Entra conditional access for self-hosted customers

[noahtalerman]

Goal

User story
As a self-hosted Fleet customer,
I want to use Entra conditional access
so that I can block end users from logging in to third-party tools via Entra when they're failing policies in Fleet.

Changes

Product

• UI changes: Allow self-managed Fleet instances to configure Entra conditional access via Fleet's UI
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: Allow self-managed Fleet instances to configure Entra conditional access via Fleet's API
• Fleet's agent (fleetd) changes: No changes
• Fleet server configuration changes: Remove support for the current Fleet server configuration that takes the key for Entra conditional access. The Fleet server will now enforce that Fleet Premium instances only can create an Entra integration.
  • @noahtalerman: I think we can remove support instead of deprecate because this config isn't publicaly documented.
• Exposed, public API endpoint changes: No changes
• fleetdm.com changes: Entra conditional access for self-hosted customers #47702
• GitOps mode UI changes: No changes
• GitOps generation changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: Fleet Premium only
• My device and fleetdm.com/better changes: No changes
• Usage statistics: No changes
• Other reference documentation changes: No changes
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: No changes.
• Feature guide changes: No changes.
• This is a premium only feature: Yes.

Risk assessment

• Risk level: Low

Test plan

⚠️ IMPORTANT for QA ⚠️

• To be able to test this, this other item must be merged to main and Awaiting QA.
• We also need to test old Fleet server versions (<= 4.89.0) with the new version of the MS proxy (so it's backwards compatible)

Core flow

Run MS proxy locally (see Conditional access testing). The proxy should allow requests without the API key (a change that will be merged to mainas part of this story).

Premium

1. Run Fleet with FLEET_MICROSOFT_COMPLIANCE_PARTNER_PROXY_URI set to the ngrok of the local MS proxy.
2. Visit Settings > Integrations > Conditional access.
3. Microsoft Entra section should be present.
4. Configure the integration as documented in https://fleetdm.com/guides/entra-conditional-access-integration#basic-article.
5. Smoke test the conditional access feature with a macOS and a Windows host (end to end to confirm that when the hosts are failing a policy in Fleet, then they are blocked from accessing Entra resources).

Free

1. Run Fleet without any special flags.
2. Visit Settings > Integrations > Conditional access.
3. Microsoft Entra section should be missing.

Premium gating (if this is a premium-only feature)

• Verify the feature is blocked on Fleet Free in the frontend (UI hidden/disabled with appropriate messaging)
• Verify the feature is blocked on Fleet Free in the backend (API returns the expected error, not just hidden in the UI)

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan (include any special setup, test data, or configuration used during development/testing if applicable).
2. QA: Added comment to user story confirming successful completion of test plan.
3. QA: Determined whether this story needs Playwright automation.
   • Needs automation: Yes / No
   • If yes, filed a follow-up issue in the :help-qa project with status "Needs automation":

[noahtalerman]

• Fleet server configuration changes: Remove support for the current Fleet server configuration that takes the key for Entra conditional access. The Fleet server will now enforce that Fleet Premium instances only can create an Entra integration.
  • @noahtalerman: I think we can remove support instead of deprecate because this config isn't publicaly documented.

FYI @rfairburn @rachaelshaw here's where we landed. I think we target 4.89. I tracked an issue on the :help-customers board to remove the server config from cloud instances and notify self-managed customers: https://github.com/fleetdm/confidential/issues/16450

cc @lucasmrod @eashaw @ddribeiro