Register for part 2 of our Device Identity Webinar Series!

Connect Fleet DM to Smallstep

Smallstep can integrate with Fleet DM to deploy certificates to your Fleet-managed devices.

In this document, we will configure your Fleet instance for use with your Smallstep team.

Requirements

You will need:

Client requirements:

  • For enrollment, devices must be MDM-enrolled in Fleet
  • The Smallstep agent will need to reach the following domains: 
    smallstep.com
api.smallstep.com
gateway.smallstep.com
control.infra.smallstep.com
*.[team-name].ca.smallstep.com
auth.smallstep.com
att.smallstep.com
tel.smallstep.com

Supported platforms:

  • macOS — Smallstep agent and osquery extension for full device identity sync, with configuration provided through a .mobileconfig profile
  • Linux (via agent software deployment)
  • Windows Pro or Enterprise — Fleet does not yet support its native Smallstep CA type on Windows, so Windows enrollment goes through Smallstep's NDES-compatible endpoints, configured in Fleet as a Dynamic SCEP CA.

macOS

macOS enrollment combines two pieces:

  • A .mobileconfig profile, generated by Smallstep and imported into Fleet, that bootstraps the Smallstep agent, which then takes over enrollment.
  • The Smallstep osquery extension registers additional device identity information directly in Fleet, for a richer device inventory and seamless enrollment experience.

Step 1. Get a Fleet API token

Smallstep needs a Fleet API token to sync your device inventory. You can use a personal API token for testing, or create a dedicated API-only user for production use.

Option A: Use a personal API token

  1. In Fleet, click your profile icon in the top right and select My account
  2. Click Get API token
  3. Copy the token — you'll need it for the next step

Option B: Create an API-only user (recommended for production)

For production use, we recommend creating a dedicated API-only user for the Smallstep integration rather than using a personal account token. An API-only user cannot log into the Fleet UI and is intended for automated integrations.

You'll need the fleetctl CLI tool installed and authenticated with admin privileges.

  1. Configure fleetctl with your Fleet server address:

    fleetctl config set --address 'https://fleet.example.com'

  2. Log in with your admin credentials:

    fleetctl login

  3. Create the API-only user:

    fleetctl user create --name 'Smallstep' \
  --email 'smallstep-api@example.com' \
  --password 'your-secure-password' \
  --api-only

  4. The command will output an API token:

    Success! The API token for your new user is: <TOKEN>

    Copy this token — you'll need it for the next step.

The default role for API-only users is Observer, which grants read-only access to hosts and device information. This is the appropriate permission level for Smallstep device sync.

Step 2. Create a Smallstep enrollment report in Fleet

Create a Fleet report to collect the enrollment data. Smallstep reads this report during device sync to include additional device identity details alongside the standard Fleet device inventory.

  1. In Fleet, go to Reports

  2. Ensure All Fleets is active. If not, the report won't apply to all your hosts.

  3. Click Add report

  4. Enter the following query:

    SELECT * FROM smallstep_enrollment;

  5. Click Save; a modal should appear

  6. In the modal, enter the following details:

  • A Name for the query, such as "Smallstep Enrollment"
  • Optionally, a Description
  • The Interval can be set to Every hour. While testing, a shorter interval is helpful
  • Optionally, enable the Observers can run checkbox
  • Enable macOS as Target
  • Select All hosts
  1. Click Save
  2. Note the numeric ID of the Smallstep enrollment report that was just created

Step 3. Connect Fleet to Smallstep

Now you'll add your Fleet API credentials to Smallstep.

  1. In the Smallstep console, go to Settings → Device Management
  2. Under Available Providers, find Fleet and click Connect
  3. Fill in the fields:
    • Name/Alias: An optional identifier for this connection (for example, Production Fleet)
    • API Base URL: Your Fleet server URL (for example, https://fleet.example.com)
    • API Token: Paste the API token from the previous step
    • Enrollment Query ID: The numeric ID of the Fleet enrollment report from the previous step
  4. Click Connect MDM
  5. After connecting, temporarily save the following values:
    • Under Authority Certificates, download the Root CA certificate.

Within a few minutes, you will see your Fleet devices in the Devices tab. Your Smallstep device inventory syncs from Fleet approximately every eight hours.

Step 4. Download the configuration profile

Fleet deploys certificates and configuration to devices using a configuration profile. You can download this from the Smallstep dashboard and upload it to Fleet. No need to build the payloads or paste certificate data by hand.

  1. In the Smallstep console, go to Settings → Device Management
  2. Open your Fleet connection, then choose the Settings tab
  3. Under Configuration Profile (macOS only), click Download to save the profile. The downloaded file is named fleet-<connection-id>.mobileconfig.

The downloaded profile bundles everything required to enroll a device: your root and intermediate CA certificates, the Smallstep agent settings, and the Login Items entry for the agent.

Step 6. Upload the configuration profile to Fleet

  1. In the Fleet console, go to Controls → OS settings → Configuration profiles
  2. Click Add profile
  3. Upload the fleet-<connection-id>.mobileconfig file you downloaded in the previous step
  4. Scope the profile to the teams or labels containing your macOS hosts

The profile will be deployed to devices at their next MDM check-in.

Step 7. Deploy the Smallstep agent

The macOS Smallstep agent picks up the configuration that Fleet deployed to the device, and uses it to register the device with Smallstep.

Deploy the agent using Fleet's software deployment feature:

  1. Download the latest macOS package: step-agent_latest.pkg (all versions)
  2. In Fleet, go to Software, choose Custom Package, and add the package
  3. Scope the software install to your macOS hosts

Alternatively, you can use a separate software management system such as Munki to deploy the agent. See the Smallstep Agent manual installation guide for detailed instructions.

Step 8. Deploy the osquery extension

Smallstep provides an osquery extension that registers additional device identity information directly in Fleet. When Smallstep syncs your device inventory from Fleet, it reads this data to enable a seamless enrollment experience on macOS.

  1. Download the step-agent-osquery package for macOS from Smallstep's releases.
  2. In Fleet, go to Software
  3. Click Add software. Ensure a fleet is selected; software is configured per-fleet
  4. Select Custom package
  5. Click Choose file, and select the step-agent-osquery package that was downloaded before
  6. Enable Deploy
  7. Click Add software.

A modal should appear, showing the package upload progress.

After upload, a Fleet policy is created that automatically triggers package installation if the package is not yet installed.

See https://fleetdm.com/guides/deploying-custom-osquery-extensions-in-fleet-a-step-by-step-guide for additional guidance and some troubleshooting options when deploying osquery extensions.

Alternatively, you can use a separate software management system such as Munki to deploy the osquery extension.

Step 9. Confirmation

To confirm certificate deployment:

  1. In the Fleet console, go to Hosts and select a macOS device that received the profile
  2. Check the OS settings status to verify the profile was applied successfully
  3. In the Smallstep console, go to Devices and confirm the device is enrolled with a certificate

On the device itself:

  • Check the output of /Applications/SmallstepAgent.app/Contents/MacOS/SmallstepAgent status

Linux

Linux does not support MDM configuration profiles, so the SCEP flow used for Apple and Windows devices does not apply. Instead, the Smallstep agent on Linux registers directly with your Smallstep team using TPM attestation. There is no certificate authority to configure in Fleet — you only need to deploy and configure the agent.

Step 1. Deploy the Smallstep agent

You'll add a Linux agent package to Fleet and attach a post-install script that writes the agent configuration and starts the service.

Pick the packages for your Linux distributions and architectures:

When adding the package in Fleet (Software → Add software → Custom package), attach this post-install script:

#!/bin/bash

# Configure the Smallstep agent
mkdir -p /etc/step-agent
cat > /etc/step-agent/agent.yaml << EOF
team: "<your-team-slug>"
fingerprint: "<your-agents-ca-fingerprint>"
EOF

# Enable and start the agent service
systemctl daemon-reload
systemctl enable --now step-agent

Replace <your-team-slug> with your Smallstep team slug (found in Settings → Team), and <your-agents-ca-fingerprint> with the SHA-256 root fingerprint of your Smallstep Agents authority (found in Certificate Manager → Authorities under the Agents authority).

If your fleet includes multiple Linux distributions or architectures, create separate software entries for each package variant. Use Fleet labels to target .deb packages to Debian/Ubuntu hosts and .rpm packages to RHEL/Fedora hosts. See the GitOps section for a complete example with label targeting.

Step 2. Deploy the osquery extension on Linux

Smallstep provides an osquery extension that registers additional device identity information, including the TPM Endorsement Key (EK)—directly in Fleet. When Smallstep syncs your device inventory from Fleet, it reads this data to enable a more seamless enrollment experience on Linux.

  1. Download the step-agent-osquery package for your Linux distribution and target architecture from Smallstep's releases.
  2. In Fleet, go to Software
  3. Click Add software. Ensure a fleet is selected; software is configured per-fleet
  4. Select Custom package
  5. Click Choose file, and select the step-agent-osquery package that was downloaded before
  6. Enable Deploy
  7. Click Add software.

A modal should appear, showing the package upload progress.

After upload, a Fleet policy is created that automatically triggers package installation if the package is not yet installed. This policy has no minimum version requirement—any version of step-agent-osquery is accepted. To force a new package version to be installed, upload the package to Fleet and edit the policy to include a condition like and version >= '0.65.1-1'.

See https://fleetdm.com/guides/deploying-custom-osquery-extensions-in-fleet-a-step-by-step-guide for additional guidance and some troubleshooting options when deploying osquery extensions.

Step 3. Create a Smallstep enrollment report in Fleet

Once the extension is active on your Linux devices, create a Fleet report to collect the enrollment data. Smallstep reads this report during device sync to include the TPM EK and other enrollment details alongside the standard Fleet device inventory.

  1. In Fleet, go to Reports

  2. Ensure All Fleets is active. If not, the report won't apply to all your hosts.

  3. Click Add report

  4. Enter the following query:

    SELECT * FROM smallstep_enrollment;

  5. Click Save; a modal should appear

  6. In the modal, enter the following details:

  • A Name for the query, such as "Smallstep Enrollment"
  • Optionally, a Description
  • The Interval can be set to Every hour. While testing, a shorter interval can be helpful
  • Optionally, enable the Observers can run checkbox
  • Enable Linux as Target
  • Select All hosts
  1. Click Save

Once the enrollment report is configured in Fleet, the Smallstep platform needs to know about its existence, so that it can gather the data reported through it.

  1. Note the numeric ID of the Smallstep enrollment report that was just created
  2. In the Smallstep console, edit your Fleet configuration
  3. Set the Enrollment Query ID to the numeric ID

Your fleet's TPM information will begin syncing to Smallstep.

Step 5. Linux agent configuration

Linux does not support MDM configuration profiles, so the SCEP enrollment flow used for macOS and Windows does not apply. Instead, the Smallstep agent on Linux uses ACME Device Attestation with the system's TPM.

After installing the agent package and the osquery extension, you must configure the agent with your Smallstep team slug and CA fingerprint.

When adding a Linux agent package in Fleet, add the following post-install script to configure and start the agent:

#!/bin/bash

# Configure the Smallstep agent
mkdir -p /etc/step-agent
cat > /etc/step-agent/agent.yaml << EOF
team: "<your-team-slug>"
fingerprint: "<your-agents-ca-fingerprint>"
EOF

# Enable and start the agent service
systemctl daemon-reload
systemctl enable --now step-agent

When the agent starts, it attests with the endpoint's TPM. Smallstep matches the attestation to the inventory data you just synced. By default, devices synced from Fleet need admin approval: if the host shows as pending in the Smallstep console, approve it there.

To approve Fleet-synced devices automatically, add Fleet to autoApproveSources in your team's device enrollment policy. This setting isn't exposed in the Smallstep console. Use the Device Enrollment Policy API with an API token that has the get-device-enrollment-policy and put-device-enrollment-policy scopes. The PUT replaces the whole policy, so fetch the current policy first and resubmit it with Fleet added to autoApproveSources:

set +o history
echo "Authorization: Bearer [your API token]" > api_headers
set -o history

# Fetch the current policy
curl -sH @api_headers --request GET \
  --url https://gateway.smallstep.com/api/device-enrollment-policy \
  --header 'Accept: application/json' \
  --header 'x-smallstep-api-version: 2026-05-01' | jq

# Resubmit it with Fleet in autoApproveSources.
# Adjust both lists to match the policy you fetched.
curl -sH @api_headers --request PUT \
  --url https://gateway.smallstep.com/api/device-enrollment-policy \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'x-smallstep-api-version: 2026-05-01' \
  --data '{
    "allowedSources": ["Smallstep API", "Smallstep Agent", "Fleet"],
    "autoApproveSources": ["Fleet"],
    "requireUserBinding": true
  }' | jq

Step 6. Confirmation (Linux)

On a Fleet-enrolled Linux host:

  1. Verify the agent service is running:

    sudo systemctl status step-agent

  2. Confirm certificate files are present under /var/lib/step-agent

  3. In the Smallstep console, check Devices for the host. Approve it if approval is required.

  4. In the Smallstep console, check Certificate Manager → Inventory for a freshly issued certificate matching the device

Windows

The Smallstep agent on Windows registers directly with your Smallstep team using TPM attestation. There is no certificate authority to configure in Fleet — you only need to deploy and configure the agent.

Step 1. Deploy the osquery extension on Windows

Smallstep provides an osquery extension that registers additional device identity information, including the TPM Endorsement Key (EK)—directly in Fleet. When Smallstep syncs your device inventory from Fleet, it reads this data to enable a more seamless enrollment experience on Windows.

The osquery extension can be installed by distributing the MSI to your devices, or by distributing it through a custom TUF auto-update server.

MSI

NOTE: the osquery extension MSI distribution is currently work in progress.

  1. Download the step-agent-osquery.ext.exe MSI for your Windows target architecture(s) from Smallstep's releases
  2. In Fleet, go to Software
  3. Click Add software. Ensure a fleet is selected; software is configured per-fleet
  4. Select Custom package
  5. Click Choose file, and select the step-agent-osquery MSI that was downloaded before
  6. Enable Deploy
  7. Click Add software.

A modal should appear, showing the upload progress.

After upload, a Fleet policy is created that automatically triggers package installation if the package is not yet installed. This policy has no minimum version requirement; any version is accepted. To force a new package version to be installed, upload the package to Fleet and edit the policy to include a condition like and version >= '0.65.1-1'.

See https://fleetdm.com/guides/deploying-custom-osquery-extensions-in-fleet-a-step-by-step-guide for additional guidance and some troubleshooting options when deploying osquery extensions.

The Update Framework (TUF) auto-update server

  1. Download the step-agent-osquery.ext.exe binary for your Windows target architecture(s) from Smallstep's releases
  2. Upload the binary to your TUF server
  3. Configure the extensions under agent_options in Fleet to include the step-agent-osquery.ext.exe binaries for your Windows target architecture(s)

See https://fleetdm.com/docs/configuration/agent-configuration#extensions for more information on how to configure extensions through TUF.

Step 2. Create a Smallstep enrollment report in Fleet

Once the extension is active on your Windows devices, create a Fleet report to collect the enrollment data. Smallstep reads this report during device sync to include the TPM EK and other enrollment details alongside the standard Fleet device inventory.

  1. In Fleet, go to Reports

  2. Ensure All Fleets is active. If not, the report won't apply to all your hosts.

  3. Click Add report

  4. Enter the following query:

    SELECT * FROM smallstep_enrollment;

  5. Click Save; a modal should appear

  6. In the modal, enter the following details:

  • A Name for the query, such as "Smallstep Enrollment"
  • Optionally, a Description
  • The Interval can be set to Every hour. While testing, a shorter interval can be helpful
  • Optionally, enable the Observers can run checkbox
  • Enable Windows as Target
  • Select All hosts
  1. Click Save
  2. Note the numeric ID of the Smallstep enrollment report that was just created

Step 3. Configure the Smallstep agent via a PowerShell script

The Windows Smallstep agent reads its configuration from HKLM:\Software\Policies\Smallstep. Fleet does not have native registry-management, so we set those values with a PowerShell script run by Fleet's Scripts feature.

The agent needs three values:

  • TeamSlug — your Smallstep team slug (found in Settings → Team)
  • CAFingerprint — the SHA-256 root fingerprint of your Smallstep Agents authority (found in Certificate Manager → Authorities under the Agents authority)

Save the following as smallstep-agent-config.ps1, replacing <team-slug> and <team-name> with your values:

$RegistryPath = "HKLM:\Software\Policies\Smallstep"

If (-NOT (Test-Path $RegistryPath)) {
    New-Item -Path $RegistryPath -Force | Out-Null
}

Set-ItemProperty -Path $RegistryPath -Name "TeamSlug"      -Value "<team-slug>"
Set-ItemProperty -Path $RegistryPath -Name "CAFingerprint" -Value "<agents-authority-root-sha256-fingerprint>"

Upload the script to Fleet and run it against your Windows hosts:

  1. In the Fleet console, go to Controls → Scripts
  2. Click Upload script and select smallstep-agent-config.ps1
  3. Scope or target the script to your Windows hosts and run it

For self-healing enforcement, you can pair this with a policy automation that checks whether the registry values exist and re-runs the script if they're missing — Fleet documents this pattern in Prevent tampering of Fleet Orbit.

Step 4. Connect Fleet to Smallstep

  1. In the Smallstep console, go to Settings → Device Management
  2. Under Available Providers, find Fleet and click Connect
  3. Fill in the fields:
    • API Base URL: Your Fleet server URL (for example, https://fleet.example.com)
    • API Token: Paste the API token from the previous step
    • Name/Alias: An optional identifier for this connection (for example, Production Fleet)
    • Enrollment Query ID: The numeric ID of the Fleet enrollment report
  4. Click Connect MDM
  5. After connecting, temporarily save the following values:
    • Under Authority Certificates, copy the SHA256 fingerprint of the Agents Root CA certificate.

Within a few minutes, you will see your Fleet devices in the Devices tab. Your Smallstep device inventory syncs from Fleet approximately every four hours.

Step 5. Deploy the Smallstep agent

Add the Smallstep agent MSI as Fleet software so it installs on enrollment:

  1. Download the agent:
  2. In the Fleet console, go to Software, choose Add software → Custom package, and upload the MSI
  3. Scope the install to your Windows hosts

On startup, the agent reads the registry values to find the team information, then attests with the endpoint's TPM. Smallstep matches the attestation to the inventory data synced from Fleet.

By default, devices synced from Fleet need admin approval: if the host shows as pending in the Smallstep console, approve it there. To approve Fleet-synced devices automatically, add Fleet to autoApproveSources in your team's device enrollment policy. This setting isn't exposed in the Smallstep console. Use the Device Enrollment Policy API with an API token that has the get-device-enrollment-policy and put-device-enrollment-policy scopes. The PUT replaces the whole policy, so fetch the current policy first and resubmit it with Fleet added to autoApproveSources:

set +o history
echo "Authorization: Bearer [your API token]" > api_headers
set -o history

# Fetch the current policy
curl -sH @api_headers --request GET \
  --url https://gateway.smallstep.com/api/device-enrollment-policy \
  --header 'Accept: application/json' \
  --header 'x-smallstep-api-version: 2026-05-01' | jq

# Resubmit it with Fleet in autoApproveSources.
# Adjust both lists to match the policy you fetched.
curl -sH @api_headers --request PUT \
  --url https://gateway.smallstep.com/api/device-enrollment-policy \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header 'x-smallstep-api-version: 2026-05-01' \
  --data '{
    "allowedSources": ["Smallstep API", "Smallstep Agent", "Fleet"],
    "autoApproveSources": ["Fleet"],
    "requireUserBinding": true
  }' | jq

Step 6. Confirmation (Windows)

On a Fleet-enrolled Windows test host:

  1. Trigger a sync: either reboot, or run gpupdate /force then wait for the MDM scheduler, or use the Sync button on the device under Settings → Accounts → Access work or school

  2. Open certlm.msc (local machine, since this profile uses Device scope)

  3. Under Personal → Certificates, confirm a certificate issued by your Smallstep Agents Intermediate CA with CN=<tpm-ek-uri>

  4. Under Trusted Root Certification Authorities → Certificates, confirm the Smallstep Agents Root CA is present

  5. Confirm the registry values were written:

    Get-ItemProperty -Path HKLM:\Software\Policies\Smallstep

  6. Confirm the agent service is running:

    sc query "Smallstep Agent"

  7. In the Smallstep console, check Certificate Manager → Inventory for a freshly issued certificate matching the device, and confirm the device appears in Devices with an Enrolled At timestamp.

If enrollment fails, check Fleet's host detail page for profile errors and Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin on the host for the underlying CSP error.

GitOps with fleetctl

As an alternative to configuring Fleet through the UI, you can manage your entire Fleet configuration with YAML files and the fleetctl gitops command. This approach is ideal for version-controlled, repeatable deployments.

Directory layout

A typical GitOps repository for Fleet looks like this:

fleet-gitops/
├── default.yml
├── teams/
│   └── team.yml
└── lib/
    ├── fleet-<connection-id>.mobileconfig
    └── smallstep-agent-setup.sh
  • default.yml — Organization-wide settings, including certificate authorities
  • teams/team.yml — Per-team configuration for profiles, software, and queries
  • lib/ — Configuration profile files and Linux agent setup script

Add the certificate authorities

In default.yml, declare the Smallstep CA (Apple) under org_settings:

org_settings:
  certificate_authorities:
    smallstep:
      - name: SMALLSTEP_AGENT
        url: <SCEP URL from Smallstep Fleet connector>
        challenge_url: <SCEP Challenge URL from Smallstep Fleet connector>
        username: $SMALLSTEP_CHALLENGE_USERNAME
        password: $SMALLSTEP_CHALLENGE_PASSWORD

Omit the block you don't need if you're only targeting one OS family.

Set the credential environment variables before running fleetctl gitops:

export SMALLSTEP_CHALLENGE_USERNAME='your-challenge-username'
export SMALLSTEP_CHALLENGE_PASSWORD='your-challenge-password'

Add configuration profiles

Download the configuration profile for your Fleet connection from the Smallstep dashboard, as described in Step 5 of the macOS section above, and place the fleet-<connection-id>.mobileconfig file in your lib/ directory. Then reference it from your team YAML file:

controls:
  macos_settings:
    custom_settings:
      - path: ../lib/fleet-<connection-id>.mobileconfig

Add the Smallstep agent software

In the same team YAML file, add the Smallstep agent packages:

software:
  packages:
    - url: https://packages.smallstep.com/stable/darwin/step-agent_latest.pkg
    - url: https://packages.smallstep.com/stable/windows/step-agent_amd64_latest.msi
    - url: https://packages.smallstep.com/stable/linux/step-agent_amd64_latest.deb
      post_install_script:
        path: ../lib/smallstep-agent-setup.sh
    - url: https://packages.smallstep.com/stable/linux/step-agent_x86_64_latest.rpm
      post_install_script:
        path: ../lib/smallstep-agent-setup.sh

If your Linux fleet includes multiple architectures, add entries for each variant and use labels_include_any to target the correct package to each host:

    - url: https://packages.smallstep.com/stable/linux/step-agent_amd64_latest.deb
      post_install_script:
        path: ../lib/smallstep-agent-setup.sh
      labels_include_any:
        - Ubuntu Linux
    - url: https://packages.smallstep.com/stable/linux/step-agent_arm64_latest.deb
      post_install_script:
        path: ../lib/smallstep-agent-setup.sh
      labels_include_any:
        - Ubuntu Linux
    - url: https://packages.smallstep.com/stable/linux/step-agent_x86_64_latest.rpm
      post_install_script:
        path: ../lib/smallstep-agent-setup.sh
      labels_include_any:
        - RedHat Linux
    - url: https://packages.smallstep.com/stable/linux/step-agent_aarch64_latest.rpm
      post_install_script:
        path: ../lib/smallstep-agent-setup.sh
      labels_include_any:
        - RedHat Linux

Adapt the label names to match your Fleet label configuration. Fleet includes built-in labels for common Linux distributions. For architecture-specific targeting, you can create custom labels using osquery queries (for example, SELECT 1 FROM system_info WHERE cpu_type = 'x86_64').

The PowerShell registry script above is run from the Fleet UI rather than GitOps. If you want it under version control, manage it through Fleet's scripts API.

Add the enrollment query

Add the Smallstep enrollment query to your team YAML. Fleet will collect results from all hosts on a schedule and expose them as a report:

queries:
  - name: Smallstep enrollment
    description: Collects Smallstep enrollment data for device identity sync
    query: SELECT * FROM smallstep_enrollment;
    interval: 3600
    platform: darwin,linux,windows
    automations_enabled: true
    logging: snapshot
    discard_data: false

The smallstep_enrollment table is provided by the Smallstep osquery extension, which runs on macOS, Linux, and Windows. Restrict the platform list to the operating systems you deploy the extension to.

Apply the configuration

Run fleetctl gitops to apply the configuration:

fleetctl gitops -f default.yml -f teams/team.yml

Use --dry-run to validate your configuration before applying:

fleetctl gitops -f default.yml -f teams/team.yml --dry-run

The --dry-run flag is useful for CI pipelines. You can run it on pull requests to validate configuration changes before merging.

Last updated on September 8, 2026

Integrate Fleet DM with Smallstep Tutorial | Smallstep