Fleet mode

Fleet mode

New in 3.0.0. Support Companion talks to Fleet through the Fleet device API, using the device's own token. No API keys are needed and none are stored.

Requirements

• Fleet's agent, orbit, installed. The device token is read from /opt/orbit/identifier.
• The Fleet server URL, which is taken from fleetd's configuration profile or orbit's LaunchDaemon.

Fleet mode is selected when orbit is installed and the MDM is Fleet, when orbit is installed and nothing else matches, or when Mode is set to Fleet. See Modes.

Overriding the server URL

<key>FleetUrl</key>
<string>https://fleet.contoso.com</string>

Profile-only. The device token is sent to whatever this names, so it is not read from anywhere a standard user could write.

Apps

The Apps page shows the Mac's Fleet self-service software.

• Search and filter by category.
• Collapsible Updates Available, Available and Installed sections. Which sections a user has collapsed is remembered per user.
• Install, update, reinstall and uninstall.
• Progress is followed until Fleet reports the result, rather than until the request is accepted. Updates stay listed until the new version is actually installed.
• The output of a failed install can be read from the app card.
• When an install does not run because the application is open, the card says Waiting for app to close rather than reporting a failure. This relies on Fleet's skipped_install flag, which is newer than Fleet 4.91 — on an older server these appear as ordinary failures.

Compliance

The Compliance page lists the Fleet policies evaluated on the Mac, with the failing ones and their remediation text. A banner appears elsewhere in the app when checks are failing, and the compliance card in the menu bar popover links straight to the page.

Re-check asks Fleet to update the Mac's details and re-run its checks.

When Fleet Desktop SSO is enabled and the user has not signed in, the page still reports how many checks are failing, but not which — see Fleet mode#Fleet Desktop SSO.

Notifications

All in the Defaults tier, so they can be turned off however you deploy settings. The first three are on by default; the sign-in reminder is not, because it asks the user to do something rather than telling them something.

Key	Default	Notifies about
FleetNotifyUpdates	on	Available software updates.
FleetNotifyInstallResults	on	Whether an install succeeded or failed.
FleetNotifyPolicies	on	Compliance checks that need attention.
FleetNotifySignIn	off	Fleet Desktop SSO needs the user to sign in. See below.

Clicking one opens the relevant page in the app.

Customizing the catalog

<key>FleetRecommendedApps</key>
<array>
    <string>slack</string>
    <string>zoom</string>
</array>
<key>FleetRecommendedTitle</key>
<string>Start here</string>

Pins those titles to the top of the catalog whether or not they are installed, under a heading you choose.

<key>FleetButtonLabels</key>
<dict>
    <key>Request software</key>
    <string>Request</string>
    <key>Arc</key>
    <dict>
        <key>Reinstall</key>
        <string>Repair</string>
    </dict>
</dict>

Replaces button text, either for a title or for one action on one title.

FleetAppOpenMessages replaces the built-in "quit the app first" phrasing with your own wording. FleetIconsFromGitHub turns off fetching app icons from the public catalog if you would rather the Mac made no such request.

Fleet Desktop SSO

Supported in-app from Fleet 4.92, where fleet_desktop.sso_enabled shipped. Earlier servers have no such setting and nothing changes for them.

Sign-in happens in a window inside the app: Support Companion asks Fleet where to send the user, and the identity provider's own page is shown. The app never sees what is typed into it — only the session Fleet issues at the end.

Requirements, on the Fleet side

• Fleet Premium, and fleet_desktop.sso_enabled turned on. The setting is org-wide, not per team.
• An IdP configured under mdm.end_user_authentication (SAML).
• The device page and the SAML callback must be on the same host. Fleet refuses to start the flow otherwise, because the session cookies are pinned to one host name.

What the user sees

A Sign In button wherever Fleet is withholding data — the Apps page, the Compliance page, and the Fleet cards in the menu bar popover. Signing in from the menu bar opens the main window first.

The session lasts for the server's session.duration, 5 days by default. It does not extend with use: the clock starts at sign-in regardless of how often the app is opened. It survives quitting the app and restarting the Mac, and is dropped if the Fleet server URL changes.

If your identity provider is brokered by an SSO extension and this app's bundle ID is allow-listed, signing in again is usually a single click with no password prompt.

Before signing in

Fleet deliberately withholds anything identifying until the user signs in — the host record, team, last seen, policy names and the software catalog are all unavailable. Support Companion still shows what Fleet will answer without a session:

• How many compliance checks are failing, on the compliance card and page, and on the sidebar badge. So a Mac with failing checks still says so while signed out.
• The Fleet server it is talking to.

Everything else collapses to a single Sign In action rather than a column of "Unknown".

Turning on FleetNotifySignIn tells the user when a sign-in is needed. It leads with the problem where there is one — "3 compliance checks need attention. Sign in to see which." — and is sent at most once a day while the user stays signed out.

Home cards

In Fleet mode the patching progress and pending updates cards use Fleet's self-service updates, and the Apps sidebar item carries a badge with the number of updates waiting.