--fleet-managed-host-identity-certificate` flag to generate `fleetd` packages for Linux that use TPMs to sign HTTP requests. • Adds `sso_server_url` configuration option to support SSO setups with separate URLs for admin access vs. agent/API access. • Adds support for Apple Account Driven User Enrollment for iOS/iPadOS when end-user authentication is configured. • Adds support for MS-MDE2 v7.0 Windows MDM Enrollments. • Adds four new Fleet-maintained macOS apps: iTerm2, YubiKey Manager, VNC Viewer, and Beyond Compare. • Host details > Software > Library and Fleet Desktop Self-Service now show installer status, installer actions, and available software updates based on detected software inventory. • Adds `fleetd` TUF extension support on Linux arm64 and Windows arm64 devices. • Switches to `UpgradeCode`-based uninstall scripts for MSI custom packages when an `UpgradeCode` can be extracted, providing more comprehensive uninstall coverage. • Changes `enable_software_inventory` to default to `true` when missing from a GitOps config. • Removes DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions (e.g., Ubuntu for an RPM). • Increases timeouts on `/fleet/mdm/profiles/batch` to better support workflows with large numbers of profiles. • Grants Fleet Primo mode users access to Software automations and failing policy ticket & webhook automations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.71.1

Mon, 04 Aug 2025 20:33:09 GMT

Fleet v4.71.1 adds MS-MDE2 v7.0 Windows MDM enrollment support and a new SSO dual-URL configuration option. • Supports MS-MDE2 v7.0 Windows MDM Enrollments, expanding compatibility with modern Windows enrollment protocols. • New `sso_server_url` configuration option enables SSO setups where admin access and agent/API access use separate URLs, restricting SSO authentication to the specified URL. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.71.0

Wed, 23 Jul 2025 21:59:00 GMT

Fleet 4.71.0 adds IdP-based labels, Apple MDM user channel, SCIM Department ingestion, and Windows app last-opened time. • Adds support for IdP-based 'Host Vitals' labels that update automatically, enabling dynamic host grouping based on identity provider attributes. • Adds support for the Apple MDM user channel: mobileconfig profiles with a PayloadScope of User are now delivered via the user channel when a host has an active user channel connection. • Adds ingestion of the user 'Department' field via SCIM and exposes it as the `FLEET_VAR_HOST_END_USER_IDP_DEPARTMENT` variable in configuration profiles. • Adds last opened time for Windows applications in software inventory. • Updates `GET /hosts/:id/encryption_key` to return the most recently archived encryption key when the current key is unavailable. • Adds verification of user-scoped profiles on macOS. • Adds functionality for verifying installation of VPP apps, switching VPP apps to show as installed only after MDM confirms installation. • Increases Fleet-maintained app check frequency from once per day to once per hour. • Adds automatic refetch of host vitals and software inventory after a successful software install or uninstall. • Adds ability to configure EULA shown during setup experience via GitOps. • Adds the `team_name` property to the `/api/v1/fleet/hosts/identifier/:id` endpoint response. • Records installer URL when a Fleet-maintained app is added via the web UI or REST API. • Separates the host details software list into two sections: Inventory (installed software) and Library (software available for installation). • Updates Windows Custom OS Settings (Win32/Desktop Bridge ADMX policies) to be marked verified after the host acknowledges the MDM install command. • Moves SSO and Host status webhook settings from Settings > Organization to Settings > Integrations. • Updates CIS benchmarks for Windows 10 to version 3. • Adds `api_only` user property to backend activity details and a new avatar for API-only users in the activity feed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.70.0

Mon, 30 Jun 2025 20:41:36 GMT

Fleet 4.70.0 adds Microsoft Entra ID conditional access, Android MDM enrollment, and richer host certificate reporting. • Adds Microsoft Entra ID conditional access support for both security engineers and IT admins. • Enables Android MDM support for enrolling BYOD devices. • Adds `source` and `username` fields to host certificates, reporting 'system' or 'user' based on keychain origin (macOS 'login' keychain = 'user') and the corresponding username. • Adds a keychain column to the certificates card on host details and My Device pages. • Extends `POST /api/v1/fleet/hosts/:id/wipe` to allow specifying the remote wipe type for Windows hosts. • Updates the vulnerabilities feed to fall back to non-primary CVSSv2/v3 sources when NVD data is unavailable, rather than omitting scores. • Updates custom SCEP proxy implementation to include one-time challenges. • Adds support for filtering the hosts page by any of the 3 batch script execution statuses. • Adds an audit log activity item for automatic install policy creation. • Adds new optional `--outfile` parameter to `fleetctl package` to override the generated filename. • Adds macOS Redis cluster support. • Implements team dropdown search in the UI. Breaking changes: • The Open Policy Agent (OPA) upgrade to v1.4.2 drops support for YAML 1.1 in configuration files: `yes`/`on` values must be changed to `true` and `no`/`off` values to `false` in any file passed via the `-c` option when starting the Fleet server. • If your server was already using Android MDM via the experimental `DEV_ANDROID_ENABLED=1` flag, you must turn off Android MDM before updating your Fleet server. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.69.0

Sat, 14 Jun 2025 19:30:02 GMT

Fleet 4.69.0 adds bulk script execution on 5,000 hosts, SCIM IdP sync for Entra ID & Authentik, and Ubuntu 24.10/25.04 OVAL vuln detection. • Adds vulnerability detection via OVAL for Ubuntu 24.10 and 25.04. • Adds ability to sync end user IdP information with Microsoft Entra ID using the SCIM protocol. • Adds ability to sync end user IdP information with Authentik using the SCIM protocol. • Updates Windows 11 Enterprise CIS policies to version 4.0. • Adds new Detail Query `luks_verify` to verify whether the stored LUKS key is valid. • Adds additional checks to vulnerability feed validation to prevent deploying an un-enriched NVD feed. • Adds SHA256 hash of Mac applications to signature information in the host software response. • Adds `FLEET_AUTH_SSO_SESSION_VALIDITY_PERIOD` environment variable to override how long end users have to complete SSO. • Adds ability to execute scripts on up to 5,000 hosts at a time using filters. • Adds ability to run a script on all hosts matching the current set of supported filters. • Adds new API endpoint `GET /scripts/batch/summary/:batch_execution_id` for retrieving a summary of a batch script execution's current state. • Adds endpoint `POST /api/v1/fleet/configuration_profiles/resend/batch` to resend a profile to all hosts satisfying a filter. • Adds a starter library automatically applied to all new Fleet instances during setup. • Adds ability to uninstall software via the Self-service tab of My device. • Adds `FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE` environment variable to increase MDM SSO endpoint rate limit and split it into its own rate limit bucket. • Adds UI to filter hosts by config profile status. • Adds UI for viewing custom profile status and batch-resending profiles to hosts where delivery failed. • Adds filtering for host endpoints by MDM config profile and status. • Adds immediate cancellation of profile delivery when a profile is deleted. • Adds ability to turn off MDM for iPhone and iPad hosts from the host details page. • Adds Neon to the list of detected Linux distributions. • Adds ability for GitOps mode to add a custom package on the software page and copy/paste the YAML needed for packages that cannot be referenced with a URL. • Adds copyable SHA256 hash to the software details page. Breaking changes: • GitOps users: SSO settings, SMTP settings, Features, and MDM end-user authentication settings are now cleared if omitted from YAML files in a GitOps run — ensure these settings are present in your global YAML settings file before the next GitOps run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.68.1

Wed, 04 Jun 2025 16:37:04 GMT

Adds `FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE` to configure MDM SSO rate limiting • Adds `FLEET_MDM_SSO_RATE_LIMIT_PER_MINUTE` environment variable to allow increasing MDM SSO endpoint rate limit from 10 per minute and splits MDM SSO into its own rate limit bucket. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet

Fleet fleet-v4.68.0

Thu, 22 May 2025 18:02:21 GMT

Fleet 4.68.0 adds Microsoft Entra conditional access, batch script execution, GitOps YAML generation, and webhook query logging. • Adds Microsoft Entra integration to conditionally block SSO for hosts failing policies. • Adds per-policy conditional access configuration with updated host policy UI showing conditional access data. • Adds CVE ID as a matching criterion for host software queries (in addition to software name). • Adds webhook as a logging configuration option for query automation. • Adds webhook query automation logging with query ID included in automation logs. • Adds shell and PowerShell syntax highlighting in the script editor UI. • Adds ability to run a script on a batch of hosts in a single user flow. • Adds `hash_sha256` field to software YAML for download validation and existing-installer matching in GitOps. • Adds `hash_sha256` field to the `GET /software/titles` API response. • Adds `fleetctl generate-gitops` command to generate GitOps YAML files from the current Fleet configuration. • Enables saving Integrations > Advanced settings in GitOps mode. • Adds support for uploading and installing tarball archives (.tar.gz). • Adds support for Fleet-maintained apps (FMA) in GitOps, including via `fleetctl` YAML files. • Adds UI for manual agent install of a bootstrap package. • Adds categorization and filtering for self-service software on the 'My device' page. • Adds count of policies triggering automatic software installs in the software table. • Adds support for `FLEET_VAR_HOST_END_USER_IDP_USERNAME`, `FLEET_VAR_HOST_END_USER_IDP_USERNAME_LOCAL_PART`, and `FLEET_VAR_HOST_END_USER_IDP_GROUPS` Fleet variables in macOS MDM configuration profiles. • Adds `last_mdm_enrolled_at` and `last_mdm_checked_in_at` fields to host detail endpoints. • Adds `macos_setup.manual_agent_install` option in Mac setup experience to bypass automatic fleetd installation. • Allows uploading VPP apps when GitOps mode is enabled. • Allows viewing install/uninstall status details from the 'My device' page. • Displays decimal representation of certificate serial numbers (below 2^63) alongside hex for easier macOS keychain matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/fleet