Entra conditional access: Windows

[zayhanlon]

Goal

User story
As an IT admin,
I want to use Entra's conditional access on my Windows hosts
so that I can block my end users from accessing corporate resources if they're failing policies (non-compliant)..

Changes

Product

• UI changes: TODO
• CLI (fleetctl) usage changes: TODO
• YAML changes: TODO
• REST API changes: TODO
• Fleet's agent (fleetd) changes: TODO
• Fleet server configuration changes: TODO
• Exposed, public API endpoint changes: TODO
• fleetdm.com changes: Implement MS proxy changes to Windows conditional access #39489
• GitOps mode UI changes: TODO
• GitOps generation changes: TODO
• Activity changes: TODO
• Permissions changes: TODO
• Changes to paid features or tiers: TODO
• My device and fleetdm.com/better changes: TODO
• Usage statistics: TODO
• Other reference documentation changes: TODO
• First draft of test plan added
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed

Engineering

• Test plan is finalized
• Contributor API changes: TODO
• Feature guide changes: TODO
• Database schema migrations: TODO
• Load testing: TODO
• Load testing/osquery-perf improvements: TODO
• This is a premium only feature: Yes / No

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires testing in a hosted environment: TODO
• Requires load testing: TODO
• Risk level: Low / High TODO
• Risk description: TODO

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

1. TODO
2. TODO
3. TODO

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

[zayhanlon]

@lucasmrod can we get a tshirt size for this issue?
@sharon-fdm FYI

[lucasmrod]

Size: M.

See implementation plan at the bottom of: https://docs.google.com/document/d/11Ws_dNjiQzIp3LsVEWpG9RjH3D6akS4PAGGc-SG9fMU/edit?tab=t.0#heading=h.3v1z5254qhm3

[sharon-fdm]

Thanks @lucasmrod.

@lukeheath — heads up that this work is estimated at Medium (2 people × 1 sprint):

• 1 person × 1 sprint from @fleetdm/orchestration
• The remaining effort is on the Website team

Please review the spec and TMWYT.

For planning purposes on the orchestration side, this should be treated as Small (1 person × 1 sprint).

cc @zayhanlon

[lukeheath]

@sharon-fdm We don't need to include website capacity in this (just Orchestration), so I'm sizing down to Small. Feel free to change if I'm incorrect.