Skip to main content
Use Fleet Device Management actions in workflows to automate device health monitoring, security compliance checks, software inventory management, and device recovery operations.

​
Actions

Retrieves all hosts associated with a user from Fleet, returning basic host information for each device. Use this to identify user devices before performing other Fleet operations.Common use cases:
  • List all devices assigned to a user
  • Verify device ownership before granting access
  • Identify which device to target for Fleet operations
  • Gather device inventory for a user
Checks comprehensive device health metrics including battery status, disk encryption, MDM enrollment, OS updates, and uptime. Use this to ensure devices meet security and compliance requirements.Common use cases:
  • Verify security compliance before access approval
  • Check device health for troubleshooting
  • Ensure disk encryption is enabled
  • Validate MDM enrollment status
Lists all software installed on a user’s device with version information and vulnerability details. Optionally filter to show only software with known vulnerabilities for security auditing.Common use cases:
  • Audit installed software for compliance
  • Identify vulnerable applications
  • Track software inventory
  • Security risk assessment
Executes custom osquery SQL statements or predefined diagnostic queries on user devices to gather specific system information. Use this for advanced troubleshooting and system analysis.Predefined query types:
  • System information
  • OS version details
  • Logged in users
  • Running processes
  • Network interfaces
  • Disk space usage
  • Recent items
Common use cases:
  • Advanced device troubleshooting
  • Custom system information gathering
  • Security investigation queries
  • Performance diagnostics
Locks devices remotely through Fleet MDM to secure lost, stolen, or compromised devices. Returns an unlock PIN for each locked device that can be shared with the user.Input fields:
  • hosts - Array of hosts to lock (from Get User Hosts action)
Output data:
  • hosts - Array of locked hosts with their unlock PINs
Common use cases:
  • Lock lost or stolen devices immediately
  • Secure compromised devices during security incidents
  • Enforce device security policies for non-compliant devices
  • Remotely secure devices during employee offboarding
Retrieves the disk encryption key for hosts that have escrowed their encryption keys with Fleet. Use this to help users recover access to encrypted devices.Input fields:
  • hosts - Array of hosts to retrieve encryption keys for (from Get User Hosts action)
Output data:
  • hosts - Array of hosts with their encryption keys and the timestamp when the key was last updated
Common use cases:
  • Help users recover access to encrypted devices
  • Retrieve escrowed encryption keys for device recovery
  • Support disk recovery scenarios when users forget their password
Retrieves the managed local administrator password for macOS hosts from Fleet. The host must have its managed account password status set to Verified in Fleet before the password can be returned.Input fields:
  • fleetHostIds - Array of Fleet host IDs to retrieve managed account passwords for (from Get User Hosts action)
Output data:
  • hosts - Array of hosts, each with the following semantic fields populated on success:
    • EndpointManagedAccountPassword - The managed local administrator password
    • EndpointManagedAccountPasswordUpdatedAt - Timestamp when the password was last rotated in Fleet
  • Hosts that fail to return a password include an error message and skip the password fields.
Common use cases:
  • Help macOS users regain administrator access when they forget their local password
  • Support disk recovery scenarios that require a local admin login
  • Deliver a rotated admin password to a requester during endpoint troubleshooting
Last modified on September 16, 2026