Research: Adding iOS/iPadOS features to Fleet

[noahtalerman]

Research: Adding iOS/iPadOS features to Fleet

[noahtalerman]

Hey @sharon-fdm, I passed this research story to you.

I think we'll want to prioritize this early next sprint so that we have the research done while we start wireframes for the following story: #18119

[lukeheath]

@sharon-fdm Thanks for the heads up. I agree; I've put a P2 on this issue.

[lucasmrod]

@rachaelshaw @noahtalerman One TODO I added to the Google doc which I forgot to mention in the meeting yesterday:
With iOS/iPadOS given we have no osquery we'll have to think about the device MDM Status ("Verified", "Verifying", "Failed").

@marko-lisica: It looks like DDM can provide us such verification of profiles to us in the absence of osquery?

[marko-lisica]

@lucasmrod That's right. Fleet issue DeclerativeManagement command (regular MDM command). It tells host that there are new declarations (we organize them into declaration profiles) then hosts check-in and look for changes (new declarations, updated ones, etc.). After that host tries to apply/remove/update declarations and sends status report (DDM) back to server. If that DDM status returns success, we consider it verified.

I believe that should work the same for iOS/iPadOS.

[lucasmrod]

@noahtalerman Moving to ready for release (as the deliverable was a Google Doc)

[sharon-fdm]

Research - 3-5 points.

[sharon-fdm]

Hey @lukeheath
Just chatting with Noah. We think we need P2 on the IOS ticket since we asked Lucas to do it first. (before bugs)
TMWYT

[lucasmrod]

I've added the Google Doc link to the description.

[marko-lisica]

With iOS/iPadOS given we have no osquery we'll have to think about the device MDM Status ("Verified", "Verifying", "Failed").

@lucasmrod @rachaelshaw We use this language to describe that we use osquery for legacy profiles and to verify settings set via declaration we use DDM protocol. I think we can adjust the copy to cover the iOS use case as well.

[lucasmrod]

@marko-lisica OK cool, does Fleet already verify DDM profiles are installed?

So, users administering iOS/iPadOS devices via DDM profiles would be able to get to the "Verified" state, right?

[fleet-release]

iOS features bloom,
In Fleet's hands, devices thrive,
Secure, in cloud's room.