Device Management (MDM)
Relevant source files
The following files were used as context for generating this wiki page:
- articles/what-is-apple-mdm.md
- articles/6-business-benefits-of-apple-mdm-explained.md
- articles/declarative-device-management-a-primer.md
- tools/mdm/apple/glossary-and-protocols.md
- tools/fleet-slackbot/system-prompt.js
- handbook/company/product-maturity-assessment.md
- frontend/utilities/endpoints.ts
- server/mdm/nanomdm/README.md
Device Management (MDM) in Fleet is a multi-platform system designed to remotely configure, manage, and secure Apple (macOS, iOS, iPadOS), Windows, and Linux devices. It leverages native protocols—such as the Apple MDM protocol and Windows MDM capabilities—to enforce security policies, deploy software, and maintain device compliance at scale. Fleet integrates with enrollment services like Apple Business Manager (ABM) to facilitate zero-touch deployment and automated provisioning.
The MDM architecture focuses on three primary pillars: enrollment, configuration, and monitoring. For Apple devices, Fleet supports both traditional imperative MDM commands and the newer Declarative Device Management (DDM) protocol. This allows for a transition from a reactive command-response model to a state-based model where devices autonomously maintain their desired configuration.
Sources: articles/what-is-apple-mdm.md, articles/6-business-benefits-of-apple-mdm-explained.md, articles/declarative-device-management-a-primer.md
Architecture and Protocol Implementation
Fleet's MDM capabilities are built upon native operating system protocols. For Apple devices, the system utilizes the Apple Push Notification service (APNs) to signal devices to check in with the Fleet server. The architecture includes a check-in protocol for enrollment and eligibility validation, and a command execution protocol for delivering management payloads.
The implementation for Apple MDM utilizes NanoMDM, a minimalist MDM server integrated into Fleet. NanoMDM serves as a composable layer between HTTP handlers and storage abstractions, handling MDM requests, enrollment-certificate authorization, and API-driven command queuing.
Sources: articles/what-is-apple-mdm.md, server/mdm/nanomdm/README.md
Enrollment Workflows
Enrollment is the process by which a device becomes managed by the Fleet server. Fleet supports several enrollment types:
- Automated Device Enrollment (ADE): Leverages Apple Business Manager (ABM) to automatically enroll devices when they are first powered on (zero-touch).
- Manual Enrollment: Requires the user to download and install an enrollment profile via a URL.
- User Enrollment (BYOD): Designed for personal devices, providing cryptographic separation between work and personal data.
The following sequence diagram illustrates the Apple MDM enrollment and command flow:
The enrollment process begins with the delivery of an enrollment profile, followed by a SCEP (Simple Certificate Enrollment Protocol) flow to establish trust, and finally, the exchange of push tokens for APNs communication.
Sources: tools/mdm/apple/glossary-and-protocols.md, articles/what-is-apple-mdm.md
Declarative Device Management (DDM)
Declarative Device Management (DDM) is an evolution of the Apple MDM protocol that shifts responsibility from the server to the device. Instead of the server sending individual imperative commands, it defines a "desired state" via declarations. The device autonomously applies and maintains this state, reporting changes back to Fleet through status channels.
DDM Pillars
| Pillar | Description |
|---|---|
| Declarations | JSON payloads defining configurations (settings), assets (certificates/credentials), activations (conditional logic), and management info. |
| Status Channel | Proactive reporting where the device sends updates to the server only when a subscribed attribute (e.g., OS version) changes. |
| Extensibility | Capability awareness that allows devices and servers to negotiate support for new features independently of protocol versions. |
Sources: articles/declarative-device-management-a-primer.md, tools/mdm/apple/glossary-and-protocols.md
Configuration and Software Management
Fleet manages device state through configuration profiles and software packages. For macOS and Windows, Fleet supports native configuration formats (.mobileconfig for Apple, .xml for Windows/CSP).
Software Deployment Features
- Self-Service Portal: Allows users to install approved software from a catalog without IT tickets.
- VPP (Volume Purchase Program): Integration with Apple Business Manager to distribute App Store apps without requiring individual Apple IDs.
- Fleet-maintained apps: Pre-configured application packages provided by Fleet for standard enterprise software.
- Setup Experience: Controls the initial configuration and software installation during the device setup assistant (e.g., macOS DEP).
Sources: handbook/company/product-maturity-assessment.md, articles/6-business-benefits-of-apple-mdm-explained.md, tools/fleet-slackbot/system-prompt.js
MDM API Endpoints
The frontend communicates with MDM services via the following specialized endpoints:
| Endpoint | Method/Route | Purpose |
|---|---|---|
MDM_APPLE_ENROLL | /api/mdm/apple/enroll | Endpoint for Apple device enrollment. |
MDM_APPLE_SETUP | /latest/fleet/mdm/apple/setup | Configuration for macOS Setup Assistant. |
HOST_LOCK | /latest/fleet/hosts/:id/lock | Remotely locks a host. |
HOST_WIPE | /latest/fleet/hosts/:id/wipe | Erases all data on a device. |
MDM_PROFILES | /latest/fleet/mdm/profiles | Manages configuration profiles. |
Sources: frontend/utilities/endpoints.ts, tools/mdm/apple/glossary-and-protocols.md
Security and Compliance Enforcement
Fleet MDM provides technical enforcement of security controls required by frameworks such as SOC 2, HIPAA, and PCI-DSS. This includes:
- Disk Encryption: Managing FileVault (macOS), BitLocker (Windows), and Linux encryption keys.
- Remote Lock/Wipe: Ability to freeze or erase lost or stolen devices remotely.
- OS Updates: Enforcing deadlines for critical security patches to ensure devices do not fall behind compliance requirements.
- Restrictions: Disabling unauthorized features like USB accessories, unauthorized pairing, or modifying system settings.
Sources: articles/6-business-benefits-of-apple-mdm-explained.md, handbook/company/product-maturity-assessment.md
MDM Maturity Model
Fleet categorizes its MDM features into maturity levels to track development:
Fleet considers its Apple enrollment (ABM/DEP) to be "Complete," while Linux enrollment is "Viable." Monitoring (via osquery integration) is rated as "Lovable" due to real-time visibility.
Sources: handbook/company/product-maturity-assessment.md
Summary
Fleet's Device Management (MDM) module provides a unified interface for managing heterogeneous fleets. By combining native MDM protocols with osquery-based visibility, Fleet allows administrators to move from manual, UI-driven management to automated, GitOps-driven workflows. The adoption of Declarative Device Management represents the project's direction toward autonomous, scalable device state management, particularly for Apple ecosystems.
Sources: articles/what-is-apple-mdm.md, articles/declarative-device-management-a-primer.md