fleet-v4.90.1

Bug fixes

• Fixed a bug where the Fleet-maintained app auto-update job could keep an app's previous install script (which references the old installer filename) after downloading a newer version, causing the install to fail.
• Fixed automatic App Store app updates and policy automations queueing a duplicate install on a host whose upcoming activity queue was not draining. Fleet now skips an app that already has an install waiting in the queue, whether or not it has been sent to the device.
• Removed the duplicate App Store app installs Fleet had already queued, keeping the most recently queued install of each app on each host. Installs requested from the install button, self-service, or the setup experience are left in place.
• Fixed policy automations acting on an App Store app added for a platform other than the host's.
• Fixed an issue where the Apple reconciler would queue profiles for deleted hosts, that was pending in Fleet via Apple Business.
• Fixed Apple hosts losing built-in label memberships during Automated Device Enrollment (ADE), which prevented label-scoped profiles, software, and OS updates from being delivered.
• Fixed a bug where the batched Apple MDM profile and declaration reconcilers could skip hosts on deployments with more than 5000 Apple MDM hosts and one or more duplicate hosts.
• Fixed a database migration that could take hours to complete on deployments with many host certificates.
• Improved the error message shown when adding a Fleet-maintained app times out or is canceled by a proxy or load balancer while downloading a large installer.
• Fixed a Windows configuration profile staying listed on Host details > OS settings when it stopped applying to a host but another profile on that host still enforced all of the same settings. This affected deleting or renaming a profile, and transferring a host between fleets with matching profiles.
• Fixed 502 errors and timeouts on the software install endpoints caused by the hourly Fleet-maintained apps sync taking exclusive row locks on the entire software and software_titles tables while normalizing software names.
• Fixed a macOS Fleet-maintained app's name being applied to the iOS and iPadOS apps that share its bundle identifier.
• Fixed macOS Fleet-maintained app software names not being corrected when the catalog refresh failed.
• Fixed a 500 error during Apple MDM enrollment when a host had no DEP assignment yet (e.g. the enrollment request arrived before the host/DEP assignment row was created or replicated). The OS updates settings lookup now returns a not-found error so enrollment proceeds gracefully instead of failing.
• Fixed a bug where updating a Fleet-maintained app to a new build that uses the same shortened version did not update the file to the new installer, but did update some fields like install script.
• Fixed a bug where hosts that re-enrolled via DEP would sometimes have profiles with exclude-any labels attached installed before they had actually reported label results

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

98d936e3b3055c40de64f442218ba894ad32a1682adb6a3716041b74001e0d14  fleet_v4.90.1_linux.tar.gz
c8ccac7479d89cc8772e13ba445189e9266d6cbb5a3fce0376661362abd73791  fleetctl_v4.90.1_linux_amd64.tar.gz
adf86cabdc399b64f69aff4b8d5d2c8b04d10634cdfa02ad14a7b493f112eed6  fleetctl_v4.90.1_linux_amd64.zip
d031eaeebc0f4fd483ea2e206e58f0d93a8804806944d1f8169ca1d3e6624346  fleetctl_v4.90.1_linux_arm64.tar.gz
d4022f340cbd3f88e2e722e6039462765176b1de13d484e7398b2488fe8a560c  fleetctl_v4.90.1_linux_arm64.zip
439e00f33710f57d4586b0141dce3c032fc3eb4c1997550de80568e8bfa8bbc2  fleetctl_v4.90.1_macos.tar.gz
9e3f41fb8db4107208262d7b0c24c364100b3d705ee2ac6146cb7b04c6517dcb  fleetctl_v4.90.1_macos.zip
da733b273f48765487f84ee774655490acb4978344f195a62b079a9abaab2d09  fleetctl_v4.90.1_windows_amd64.tar.gz
009380c7efdde3f0ac2170cd3b3ef6269e0f18fe338a7a02cc60a85bdaa4036c  fleetctl_v4.90.1_windows_amd64.zip
5d8b669ac914baaa3ad048eb2b5afa30552d4e81d322568228328824df0aa261  fleetctl_v4.90.1_windows_arm64.tar.gz
2768ac7f53b7fe4da3d9c88736ed9752daac92a31e7e1bd3ba75688de0883c13  fleetctl_v4.90.1_windows_arm64.zip

fleet-v4.90.0

Fleet 4.90.0 (Aug 05, 2026)

IT Admins

• Added the ability to upload multiple custom packages (up to 10) for the same software title on a team, so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. When a host matches more than one package, the first-added package is installed.
• Added support for editing existing configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, and Android) in place via PATCH /api/v1/fleet/configuration_profiles/:profile_uuid.
• Added custom host vitals: admins can define custom host fields, set their values per host manually or via the API, and reference them as $FLEET_HOST_VITAL_<id> variables in scripts and configuration profiles.
• Added the ability to enforce a host naming template on macOS, iOS, and iPadOS hosts under Controls > OS settings > Host names, for a fleet or for "No team" (Fleet Premium).
• Added POST /api/v1/fleet/host_name_template to set or clear the naming template (fleet_id omitted or 0 targets "No team"); an empty template clears it without renaming any host.
• Added a name_template key under controls in GitOps for fleets and "No team", and included it in fleetctl generate-gitops output.
• Added a "Host name" row with enforcement status (Enforcing, Verifying, Verified, Failed) to the host details OS settings modal, including a resend action via POST /api/v1/fleet/hosts/{id}/name_template/resend.
• Added host name enforcement statuses to the Controls OS settings aggregate cards and the os_settings host filter.
• Added the edited_host_name_template activity.
• Added support for Python (.py) script-only software packages, which can be uploaded as custom packages (the file contents become the install script) and installed on macOS and Linux hosts, via the UI, REST API, and GitOps.
• Added support for provisioning macOS users during setup and keeping passwords in sync with any OAUTH ROPG supporting IdP via the Fleet Desktop app on macOS 26+ hosts.
• Added UI for configuring Apple account provisioning (FPSSO) in the integrations settings.
• Enabled Microsoft Entra conditional access for self-hosted Fleet Premium instances (previously available only on Fleet Cloud). The microsoft_compliance_partner.proxy_api_key server configuration has been removed; the feature is now gated on the Fleet Premium license tier.
• Added native Splunk HEC log destination for osquery status, result, and audit logs.
• Added support for escrowing disk encryption recovery keys from Linux hosts that use TPM-backed full-disk encryption (e.g. Ubuntu 26). On these hosts, orbit escrows a dedicated Fleet-owned snapd recovery key silently, without prompting the end user for a passphrase.
• Added FLEET_MDM_ENABLE_CUSTOM_DISK_ENCRYPTION (mdm.enable_custom_disk_encryption) as a cross-platform alias for FLEET_MDM_ENABLE_CUSTOM_FILEVAULT. When set, it allows both custom Apple MDM profiles for FileVault and custom Windows configuration profiles for BitLocker.
• Enabled "Turn off MDM" button for offline macOS hosts. The unenroll command is now queued and delivered when the device comes back online, consistent with iOS/iPadOS behavior.
• Added enrollment profile URL to the macOS tab in the "Add hosts" modal, with enrollment type selection (company-owned or personal/BYOD) for MDM users.
• Added support for targeting declarations to the user channel on macOS.
• Added the ability to handle DDM assets, and unblocked more declaration types.
• Added the certificates list to the host details page for Windows hosts, showing each certificate's scope (System or User). This requires osquery 5.23.1 or higher on the host.
• Added a "View certificate" modal to Controls > OS settings > Certificates so admins can inspect and copy an existing certificate's details.
• Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.
• Added "Targeted platforms" column and platform filter dropdown to the Policies page.
• Added optional platform query parameter to GET /api/v1/fleet/policies and GET /api/v1/fleet/fleets/{id}/policies to filter policies by targeted platform.
• Added public IP address to host search, so that searching by IP now matches both the primary (private) IP and the public IP.
• Added Zorin OS as a recognized Linux platform. Hosts running Zorin OS now enroll with platform=zorin, appear in the Linux disk-encryption summary, support .deb software installs, can be targeted by label platform filters, and have CVEs matched against the underlying Ubuntu LTS OVAL feed (Zorin 16 → Ubuntu 20.04, 17 → 22.04, 18 → 24.04). Unknown future Zorin versions fall through to an unsupported platform string so vulnerability scanning is skipped rather than served stale data from an aging LTS feed.
• Added support for CachyOS (an Arch-based Linux distribution) as a recognized Linux platform.
• Added an "Operating systems" card to the dashboard when Linux or Android is selected.
• Added installed version and available version columns to the self-service software table on the My device page.
• Added the "Applications" / "Full inventory" software filter to the Fleet Desktop My device > Software tab for macOS hosts, matching the host details page.
• Added the asynchronous live query endpoint (POST /api/v1/fleet/reports/run) to the API endpoints catalog so it can be granted to API-only users that have a restricted API endpoint allowlist.
• Added audit activities when secret variables are created or updated through the PUT /api/latest/fleet/spec/secret_variables endpoint.

Security Engineers

• Added vulnerability (CVE) reporting for Android OS versions on the Software > OS page, where Android previously showed as "Not supported."
• Folded the Android security patch level into the host's OS version so Android versions read as "Android 16 (2026-05-01)", giving vulnerability-relevant granularity per patch level.
• Updated CIS Benchmark policies for Windows 10 Enterprise to align with the CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 (added, removed, and updated policies per the v4.0.0 change history).
• Added automatic renewal for SCEP and ACME certificates issued by external certificate authorities (Okta Conditional Access, Okta Verify, Hydrant ACME). Add $FLEET_VAR_CERTIFICATE_RENEWAL_ID to the certificate's Subject OU to enable.
• Renamed $FLEET_VAR_SCEP_RENEWAL_ID to $FLEET_VAR_CERTIFICATE_RENEWAL_ID. The legacy name still works.
• Enabled automatic renewal by default in Fleet's generated Conditional Access profile. Existing customers can opt in by redeploying the User scope profile.
• Windows configuration profiles that use a Fleet-proxied SCEP certificate (custom SCEP proxy, NDES, or Smallstep) now report "Verified" only after Fleet observes the issued certificate on the host, instead of reporting "Verified" as soon as the host acknowledged the profile. They report "Failed" when the SCEP proxy request returns an upstream error, or when the certificate is still missing from the host an hour after delivery (once Fleet can confirm the certificate's store was readable).
• Removed the validation, added in Fleet 4.89.0, that rejected custom SCEP proxy certificate authority challenges containing characters outside the ASN.1 PrintableString set (for example, an underscore). Apple devices can enroll certificates using such challenges, so they are accepted again. A fix for Windows certificate enrollment failing with these challenges will ship separately.
• Rejected empty and whitespace-only enroll secrets when creating or updating teams.
• Restricted SCIM endpoint access to global admin users only.
• Removed the unused /api/mdm/microsoft/auth Windows MDM STS endpoint. Fleet always advertises the OnPremise auth policy, so no device ever contacted this endpoint. It now returns a 404. Windows MDM enrollment (Autopilot, Settings app, and fleetd-initiated) is unaffected.
• Added a server_bypass_network_blocking server config option to allow disabling all outbound network blocking protections for integration HTTP requests in production, for environments where egress is already constrained by external infrastructure.

Bug fixes and improvements

• Improved software ingestion performance by removing a full table scan of software_titles table.
• Optimized memory usage of CVE chart cron job.
• Reduced MySQL reader load when listing hosts with device_mapping=true and a search query by evaluating device mapping as a per-row correlated subquery instead of a fully-materialized derived-table join, and by skipping it entirely in the host count query.
• Improved the performance of Windows MDM profile installation across large numbers of hosts by reducing database lock contention when recording command results.
• Improved performance of Orbit config endpoint by batching extension label-membership checks into a single database query.
• Improved performance of host config endpoint by caching scheduled query configuration.
• Improved efficiency of the scheduled query stats aggregation cron job.
• Added better indexing for the Get Next Apple MDM command query.
• Added a long-lived immutable Cache-Control header to content-hashed static assets under /assets/ so browsers and CDNs can cache them across loads instead of refetching the JS/CSS bundle from origin every time.
• Removed the fleetdm/bomutils Docker dependency for generating macOS .pkg fleetd installers; the Bill of Materials and xar archive are now written by pure-Go code, so fleetctl package --type pkg no longer requires Docker, mkbom, or xar.
• Updated the Render deployment blueprint to use MySQL 8.0.44 (previously 8.0.24), fixing an "Error 1235 ... nesting of unions at the right-hand side" error on Render deployments.
• Improved GitOps...

fleet-v4.89.2

Bug fixes

• Fixed a bug where a failed software install was reported as successfully installed when the install script exited with an error but a post-install script exited successfully.
• Fixed Windows Autopilot enrollments intermittently hanging on the Enrollment Status Page at "Account setup".
• Fixed an issue where devices given a mandatory update during ADE enrollment might display a failure or fail to display the update
• Fixed a bug where adding Windows software via GitOps could create a duplicate software title when a host had already reported the same program.
• Fixed a bug where Apple MDM devices re-enrolling manually with a pending SCEP renewal would not be treated as a new renewal and might skip apps, profiles, etc
• Fixed a bug where a Fleet-maintained app install could run a stale, previously-cached version after the app was auto-updated; installs (including automatic retries) now target the version Fleet currently displays.
• Fixed a bug where pinning a Fleet-maintained app to a different version didn't update the patch policy for it.

Upgrading

Please note this upgrade has an elevated migration time for a one time table rebuild that could take up to 30m

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

6939f39a5a3290e9254b8dd030e48ebe34eb1ca757f84c252116cece082a2bb7  fleet_v4.89.2_linux.tar.gz
a60f0bdef6940a97500f589221c037400ae2827ffecadd86a6de9185a6366306  fleetctl_v4.89.2_linux_amd64.tar.gz
7753dbdca016bb68d5f2b8975902c8f1dc3677ad3aa33a8d6421bdaac6123202  fleetctl_v4.89.2_linux_amd64.zip
d7e463a015beb0c22818b96284bcef017737fa3b1a2a5b983af22c37638d1e10  fleetctl_v4.89.2_linux_arm64.tar.gz
2d4e9e3099ef5d7986771c8050175d7f5110020646b41df91d13f4e62b556a77  fleetctl_v4.89.2_linux_arm64.zip
38222bb2a5cb010e3de1337e6cd500a4d8773f68da1f74696850ed4ec1b18270  fleetctl_v4.89.2_macos.tar.gz
2b458368f444f8b352a42afd3b16e37085a9bcc6262800523e0d6c0337805644  fleetctl_v4.89.2_macos.zip
aa5d5083b94cc0bf166e70a01a62604f1a48554a2dfd2d88f4c7d09f0db2d904  fleetctl_v4.89.2_windows_amd64.tar.gz
89fb65ea511a49b85331ee74b1b1acc029750f85eb1972115c5fbbe23c65a775  fleetctl_v4.89.2_windows_amd64.zip
a36936f41280ff13c8c2364254b57d2fb08f6888626cd01e1e700c429d55d37d  fleetctl_v4.89.2_windows_arm64.tar.gz
9d5ac115c810d8a9db30254e3bfb1362e5549a21c27114217032d224c3947a73  fleetctl_v4.89.2_windows_arm64.zip

fleet-v4.89.1

Bug fixes

• Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error
  80180006 because the device's discovery RequestVersion (e.g. "9.0") was rejected by an exact-match
  allow-list. Fleet now accepts any MS-MDE2 discovery RequestVersion at or above the minimum supported
  version ("4.0").

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

72fb53b632048d94a475082050a3fb9ee147c120b90b4bd03407668b0643eb2f  fleet_v4.89.1_linux.tar.gz
5fdccf39237db3c96fa69468539e22c2cd69cfff5a4b147fdbcb5ca22ea1f2be  fleetctl_v4.89.1_linux_amd64.tar.gz
7a2316437e9183cfaf1b18047df6245e8a88b338f8879fbe2ebaf06a39a00cda  fleetctl_v4.89.1_linux_amd64.zip
ff6e4225004fb2db43d5f1f178ea780d82db0925258015a67379d52056aed092  fleetctl_v4.89.1_linux_arm64.tar.gz
62617b3fec54ccf4d458b1f69ab0d82b91299594e802c9d27f5e3ce61789d5f2  fleetctl_v4.89.1_linux_arm64.zip
a13f88800e59792af3480feb1ac0e6fe4f63775e87f237b5a47264a5e05f85e6  fleetctl_v4.89.1_macos.tar.gz
faee6f1383eb9c745c8d225e2d8972b5c51c89b86db68da14e1cc84c641722ba  fleetctl_v4.89.1_macos.zip
e57afa95adbb86592495583fb61f6669d40629dd8ee16aebce426ab3443580c2  fleetctl_v4.89.1_windows_amd64.tar.gz
1d9a5a250d5367a8252a3eefc016c3d83edfb5a1ef795809a215f6ad84df5948  fleetctl_v4.89.1_windows_amd64.zip
39d7a5b4fe7533cb696bb6de6da42928801f96315bb98719d9225add5d650263  fleetctl_v4.89.1_windows_arm64.tar.gz
df97595ce284ccb1ff86e27644ad337ed34af17b12350cefd12a0d4654ec7eb4  fleetctl_v4.89.1_windows_arm64.zip

fleet-v4.89.0

Fleet 4.89.0 (Jul 15, 2026)

IT Admins

• Added the ability to target a policy to hosts using a combination of "include" and "exclude" labels.
• Added the ability to run a policy check before installing Windows and Linux setup experience software. When a team policy's install-software automation points at a setup experience installer, Fleet runs that policy during setup and skips the install when it passes (the software is already installed and up to date), speeding up the end user setup experience. When the policy fails, the software is installed as part of setup experience.
• Changed calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure, instead of always being scheduled on the next Tuesday.
• Updated policy details page to show automations and labels as a single property. Also changed the layout of policy properties.
• Added automation runs table to the policy details page, showing per-host automation outcomes with filtering, search, and a reset policy action.
• Added per-host activity log entries when policy automations (webhook, tickets, Google Calendar, and Microsoft conditional access) fail or succeed.
• Added POST /api/v1/fleet/policies/:policy_id/reset endpoint to reset a policy's pass/fail results, clearing counts and membership immediately.
• Added GET /api/v1/fleet/policies/:id/automation_activities endpoint to list automation activities for a policy.
• Added the ability to keep Fleet-maintained apps automatically updated to the latest version, pin them to a specific version or major version, or roll back to a previously cached version, from the UI and via GitOps (Fleet Premium).
• Surfaced .sh script-only software packages on the macOS tab of Controls > Setup experience > Install software, with selections tracked independently from the Linux tab.
• Added setup_experience_platform on software packages in GitOps YAML so .sh script-only installers can be selected for the macOS setup experience declaratively, matching the per-platform UI selection. The value is authoritative on every batch apply and reconciles the cross-platform selection table.
• Added support for pre-install query, post-install script, and uninstall script on script-only packages (.sh and .ps1) via the UI, REST API, and GitOps.
• Added an error on the Windows enrollment status page (ESP) when setup experience software fails to install during automatic enrollment (Autopilot and other OOBE flows) and "Cancel setup if software fails" is turned off.
• Added "🛟 Support" as a new default self-service software category.
• Added support for $FLEET_VAR_HOST_* variables in Android configuration profiles.
• Added support for $FLEET_VAR_HOST_* variables in Android managed app configuration.
• Android certificate templates and managed app configurations are now automatically resent when IdP variable values change.
• Added support for defining the default fleet BYO Apple devices enroll into.
• Added a Google Workspace integration that maps identity provider (IdP) users to hosts, populating IdP host vitals directly from your Google Workspace directory.
• Added an activity feed entry when a user runs a custom Apple or Windows MDM command, visible in both the global activity feed and the host's activity feed.
• Added an activity when editing the managed local account setting using the update fleet endpoint or GitOps.
• Enabled tracking of mobile devices for the "hosts online" chart, and added default filtering to that chart that excludes mobile platforms.
• Added tooltips on the Settings > Users and My account pages to show assigned fleets and roles when a user has multiple.

Security Engineers

• Started collecting non-critical CVEs, filtering them out of charts by default.
• Added the ability to filter vulnerable software by severity (CVSS score) and known exploit status on the Fleet Desktop My device > Software tab (Fleet Premium). The corresponding min_cvss_score, max_cvss_score, and exploit query parameters were added to the GET /device/{token}/software API endpoint.
• Added more filtering options for the Vulnerability Exposure chart.
• Added ability to set default Vulnerability Exposure chart filters via GitOps.
• Improved certificate renewal validation in the host identity SCEP service.
• Added support for all IdP variables and host platform in certificate template subject names and SANs.
• Improved input validation for conditional access SCEP enrollment.
• Validated that a custom SCEP proxy certificate authority challenge contains only printable characters, so Windows certificate enrollment no longer fails with "The string contains a non-printable character" (for example, when the challenge contains an underscore). Existing challenges are only re-validated when changed.
• Restricted authorization for team membership management operations.
• Made authorization more robust when creating labels from manual hosts.
• Improved fleet scope validation for software title lookups.
• Restricted authorization for conditional access Okta IdP asset endpoints so that observer and observer+ roles can no longer read them.
• Improved session handling during password reset flows.
• Cleared the SSO authentication cookie after successful authentication for fully-managed Android enrollment.
• Added private network IP blocking to Fleet's HTTP client. Loopback and cloud metadata addresses (127.0.0.0/8, 169.254.0.0/16) are always blocked. RFC 1918 and other private ranges are blocked by default; use --allow_private_network_integrations to allow them for environments with on-prem integrations (e.g. EJBCA, Jira, SCEP servers on private networks).
• Added the s3.carves_cleanup_disabled server setting to skip S3 file carve reconciliation for deployments that rely solely on the bucket's lifecycle policy to remove carve objects.
• Added the s3.carves_cleanup_max_per_run and s3.carves_cleanup_concurrency server settings to tune how many carves the S3 cleanup reconciles per run and how many concurrent S3 requests it makes.
• Updated the SigNoz OTEL dashboards under tools/signoz/ to template and filter on the deployment.environment resource attribute, with the environment variable defaulting to default, so multiple Fleet environments reporting to the same SigNoz backend can be scoped per environment.

Bug fixes and improvements

• Updated Go to 1.26.5.
• Updated checkbox labels in the Fleet UI to use positive language, making it clearer what each setting enables rather than what it disables.
• Improved Windows MDM configuration profile performance. Changes to Windows profiles now reach hosts more quickly. Large changes that affect many hosts at once, such as adding or removing profiles across a team or transferring many hosts between teams, now finish faster and put significantly less load on Fleet's database, keeping the server responsive at scale.
• Improved validation on batch script executions.
• Updated golang.org/x/image to v0.42.0 to resolve CVE-2026-33813 (WebP decoder denial of service on 32-bit platforms).
• Redesigned in-app success and error notifications as toasts. Error notifications now persist until dismissed and can be expanded to show the server's raw response.
• Added configurable batch size FLEET_MDM_ANDROID_BATCH_SIZE (default: 1000 hosts) for Android MDM operations to prevent overwhelming the Google Android Management API.
• Added batching and staggered scheduling for Android software installation jobs to spread AMAPI load across multiple worker ticks.
• Improved the error message shown when saving a custom variable without the required server private key configured.
• Improved software tooltips on the host details page to display the human-friendly software name and correct action labels for scripts.
• Improved orbit check-in performance by deriving the Fleet MDM connection state from existing host MDM data instead of running a separate 3-table JOIN query on every check-in for every host.
• Improved fleetctl to detect when SSO is enabled on the Fleet server and display a helpful message directing users to authenticate using an API token instead of email and password.
• Refactored makeAndroidAppAvailable to use staggered job queuing instead of sleeping between batches inside a single worker job.
• Updated the checkerboard graph to make it clearer which square represents the current time and which squares are in the future.
• Windows configuration profiles are now queued immediately when a host enrolls in Windows MDM, instead of waiting for the next profile reconciliation cron pass.
• Improved query validation logic around policy creation.
• Updated the "installed during setup" tooltip on Controls > Setup experience > Install software to clarify that installation order depends on software name (0-9, then A-Z), and that software without a policy is installed before software with a policy.
• Navigate back to the report details page after saving changes to a report.
• Enabled automatic refreshing of report results when the window is refocused and every 5 seconds while waiting for results to arrive (skipped when report caching is disabled).
• Reduced database write pressure on the Windows MDM check-in path by gzip-compressing stored device response envelopes.
• Updated the Fleet-maintained apps item count to reflect the total number of apps, counting an app's macOS and Windows versions separately (for example, a search for "Zoom" that returns Zoom and Zoom Rooms on both platforms shows 4 items).
• Moved and updated tooltip from the Vulnerabilities column on the Software > OS page to "Not supported", explaining which platforms support vulnerability detection.
• Improved some GitOps error messages around bootstrap packages, setup assistant and scripts.
• Fixed fleet-scoped context when retrieving a list of users in a fleet.
• Fixed an issue where cleanup of expire...

fleet-v4.88.1

Bug fixes

• Fixed an issue where a configuration profile could be enqueued multiple times for a single host.
• Fixed recovery lock password being enforced on personally-owned (BYOD) macOS hosts, where it would always fail because personal enrollments have device lock rights stripped. These hosts are now skipped.
• Fixed a bug where a user's BYOD selection was not persisted through IdP authentication
• Fixed a bug where installing App Store (VPP) or in-house apps on an iOS/iPadOS host enrolled with the manual (profile-driven) BYOD enrollment profile failed while trying to look up a VPP user. These device-channel hosts now install apps to the device, the same as company-owned manual enrollment; user-scoped licensing is reserved for Account-Driven User Enrollment.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

1adc9236a16edfdbaa321b3abcbea8fd93354bf348aa1984f1dbf41929f837be  fleet_v4.88.1_linux.tar.gz
c0e6db9c7559487036572a292c8a4acb586fa041524d4e59d76730b4932a7375  fleetctl_v4.88.1_linux_amd64.tar.gz
3396a776f736513f511c7e8486838c0a4d6548d42329b66967d5abe33d8d1616  fleetctl_v4.88.1_linux_amd64.zip
6587d56fa84b8b93a25bc26551c86170de61a3ff00f7ad2745b841522fb9cff9  fleetctl_v4.88.1_linux_arm64.tar.gz
b79a62d090d562fd223b6674a9393f7276b5735fbae38ea5438927ba7a21554e  fleetctl_v4.88.1_linux_arm64.zip
c308cce437f2cca7b24e27aa3501f8da5b072192f31ab68bd763dd33de7facad  fleetctl_v4.88.1_macos.tar.gz
18256e18353febc7205cdaf5512ea820af282c0993ab8908704ee7a958814887  fleetctl_v4.88.1_macos.zip
b6028f87ca1c9f0302f0c8fa496de8f36afb06aab5838131befede5b20d95e93  fleetctl_v4.88.1_windows_amd64.tar.gz
6d67da0f5a97310abfd5772876d6baabe110bc8219e49e08cbea674f8086e60c  fleetctl_v4.88.1_windows_amd64.zip
ff8334a6c8527a7d9ae069492aecf67403197ef4761e99c5526038adf39cc202  fleetctl_v4.88.1_windows_arm64.tar.gz
04db52fdd300cc55ffa94e84163551c0d8777414652ae995ab56fed778d1d873  fleetctl_v4.88.1_windows_arm64.zip

fleet-v4.88.0

Bug fixes

• Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.
• Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85280edd8db7ad2212ba5456997cfacdfeeabaf5b6124732f6fb95df45324163  fleet_v4.88.0_linux.tar.gz
847f9bfee46cd8a2f637975efbb4e8b5b2a5ed290af3759361721a4623338631  fleetctl_v4.88.0_linux_amd64.tar.gz
8698436ad196fb0542705d9a1872f7f45a3804e40d87d5e66d889e5def928d73  fleetctl_v4.88.0_linux_amd64.zip
80d52c9b38960a6ddbaf9e6b1545f2aba24210e5c9274efe716eaf7ec33183a5  fleetctl_v4.88.0_linux_arm64.tar.gz
e2be3aa46de32dbde7e998ebf4ccf807021dec2468242f22f1efdd77e1f2014a  fleetctl_v4.88.0_linux_arm64.zip
e6cd3e2e28c955a9f64c8f12c50e1e78935b7a30dac0f9253726725633f19b5d  fleetctl_v4.88.0_macos.tar.gz
f192245fde09f6f9a2a14c34d443114104f55ec93841ec330d6149845b9a8794  fleetctl_v4.88.0_macos.zip
3a113fdf800011ce006a1c68c00f039eaab5d3546c64d21b4bb02209391f55ff  fleetctl_v4.88.0_windows_amd64.tar.gz
109eda99ba889f9aa2d3e676748158cdacfa759125f8484817035beeae42a950  fleetctl_v4.88.0_windows_amd64.zip
5b370cc2d208ce752b073fc11e24f77ad02294881b8ad01fc7ac6f4bc9518860  fleetctl_v4.88.0_windows_arm64.tar.gz
4d029140b782793f5051068129410decfb19d819fb41f83880dccc2ee8304596  fleetctl_v4.88.0_windows_arm64.zip

fleet-v4.87.1

Bug fixes

• Fixed a bug where an Apple SCEP certificate profile backed by NDES could be marked "failed" and consume one of the host's limited profile retry attempts when its challenge password expired, instead of being automatically resent with a fresh challenge.
• Fixed GitOps runs failing with a software_categories duplicate-entry error when a software category's name differed only by characters MySQL's collation treats as equal (such as the Unicode variation selector in default categories like "🖥️ Productivity").
• Fixed the My device > Software tab appending a macos_applications query parameter to the URL when paginating, even though that page has no /Applications filter.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f2d4e41a21bb117adf090a5803866214ce976880fab0343252b8396d722c8447  fleet_v4.87.1_linux.tar.gz
36adc7723f4b03eea01b287f1235010d036d7aa724dc6b1549150c43ce53c04d  fleetctl_v4.87.1_linux_amd64.tar.gz
c16fc64a4d82176d1f81eb3031024669a2c94f12a49eb2de081b9ca79986e399  fleetctl_v4.87.1_linux_amd64.zip
634d314705e9f081a4a35c2eed0b689234b5883a18c88f2ca6129a251e685d43  fleetctl_v4.87.1_linux_arm64.tar.gz
14bdf0e98f40e2620055cbf35dc7d2d2e51335a215a56290b74d1f4a5f162e25  fleetctl_v4.87.1_linux_arm64.zip
a050f589a44152138527e42d0f2727f2f193eff3c9888f21805e6591b66ba14c  fleetctl_v4.87.1_macos.tar.gz
1901517bb3b62293c1666289795bd04438d43d0817a770a8e2655714c1300dc1  fleetctl_v4.87.1_macos.zip
f1b86d55d567e56168b5760231aec16d1a7f3b6481bd077bdf96044e286958f5  fleetctl_v4.87.1_windows_amd64.tar.gz
8bd5baa2ef829926b6539e935bdd34562018c640a28e53bdb14fcbf591b11db5  fleetctl_v4.87.1_windows_amd64.zip
3fdccd663a6facd8b6dcd79d43c576b108090e7dcab9d00b8b3ffcd465781384  fleetctl_v4.87.1_windows_arm64.tar.gz
08df1022f8fbd6b58995729697c6d520d7bda89253898f28ce405fcf169b4994  fleetctl_v4.87.1_windows_arm64.zip

fleet-v4.87.0

Fleet 4.87.0 (Jun 19, 2026)

IT Admins

• Added 236 new Fleet-maintained apps for Windows, including Microsoft Office, PowerShell, PowerToys, Power BI, Power Automate, SQL Server Management Studio, Microsoft .NET Runtime 8 and 10, Git, Node.js, Python 3.13 and 3.14, PostgreSQL 15–18, Windsurf, Kiro, Dell Command Update, Lenovo Dock Manager, Nessus Agent, Bitwarden, Canva, Miro, Snagit, Tableau Desktop, VirtualBox, TortoiseGit, GitHub Desktop, and more.
• Added 727 new Fleet-maintained apps for macOS, including Kiro, Codex, OpenCode, Claude DevTools, Granola, Logitune, and hundreds more tools across development, security, productivity, and design.
• Added the ability to deploy custom OS update configuration profiles for Apple and Windows.
• Added support for issuing Lock, Wipe, and Clear passcode commands to Android hosts. Lock and Clear passcode work for both BYO (personal) and COBO (company-owned) Android hosts; Wipe is COBO-only. For BYO hosts, Unenroll now issues an AMAPI WIPE under the hood, which removes only the work profile and leaves personal data intact. All Android commands are issued with duration=315360000s (10 years), matching the pending-forever queue semantics Fleet uses for Apple and Windows MDM.
• Made the Wipe command available to Fleet Free users for Android (company-owned) hosts, in both the UI and the API. Wipe for macOS, iOS, iPadOS, Linux, and Windows hosts remains a Fleet Premium feature.
• Android host display name now uses "{IdP first name}'s {hardware model}" when an IdP account is associated.
• Reduced Windows MDM server and database load by relaxing the device management poll schedule from 1 minute to 8 hours for hosts running a version of fleetd that supports on-demand Windows MDM sync (1.57.0 and later). When commands are queued, the server wakes these devices through fleetd to start a management session, so command delivery stays near real-time. Hosts on older fleetd versions keep the previous poll behavior.
• Renamed Apple Business Manager (ABM) terminology to Apple Business (AB) in the API, GitOps YAML, and fleetctl CLI. The new /api/v1/fleet/ab_tokens and /api/v1/fleet/mdm/apple/ab_public_key endpoints, mdm.apple_business YAML key, and fleetctl get mdm-ab/fleetctl generate mdm-ab commands are canonical. The now-deprecated /abm_tokens, /mdm/apple/abm_public_key, apple_business_manager, mdm-apple-bm aliases continue to work for backwards compatibility and log a deprecation warning when used.
• labels_exclude_any can now be combined with labels_include_all or labels_include_any when uploading MDM configuration profiles, allowing hosts to be included by label membership and excluded by another set of labels simultaneously.
• Added support for setting the end user account type to standard for a standard (non-admin) user or none to skip end-user account creation, both requiring a local admin account.
• Added a "Continuous" option to policy automations that re-runs script and software automations on every subsequent policy failure, with editable automations now available directly on the policy create, edit, and details pages.
• Added the ability for users with the Technician role to transfer hosts between fleets (Fleet Premium only). Global technicians can transfer hosts via the Fleet UI (manage hosts and host details pages) and the REST API. Fleet-scoped technicians can transfer hosts between fleets they manage via the REST API.
• Added Self-service categories page (Premium) under Software > Library for managing custom categories per fleet, including add, edit, and delete flows.
• Added Categories button to the Software > Library page that navigates to the new categories page.
• Replaced the static category sidebar on the My device > Self-service page with a custom-category dropdown driven by the org's self-service categories, and added an "Install all (n)" button per category (with a confirmation modal) that posts to /device/{token}/software/install_all?category_id=:id.
• Added macos_applications filter for host software list.
• Added Fleet "Spotlight" - A command palette that opens when pressing Command + K or Control + K.
• Added a "My device" button on the host details User card so global admins can open the host's end-user My device page in a new tab; Fleet refreshes or generates the device auth token as needed so the link is always valid.
• Showed the end user's IdP full name (e.g. "Jane Doe's device") on the My device page header and browser tab when available; falls back to "My device" otherwise.
• Added support for configuring an optional SES sender domain.

Security Engineers

• Added support for validating Microsoft Entra v2 access tokens during Windows MDM enrollment. Effective July 1, 2026, new on-premises MDM applications created via the Entra portal flow issue v2 access tokens whose audience (aud) is the application's client ID; adding the client ID lets these applications enroll Windows hosts. Existing v1 tokens (audience = Fleet server URL) continue to work unchanged.
• Hardened in-house iOS app distribution by requiring a per-install token in the manifest and package download URLs. The token is minted when an install is enqueued, bound to the target host, and expires after 6 hours, aligning the in-house download flow with the URL-token authentication already used by Fleet's MDM installer and software installer download endpoints.
• Added GCS IAM authentication support for software installers S3 storage using Google Application Default Credentials (ADC) bearer tokens instead of S3 HMAC keys. Configurable via s3_software_installers_gcs_iam_auth.
• Added GCS IAM authentication support for file carving S3 storage. Configurable via s3_carves_gcs_iam_auth.
• Added route-aware head sampling for OpenTelemetry trace export. When tracing_enabled is on, agent firehose endpoints (osquery distributed read/write, orbit ping/config, device desktop/ping) are sampled at 0.1% by default, admin reads at 2%, and everything else (enroll, SCEP, MDM checkin, cron jobs, GitOps batch) at 100%. Liveness probes (/healthz, /version, /metrics) are dropped unconditionally.
• Added GET/PATCH /debug/trace_sampler (admin only, behind the existing /debug auth) for adjusting ratios or flipping a 100% force_full debug window at runtime. Each Fleet replica polls the new trace_sampler_settings row every 60 seconds and applies changes without a restart.
• Updated the vulnerability processing guide to clarify Linux vulnerability scanning coverage, including a per-distribution table covering OS/kernel, system packages, and cross-platform packages and which scanner is used for each.

Bug fixes and improvements

• Updated Go to 1.26.4.
• Significantly improved performance of the Apple profile and DDM reconciler.
• Improved the performance of listing labels with host counts by aggregating membership counts in a single pass instead of a per-label subquery, and skipping the unnecessary join to the hosts table when the requesting user can see all hosts.
• Android profiles now use content checksums to determine when to re-sync, avoiding unnecessary re-delivery on unrelated policy changes.
• Long policy resolution text now wraps on the policy details page instead of being truncated.
• Updated initialization semantics around api_endpoints. The catalog is now loaded from the embedded YAML once at package initialization time.
• Added Python 3.14 and Python 3.13 as Windows Fleet-maintained apps.
• Normalized Python's reported version on Windows (e.g. 3.14.5150.0 -> 3.14.5) so software inventory and vulnerability matching use the real version.
• Replaced the "Osquery" column with a richer "Agent" column on the Hosts page that shows Orbit version with a tooltip displaying osquery, Orbit, and Fleet Desktop versions.
• Hid "Issues" and "Private IP address" columns by default for new Fleet instances.
• Added hosts page tooltip to MDM status on hover.
• Added certificate rollover process to MDM assets tool.
• Added a migration cleanup tool for recovering failed starts after renumbered migrations.
• Added each platform's percentage of total enrolled hosts to the "Hosts enrolled" card tooltip on the dashboard.
• Updated conditional access policy query to use parameter binding for platform filter.
• Rejected Windows MDM configuration profiles that don't contain at least one supported SyncML top-level element (<Replace>, <Add>, <Exec>, or <Atomic>), so non-XML or empty payloads are caught at upload instead of failing on devices.
• Updated to now prevent deleting a label that is in use by an MDM configuration profile or declaration, returning an error instead of silently breaking the profile's label targeting.
• Raised the default FLEET_REDIS_HOST_CACHE_TTL from 60s to 180s and removed the reverse-index GETs that the host-update invalidation path performed. Together these reduce DB reader load and lower Redis CPU usage.
• Surfaced continuous_automations_enabled in GitOps YAML (read and generated by fleetctl generate-gitops).
• Stopped the 1Password autofill icon from appearing on Fleet UI inputs that are not credential fields.
• Hid the "Rotate password" button in the Recovery Lock password modal for users with the Observer role, instead of showing it as disabled.
• Updated Android Enterprise connect to surface real error messages to the user.
• Updated self-service activity copy to passive voice without an "end user" actor (e.g. "GitHub Desktop was installed on this host (self-service).") on both the host activity feed and the dashboard global activity feed.
• Updated GitOps error message about exceptions to include the URL to visit to disable exceptions.
• Updated the error displayed when GitOps encounters an unknown env var to account for cases where the string is a literal that needs escaping.
• Removed orphaned duplicate SCEP certificates from the per-user keychain auto...

fleet-v4.86.2

Bug fixes

• Fixed Fleet failing to start on a read-only root filesystem by storing custom org logos in the database when no S3 software installers bucket is configured, instead of writing to local disk.
• Fixed a bug where host vitals labels (e.g. IdP group/department labels) scoped to a fleet/team never got any hosts. The membership cron only looked at global labels, and team-scoped IdP labels also failed to populate due to an incorrect SQL join.
• Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85d05a46359c6cedfc876ea6646e86c46530a5e0253a4144310dc2f8f9b64055  fleet_v4.86.2_linux.tar.gz
f523b48ac462afbefec073a1f04f622bbc0b2b6263377be85d64b8feb5cc219b  fleetctl_v4.86.2_linux_amd64.tar.gz
e55e5d95c8c20b9be7e1b3d30bea077a37b1530440309ff068e9a13812d6e6be  fleetctl_v4.86.2_linux_amd64.zip
0c921a88d30de3679e903cacd8256d1905f0013438827f7569e7bf8cb301284b  fleetctl_v4.86.2_linux_arm64.tar.gz
406910bcc05ec7b6e4629717d5c990295388677ba2b432cb1d05d8cdd591d7ba  fleetctl_v4.86.2_linux_arm64.zip
d8ccd61b5765c8b4052c09c2b5ac832479bf296f77e8f2789cd6397c21d4375d  fleetctl_v4.86.2_macos.tar.gz
c97d41a5defcdebbc049fae4ddfa1b4167e6f39eb5eb5a45c29d39517c9c1187  fleetctl_v4.86.2_macos.zip
978ce2ef670afe9ed539426eb635331ca358f83ebebd3823225c530704b9302b  fleetctl_v4.86.2_windows_amd64.tar.gz
8c310d15fdc7264804b6d22a013fbe0bb09804799234668490840b00258f1004  fleetctl_v4.86.2_windows_amd64.zip
be8bab06e4ff592d7cd3a177ec2cb3487b4f0bf1da1d0afd4f49d7a9299b163e  fleetctl_v4.86.2_windows_arm64.tar.gz
b72948b6f18cf5a01ab5d95702b1d501350a60f9f8fe841a5b07cf9233dea278  fleetctl_v4.86.2_windows_arm64.zip