July 2026 Summaries

Agentic security tools are increasingly being designed to triage threats and perform remediation, making the accuracy, freshness, breadth, and transparency of device inventory data central to their safe use. The piece cites Microsoft’s August 2026 preview of the MAI-Cyber-1-Flash model and Project Perception as evidence of this shift, while noting that Microsoft’s performance figures are vendor-reported. It argues that agents can act incorrectly when relying on stale or incomplete inventory, even if their reasoning is otherwise sound, and advocates on-demand, cross-platform visibility across macOS, Windows, and Linux. Fleet and its open-source fleetd agent are presented as tools for live SQL-based device queries, including identifying installed AI tools, MCP servers, permissions, exposed secrets, instruction-file risks, and network connections. The recommended operational model is read-only agent access by default, validation before queries execute, human approval for state-changing actions, and Git-based policy management so proposed changes are reviewable, auditable, and reversible.

Fleet 4.89.0 introduces significant enhancements to script-only packages, transforming them into a comprehensive lifecycle management tool for Linux software, enabling a self-service software catalog defined in Git. This update allows script-only packages to include an uninstall script, a pre-install query, and a post-install script, effectively turning them into a full-fledged package manager front end. The ability to attach a matching removal script means the same package tile used for installation can now also cleanly remove software, addressing a previous limitation. By leveraging Fleet’s GitOps integration, software management becomes auditable and reversible, with installations and removals being managed through pull requests. The update also includes automated verification to ensure installs are successful and tools for targeting specific hosts using labels, enhancing reliability across diverse environments. This framework allows for the generation of new catalog entries from a package name, streamlining the process of adding applications to the self-service page, thus providing a flexible, script-driven solution for Linux package management.

Fleet's app catalog offers a transparent and secure pipeline for managing software installations across macOS and Windows platforms, ensuring that apps are downloaded directly from official vendor sources, verified, and tested on real hardware before deployment. The system automatically updates its catalog every four hours, allowing for timely incorporation of vendor releases, while maintaining a robust validation process that involves automated testing and human review. If an update fails validation, it is held at the last successful version, preventing unverified updates from being installed. Users benefit from automated and auditable processes, with open-source scripts and pull requests available for scrutiny, along with options for version pinning and patch policies to manage updates effectively. Fleet's approach emphasizes trust and transparency by providing public access to the entire app management workflow, thereby mitigating the risks associated with software supply chain attacks.

In the realm of IT budgeting, the notion that certain services are "included" can lead to significant financial misjudgments, particularly with Microsoft's enterprise offerings. This year has seen notable changes, such as the introduction of Microsoft 365 E7, priced at $99 per user per month, and price increases across various Microsoft 365 plans. Despite perceptions of inclusivity, services like Intune, priced separately at $8 per user per month, are embedded within bundles like E3 and E5, often resulting in underutilization and wasted spend, as around 50% of E5 licenses remain inactive. Organizations are advised to make data-driven decisions rather than default choices, potentially saving substantial amounts by rightsizing licenses to better fit actual usage patterns. This involves assessing the real consumption of bundled features, individually pricing components, and using new tiers like E7 as leverage during negotiations. The article emphasizes that understanding and reassessing these bundles is crucial, as many companies are unknowingly incurring significant costs due to the "it's included" fallacy.

The Fleet roadmap for summer 2026 outlines several upcoming features and enhancements aimed at improving device management and IT governance. In the near term, Fleet plans to introduce AI governance to monitor AI tools across systems, implement patch policies with scheduling options, and enhance Windows management by creating and rotating local admin accounts. Additional updates include support for deploying configuration profiles in various formats, executing commands via the Android Management API, and managing tvOS enrollments. Improvements to iOS/iPadOS and macOS include auto-installing apps and triggering updates based on critical vulnerabilities. The roadmap also highlights the ability to create custom host vitals, label mobile devices using host attributes, and enhance software inventory management with expanded support for various applications. Looking further ahead, Fleet aims to enable Microsoft Store app deployments, leverage AI for generating reports and configuration profiles, and introduce zero-touch enrollment for Android devices. Feedback and contributions from the community are encouraged as Fleet continues to evolve its offerings.

Fleet is an open-source platform designed to enhance cross-platform visibility and control across various operating systems, including macOS, Windows, Linux, ChromeOS, iOS, and Android, within the Microsoft stack. While Microsoft's tools like Intune, Entra, and Sentinel are optimized primarily for Windows, they fall short in providing comprehensive management and compliance checks for Apple and Linux devices. Fleet addresses these gaps by offering real-time, in-depth telemetry and compliance capabilities that go beyond the fixed checklist approach of Intune. It integrates seamlessly with existing Microsoft tools, allowing IT and security teams to enforce and verify policies across all devices, ensuring that "compliant" reflects the actual security requirements. Fleet also enriches endpoint telemetry for security operations centers, supports AI governance by tracking unauthorized software, and operates via a GitOps model for versioned, reviewable, and reversible device management. This integration not only maximizes the potential of the Microsoft stack but also ensures that compliance and security standards are met across all platforms, providing a cohesive and transparent management solution.

Fleet is launching a comprehensive certification program in August to provide credentials for multi-OS device management, including Apple, Windows, and Linux, as well as GitOps practices. The program begins with three platform-specific certifications—Fleet-certified Apple, Windows, and Linux admin—each covering the comprehensive management of these operating systems. Additionally, two GitOps credentials emphasize managing devices through code and version control, marking a shift from traditional console management. These core credentials serve as prerequisites for the Fleet expert capstone exam, which proves proficiency in managing a cross-platform fleet. The core path to Fleet expert involves hands-on, in-person workshops designed to provide practical experience, while self-paced elective certifications will be available throughout the year, allowing for specialization in areas like self-managing Fleet infrastructure and developing with the Fleet API. This program aims to validate and formalize the diverse skills required for modern device management, with workshops and electives evolving alongside Fleet's offerings.

With the introduction of declarative device management (DDM), controlling beta software enrollment on Apple devices has shifted from a blunt all-or-nothing approach to a more nuanced, device-specific policy. This change allows administrators to selectively offer, block, or mandate beta program participation on a per-device basis using a JSON payload in the Fleet UI or through GitOps. The critical component of this process is obtaining beta program tokens from Apple Business, a task that is streamlined by a script published by Microsoft and HCS Technology Group, which automates the otherwise tedious manual authentication process. Once the tokens are obtained, they can be used to manage beta offerings across an organization's fleet, providing flexibility to test new software versions on specific devices without disrupting the entire network. This level of control ensures that only designated test devices receive beta updates while others remain unaffected, allowing for a more controlled and efficient testing environment.