> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Fleet > Connect Fleet device management to Oleria to discover its users, API-only users, fleets, roles, and credentials, review its audit log, and manage users, fleets, fleet membership, and roles. Connect Fleet to Oleria to see who can administer your device fleet: which users and automation identities hold a global role or a role on a fleet, which API tokens and enroll secrets exist, and who signed in or changed access. Oleria reads this from the Fleet REST API. This integration works with self-hosted Fleet servers and Fleet-managed cloud (`https://.cloud.fleetdm.com`). One Oleria connection maps one Fleet server. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from the Fleet server: * **Users** - every Fleet user, with their global role or fleet roles, position, sign-in method (password, single sign-on, or Fleet's email-based MFA), creation date, and last activity. Users with no role are shown as disabled. Oleria treats Fleet as an MFA provider only when Fleet's own MFA can run: on Fleet Premium, with email (SMTP) configured on the server. * **API-only users** - Fleet API-only users, shown as non-human identities of type **Service account**. * **API tokens** - the token of each API-only user, as a credential linked to that user, with the date it was issued. On Fleet Premium, a token limited to specific API endpoints lists those endpoints. * **Enroll secrets** - the global enroll secret and each fleet's enroll secrets, shown as non-human identities of type **API token** with their creation dates. Oleria never reads or stores the secret values. * **Fleets** - each fleet (formerly called a team), shown as a group, with its members and each member's role. * **Roles** - the global roles (Admin, Maintainer, Observer, and on Fleet Premium Observer+, Technician, and GitOps) and the same roles on each fleet, with who holds them. * **Activity** - Fleet's audit log, including sign-ins, failed sign-ins, user creation and deletion, role changes, fleet changes, enroll secret changes, and reads of host disk encryption keys and recovery passwords. Hosts, software, policies, reports, scripts, and labels are not synced. ## Prerequisites * A Fleet server reachable over **HTTPS from the internet** at a public address. Servers that are only reachable on a private network or VPN can't be connected. * A Fleet user for Oleria. We recommend an API-only user's API token, which doesn't expire and isn't tied to a person. You can also connect with a Fleet user's email and password. The user's role sets what Oleria can do: * **Global observer** lets Oleria read users, fleets, roles, enroll secrets of fleets, and the audit log. * **Global admin** is also required to read API-only users' tokens and the global enroll secret, and to run remediation actions. * Fleet Premium for fleets, fleet roles, Fleet's email-based MFA, the Observer+, Technician, and GitOps roles, and the **Create group** action. On Fleet Free, Oleria syncs users, API-only users and their tokens, the global enroll secret, global roles, and activity. ## Create an API-only user in Fleet **1. Create the user** As a Fleet global admin, run `fleetctl user create --api-only --name "Oleria" --global-role observer` (use `admin` instead of `observer` to enable remediation actions). Fleet prints the user's API token. **2. Copy the token** Copy the token. API-only user tokens don't expire. > [!NOTE] > > You can also use the token from a person's **My account** -> **Get API token** page, but it expires with the server's session duration and ties the integration to that person. ### Use an email and password instead With **Email and password**, Oleria signs in to Fleet as that user each time it syncs. Each sign-in opens a Fleet session and adds a sign-in to Fleet's activity log. Fleet doesn't allow API sign-in for users who sign in with single sign-on or Fleet's email-based MFA, so connect those users with an API token instead. ## Connect Fleet to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **Fleet**. **2. Complete the connection form** | Field | Notes | | :- | :- | | Fleet server URL | Required. The HTTPS address of your Fleet server, for example `https://fleet.example.com` or `https://acme.cloud.fleetdm.com`. | | Authentication Method | **API token** (default) or **Email and password**. | | API token | **API token** only. The API-only user's token. | | Email | **Email and password** only. The email address of the Fleet user Oleria signs in as. | | Password | **Email and password** only. That user's password. | When you edit the integration later, leave **API token** or **Password** blank to keep the stored value. If you switch the authentication method, enter the new method's credential. **3. Authenticate** Select **Authenticate** to validate and save the integration. Oleria checks the token, or signs in with the email and password, against your Fleet server before saving. ## Verify the integration Confirm the Fleet instance appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, review the discovered users, fleets, roles, and non-human identities in your Oleria workspace. ## Remediation actions When Oleria connects as a **Global admin**, it can take the following actions: | Action | What it does | Revert | | :- | :- | :- | | Add user to group | Adds the user to the fleet with the Observer role. If the user is already a member, nothing changes. | Supported - removes the membership Oleria added. | | Remove user from group | Removes the user from the fleet. | Supported - adds the user back with their previous role. | | Add user to role | Assigns a global role, or a role on a fleet. If the user already holds that role or a broader one (Admin, then Maintainer, then Observer+, then Observer), nothing changes. Assigning a global role replaces the user's fleet roles, as Fleet requires. | Supported - restores the user's previous roles. | | Remove user from role | Removes the user's role on a fleet. | Supported - assigns the role back. | | Revoke user sessions | Signs the user out of Fleet everywhere, including any API token they copied from **My account** -> **Get API token**. | Not supported. | | Disable non-human identity | Revokes an API-only user's API token. | Not supported. A new token has to be issued in Fleet. | | Delete user | Permanently deletes the user from Fleet. If the user no longer exists, nothing changes. | Not supported. Fleet can't restore a deleted user. | | Create user | Creates a Fleet user with the name, email address, and password you provide or Oleria generates, with the Observer role on the fleets you choose, or **Global observer** if you choose none. Fleet requires the user to reset the password at first sign-in. If a user with that email address already exists, nothing changes. | Supported - deletes the user, only if Oleria created it and its email address hasn't changed. | | Create group | Creates a fleet with the name you provide. Requires Fleet Premium. If a fleet with that name already exists, nothing changes. | Supported - deletes the fleet, only if Oleria created it and it still has no users or hosts. | > [!NOTE] > > Oleria refuses to: > > * change or delete the integration's own Fleet user > * add a user who has a global role to a fleet, or give them a fleet role their global role doesn't already cover, because Fleet doesn't let a user hold a global role and a fleet role at the same time > * remove a global role, because Fleet requires every user to have a role. Assign a different role instead. > * assign a role that would replace a broader or unrelated role the user holds, such as Observer over Technician, or a global role that is narrower than one of the user's fleet roles. Remove the existing role first. > * revoke sessions of an API-only user (use **Disable non-human identity**), or disable an enroll secret ## Known limitations * **Users can't be disabled.** Fleet has no disabled state. **Delete user** removes a user's access, but it can't be undone. * **Pending invitations aren't synced.** * **Last password change isn't available.** Fleet doesn't expose it. * **MFA for single sign-on users isn't shown.** It's enforced by your identity provider. * **Enroll secrets can't be disabled.** Fleet replaces the secret list as a whole, and removing a secret breaks enrollment for installers built with it. * **The audit log's source IP is only recorded for sign-ins.** ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.