Welcome to the documentation for Fleet, the lightweight management platform for laptops and servers.
Can't find what you're looking for? Support
This section provides instructions for migrating your hosts away from your old MDM solution to Fleet.
On their My device page, once an end user's device is unenrolled from the old MDM solution, the end user will be given the option to manually download the MDM enrollment profile.
Once downloaded, the user will receive a system notification that the Device Enrollment profile needs to be installed in their System Settings > Profiles section.
After installation, the MDM enrollment profile can be removed by the end user at any time.
Automatic enrollment is available in Fleet Premium or Ultimate
To migrate automatically enrolled hosts, we will do the following steps:
There are two migration workflows in Fleet: default and end user.
The default migration workflow requires that the IT admin unenrolls hosts from the old MDM solution before the end user can complete migration. This will result in a gap in MDM coverage until the end user completes migration.
The end user migration workflow allows the end user to kick-off migration by unenrolling from the old MDM solution on their own. Once the user is unenrolled, they're prompted to turn on MDM features in Fleet. This reduces the gap in MDM coverage.
Configuring the end user migration workflow requires a few additional steps.
In your old MDM solution, unenroll the hosts to be migrated. MacOS does not allow multiple MDMs to be installed at once.
Send these guided instructions to your end users to complete the final few steps via Fleet Desktop.
The end user will receive a "Device Enrollment: <organization> can automatically configure your Mac." system notification within the macOS Notifications Center.
After the end user clicks on the system notification, macOS will open the System Setting > Profiles and ask the user to "Allow Device Enrollment: <organization> can automatically configure your Mac based on settings provided by your System Administrator."
If the end user does not install the profile, the system notification will continue to prompt the end user until the setting has been allowed.
Once this setting has been approved, the MDM enrollment profile cannot be removed by the end user.
Available in Fleet Premium or Ultimate
The end user migration workflow is supported for automatically enrolled (DEP) hosts.
To watch a GIF that walks through the end user experience during the migration workflow, in the Fleet UI, head to Settings > Integrations > Mobile device management (MDM), and scroll down to the End user migration workflow section.
In Fleet, you can configure the end user workflow using the Fleet UI or fleetctl command-line tool.
Fleet UI:
Select the avatar on the right side of the top navigation and select Settings > Integrations > Mobile device management (MDM).
Scroll down to the End user migration workflow section and select the toggle to enable the workflow.
Under Mode choose a mode and enter the webhook URL for you automation tool (ex. Tines) under Webhook URL and select Save.
During the end user migration workflow, an end user's device will have their selected system theme (light or dark) applied. If your logo is not easy to see on both light and dark backgrounds, you can optionally set a logo for each theme: Head to Settings > Organization settings >
Organization info, add URLs to your logos in the Organization avatar URL (for dark backgrounds) and Organization avatar URL (for light backgrounds) fields, and select Save.
fleetctl CLI:
fleet-config.yaml
file or add to your existing config
YAML file:apiVersion: v1
kind: config
spec:
mdm:
macos_migration:
enable: true
mode: "voluntary"
webhook_url: "https://example.com"
...
mdm.macos_migration
key.To learn about each option, in the Fleet UI, select the avatar on the right side of the top navigation, select Settings > Integrations > Mobile device management (MDM), and scroll down to the End user migration workflow section.
If want to add a your organization's logo, you can optionally set a logo for each background:
apiVersion: v1
kind: config
spec:
org_info:
org_logo_url: https://fleetdm.com/images/press-kit/fleet-blue-logo.png
org_logo_url_light_background: https://fleetdm.com/images/press-kit/fleet-white-logo.png
...
Add URLs to your logos that are visible on a dark background and light background in the org_logo_url
and org_logo_url_light_background
keys respectively. If you only set a logo for one, the Fleet logo will be used for the other.
Run the fleetctl apply -f fleet-config.yml
command to add your configuration.
Confirm that your configuration was saved by running fleetctl get config
.
Send these guided instructions to your end users to complete the final few steps via Fleet Desktop.
Select the Fleet icon in your menu bar and select Migrate to Fleet.
Select Start in the Migrate to Fleet popup.
On your My device page, select the Turn on MDM button in the yellow banner and follow the instructions.
To see a report of which hosts have successfully migrated to Fleet, have MDM features off, or are still enrolled to your old MDM solution head to the Dashboard page by clicking the icon on the left side of the top navigation bar.
Then, scroll down to the Mobile device management (MDM) section.
Available in Fleet Premium
When migrating from a previous MDM, end users need to take action to escrow FileVault keys to Fleet. The My device page in Fleet Desktop will present users with instructions to reset their key.
To start, enforce FileVault (disk encryption) and escrow in Fleet. Learn how here.
After turning on disk encryption in Fleet, share these guided instructions with your end users.
If your old MDM solution did not enforce disk encryption, the end user will need to restart or log out of the host.
If your old MDM solution did enforce disk encryption, the end user will need to reset their disk encryption key by following the prompt on the My device page and inputting their password.
In Fleet, the Activation Lock feature is disabled by default for automatically enrolled (DEP) hosts.
If a host under the old MDM solution has Activation Lock enabled, we recommend asking the end user to follow these instructions to disable Activation Lock before migrating this host to Fleet: https://support.apple.com/en-us/HT208987.
This is because if the Activation Lock is enabled, you will need the Activation Lock bypass code to successfully wipe and reuse the Mac.
However, Activation Lock bypass codes can only be retrieved from the Mac up to 30 days after the device is enrolled. This means that when migrating from your old MDM solution, it’s likely that you’ll be unable to retrieve the Activation Lock bypass code.
If you notice something we've missed or could be improved on, please follow this link and submit a pull request to the Fleet repo.
Back to top