Includes:
Opt-in macOS MDM
REST API and webhooks
YAML configuration
Enforce device configurations
Run MDM commands via CLI
End user transparency
Community support (MacAdmins Slack)
Self-hosted
Manage osquery at enterprise scale
Monitor query performance
REST API and webhooks
YAML configuration
Detect vulnerabilities
Software inventory
Device health report
Ship logs to Splunk, Snowflake, and more
Self-hosted
For organizations with large deployments, contact sales.
All of Free plus:
Zero-touch MDM for macOS
Windows MDM with Autopilot*
Safely execute remote scripts*
Programmable remediations*
Disk encryption key escrow
macOS update via Nudge
Remote lock and wipe
24x7 support
Self-managed or private cloud hosted
Dedicated Slack channel
End user sign-in with Okta, AD, or any IDP
Integrate with Munki, Chef, and Puppet
Enterprise-ready MDM migration
GitOps-ready
CIS for macOS and Windows
Custom vulnerability reporting
Phased rollouts (canaries)
Single-Sign On (SSO)
Version history for queries and config
Granular role-based access
Target and configure specific device groups
Programable audit log
Vulnerability scores (EPSS and CVSS)
CISA known exploited vulnerabilities
24x7 support
Self-managed or private cloud hosted
Sync user roles from Okta, AD, or any IDP
Just-in-time (JIT) provisioning
Aggregate insights for groups of devices
Agent auto-updates
Manage osquery extensions remotely
Device management |
Free | Premium |
User-initiated enrollment of macOS computers | ![]() |
![]() |
Remotely enforce macOS settings | ![]() |
![]() |
Low-level macOS MDM commands (e.g. remote restart) | ![]() |
![]() |
Native macOS update reminders | ![]() |
![]() |
Zero-touch setup for macOS computers | ![]() |
|
Safely execute custom scripts | ![]() |
|
End-user macOS update reminders (via Nudge) | ![]() |
|
Encrypt macOS hard disks with FileVault | ![]() |
|
Manage queued MDM commands on macOS* | ![]() |
|
Remotely lock and wipe macOS computers | ![]() |
|
Update apps on macOS computers* | ![]() |
|
Puppet integration | ![]() |
|
Interactive MDM migration | ![]() |
Support |
||
Public issue tracker (GitHub) | ![]() |
![]() |
Community Slack channel | ![]() |
![]() |
Unlimited email support (confidential) | ![]() |
|
Phone and video call support | ![]() |
Inventory management |
||
Secure REST API | ![]() |
![]() |
Command line tool (CLI) | ![]() |
![]() |
Realtime device inventory dashboard | ![]() |
![]() |
Browse installed software packages | ![]() |
![]() |
Search devices by IP, serial, hostname, UUID | ![]() |
![]() |
Target and configure specific groups of devices | ![]() |
|
Aggregate insights for groups of devices | ![]() |
Collaboration |
||
Shareable device health reports | ![]() |
![]() |
Versionable queries and config (GitOps) | ![]() |
![]() |
Human-to-device mapping | ![]() |
![]() |
Scope transparency | ![]() |
![]() |
Security and compliance |
||
Single sign on (SSO, SAML) | ![]() |
![]() |
Report on disk encryption status (FileVault) | ![]() |
![]() |
Audit queries and user activities | ![]() |
![]() |
Grant API-only access | ![]() |
![]() |
Role-based access control | ![]() |
![]() |
Ship logs to Splunk, Snowflake, and more | ![]() |
![]() |
Programmable audit log | ![]() |
|
Just-in-time (JIT) provisioning | ![]() |
|
Automated user role sync via Okta, AD, or any IDP | ![]() |
|
Vanta integration | ![]() |
|
Trigger a workflow based on a failing policy* | ![]() |
|
Granular role-based access control | ![]() |
Monitoring |
||
Schedule and automate custom queries | ![]() |
![]() |
Detect vulnerable software | ![]() |
![]() |
Query performance monitoring | ![]() |
![]() |
Standard query and policy library | ![]() |
![]() |
Policy and vulnerability automations (webhook, Zendesk, JIRA, ServiceNow*) | ![]() |
![]() |
Detect and surface issues with devices (policies) | ![]() |
![]() |
Mark policies as critical | ![]() |
|
Vulnerability scores (EPSS and CVSS) | ![]() |
|
CISA known exploited vulnerabilities | ![]() |
|
End-user self-service | ![]() |
Data outputs |
||
Flexible log destinations (AWS Kinesis, Lambda, GCP, Kafka) | ![]() |
![]() |
File carving (AWS S3) | ![]() |
![]() |
Deployment |
||
Self-hosted | ![]() |
![]() |
Deployment tools (Helm, Terraform) | ![]() |
![]() |
Configure osquery startup flags remotely | ![]() |
![]() |
Auto-update osquery agents | ![]() |
![]() |
Self-managed auto-update registry | ![]() |
|
Manage osquery extensions remotely | ![]() |
|
Managed Cloud | ![]() |
* Coming soon
* Coming soon
Security and compliance |
Free | Premium |
Single sign on (SSO, SAML) | ![]() |
![]() |
Report on disk encryption status (FileVault) | ![]() |
![]() |
Audit queries and user activities | ![]() |
![]() |
Grant API-only access | ![]() |
![]() |
Role-based access control | ![]() |
![]() |
Ship logs to Splunk, Snowflake, and more | ![]() |
![]() |
Programmable audit log | ![]() |
|
Just-in-time (JIT) provisioning | ![]() |
|
Automated user role sync via Okta, AD, or any IDP | ![]() |
|
Vanta integration | ![]() |
|
Trigger a workflow based on a failing policy* | ![]() |
|
Granular role-based access control | ![]() |
Monitoring |
||
Schedule and automate custom queries | ![]() |
![]() |
Detect vulnerable software | ![]() |
![]() |
Query performance monitoring | ![]() |
![]() |
Standard query and policy library | ![]() |
![]() |
Policy and vulnerability automations (webhook, Zendesk, JIRA, ServiceNow*) | ![]() |
![]() |
Detect and surface issues with devices (policies) | ![]() |
![]() |
Mark policies as critical | ![]() |
|
Vulnerability scores (EPSS and CVSS) | ![]() |
|
CISA known exploited vulnerabilities | ![]() |
|
End-user self-service | ![]() |
Inventory management |
||
Secure REST API | ![]() |
![]() |
Command line tool (CLI) | ![]() |
![]() |
Realtime device inventory dashboard | ![]() |
![]() |
Browse installed software packages | ![]() |
![]() |
Search devices by IP, serial, hostname, UUID | ![]() |
![]() |
Target and configure specific groups of devices | ![]() |
|
Aggregate insights for groups of devices | ![]() |
Collaboration |
||
Shareable device health reports | ![]() |
![]() |
Versionable queries and config (GitOps) | ![]() |
![]() |
Human-to-device mapping | ![]() |
![]() |
Scope transparency | ![]() |
![]() |
Support |
||
Public issue tracker (GitHub) | ![]() |
![]() |
Community Slack channel | ![]() |
![]() |
Unlimited email support (confidential) | ![]() |
|
Phone and video call support | ![]() |
Data outputs |
||
Flexible log destinations (AWS Kinesis, Lambda, GCP, Kafka) | ![]() |
![]() |
File carving (AWS S3) | ![]() |
![]() |
Deployment |
||
Self-hosted | ![]() |
![]() |
Deployment tools (Helm, Terraform) | ![]() |
![]() |
Configure osquery startup flags remotely | ![]() |
![]() |
Auto-update osquery agents | ![]() |
![]() |
Self-managed auto-update registry | ![]() |
|
Manage osquery extensions remotely | ![]() |
|
Managed Cloud | ![]() |
* Coming soon
* Coming soon
Is Fleet MIT licensed?
We have different licenses for portions of our software which are noted in the LICENSE file in our docs. The majority of Fleet is MIT licensed. Paid features require a license key.
What is your commitment to open source stewardship?
How do I contact Fleet for support?
Find out how to contact support in our handbook.
What if we choose not to renew?
If you opt not to renew Fleet Premium, you can continue using Fleet Community Edition (same code base, just unconfigure the license key.)
Can we buy a licence to access premium features with reduced support for a reduced cost?
We aren’t able to sell licenses and support separately.
Do you offer pricing for ephemeral hosts which may scale up or down?
For now, the number of hosts is the maximum cap of distinct agents enrolled at any given time.
When run locally, what resources does the Fleet app typically consume on an individual instance, and when run in HA, at high volume? And how is latency on an individual instance vs clustered deployment?
Like any modern application, Fleet scales horizontally. The biggest potential bottleneck for Fleet is the number of hosts being monitored, so that's where we've devoted the most attention when testing. The largest number of hosts we've had a customer ask about was 350,000, for all of the production servers and employee laptops of a publicly traded company.
Where's the data stored?
Since Fleet is self-managed, some metadata is stored wherever it is deployed (e.g. Amazon, Azure, Google, your own data center, hybrid cloud, anywhere). That's done using a MySQL database, but the bulk of the data is not stored there — instead, it flows directly into a tool like Splunk or ElasticSearch. You can send that information to any of Fleet's supported log destinations.
Can I fork Fleet's source code and build upon it myself to create my own features?
Anyone is free to fork the project. We are always interested to hear feedback, and we are happy to take pull requests and ideas upstream any time we can.
Can I buy support or services separate from Fleet Premium?
The only way we are able to partner as a business to provide support and build new open source and paid features is through customers purchasing Fleet Premium.