[Guide] Add Apple DDM support and example in documentation#48131
[Guide] Add Apple DDM support and example in documentation#48131melpike wants to merge 5 commits into
Conversation
Added support for Apple Declarative Device Management (DDM) profiles, including configurations and assets, along with an example JSON structure for asset declarations.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
JordanMontgomery
left a comment
JordanMontgomery
left a comment
There was a problem hiding this comment.
One other change we're gonna be making here is trimming down the forbidden declarations list:
var ForbiddenDeclTypes = map[string]struct{}{
"com.apple.configuration.account.caldav": {},
"com.apple.configuration.account.carddav": {},
"com.apple.configuration.account.exchange": {},
"com.apple.configuration.account.google": {},
"com.apple.configuration.account.ldap": {},
"com.apple.configuration.account.mail": {},
"com.apple.configuration.screensharing.connection": {},
"com.apple.configuration.security.certificate": {},
"com.apple.configuration.security.identity": {},
"com.apple.configuration.security.passkey.attestation": {},
"com.apple.configuration.services.configuration-files": {},
"com.apple.configuration.watch.enrollment": {},
}
Most of these are forbidden because they require an asset - we'll be removing those. At least con.apple.configuration.watch.enrollment, however, is forbidden for other reasons(requires a special enrollment URL IIRC). We won't be removing that and we won't be allowing management declarations. Unless of course they add the existing "allow all declarations" flag. Do we want to call that behavior out somewhere?
|
|
||
| For macOS hosts, Fleet supports uploading Apple Declarative Device Management (DDM) profiles as `.json` files. Fleet supports the following declaration types: | ||
|
|
||
| - **Configurations** (`com.apple.configuration.*`): Enforce settings like passcode policies, account configurations, and more. |
There was a problem hiding this comment.
Do we want to call out that assets should be uploaded on the assets tab or something similar since there's a different upload pipe for them?
| ### Device and user scope | ||
|
|
||
| Currently, on macOS and Windows hosts, Fleet supports enforcing OS settings at the device (device scoped) and user (user scoped) levels. The iOS, iPadOS, and Android platforms only support device-scoped configuration profiles. User-scoped declaration (DDM) profiles for macOS are coming soon. | ||
| Currently, on macOS and Windows hosts, Fleet supports enforcing OS settings at the device (device scoped) and user (user scoped) levels. The iOS, iPadOS, and Android platforms only support device-scoped configuration profiles. |
There was a problem hiding this comment.
We have an example of a .mobileconfig below with PayloadScope, do we want something similar for DDM configurations?
There was a problem hiding this comment.
I added an example but lmk if it's not a great one.
One other change we're gonna be making here is trimming down the forbidden declarations list
@JordanMontgomery Happy to add this in—do we have that list of what will be forbidden? Or did you mean just mention it?
Updated the instructions for adding configuration profiles and assets in Fleet, including clarifications on user-scoped profiles and editing existing profiles.
mike-j-thomas
left a comment
mike-j-thomas
left a comment
There was a problem hiding this comment.
LGTM. Good to merge once Jordan's feedback is resolved.
3 participants
Added support for Apple Declarative Device Management (DDM) profiles, including configurations and assets, along with an example JSON structure for asset declarations.
Related issue: Resolves # 38986