iOS/iPadOS automatic (DEP) enrollment and custom MDM commands (CLI/API)

[noahtalerman]

Goal

User story
As an endpoint operator,
I want my iOS and iPadOS hosts in Apple Business Manager to automatically enroll to Fleet w/ MDM features on
so that I can run MDM commands on these hosts in Fleet.

This is an MVP for dogfooding and early adopters. We won't include an announcement in the release blogpost.

What's included in the MVP?

1. New iPhones and iPads in Apple Business Manager that aren’t being used yet show up in Fleet as pending. When the enroll, they start reporting minimal host vitals.
2. No new workflow for manual (BYOD) enrollment as part of this story. The existing manual enrollment profile API can be used to get an enrollment profile for enrolling test iOS/iPadOS devices to dogfood.
3. iOS/iPadOS hosts only show up on the Hosts page for now. No filters for iOS/iPadOS.
4. Host details page (in case of direct navigation) will be mostly empty.
5. Run custom MDM command & see results using the existing CLI commands or API endpoints (docs here)

Context

• Product designer: @rachaelshaw

Changes

Product

• [ ] UI changes: TODO
• [ ] CLI usage changes: TODO
• [ ] REST API changes: TODO
• [ ] Permissions changes: TODO
• [ ] Outdated documentation changes: TODO
• [ ] Changes to paid features or tiers: TODO

Engineering

• [ ] Database schema migrations: TODO
• [ ] Load testing: TODO

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Manual testing steps

1. Step 1
2. Step 2
3. Step 3

Testing notes

Confirmation

1. [ ] Engineer (@____): Added comment to user story confirming successful completion of QA.
2. [ ] QA (@____): Added comment to user story confirming successful completion of QA.

[noahtalerman]

Hey @rachaelshaw here's the first iOS/iPadOS story.

For designs, I think we want to think through what an iOS/iPadOS host looks like on the Hosts and Host details page.

Also, while the goal of this story is a read-only view of iOS/iPadOS hosts, I think we should also wireframe lock/wipe as part of this story. We can carve these out later.

Unless we find a way to install osquery (or something like it) on these hosts, I think Fleet will send the "Get Device Information" MDM command to get host vitals.

We can see the info we'd get back by looking at the list of properties here: https://developer.apple.com/documentation/devicemanagement/deviceinformationcommand/command/queries

[noahtalerman]

Brock: Customer-preston might want BYOD as well. We don't know.

JD: If there's an enrollment profile, we "support" BYOD. It's a matter of whether we document this workflow or build dedicated UI for it.

[noahtalerman]

Marko: Declaration (DDM) profiles are supported on iOS 15+

This means we might be able to subscribe to a status channel to get read-only info that we want to display in the UI. Instead of MDM commands.

Advantage of status channel is the device sends updates to the Fleet server. Fleet server doesn't have to run a job to send an MDM commands.

[noahtalerman]

FYI @lucasmrod ^^

[lucasmrod]

@noahtalerman OK, so I will assume we will build iOS/iPadOS support leveraging DDM, correct?

[noahtalerman]

@lucasmrod I'm not sure but I think we'll want to leverage both DDM and the MDM v1 protocol.

We want to deliver MDM v1 profiles and DDM profiles.

We want to deliver MDM v1 commands (lock, wipe, etc.)

For the read-only information about the host (OS, software, etc.) what do we get from DDM v. the MDM v1 protocol?

[lucasmrod]

Main backend tasks for estimation today (I may be missing some details):

• Detect iOS/iPadOS CheckIn requests:
  • Insert host with:
    • hosts.platform ios and ipados
    • Map available values (like model) in the CheckIn to hosts columns.
• When enrolling iOS/iPadOS do not send the fleetd configuration profile and/or other macOS only profiles.
• Mechanism to send DeviceInformation command every ~ 1 hour and ingest results.
  • We should not insert these commands and their results on the DB (the command MySQL tables will grow out of control otherwise)
  • Map MVP values we receive from MDM and update hosts table (see https://docs.google.com/spreadsheets/d/1A_tJFjBHPBrJASlrnwvByXd8X6CEsfrMTyiELkNZHQQ/edit#gid=0).
• Automatically insert "All Hosts" label on all iOS/iPadOS devices.
• DEP fetching of devices might need some changes in Fleet:
  • Check that device is listed properly in Fleet after being enrolled via DEP.

[sharon-fdm]

@RachelElysia will take the FE part which is 3 pts. Adding to the total est. BE 13 / FE 3

[lucasmrod]

@xpkoala I've updated the QA section in the description.

[noahtalerman]

• [ ] CLI usage changes:
  • Add support for running custom MDM commands using fleetctl mdm run-command against iOS/iPadOS hosts.
  • Add support for seeing results for custom MDM commands run against iOS/iPadOS hosts using mdm-command-results
  • Add custom MDM commands run against iOS/iPadOS hosts to fleetctl get mdm-commands
  • Return iOS/iPadOS hosts when running fleetctl get hosts --mdm
• [ ] REST API changes: Add support for iOS/iPadOS hosts in the following API endpoints:
  • Run custom MDM command: https://fleetdm.com/docs/rest-api/rest-api#run-custom-mdm-command
  • Get custom MDM command results: https://fleetdm.com/docs/rest-api/rest-api#get-custom-mdm-command-results
  • List custom MDM commands: https://fleetdm.com/docs/rest-api/rest-api#list-custom-mdm-commands
• [ ] Permissions changes: No permissions changes.
• [ ] Changes to paid features or tiers: Only Fleet Premium users can automatically enroll iOS/iPadOS hosts

Hey @lucasmrod, when you get the chance, can you please confirm that the above changes were shipped as part of this story?

I updated the "Changes" section in the issue description. That should have been filled out prior to pulling this into a sprint. That's a miss from me.

[lucasmrod]

All has been implemented except this requirement:

Changes to paid features or tiers: Only Fleet Premium users can automatically enroll iOS/iPadOS hosts

I didn't add any restrictions to prevent iOS/iPadOS from enrolling on free instances. However, I did add a check to not do refetch of host details of iOS/iPadOS devices on free instances.

Let me know if we want to prevent iOS/iPadOS devices from enrolling on free instances and I can work on the changes.

Also I'm confused by the first and third bullets here (they look like the same thing?):

CLI usage changes:

• Add support for running custom MDM commands using fleetctl mdm run-command against iOS/iPadOS hosts.
• Add support for seeing results for custom MDM commands run against iOS/iPadOS hosts using mdm-command-results
• Add custom MDM commands run against iOS/iPadOS hosts to fleetctl get mdm-commands
• Return iOS/iPadOS hosts when running fleetctl get hosts --mdm

[noahtalerman]

I didn't add any restrictions to prevent iOS/iPadOS from enrolling on free instances.

@lucasmrod got it. I think that's ok. If I'm understanding correctly, free users can manually enroll iOS/iPadOS using an undocumented workflow of installing the manual enrollment profile.

Only premium users can automatically enroll iOS/iPadOS because only premium users can connect Fleet to Apple Business Manager (ABM). Automatic enrollment requires Fleet <=> ABM connection.

However, I did add a check to not do refetch of host details of iOS/iPadOS devices on free instances.

Good to know. I think at some point soon we'll end up removing this restriction. Probably when we support BYOD iOS/iPadOS (aka manual enrollment).

Also I'm confused by the first and third bullets here (they look like the same thing?)

Ah, sorry. The 3rd bullet is confusing (fixed it in my above comment). Instead it should be this: Add iOS/iPadOS commands to fleetctl get mdm-commands

I think we added iOS/iPadOS support for this command but I'm just double checking before we close the issue.

[lucasmrod]

fleetctl get mdm-commands

Ah yes, I can see commands sent to iPhone/iPads when running fleetctl get mdm-commands.

[marko-lisica]

@noahtalerman TODO: open a new PR for docs changes a nd update copy in ABM docs (see screenshot below)

[Uploading... Screenshot 2024-06-27 at 17.00.55.png]

[noahtalerman]

update copy in ABM docs

Here's the PR:

• #20124

[noahtalerman]

Hey @zayhanlon, @dherder, and @Patagonia121 heads up, "iOS/iPadOS automatic (DEP) enrollment and custom MDM commands (CLI/API)" was shipped in Fleet 4.51 🚀

[fleet-release]

Fleet's iOS embrace, Auto-enroll, secure with grace, Cloud city, safe space.