Windows custom settings (configuration profiles)

[noahtalerman]

Goal

User story
As an IT admin,
I want to add Windows profiles
so that I can enforce custom settings on Windows workstations to keep them compliant and secure.

Requirements

• IT admin can export Windows profiles from Workspace ONE (WS1), edit the XML so that the only top level objects are <Replace>, and upload these to a team or "No team" in Fleet via UI, CLI, and API. This enforces custom settings on Windows workstations.
• IT admin can create the XML for Windows profiles by following instructions in the Fleet docs and upload these to a team or "No team" in Fleet via UI, CLI, and API
• IT admin can download Windows profiles via UI and API
• IT admin can delete Windows profiles via UI and API. If a profile is deleted, the profile isn't removed from the Windows workstation
• If a host is transferred to a new team, the Windows profiles from the old team aren't removed
• If a profile fails, none of the options in the profile are applied
• "Failed" profiles aren't redelivered for Windows
• Fleet contributors use this language when talking about this feature: https://docs.google.com/document/d/17loPAoQSxZDk41IPHdNgKF6mBIF4ZzRtvIqtbDLZwP4/edit

Changes

Product

• UI changes: https://www.figma.com/file/eC1C8kp9grdPMAZGvR0ibT/%2313281-Enforce-configuration-on-Windows?type=design&node-id=2-130&mode=design
• CLI usage changes: https://www.figma.com/file/eC1C8kp9grdPMAZGvR0ibT/%2313281-Enforce-configuration-on-Windows?type=design&node-id=168-4489&mode=design&t=yvv7Ff7RmirlsZ5T-4
• Permissions changes:
  • Maintainers and admins (global and team) can view, add, download, and delete Windows profiles
  • GitOps (global and team) can add and delete Windows profiles
• Documentation changes: Document Windows custom settings

Engineering

• REST API changes: API changes outlined in this PR MDM Custom settings (profiles) - API changes #14230
• Database schema migrations: TODO
• Documentation changes complete

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

Context

• Requestor(s): @zhumo

QA

Manual testing steps

UI:
[X] Verify Zero-state
[X] Validate copy changes against Figma
[X] Verify UI allows upload of .xml files for any teams & “no team” by any Admin or Maintainer
[X] Name of Profile is pulled from XML file
[X] Verify able to download & delete files
[X] Host counts/statuses are accurate
[X] Controls page filters link to correct hosts
[X] Verify copy for upload statuses & delete modal
[X] Verify pagination
[X] Verify role permissions match current for macOS profiles
[X] Verify Activity Feed entries

[X] Verify that on team transfer, profiles are not removed from host but no longer show in host status
[X] Verify no profile redelivery on failure, test manual remediation via team transfer

• Failed profiles will not apply any values to the host
  [X] Verify os settings statuses, including error messages for Failed
  [X] Verify on-device

CLI:
[X] Verify able to apply profiles with a yaml file

• Note that getting existing config into yaml may not include existing .xml uploads from the UI, needs validation
• Note that applying an empty value for custom_settings will remove all currently configured profiles
• Note that changing or removing an existing value in the yaml will edit or delete the corresponding file
  [X] Apply should fail with MDM off, or with only macOS/Windows turned on
• Verify does this mean OS-specific profiles will fail?
  [X] Apply should fail if the yaml includes an invalid file
  [X] Apply should fail if the yaml includes a missing file
  [X] Apply should fail if duplicate file name is included
  [X] Test with BitLocker profile (should fail)
  [X] Test with Windows Updates (should fail)

Testing notes

Confirmation

1. Engineer (@____): Added comment to user story confirming succesful completion of QA.
2. QA (@____): Added comment to user story confirming succesful completion of QA.

[noahtalerman]

@marko-lisica heads up that I'm linking to your research doc here and in the issue description so other folks that come across this issue can check it out.