search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
3.01k stars 418 forks source link

iOS/iPadOS automatic (DEP) enrollment and custom MDM commands (CLI/API) #18119

Closed noahtalerman closed 3 months ago

noahtalerman commented 6 months ago

Goal

User story
As an endpoint operator,
I want my iOS and iPadOS hosts in Apple Business Manager to automatically enroll to Fleet w/ MDM features on
so that I can run MDM commands on these hosts in Fleet.

This is an MVP for dogfooding and early adopters. We won't include an announcement in the release blogpost.

What's included in the MVP?

  1. New iPhones and iPads in Apple Business Manager that aren’t being used yet show up in Fleet as pending. When the enroll, they start reporting minimal host vitals.
  2. No new workflow for manual (BYOD) enrollment as part of this story. The existing manual enrollment profile API can be used to get an enrollment profile for enrolling test iOS/iPadOS devices to dogfood.
  3. New platforms: ios and ipados.
  4. iOS/iPadOS hosts only show up on the Hosts page for now. No filters for iOS/iPadOS.
  5. Host details page (in case of direct navigation) will be mostly empty.
  6. Run custom MDM command & see results using the existing CLI commands or API endpoints (docs here)
  7. iPhones/iPads are included in the fleetctl get hosts --mdm filter

Context

Changes

Product

Engineering

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

IMPORTANT: Given that we've made changes all over the place to support iOS/iPadOS, ALL macOS MDM features should be re-tested on this release (DEP, bootstrap packages, XML profiles and DDM profiles, Setup experience, DEP with SSO, Disk encryption, running commands, Wipe/Lock/Unlock, etc.).

NOTE: After being enrolled to MDM (after following the DEP setup on the device) it can take up to 10 minutes for iPhones and iPads to fetch their details (like OS version and disk utilization). Then these details are refetched every 1h.

The tests that should be executed on iPhone and iPads are well summarized in the What's included in the MVP? and how it should look like is on the linked Figma document.

Risk assessment

Manual testing steps

  1. Step 1
  2. Step 2
  3. Step 3

Testing notes

Confirmation

  1. [ ] Engineer (@____): Added comment to user story confirming successful completion of QA.
  2. [ ] QA (@____): Added comment to user story confirming successful completion of QA.
noahtalerman commented 6 months ago

Hey @rachaelshaw here's the first iOS/iPadOS story.

For designs, I think we want to think through what an iOS/iPadOS host looks like on the Hosts and Host details page.

Also, while the goal of this story is a read-only view of iOS/iPadOS hosts, I think we should also wireframe lock/wipe as part of this story. We can carve these out later.

Unless we find a way to install osquery (or something like it) on these hosts, I think Fleet will send the "Get Device Information" MDM command to get host vitals.

We can see the info we'd get back by looking at the list of properties here: https://developer.apple.com/documentation/devicemanagement/deviceinformationcommand/command/queries

noahtalerman commented 5 months ago

Brock: Customer-preston might want BYOD as well. We don't know.

JD: If there's an enrollment profile, we "support" BYOD. It's a matter of whether we document this workflow or build dedicated UI for it.

noahtalerman commented 5 months ago

Marko: Declaration (DDM) profiles are supported on iOS 15+

This means we might be able to subscribe to a status channel to get read-only info that we want to display in the UI. Instead of MDM commands.

Advantage of status channel is the device sends updates to the Fleet server. Fleet server doesn't have to run a job to send an MDM commands.

noahtalerman commented 5 months ago

FYI @lucasmrod ^^

lucasmrod commented 5 months ago

@noahtalerman OK, so I will assume we will build iOS/iPadOS support leveraging DDM, correct?

noahtalerman commented 5 months ago

@lucasmrod I'm not sure but I think we'll want to leverage both DDM and the MDM v1 protocol.

We want to deliver MDM v1 profiles and DDM profiles.

We want to deliver MDM v1 commands (lock, wipe, etc.)

For the read-only information about the host (OS, software, etc.) what do we get from DDM v. the MDM v1 protocol?

lucasmrod commented 4 months ago

Main backend tasks for estimation today (I may be missing some details):

sharon-fdm commented 4 months ago

@RachelElysia will take the FE part which is 3 pts. Adding to the total est. BE 13 / FE 3

lucasmrod commented 4 months ago

@xpkoala I've updated the QA section in the description.

noahtalerman commented 3 months ago

Hey @lucasmrod, when you get the chance, can you please confirm that the above changes were shipped as part of this story?

I updated the "Changes" section in the issue description. That should have been filled out prior to pulling this into a sprint. That's a miss from me.

lucasmrod commented 3 months ago

All has been implemented except this requirement:

Changes to paid features or tiers: Only Fleet Premium users can automatically enroll iOS/iPadOS hosts

I didn't add any restrictions to prevent iOS/iPadOS from enrolling on free instances. However, I did add a check to not do refetch of host details of iOS/iPadOS devices on free instances.

Let me know if we want to prevent iOS/iPadOS devices from enrolling on free instances and I can work on the changes.

Also I'm confused by the first and third bullets here (they look like the same thing?):

CLI usage changes:

  • Add support for running custom MDM commands using fleetctl mdm run-command against iOS/iPadOS hosts.
  • Add support for seeing results for custom MDM commands run against iOS/iPadOS hosts using mdm-command-results
  • Add custom MDM commands run against iOS/iPadOS hosts to fleetctl get mdm-commands
  • Return iOS/iPadOS hosts when running fleetctl get hosts --mdm
noahtalerman commented 3 months ago

I didn't add any restrictions to prevent iOS/iPadOS from enrolling on free instances.

@lucasmrod got it. I think that's ok. If I'm understanding correctly, free users can manually enroll iOS/iPadOS using an undocumented workflow of installing the manual enrollment profile.

Only premium users can automatically enroll iOS/iPadOS because only premium users can connect Fleet to Apple Business Manager (ABM). Automatic enrollment requires Fleet <=> ABM connection.

However, I did add a check to not do refetch of host details of iOS/iPadOS devices on free instances.

Good to know. I think at some point soon we'll end up removing this restriction. Probably when we support BYOD iOS/iPadOS (aka manual enrollment).

Also I'm confused by the first and third bullets here (they look like the same thing?)

Ah, sorry. The 3rd bullet is confusing (fixed it in my above comment). Instead it should be this: Add iOS/iPadOS commands to fleetctl get mdm-commands

I think we added iOS/iPadOS support for this command but I'm just double checking before we close the issue.

lucasmrod commented 3 months ago

fleetctl get mdm-commands

Ah yes, I can see commands sent to iPhone/iPads when running fleetctl get mdm-commands.

marko-lisica commented 3 months ago

@noahtalerman TODO: open a new PR for docs changes aScreenshot 2024-06-27 at 17.00.55.png nd update copy in ABM docs (see screenshot below)

[Uploading... Screenshot 2024-06-27 at 17.00.55.png]

noahtalerman commented 3 months ago

update copy in ABM docs

Here's the PR:

noahtalerman commented 3 months ago

Hey @zayhanlon, @dherder, and @Patagonia121 heads up, "iOS/iPadOS automatic (DEP) enrollment and custom MDM commands (CLI/API)" was shipped in Fleet 4.51 🚀

fleet-release commented 3 months ago

Fleet's iOS embrace, Auto-enroll, secure with grace, Cloud city, safe space.