Add button for Lost Mode on iOS/iPadOS

[harrisonravazzolo]

customer-pingali: Gong snippet https://us-65885.app.gong.io/call?id=2699116120479648557&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A325%2C%22to%22%3A365%7D%5D

• @noahtalerman: User requested this because they want to build an automated workflow to lock an iPhone/iPad when the end user notifies us that their device is lost of stolen. This way, we can ensure that organization data doesn't fall into the wrong hands.
  • @allenhouchins: Lost Mode also disables services that work at the lock screen (like Apple Wallet). Lost Mode makes sure that the Find My features stay on so that the organization could track down the device.
  • @allenhouchins: Other MDM solutions allow the IT admin to customize the message shown on the locked iPhone. In these MDMs the IT admin configures the message once, before they use the command. It's not configured on a per device basis.
  • @allenhouchins: Users want to be able to show auditors that we clicked this button.
  • @noahtalerman: Activities should be generated when lost mode is sent.
  • @noahtalerman: The lock command that is used for Mac only kicks the iPhone to the lock screen. Anyone w/ physical access to the device can still attempt to unlock w/ a password/PIN.
  • @noahtalerman: In the interim the user can send a custom MDM command using Fleet's API.

  • @noahtalerman: Eventually there could be a "Enable Lost Mode" button in Fleet. Maybe Fleet will actually use "Lock" for iOS/iPadOS and sent the Lost Mode command under the hood.

[noahtalerman]

Problem

Lost Mode is not natively supported in Fleet. Activating Lost Mode should be accessible through the API with a single command and through the Host actions dropdown.

customer-pingali would like the ability to put an iOS device into Lost Mode through the API, a feature currently only available to MacOS, Windows and Linux.

What have you tried?

You could use fleetctl with the fleetctl mdm run-command flag to pass a .xml/.mobileconfig which I have tested and it does work.

Potential solutions

See previous section ^

What is the expected workflow as a result of your proposal?

Most commercially available MDMs have a way to do this with a simple click in the UI or an API call.

[noahtalerman]

Unrelated to this request, @allenhouchins shared this Slack thread w/ me and it looks like pingali wants iOS/iPadOS support for the DELETE /hosts/:id/mdm endpoint.

@harrisonravazzolo can you please track a separate request for that? Also, if Fleet only supports macOS today can you please open a PR to the API docs?