# Fleet v4.72.0

- Product: Fleet (https://whatsnew.fyi/product/fleet)
- Vendor: Fleet Device Management
- Date: 2025-08-13
- Version: v4.72.0
- Original notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.72.0
- Permalink: https://whatsnew.fyi/product/fleet/releases/v4.72.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Support issuing host identity certificates through SCEP that fleetd can use with TPM 2.0 hardware to cryptographically sign all HTTP requests
- **added** — Flag --fleet-managed-host-identity-certificate to generate fleetd packages for linux that use TPMs to sign HTTP requests
- **added** — Configuration option sso_server_url to support SSO setups with separate URLs for admin access vs agent/API access
- **added** — Support for Apple Account Driven User Enrollment for iOS/iPadOS when end user authentication is configured
- **added** — Support for MS-MDE2 v7.0 Windows MDM Enrollments
- **added** — Fleet-maintained apps for macOS: iTerm2, Yubikey Manager, VNC Viewer, Beyond Compare
- **added** — Show installer status and installer actions on host details software library page and Fleet Desktop Self-service page based on detected software inventory
- **added** — Show when software can be updated on host details software library page and Fleet Desktop Self-service page, allowing users to trigger updates and see fresh data
- **added** — Support for fleetd TUF extensions on Linux arm64 and Windows arm64 devices
- **changed** — Retain last install information for VPP apps reported by osquery when viewed in host software library
- **changed** — Switch to UpgradeCode based uninstall scripts when an UpgradeCode can be extracted from an MSI custom package
- **changed** — Add fallback to package install path for extracting app names from uploaded PKG packages
- **changed** — Add special handling for version extraction of Fleet-maintained app manifests that reference a download URL that isn't version-pinned
- **changed** — Change enable_software_inventory to default to true if missing from gitops config
- **changed** — Update backend for GET /api/v1/fleet/commands when filtering by host_identifier to address performance concerns and database connection exhaustion
- **changed** — Remove DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions
- **changed** — Revise MSI uninstall scripts to wait for uninstall completion before returning and avoid restarting after uninstall
- **changed** — Update Go to 1.24.6
- **fixed** — SSO authentication errors for organizations using dual URL configurations
- **fixed** — Accuracy of auto-install queries for custom MSI packages by using a better identifier
- **fixed** — Race condition in AddHostsToTeam method introduced by global var
- **fixed** — Label created_at no longer factored in when scoping software packages by exclude any manual labels
- **fixed** — Package ids ordering causing software installers' scripts to be inconsistently generated
- **fixed** — Incorrectly displayed status in controls OS Settings page if a host was only pending or failing on declaration for removal
- **fixed** — Bug with mdm_bridge Orbit table that caused panics due to invalid COM initialization
- **fixed** — Certificate Distinguished Name parser did not allow forward slashes in the value which resulted in parsing error
- **fixed** — Detected date for software vulnerabilities not being pulled correctly from the database
- **fixed** — Missing empty host lists on manual labels in gitops
- **fixed** — Issue where two banners would sometimes be displayed on the host details page
- **fixed** — Missing webhook url in automations tooltip
- **fixed** — Using ESCAPE in a LIKE clause caused SQL validation to fail
- **fixed** — Error when trying to escrow a linux disk key multiple times
- **fixed** — Silent failure when passing flags after arguments in fleetctl
- **fixed** — Wrongly formatted URL for EULA when accessing from Fleet UI and in the iFrame for SSO callback
- **fixed** — Stale pending remove apple declarations if the host was offline while adding and removing the same declaration
- **fixed** — Vulnerability showing up twice for a given operating system
- **fixed** — Specification of policy software automations via GitOps when referring to software by hash from a software YAML file
- **fixed** — Vulnerabilities list endpoint counting the same CVE multiple times for the count field
- **fixed** — SSO URLs with trailing slashes causing authentication failures due to double slashes in the ACS URL
- **fixed** — DEP sync errors such as 404 from the DEP API resulting in devices never being assigned a cloud configuration profile
- **fixed** — Server panic when listing software titles for All teams with page containing a software title with a policy automation in No team

##### Fleet 4.72.0 (Aug 13, 2025)

###### Security Engineers
- Added support for issuing host identity certificates through SCEP (Simple Certificate Enrollment Protocol) that `fleetd` can use with TPM 2.0 hardware to cryptographically sign all HTTP requests.
- Added flag `--fleet-managed-host-identity-certificate` to generate `fleetd` packages for linux that use TPMs to sign HTTP requests.
- Added `sso_server_url` configuration option to support SSO setups with separate URLs for admin access vs agent/API access. When set, SSO authentication will only work from the specified URL. This fixes SSO authentication errors for organizations using dual URL configurations.

###### IT Admins
- Added support for Apple Account Driven User Enrollment for iOS/iPadOS when end user authentication is configured.
- Added support for MS-MDE2 v7.0 Windows MDM Enrollments.
- Added the following Fleet-maintained apps for macOS: iTerm2, Yubikey Manager, VNC Viewer, Beyond Compare. 
- On the host details > software > library page and Fleet Desktop > Self-service page, show installer status and installer actions based on what software is detected in software inventory.
- On the host details > software > library page and Fleet Desktop > Self-service page, show user's when a software can be updated, allowing users to easily trigger a software update and see fresh data after an update completes.
- Updated VPP apps reported by osquery to retain their last install information when viewed in host software library.
- Switched to more comprehensive `UpgradeCode` based uninstall scripts when an `UpgradeCode` can be extracted from an MSI custom package.

###### Other improvements and bug fixes
- Added support for `fleetd` TUF extensions on Linux arm64 and Windows arm64 devices.
- Added a fallback to package install path for extracting app names from uploaded PKG packages.
- Added special handling for version extraction of Fleet-maintained app manifests that reference a download URL that isn't version-pinned.
- Improved `fleetctl gitops` type error mesages.
- Improved accuracy of auto-install queries for custom MSI packages by using a better identifier.
- Label created_at no longer factored in when scoping software packages by "exclude any" manual labels.
- Refactored `AddHostsToTeam` method to fix race condition introduced by global var.
- Changed `enable_software_inventory` to default to true if missing from gitops config.
- Modified backend for `GET /api/v1/fleet/commands` when filtering by `host_identifier` to address performance concerns and exhausting database connections when API is called concurrently for many hosts.
- Allowed users of Fleet in Primo mode to access Software automations and failing policy ticket & webhook automations.
- Update UI to support personally enrolled MDM devices.
- Removed DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions (e.g. Ubuntu for an RPM).
- Revised MSI uninstall scripts to wait for an uninstall to complete before returning and avoid restarting after an uninstall.
- Added back software mutation on ingestion to fix non-semver-compliant software versions, starting with DCV Viewer.
- Increased timeouts on `/fleet/mdm/profiles/batch` to better support customer workflows with large numbers of profiles.
- Made consistent and update the Install and Uninstall detail modals for VPP and non-VPP apps across the Fleet UI.
- Updated go to 1.24.6.
- Fixed issue with package ids ordering causing software installers' scripts to be inconsistently generated.
- Fixed incorrectly displayed status in controls OS Settings page, if a host was only pending or failing on declaration for removal.
- Fixed bug with `mdm_bridge` Orbit table that caused panics due to invalid COM initialization.
- Fixed bug where a certificate Distinguished Name (DN) parser did not allow forward slashes in the value which resulted in parsing error.
- Fixed an issue where the detec

_[Truncated at 4000 characters — full notes: https://github.com/fleetdm/fleet/releases/tag/fleet-v4.72.0]_