GitOps & API design: Add multiple Apple Business Manager and Volume Purchasing Program connections #21043
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -1163,8 +1163,8 @@ Modifies the Fleet's configuration with the supplied information. | |
| }, | ||
| "mdm": { | ||
| "apple_bm_default_team": "", | ||
| "apple_bm_terms_expired": false, # set to true is there's one or more Apple Business Manager connections w/ terms expired | ||
| "apple_bm_enabled_and_configured": false, # set to true is there's one or more Apple Business Manager connections | ||
| "enabled_and_configured": false, | ||
| "windows_enabled_and_configured": false, | ||
| "enable_disk_encryption": true, | ||
|
|
@@ -6349,7 +6349,8 @@ This endpoint returns the list of custom MDM commands that have been executed. | |
| ## Integrations | ||
|
|
||
| - [Get Apple Push Notification service (APNs)](#get-apple-push-notification-service-apns) | ||
| - [List Apple Business Manager (ABM) connections](#list-apple-business-manager-abm-connections) | ||
| - [List Volume Purchasing Program (VPP) connections](#list-volume-purchasing-program-vpp-connections) | ||
|
|
||
| ### Get Apple Push Notification service (APNs) | ||
|
|
||
|
|
@@ -6376,32 +6377,72 @@ None. | |
| } | ||
| ``` | ||
|
|
||
| ### List Apple Business Manager (ABM) connections | ||
|
|
||
| _Available in Fleet Premium_ | ||
|
|
||
| `GET /api/v1/fleet/apple_business_manager` | ||
|
|
||
| #### Parameters | ||
|
|
||
| None. | ||
|
|
||
| #### Example | ||
|
|
||
| `GET /api/v1/fleet/apple_business_manager` | ||
|
|
||
| ##### Default response | ||
|
|
||
| `Status: 200` | ||
|
|
||
| ```json | ||
| [ | ||
| { | ||
| "apple_id": "apple@example.com", | ||
| "org_name": "Fleet Device Management Inc.", | ||
| "mdm_server_url": "https://example.com/mdm/apple/mdm", | ||
| "renew_date": "2023-11-29T00:00:00Z", | ||
| "terms_expired": false, | ||
| "macos_team": "💻 Workstations", | ||
| "ios_team": "📱🏢 Company-owned iPhones", | ||
| "ipados_team": "🔳🏢 Company-owned iPads" | ||
marko-lisica marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| ### List Volume Purchasing Program (VPP) connections | ||
|
|
||
|
There was a problem hiding this comment. DevLet's break the existing |
||
| _Available in Fleet Premium_ | ||
|
|
||
| `GET /api/v1/fleet/volume_purchasing_program` | ||
|
|
||
| #### Parameters | ||
|
|
||
| None. | ||
|
|
||
| #### Example | ||
|
|
||
| `GET /api/v1/fleet/volume_purchasing_program` | ||
|
|
||
| ##### Default response | ||
|
|
||
| `Status: 200` | ||
|
|
||
| ```json | ||
| [ | ||
| { | ||
| "org_name": "Fleet Device Management Inc.", | ||
| "location": "https://example.com/mdm/apple/mdm", | ||
| "renew_date": "2023-11-29T00:00:00Z", | ||
| "terms_expired": false, | ||
|
There was a problem hiding this comment. @noahtalerman, what does There was a problem hiding this comment. VPP doesn't have such a concept, I think it's a copy 🍝 There was a problem hiding this comment. Correct! It's some copy pasta. Great catch. I removed That said, do we know if VPP breaks when ABM terms are expired? I think let's test that so that we know if we have to surface this in the UI. cc @PezHub |
||
| "teams": [ | ||
| "💻 Workstations", | ||
| "💻🐣 Workstations (canary)", | ||
| "📱🏢 Company-owned iPhones", | ||
| "🔳🏢 Company-owned iPads" | ||
| ], | ||
marko-lisica marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
| ] | ||
| ``` | ||
|
|
||
| --- | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -569,16 +569,44 @@ Can only be configured for all teams (`org_settings`). | |
|
|
||
| #### mdm | ||
|
|
||
| ##### apple_business_manager | ||
|
|
||
| - `organization_name` - is the organziation name associated with the Apple Business Manager account. | ||
| - `macos_team` - macOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. | ||
| - `ios_team` - iOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. | ||
| - `ipados_team` - iPadOS hosts are automatically added to this team in Fleet when they appear in Apple Business Manager. | ||
|
|
||
| ##### Example | ||
|
|
||
| ```yaml | ||
| org_settings: | ||
| mdm: | ||
| apple_business_manager: # Available in Fleet Premium | ||
|
There was a problem hiding this comment. Dev noteMaintain support for the old When the user upgrades, set the new If the user sets "mdm.apple_bm_default_team has been deprecated. Please use the new mdm.apple_business_manager key documented here: https://fleetdm.com/learn-more-about/apple-business-manager-gitops" There was a problem hiding this comment. Redirect for the URL in the error message is here: https://github.com/fleetdm/fleet/pull/21043/files#diff-0c6120927d3e65309562b5b15b261d3298d05fcb0ff18e5b6512ee683b7ad6b3R533 |
||
| - organization_name: Fleet Device Management Inc. | ||
| macos_team: "💻 Workstations" | ||
| ios_team: "📱🏢 Company-owned iPhones" | ||
| ipados_team: "🔳🏢 Company-owned iPads" | ||
| ``` | ||
|
|
||
| Can only be configured for all teams (`org_settings`). | ||
|
|
||
| ##### volume_purchasing_program | ||
|
|
||
| - `location` - is the name of the location in the Apple Business Manager account. | ||
| - `teams` - is a list of team names. If you choose specific teams, App Store apps in this VPP account will only be available to install on hosts in these teams. If not specified, App Store apps are available to install on hosts in all teams. | ||
|
|
||
| ##### Example | ||
|
|
||
| ```yaml | ||
| org_settings: | ||
| mdm: | ||
| volume_purchasing_program: # Available in Fleet Premium | ||
| - location: Fleet Device Management Inc. | ||
| teams: | ||
|
There was a problem hiding this comment. Dev noteIf the user tries to add a team that doesn't exist, show the following error: There was a problem hiding this comment. QA noteThe above error will likely happen when a user changes a team's name via GitOps but forgets to update the team name here. There was a problem hiding this comment. Dev noteIf the user tries to add a team that already has a VPP token, show the following error: There was a problem hiding this comment. Hey @roperzh, now that a new VPP token doesn't have any teams by default (instead of "All team") how do you think the user should specify "All teams" via GitOps? Could we make it so empty There was a problem hiding this comment. Hey @noahtalerman that makes sense, the only gotcha I see is how would you define "no team"? There was a problem hiding this comment. I think they would specify That made me wonder, what happens if I create a team w/ "No team" name in Fleet... It actually breaks the team. And so does naming a team "All teams." Filed a bug for this here: #21264 |
||
| - "💻 Workstations" | ||
noahtalerman marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - "💻🐣 Workstations (canary)" | ||
| - "📱🏢 Company-owned iPhones" | ||
| - "🔳🏢 Company-owned iPads" | ||
| ``` | ||
|
|
||
| Can only be configured for all teams (`org_settings`). | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.