VPP apps failed to install on online host because MDM is turned off, user had no idea that's why

[RachelElysia]

Fleet version: <!-- Copy this from the "My account" page in the Fleet UI, or run fleetctl --version -->

Web browser and operating system:

---

💥  Actual behavior

User tried to install a VPP app on a host that had MDM turned off. Took me awhile triaging with them to realize they had the MDM off banner, super bad user experience

(See customer slack thread dated: 10/25/24, search: "VPP app won't install on a device (unspecified error)" for more info)

🧑‍💻  Steps to reproduce

1. Add VPP app
2. Go to a host details page > software
3. Go to Actions > Install
4. See generic install error flash message

🕯️ More info (optional)

N/A

🛠️ To fix

• Figma link

[marko-lisica]

@georgekarrv Moving this one back to :release board. Solution is specified in "🛠️ To fix" section in the issue description.

[jahzielv]

@marko-lisica so a fix for basically the same bug was merged here: https://github.com/fleetdm/fleet/pull/23207/files

That PR fixes the issue by omitting VPP apps from the list altogether if the host is not enrolled in Fleet MDM.

Is that an OK fix?

[marko-lisica]

@jahzielv What do we filter out in this bug? I guess we don't show VPP app that's not installed on the host, but is available for install.

What about case when app is installed on the host by end user and is available for install?

[jahzielv]

@marko-lisica

I guess we don't show VPP app that's not installed on the host, but is available for install.

yep, that's it!

What about case when app is installed on the host by end user and is available for install?

Ok so I just checked, and we're filtering out software that's installed on the host that's also available to install via VPP. To check, I:

• installed Slack on a host
• added Slack to the team via VPP
• installed fleetd on the host but did not enroll in MDM

Should we improve/change this behavior? Related: when I enrolled the host in MDM, I was able to see the Slack software again. However, it has "install" as an option, which seems weird since the software is already installed.

[marko-lisica]

@jahzielv We should always display the software present on the host. If the user turns off MDM for the host, it won't provide an accurate picture of what's installed on the host.

I think the fix that's specified in this bug still makes sense.

For hosts that have MDM turned off:

• If the software is already installed by the end user and it's added to the team as a VPP app, we want to show that software on host details, but disable "Install" action.
• If the software is not already installed on the host, then we filter out that software from host details, because it can't be installed and it's not already on the host.

Let me know wdyt.

[jahzielv]

@marko-lisica Yeah that makes sense to me!

[jahzielv]

@marko-lisica

If the software is already installed by the end user and it's added to the team as a VPP app, we want to show that software on host details, but disable "Install" action.

should we also set the "install status" column icon to be "installed"? Since it's already installed.

[jahzielv]

also @marko-lisica I think we should also disable self-service VPP apps from being installed on the My device page if the host is not MDM enrolled. Should that be handled in a new ticket, since it will require additional designs?

[marko-lisica]

also @marko-lisica I think we should also disable self-service VPP apps from being installed on the My device page if the host is not MDM enrolled. Should that be handled in a new ticket, since it will require additional designs?

@jahzielv I can add wireframes to this bug, but if you think that's too much for this issue, then I can file an additional bug.

[jahzielv]

@marko-lisica I think it's ok to add them here! I'll ask for an estimation bump.

[marko-lisica]

@jahzielv I just updated Figma to include My device changes.

[PezHub]

QA Notes:

1. confirmed VPP apps are not visible in Self-Service on the host when mdm is turned off
2. confirmed if the VPP was already installed manually on the host, fleet still lists it in the table but the install option is grayed out with a nice tooltip
3. confirmed error message when trying to install the vpp app on the host via API
4. confirmed once I turn mdm on, everything shows up as available to install