Self-service: Allow users to install opt-in configuration profiles

[jakestenger]

Summary

Admins have no way to offer configuration profiles to end users on an opt-in basis. Today, profiles can only be pushed to hosts (enforced) or scoped to labels (still admin-controlled). There is no mechanism for a user to browse available profiles and install one themselves via Fleet Desktop's self-service interface.

Customer ask

A customer wants to deploy profiles that are optional rather than enforced — for example, privacy settings, optional VPN configurations, or accessibility configs — and let end users choose to apply them.

Proposed behavior

Configuration profiles (.mobileconfig) can be marked as self-service in the Fleet UI, similar to how software packages can be marked self-service today. Users would see available profiles in Fleet Desktop and choose to install them.

Slack Thread (no Gong recording)

https://fleetdm.slack.com/archives/C09QZ73USMB/p1774040403089049