fleet-v4.88.1

Bug fixes

• Fixed an issue where a configuration profile could be enqueued multiple times for a single host.
• Fixed recovery lock password being enforced on personally-owned (BYOD) macOS hosts, where it would always fail because personal enrollments have device lock rights stripped. These hosts are now skipped.
• Fixed a bug where a user's BYOD selection was not persisted through IdP authentication
• Fixed a bug where installing App Store (VPP) or in-house apps on an iOS/iPadOS host enrolled with the manual (profile-driven) BYOD enrollment profile failed while trying to look up a VPP user. These device-channel hosts now install apps to the device, the same as company-owned manual enrollment; user-scoped licensing is reserved for Account-Driven User Enrollment.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

1adc9236a16edfdbaa321b3abcbea8fd93354bf348aa1984f1dbf41929f837be  fleet_v4.88.1_linux.tar.gz
c0e6db9c7559487036572a292c8a4acb586fa041524d4e59d76730b4932a7375  fleetctl_v4.88.1_linux_amd64.tar.gz
3396a776f736513f511c7e8486838c0a4d6548d42329b66967d5abe33d8d1616  fleetctl_v4.88.1_linux_amd64.zip
6587d56fa84b8b93a25bc26551c86170de61a3ff00f7ad2745b841522fb9cff9  fleetctl_v4.88.1_linux_arm64.tar.gz
b79a62d090d562fd223b6674a9393f7276b5735fbae38ea5438927ba7a21554e  fleetctl_v4.88.1_linux_arm64.zip
c308cce437f2cca7b24e27aa3501f8da5b072192f31ab68bd763dd33de7facad  fleetctl_v4.88.1_macos.tar.gz
18256e18353febc7205cdaf5512ea820af282c0993ab8908704ee7a958814887  fleetctl_v4.88.1_macos.zip
b6028f87ca1c9f0302f0c8fa496de8f36afb06aab5838131befede5b20d95e93  fleetctl_v4.88.1_windows_amd64.tar.gz
6d67da0f5a97310abfd5772876d6baabe110bc8219e49e08cbea674f8086e60c  fleetctl_v4.88.1_windows_amd64.zip
ff8334a6c8527a7d9ae069492aecf67403197ef4761e99c5526038adf39cc202  fleetctl_v4.88.1_windows_arm64.tar.gz
04db52fdd300cc55ffa94e84163551c0d8777414652ae995ab56fed778d1d873  fleetctl_v4.88.1_windows_arm64.zip

fleet-v4.88.0

Bug fixes

• Added support for personal (BYOD) Apple MDM enrollment, tracking per-host enrollment permissions so that personal devices cannot be remotely wiped or locked, and preserving those permissions across SCEP/ACME certificate renewal.
• Fixed an issue where fleetd could intermittently fail to install during Windows MDM enrollment, which could cause the Windows Autopilot Enrollment Status Page to hang.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85280edd8db7ad2212ba5456997cfacdfeeabaf5b6124732f6fb95df45324163  fleet_v4.88.0_linux.tar.gz
847f9bfee46cd8a2f637975efbb4e8b5b2a5ed290af3759361721a4623338631  fleetctl_v4.88.0_linux_amd64.tar.gz
8698436ad196fb0542705d9a1872f7f45a3804e40d87d5e66d889e5def928d73  fleetctl_v4.88.0_linux_amd64.zip
80d52c9b38960a6ddbaf9e6b1545f2aba24210e5c9274efe716eaf7ec33183a5  fleetctl_v4.88.0_linux_arm64.tar.gz
e2be3aa46de32dbde7e998ebf4ccf807021dec2468242f22f1efdd77e1f2014a  fleetctl_v4.88.0_linux_arm64.zip
e6cd3e2e28c955a9f64c8f12c50e1e78935b7a30dac0f9253726725633f19b5d  fleetctl_v4.88.0_macos.tar.gz
f192245fde09f6f9a2a14c34d443114104f55ec93841ec330d6149845b9a8794  fleetctl_v4.88.0_macos.zip
3a113fdf800011ce006a1c68c00f039eaab5d3546c64d21b4bb02209391f55ff  fleetctl_v4.88.0_windows_amd64.tar.gz
109eda99ba889f9aa2d3e676748158cdacfa759125f8484817035beeae42a950  fleetctl_v4.88.0_windows_amd64.zip
5b370cc2d208ce752b073fc11e24f77ad02294881b8ad01fc7ac6f4bc9518860  fleetctl_v4.88.0_windows_arm64.tar.gz
4d029140b782793f5051068129410decfb19d819fb41f83880dccc2ee8304596  fleetctl_v4.88.0_windows_arm64.zip

fleet-v4.87.1

Bug fixes

• Fixed a bug where an Apple SCEP certificate profile backed by NDES could be marked "failed" and consume one of the host's limited profile retry attempts when its challenge password expired, instead of being automatically resent with a fresh challenge.
• Fixed GitOps runs failing with a software_categories duplicate-entry error when a software category's name differed only by characters MySQL's collation treats as equal (such as the Unicode variation selector in default categories like "🖥️ Productivity").
• Fixed the My device > Software tab appending a macos_applications query parameter to the URL when paginating, even though that page has no /Applications filter.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

f2d4e41a21bb117adf090a5803866214ce976880fab0343252b8396d722c8447  fleet_v4.87.1_linux.tar.gz
36adc7723f4b03eea01b287f1235010d036d7aa724dc6b1549150c43ce53c04d  fleetctl_v4.87.1_linux_amd64.tar.gz
c16fc64a4d82176d1f81eb3031024669a2c94f12a49eb2de081b9ca79986e399  fleetctl_v4.87.1_linux_amd64.zip
634d314705e9f081a4a35c2eed0b689234b5883a18c88f2ca6129a251e685d43  fleetctl_v4.87.1_linux_arm64.tar.gz
14bdf0e98f40e2620055cbf35dc7d2d2e51335a215a56290b74d1f4a5f162e25  fleetctl_v4.87.1_linux_arm64.zip
a050f589a44152138527e42d0f2727f2f193eff3c9888f21805e6591b66ba14c  fleetctl_v4.87.1_macos.tar.gz
1901517bb3b62293c1666289795bd04438d43d0817a770a8e2655714c1300dc1  fleetctl_v4.87.1_macos.zip
f1b86d55d567e56168b5760231aec16d1a7f3b6481bd077bdf96044e286958f5  fleetctl_v4.87.1_windows_amd64.tar.gz
8bd5baa2ef829926b6539e935bdd34562018c640a28e53bdb14fcbf591b11db5  fleetctl_v4.87.1_windows_amd64.zip
3fdccd663a6facd8b6dcd79d43c576b108090e7dcab9d00b8b3ffcd465781384  fleetctl_v4.87.1_windows_arm64.tar.gz
08df1022f8fbd6b58995729697c6d520d7bda89253898f28ce405fcf169b4994  fleetctl_v4.87.1_windows_arm64.zip

fleet-v4.87.0

Fleet 4.87.0 (Jun 19, 2026)

IT Admins

• Added 236 new Fleet-maintained apps for Windows, including Microsoft Office, PowerShell, PowerToys, Power BI, Power Automate, SQL Server Management Studio, Microsoft .NET Runtime 8 and 10, Git, Node.js, Python 3.13 and 3.14, PostgreSQL 15–18, Windsurf, Kiro, Dell Command Update, Lenovo Dock Manager, Nessus Agent, Bitwarden, Canva, Miro, Snagit, Tableau Desktop, VirtualBox, TortoiseGit, GitHub Desktop, and more.
• Added 727 new Fleet-maintained apps for macOS, including Kiro, Codex, OpenCode, Claude DevTools, Granola, Logitune, and hundreds more tools across development, security, productivity, and design.
• Added the ability to deploy custom OS update configuration profiles for Apple and Windows.
• Added support for issuing Lock, Wipe, and Clear passcode commands to Android hosts. Lock and Clear passcode work for both BYO (personal) and COBO (company-owned) Android hosts; Wipe is COBO-only. For BYO hosts, Unenroll now issues an AMAPI WIPE under the hood, which removes only the work profile and leaves personal data intact. All Android commands are issued with duration=315360000s (10 years), matching the pending-forever queue semantics Fleet uses for Apple and Windows MDM.
• Made the Wipe command available to Fleet Free users for Android (company-owned) hosts, in both the UI and the API. Wipe for macOS, iOS, iPadOS, Linux, and Windows hosts remains a Fleet Premium feature.
• Android host display name now uses "{IdP first name}'s {hardware model}" when an IdP account is associated.
• Reduced Windows MDM server and database load by relaxing the device management poll schedule from 1 minute to 8 hours for hosts running a version of fleetd that supports on-demand Windows MDM sync (1.57.0 and later). When commands are queued, the server wakes these devices through fleetd to start a management session, so command delivery stays near real-time. Hosts on older fleetd versions keep the previous poll behavior.
• Renamed Apple Business Manager (ABM) terminology to Apple Business (AB) in the API, GitOps YAML, and fleetctl CLI. The new /api/v1/fleet/ab_tokens and /api/v1/fleet/mdm/apple/ab_public_key endpoints, mdm.apple_business YAML key, and fleetctl get mdm-ab/fleetctl generate mdm-ab commands are canonical. The now-deprecated /abm_tokens, /mdm/apple/abm_public_key, apple_business_manager, mdm-apple-bm aliases continue to work for backwards compatibility and log a deprecation warning when used.
• labels_exclude_any can now be combined with labels_include_all or labels_include_any when uploading MDM configuration profiles, allowing hosts to be included by label membership and excluded by another set of labels simultaneously.
• Added support for setting the end user account type to standard for a standard (non-admin) user or none to skip end-user account creation, both requiring a local admin account.
• Added a "Continuous" option to policy automations that re-runs script and software automations on every subsequent policy failure, with editable automations now available directly on the policy create, edit, and details pages.
• Added the ability for users with the Technician role to transfer hosts between fleets (Fleet Premium only). Global technicians can transfer hosts via the Fleet UI (manage hosts and host details pages) and the REST API. Fleet-scoped technicians can transfer hosts between fleets they manage via the REST API.
• Added Self-service categories page (Premium) under Software > Library for managing custom categories per fleet, including add, edit, and delete flows.
• Added Categories button to the Software > Library page that navigates to the new categories page.
• Replaced the static category sidebar on the My device > Self-service page with a custom-category dropdown driven by the org's self-service categories, and added an "Install all (n)" button per category (with a confirmation modal) that posts to /device/{token}/software/install_all?category_id=:id.
• Added macos_applications filter for host software list.
• Added Fleet "Spotlight" - A command palette that opens when pressing Command + K or Control + K.
• Added a "My device" button on the host details User card so global admins can open the host's end-user My device page in a new tab; Fleet refreshes or generates the device auth token as needed so the link is always valid.
• Showed the end user's IdP full name (e.g. "Jane Doe's device") on the My device page header and browser tab when available; falls back to "My device" otherwise.
• Added support for configuring an optional SES sender domain.

Security Engineers

• Added support for validating Microsoft Entra v2 access tokens during Windows MDM enrollment. Effective July 1, 2026, new on-premises MDM applications created via the Entra portal flow issue v2 access tokens whose audience (aud) is the application's client ID; adding the client ID lets these applications enroll Windows hosts. Existing v1 tokens (audience = Fleet server URL) continue to work unchanged.
• Hardened in-house iOS app distribution by requiring a per-install token in the manifest and package download URLs. The token is minted when an install is enqueued, bound to the target host, and expires after 6 hours, aligning the in-house download flow with the URL-token authentication already used by Fleet's MDM installer and software installer download endpoints.
• Added GCS IAM authentication support for software installers S3 storage using Google Application Default Credentials (ADC) bearer tokens instead of S3 HMAC keys. Configurable via s3_software_installers_gcs_iam_auth.
• Added GCS IAM authentication support for file carving S3 storage. Configurable via s3_carves_gcs_iam_auth.
• Added route-aware head sampling for OpenTelemetry trace export. When tracing_enabled is on, agent firehose endpoints (osquery distributed read/write, orbit ping/config, device desktop/ping) are sampled at 0.1% by default, admin reads at 2%, and everything else (enroll, SCEP, MDM checkin, cron jobs, GitOps batch) at 100%. Liveness probes (/healthz, /version, /metrics) are dropped unconditionally.
• Added GET/PATCH /debug/trace_sampler (admin only, behind the existing /debug auth) for adjusting ratios or flipping a 100% force_full debug window at runtime. Each Fleet replica polls the new trace_sampler_settings row every 60 seconds and applies changes without a restart.
• Updated the vulnerability processing guide to clarify Linux vulnerability scanning coverage, including a per-distribution table covering OS/kernel, system packages, and cross-platform packages and which scanner is used for each.

Bug fixes and improvements

• Updated Go to 1.26.4.
• Significantly improved performance of the Apple profile and DDM reconciler.
• Improved the performance of listing labels with host counts by aggregating membership counts in a single pass instead of a per-label subquery, and skipping the unnecessary join to the hosts table when the requesting user can see all hosts.
• Android profiles now use content checksums to determine when to re-sync, avoiding unnecessary re-delivery on unrelated policy changes.
• Long policy resolution text now wraps on the policy details page instead of being truncated.
• Updated initialization semantics around api_endpoints. The catalog is now loaded from the embedded YAML once at package initialization time.
• Added Python 3.14 and Python 3.13 as Windows Fleet-maintained apps.
• Normalized Python's reported version on Windows (e.g. 3.14.5150.0 -> 3.14.5) so software inventory and vulnerability matching use the real version.
• Replaced the "Osquery" column with a richer "Agent" column on the Hosts page that shows Orbit version with a tooltip displaying osquery, Orbit, and Fleet Desktop versions.
• Hid "Issues" and "Private IP address" columns by default for new Fleet instances.
• Added hosts page tooltip to MDM status on hover.
• Added certificate rollover process to MDM assets tool.
• Added a migration cleanup tool for recovering failed starts after renumbered migrations.
• Added each platform's percentage of total enrolled hosts to the "Hosts enrolled" card tooltip on the dashboard.
• Updated conditional access policy query to use parameter binding for platform filter.
• Rejected Windows MDM configuration profiles that don't contain at least one supported SyncML top-level element (<Replace>, <Add>, <Exec>, or <Atomic>), so non-XML or empty payloads are caught at upload instead of failing on devices.
• Updated to now prevent deleting a label that is in use by an MDM configuration profile or declaration, returning an error instead of silently breaking the profile's label targeting.
• Raised the default FLEET_REDIS_HOST_CACHE_TTL from 60s to 180s and removed the reverse-index GETs that the host-update invalidation path performed. Together these reduce DB reader load and lower Redis CPU usage.
• Surfaced continuous_automations_enabled in GitOps YAML (read and generated by fleetctl generate-gitops).
• Stopped the 1Password autofill icon from appearing on Fleet UI inputs that are not credential fields.
• Hid the "Rotate password" button in the Recovery Lock password modal for users with the Observer role, instead of showing it as disabled.
• Updated Android Enterprise connect to surface real error messages to the user.
• Updated self-service activity copy to passive voice without an "end user" actor (e.g. "GitHub Desktop was installed on this host (self-service).") on both the host activity feed and the dashboard global activity feed.
• Updated GitOps error message about exceptions to include the URL to visit to disable exceptions.
• Updated the error displayed when GitOps encounters an unknown env var to account for cases where the string is a literal that needs escaping.
• Removed orphaned duplicate SCEP certificates from the per-user keychain auto...

fleet-v4.86.2

Bug fixes

• Fixed Fleet failing to start on a read-only root filesystem by storing custom org logos in the database when no S3 software installers bucket is configured, instead of writing to local disk.
• Fixed a bug where host vitals labels (e.g. IdP group/department labels) scoped to a fleet/team never got any hosts. The membership cron only looked at global labels, and team-scoped IdP labels also failed to populate due to an incorrect SQL join.
• Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

85d05a46359c6cedfc876ea6646e86c46530a5e0253a4144310dc2f8f9b64055  fleet_v4.86.2_linux.tar.gz
f523b48ac462afbefec073a1f04f622bbc0b2b6263377be85d64b8feb5cc219b  fleetctl_v4.86.2_linux_amd64.tar.gz
e55e5d95c8c20b9be7e1b3d30bea077a37b1530440309ff068e9a13812d6e6be  fleetctl_v4.86.2_linux_amd64.zip
0c921a88d30de3679e903cacd8256d1905f0013438827f7569e7bf8cb301284b  fleetctl_v4.86.2_linux_arm64.tar.gz
406910bcc05ec7b6e4629717d5c990295388677ba2b432cb1d05d8cdd591d7ba  fleetctl_v4.86.2_linux_arm64.zip
d8ccd61b5765c8b4052c09c2b5ac832479bf296f77e8f2789cd6397c21d4375d  fleetctl_v4.86.2_macos.tar.gz
c97d41a5defcdebbc049fae4ddfa1b4167e6f39eb5eb5a45c29d39517c9c1187  fleetctl_v4.86.2_macos.zip
978ce2ef670afe9ed539426eb635331ca358f83ebebd3823225c530704b9302b  fleetctl_v4.86.2_windows_amd64.tar.gz
8c310d15fdc7264804b6d22a013fbe0bb09804799234668490840b00258f1004  fleetctl_v4.86.2_windows_amd64.zip
be8bab06e4ff592d7cd3a177ec2cb3487b4f0bf1da1d0afd4f49d7a9299b163e  fleetctl_v4.86.2_windows_arm64.tar.gz
b72948b6f18cf5a01ab5d95702b1d501350a60f9f8fe841a5b07cf9233dea278  fleetctl_v4.86.2_windows_arm64.zip

fleet-v4.86.1

Bug fixes

• Updated conditional access policy query to use parameter binding for platform filter.

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

995b74191f79783defd244c5538f93b9ae0da7a2bf99f7668775088cd8f7a735  fleet_v4.86.1_linux.tar.gz
0c5b031e5e973e3f8f96307cfdaa55a33a0ab4e7859eee52150bda51572c7349  fleetctl_v4.86.1_linux_amd64.tar.gz
2883b8166c8b09a584de75708558c926b74df4eab48229972b098d40570952d0  fleetctl_v4.86.1_linux_amd64.zip
eab4e7814d6bd76ec07b662833a0289ecade4b9226efb24b8727459bfc3f3fcc  fleetctl_v4.86.1_linux_arm64.tar.gz
92ceee1089c4be0d74afc5289f6e3faa165efb38d4a1a9059fe06c13794cfbbd  fleetctl_v4.86.1_linux_arm64.zip
d4f7db86dcb60dc241177505819c20619401dbbbd6003c0091a2888e1d921d36  fleetctl_v4.86.1_macos.tar.gz
ab6510afc7686f5416596da16476b5a996dfa86d5b7dded6d77f85ff228f96a0  fleetctl_v4.86.1_macos.zip
faaa144f2c26ca72cefc398fe126ab04808bee859860f0ad913c6571e6594036  fleetctl_v4.86.1_windows_amd64.tar.gz
de073acde2f4ced32dff7a20250058085134d0a220714208aee51ecde345b665  fleetctl_v4.86.1_windows_amd64.zip
d2b2473f6d6e11c6dfb511b6f44d22c2d4f69b4d8c4065129e334d13734ec6a7  fleetctl_v4.86.1_windows_arm64.tar.gz
70ddf117dbd1b86a6eeb2a2cec97fe89611e621040c4e33092c1ce1d247c7d3e  fleetctl_v4.86.1_windows_arm64.zip

fleet-v4.85.2

Bug fixes

• Fixed a server out-of-memory crash that could occur when Apple's VPP (App and Book Management) API repeatedly returned transient errors (HTTP 500 with Retry-After, or error 9646) during VPP API operations (e.g., app installs, user registration, license seat releases).

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

78ebca78943efcd4e86a0096ab60520014261e2081446e9ef6452c50430d4eea  fleet_v4.85.2_linux.tar.gz
d86d60c67b45fa02de9408a5a8d8ed9770c95ceeb9e0709be17aa65ce9d06b0d  fleetctl_v4.85.2_linux_amd64.tar.gz
ba300343e351f9fe514b46147115836ecb61eaf479ef28e2918eb5d55dec8641  fleetctl_v4.85.2_linux_amd64.zip
8611adc78afb8556b14e745616355a870e85ea6d32e9d11e2e0ae9724841c689  fleetctl_v4.85.2_linux_arm64.tar.gz
642cd1a47ed8e13214785d0fc0c8892d8690adbca062ea3a7bab715983e7a20d  fleetctl_v4.85.2_linux_arm64.zip
2f84e5fe342117b7f1eb4a4349eeaf8a1b6ceaf7b5454230a9cc751c9c1c95bb  fleetctl_v4.85.2_macos.tar.gz
26b95926eb50904b5302f83c0a47760f486c08b1e8c9fb3703ba9a331fe9cd70  fleetctl_v4.85.2_macos.zip
a85f85b022c850a70372e7c1707f76c8f87f187758c5289ed570e26065c430b8  fleetctl_v4.85.2_windows_amd64.tar.gz
8473a426386690468bf4a689027eab588fdaeb73cb4b701fd4e5eb50a5e44a2e  fleetctl_v4.85.2_windows_amd64.zip
c155bb3393354c33da9c8b67ff5974fff690a11af1857d3d5e44008fd47df148  fleetctl_v4.85.2_windows_arm64.tar.gz
4b38085f4df9574f27a1a36f73a2d192f3faeee973face0c357c4b4dc94b7b2d  fleetctl_v4.85.2_windows_arm64.zip

fleet-v4.86.0

Fleet 4.86.0 (May 29, 2026)

IT Admins

• Added automatic rotation of managed local admin account passwords after they have been viewed.
• Added a require_all_software_windows setting to cancel the Windows setup experience if any software install fails during Autopilot enrollment, matching the existing macOS behavior.
• Added GitOps support for uploading custom org logos. fleetctl gitops accepts org_logo_path_dark_mode and org_logo_path_light_mode keys to upload local files, and fleetctl generate-gitops exports Fleet-hosted logos as local files alongside path keys while keeping external URLs as org_logo_url_*_mode keys.
• Added support for installing VPP and in-house (.ipa) apps on iOS and iPadOS hosts enrolled via Account-Driven User Enrollment with a Managed Apple Account.
• Enabled self-service software installs from the My device page for user-enrolled iOS and iPadOS hosts.
• Enabled setup experience software in Controls > Setup experience to install automatically on user-enrolled iOS and iPadOS hosts at enrollment.
• Provisioned a VPP client user per Managed Apple Account on first install, and associated VPP licenses to the user rather than the device, supporting Apple's up-to-5-devices-per-user licensing semantics.
• Added managed app configuration for iOS and iPadOS apps (VPP and in-house), configurable via UI, REST API, and GitOps, with $FLEET_VAR_* substitution.
• Added support for VPP apps purchased from non-US-based Apple Business accounts.
• Added the ability to upload a custom organization logo for light and dark modes, hosted by Fleet, replacing the previous URL-only flow on the setup screen and organization settings page.
• Added include_all label scope to policies, and include_all and include_any label scopes to reports, including support via GitOps and fleetctl.
• Added a "Custom" target dropdown when creating or updating reports under the premium tier.
• Added an "Include all" option to the "Custom" target dropdown on Policies for premium users only.
• Added permissions for the GitOps user to list software titles.
• Added support for setting gitops_mode_enabled and repository_url via GitOps.
• Added output to GitOps for scripts, indicating how many scripts would be applied (dry run) or were applied.
• Added activity entries for retried software installs and script runs from policy automations.
• Added an activity when hosts fail enrollment profile renewal.
• Added activities when users create, edit, or delete labels (created_label, edited_label, and deleted_label).
• Added "Hosts online", "Hosts enrolled", and "Vulnerability exposure" charts to the dashboard.
• Added an option to convert and return a PEM-encoded X.509 certificate instead of a PEM-encoded PKCS7 envelope from the Request a Certificate endpoint.
• Added a deprecation warning when using setup_experience.software or macos_setup.software keys in config.
• Released fleetctl as a pkg for macOS.
• Released fleetctl as an msi for Windows.
• Enabled wiping a host to cancel all of its upcoming activities.
• Updated the default automatic enrollment profile, and added the ability to download and view the applied default profile.
• Updated OS version reporting for iOS and iPadOS to include the Rapid Security Response suffix (e.g. (a)) when the device reports a SupplementalOSVersionExtra field via MDM.
• Updated fleetd and MDM enroll activities to display the serial number and preserve the osquery-provided display name.
• Required the --host flag for fleetctl get mdm-commands, and deprecated GET /api/v1/fleet/commands without a host_identifier.
• Cleared host vitals on ABM host re-enrollment, with a config option to preserve past host activities.

Security Engineers

• Added macOS 26 CIS Benchmark v1.0.0.
• Updated CIS Windows 11 Enterprise benchmark policies from v4.0.0 to v5.0.1, adding 17 new L1 policies and updating 42 existing policy titles.
• Surfaced hardware-bound ACME certificates on macOS host vitals by retrieving them via the MDM CertificateList command when an ACME-bearing configuration profile is installed or re-installed.
• Added SVG support for custom organization logos, with strict server-side sanitization to reject scripts and other unsafe SVG content.
• Added support for the subject_alternative_name field on Android certificate templates.
• Optimized OSV vulnerability scanning to query distinct software per OS version rather than per host, reducing redundant database queries for many hosts sharing the same packages.
• Improved vulnerability scanning performance by using a per-vendor product cache during CVE matching to optimize translate_cpe_to_cve.

Bug fixes and improvements

• Updated Go to 1.26.3.
• Removed debug symbols from fleet and fleetctl executables to reduce binary size.
• Reduced database load from GET /api/latest/fleet/device/{token}/desktop and other Fleet Desktop endpoints when invalid or expired device auth tokens are presented, by resolving the token to a host ID with a single-table indexed lookup before running the multi-join host-details query.
• Improved Windows MDM performance when transferring large numbers of hosts between teams or applying bulk profile changes. These operations now return quickly and roll out profile updates to Windows hosts in the background, so host check-ins and other MDM activity are no longer slowed down while a large change is in progress.
• Added a Redis-backed cache for host lookups on the osquery and orbit authentication paths. Successful lookups are cached for 60s (±10% jitter) and invalidated on writes that mutate cached host fields. Reduces reader-side DB load at scale without changing the HTTP contract. Requires Redis 6.2 or later.
• Added a missing uninstall option on the host software library even when an installer has no matching software in the host's inventory.
• Improved Windows MDM profile removal performance by scoping the desired-state subquery.
• Improved Windows MDM profile removal performance by skipping redundant database writes for verified-remove ACKs.
• Consolidated non-variable templated Windows MDM profile command inserts from one per-profile to a single bulk insert.
• Added a periodic cron job to clean up the Windows MDM command queue, reducing write pressure during ACK transactions.
• Made host team assignment sticky across orbit and osquery re-enrollments.
• Improved errors returned from the API when running fleetctl commands by dropping path and status code.
• Improved validation of order parameters on list endpoints.
• Added the orbit.debug_logging_on_enroll_duration agent option to enable orbit debug logging for a specified time period after enrollment.
• Improved validation for invalid order_key values in /api/v1/fleet/commands, /api/v1/fleet/mdm/commands, and /api/v1/fleet/mdm/apple/commands endpoints.
• Improved the error message when the name key is omitted from a GitOps YAML file.
• Improved the error message when deleting a label used for targeting a software installation.
• Updated fleetctl gitops to warn when labels: is specified in no-team or unassigned files, where it is not supported.
• Updated the expired Fleet Premium license CLI banner to link to https://fleetdm.com/learn-more-about/downgrading instead of a stale FAQ anchor.
• Updated the Edit label page to reference "fleets" instead of "teams" when a label is associated with a fleet.
• Updated the setup experience Users card with a link to PSSO local account documentation.
• Updated empty state copy to be action-oriented. Headers describe the current state ("No hosts", "No policies for this fleet") instead of prompting action. Body text explains what to expect. CTA buttons are explicit ("Add policy", "Schedule a report") and permission-gated.
• Updated empty states on Hosts, Reports, Policies, and Software pages so search bars, filters, and dropdowns remain visible but disabled when empty, avoiding layout shift when the first item is added. Item count remains visible.
• Updated Settings, Fleets, Ticket destinations, Certificates, and Identity provider pages with consistent page descriptions and learn-more links.
• Updated empty state visuals to a fresher, consistent design.
• Updated timestamps with tooltips on the host Vitals component to always use cursor: pointer.
• Updated the version of the checkout action in the fleetctl new template to avoid Node warnings.
• Updated the MSI builder to skip packaging the unusable "dummy" secret value when building fleetd-base.msi for Autopilot installs.
• Scoped install commands for user-enrolled hosts to the host's Managed Apple Account (clientUserIds) instead of serialNumbers, so apps install on the correct user account on the device.
• Surfaced a clear host-level error when license association fails during install (for example, no licenses available or the user has reached the 5-device limit) instead of failing silently.
• Made created_at upper-bound filtering consistent on the list activities API. The endpoint now caps results at now by default whether or not start_created_at is provided, matching the documented behavior of end_created_at.
• Unified access to global and team policies in the UI by using the now-generic GET /api/latest/fleet/policies/:id endpoint.
• Wrapped Get-ItemProperty calls in try/catch blocks during registry enumeration to gracefully handle terminating exceptions (e.g. System.InvalidCastException) from malformed registry entries, logging the offending path instead of aborting.
• Replaced the cryptic "startTLS error: ..." flash with a prescriptive message when saving SMTP settings fails because SSL/TLS is disabled but STARTTLS is still enabled. Added a tooltip on the SSL/TLS checkbox pointing to the STARTTLS toggle in Advanced options.
• Removed a dead SQL condition in hostVPPInstalls that was misleading but har...

fleet-v4.85.1

Bug fixes

• Fixed fleetctl gitops rejecting Android or Windows configuration profiles when editing an existing team, even when the corresponding MDM platform was configured.
• Implement roaring bitmaps in historical data collection for improved performance.
• Fixed dynamic SCEP certificate issuance failing with an "Invalid NDES admin credentials" error when the NDES Admin URL is fronted by Okta or another gateway that uses HTTP Basic auth instead of NTLM.
• Remove unneeded call to get tracked CVEs when reading CVE chart data

Upgrading

Please visit our update guide for upgrade instructions.

Documentation

Documentation for Fleet is available at fleetdm.com/docs.

Binary Checksum

SHA256

1aa5bbaf65833a60040fe28aa1d8b88535a025947185842c6dc6d128052f6132  fleet_v4.85.1_linux.tar.gz
1ca2b8543d5e2cb738536db75f92192c63b8bd650022b0f9ffe5b01fff3c791d  fleetctl_v4.85.1_linux_amd64.tar.gz
04d9f24669ceabad7467c40c2ca631e076a700def73291dd621c22a2dd1dad26  fleetctl_v4.85.1_linux_amd64.zip
5bd235b4840ab2fde87456267843c2ff4f29cae3fb4d431e1d0b87287d15b568  fleetctl_v4.85.1_linux_arm64.tar.gz
118dcc5a485bf1bb337496ab5bb75c6b437b8ecb9858b5ff29d405172a5cc8bd  fleetctl_v4.85.1_linux_arm64.zip
43667769f2d59e45c78d7558e05cd9350f4606681642e8238eaeea6247b7c337  fleetctl_v4.85.1_macos.tar.gz
def4fa7b8d40d6525822ef2a4e810ba8fd9b1525f6ffafa384110f4547df3fc9  fleetctl_v4.85.1_macos.zip
e7567a7e1d61cbe1a6dadc19d0c7ba6e4801dc51b9c91e58f4d303a4fe86cfdb  fleetctl_v4.85.1_windows_amd64.tar.gz
18d8861a7a0242fe2eb032b4d262c4a02411609463f0314adb7e915ccf437e03  fleetctl_v4.85.1_windows_amd64.zip
7e0ae875f2e0a86fb8cd5b746b885f10b1f6c176b404776be79a1480b21a510f  fleetctl_v4.85.1_windows_arm64.tar.gz
7c5604be0976801b00bb6bdb7199a02e10bf88bfcf3feab58011a891caf4d382  fleetctl_v4.85.1_windows_arm64.zip

fleet-v4.85.0

Fleet 4.85.0 (May 14, 2026)

IT Admins

• Added a dark theme to the Fleet UI, selectable in account settings with light, dark, and system options.
• Implemented Clear Passcode feature for iOS and iPadOS.
• Added support for Fleet variables in Apple's declaration profiles (DDM).
• Added support for passing end-user authentication context to the Fleet MSI installer during Windows MDM enrollment, so end users are not prompted to authenticate twice when EUA is enabled.
• Switched to Docker as the default WiX runtime on macOS (including Apple Silicon) when generating .msi packages via fleetctl package. Wine is no longer required on macOS for the default path.
• Updated macOS 15 CIS benchmark to include v2.0.0 changes.
• Updated the macOS 14 (Sonoma) CIS policy set to benchmark v3.0.0.
• Switched Fleet-maintained apps serving location from GitHub to https://maintained-apps.fleetdm.com/manifests. If this site is inaccessible, Fleet will fall back to the previous GitHub-hosted copies of manifest files.
• Added conditional HTTP downloads using ETag headers for software in GitOps, skipping re-download when content hasn't changed.
• Added always_download option for software in GitOps to bypass the new conditional download feature.
• Added automatic escaping of JSON special characters in GitOps variables used in .json configuration profiles (Apple DDM declarations and Android profiles).
• Updated fleetctl gitops to process Android certificates before Android profiles.
• Made fleet name uniqueness rules consistent across the UI, API, and GitOps paths. Fleet names must now differ by more than letter case, and conflicts return a 409 error on all code paths.
• Enabled renewing and deleting AB tokens in the UI in GitOps mode.
• Changed the team's script_execution_timeout in agent options to default to the global agent options value when unset.
• Added ability to save policies whose SQL is flagged as a syntax error.
• Withheld Android Wi-Fi configuration profiles (openNetworkConfiguration with ClientCertKeyPairAlias) until the referenced certificate is installed or terminally failed on the device.
• Updated the host OS settings detail column to show the reason when an Android profile is pending due to a certificate dependency.
• Added "Hosts online", "Vulnerability exposure", and "Hosts enrolled" charts to the dashboard.
• Added an admin setting to control retention of vulnerability-exposure data used by the dashboard chart.
• Added new policy details page with a read-only view of policy information.
• Updated edit policy page to redirect users with read-only access to the policy details page.
• Added dedicated /policies/:id/live route for running policies.

Security Engineers

• Added UI pages for creating and editing API-only users with support for fleet assignment, role selection, and API endpoint access control.
• Added new middleware (APIOnlyEndpointCheck) that enforces a 403 response for API-only users whose request either isn't in the API endpoint catalog or falls outside their configured per-user endpoint restrictions.
• Added POST /users/api_only endpoint for creating API-only users.
• Added PATCH /users/api_only/{id} endpoint for updating existing API-only users.
• Updated fleetctl user create --api-only to remove email and password field requirements.
• Added a new premium GET /api/_version_/fleet/rest_api endpoint that returns the contents of the embedded api_endpoints.yml artifact.
• Updated GET /users/{id} response to include the new api_endpoints field for API-only users.
• Added user_api_endpoints table to track per-user API endpoint permissions.

Bug fixes and improvements

• Updated Go to 1.26.3.
• Improved MySQL writer performance by skipping no-op UPDATE host_orbit_info and UPDATE host_disks writes when the stored values already match the incoming ingest values from osquery, cutting these writes to near zero at steady state.
• Improved Fleet-maintained apps (FMA) sync performance by adding an index on software.bundle_identifier that eliminates a full table scan during the hourly sync, reducing writer CPU load on large deployments.
• Improved the performance of deleting Windows MDM configuration profiles at scale by collapsing the per-profile update loop into a single batched statement that spans multiple profiles per chunk.
• Updated copy, show, and other action buttons app-wide for a more consistent style.
• Improved button and link styling.
• Improved the OS settings modal layout.
• Improved host policy empty state.
• Updated the enrollment page enroll button to render at full screen width for larger-resolution mobile devices.
• Updated the error message returned when an invalid domain is supplied for MDM Apple CSR signing.
• Updated EULA PDF upload size check to use the default max request body size.
• Added activity when a Windows MDM wipe command fails.
• Improved documentation for MySQL read replica configuration, clarifying that all settings (including region for IAM authentication) must be explicitly set for the read replica.
• Upgraded to TypeScript 6.0 for the app frontend.
• Moved some core UI form components to TypeScript for better predictability and reliability.
• Removed the unused windows_updates MySQL table and ingestion code.
• Implemented the chart bounded context and schema to support charting capabilities in Fleet.
• Added gitOpsModeEnabled and gitOpsModeExceptions to the anonymous statistics payload.
• Added startup validation that panics if any route declared in service/api_endpoints.yml is not registered in the router.
• Stopped turning on Prometheus serving by default with a hard-coded username and password when the server is started with --dev.
• Fixed a Windows BitLocker encrypt/decrypt loop on machines with secondary drives using auto-unlock. Fleet now detects disk encryption using conversion_status (not just protection_status), preventing the server from repeatedly requesting encryption when the disk is already encrypted. Added bitlocker_protection_status tracking so the UI shows "Action required" when BitLocker protection is off instead of misleadingly showing "Verified."
• Fixed a race condition where a host could silently revert to its previous team after an admin team transfer.
• Fixed an issue where trying to wipe a device after its certificate was renewed could fail due to a missing bootstrap token. Note: The device might still have wiped.
• Fixed a server panic (502) when an Android pubsub status report arrived for a host that had been deleted from Fleet.
• Fixed a server panic when an Apple MDM DeviceInformation refetch response omitted DeviceName or other expected fields.
• Fixed an issue where Fleet would send an AccountConfiguration command to iOS and iPadOS devices when end user authentication was enabled; AccountConfiguration is macOS-only.
• Fixed a bug where pending MDM profile rows persisted in the database after Apple or Windows MDM was turned off, causing stale profiles to reappear when MDM was re-enabled. Also fixed cleanup of pending Windows profile rows when a device unenrolls from MDM.
• Fixed a bug where custom package installers were not removed when adding an FMA for the same title via GitOps, which caused setup experience to install duplicate software.
• Fixed a bug where renaming a patch policy in a GitOps file caused it to be deleted initially.
• Fixed a bug where host environment variables in script-only packages would cause GitOps to fail.
• Fixed an issue where the DDM reconciler would not self-heal for stuck remove/pending profiles due to resend with update.
• Fixed an issue where a host DDM cleanup function was not executed for stale remove/pending profiles that weren't reported by the device.
• Fixed an issue where batch processing many DDM profile changes would result in stuck remove/pending profiles.
• Fixed an issue where sending a differently cased display name for a DDM profile via the batch endpoint would result in recreating the DDM profile and triggering a resend.
• Fixed an issue where Fleet would not remove the host OS setting entry if a RemoveProfile command failed with error code 89 (profile not found on device).
• Fixed an issue where adding a custom icon for a script-only package was not allowed in GitOps.
• Fixed an issue where duplicate Disk Encryption activity types showed up.
• Fixed the host details activity feed showing the previously opened host's activities by including the host ID in the activity query cache keys.
• Fixed navigation to the settings page for multi-team admin users.
• Fixed software table page number to be bookmarkable.
• Fixed an infinite page loop pagination bug on the software table page that occurred when viewing a subsequent page and then using the software filter dropdown.
• Fixed styling bugs in GitOps mode UI.
• Fixed padding between GitOps exceptions checkboxes.
• Fixed a nil pointer dereference in the contributor API spec/policies.

Fleet-maintained app updates and vulnerability fixes are applied, whether or not you upgrade.

Fleet's agent

The following version of Fleet's agent (fleetd) support the latest changes to Fleet:

1. orbit-v1.55.0
2. fleet-desktop-v1.55.0 (included with Orbit)
3. osquery-5.23.0 (included with Orbit)
4. fleetd-chrome-v1.3.5
5. fleetd-android-v1.0.2

While newer versions of fleetd still function with older versions of Fleet, old versions of fleetd and osquery may not function with new versions of Fleet. We do not actively test these scenarios, and we recommend deploying a minimum of the agent versions above before upgrading to this version of Fleet.

Upgrading

Ple...