Website: don't require an API key on Microsoft compliance proxy requests

[lucasmrod]

Related issue: Resolves #47699

Testing

• QA'd all new/changed functionality manually

What & why

Entra conditional access is becoming available to self-hosted Fleet Premium instances, which don't have the shared MS-API-KEY that cloud-managed customers use. This makes the microsoft-proxy/* endpoints reachable without that key by dropping the is-cloud-customer policy gate (and the now-unused shared-secret config comments / policy file).

A replacement auth mechanism for the proxy is tracked separately in #47702.

Split out of #49414 so the website change can ship independently.

Summary by CodeRabbit

• Changes
  • Updated Microsoft proxy access handling so requests no longer require cloud-customer verification.
  • Removed the associated shared-secret configuration settings.

[Copilot]

Pull request overview

Updates the Fleet website (Sails) policy configuration for the Microsoft compliance proxy so self-hosted Fleet Premium instances can use the proxy endpoints without requiring the shared MS-API-KEY header, and removes now-unused shared-secret configuration comments/policy.

Changes:

• Removes the is-cloud-customer policy gate from microsoft-proxy/* routes.
• Deletes the is-cloud-customer policy implementation and removes unused shared-secret config comments.
• Keeps the Microsoft compliance proxy endpoints reachable without a website session.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
website/config/policies.js	Makes microsoft-proxy/* requests bypass the default is-logged-in policy.
website/config/custom.js	Removes obsolete commented config entries for shared secrets.
website/api/policies/is-cloud-customer.js	Deletes the no-longer-used policy that validated MS-API-KEY.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d3898050-b7ee-4c62-a58d-149c76265eef

📥 Commits

Reviewing files that changed from the base of the PR and between 01bb250 and 820668c.

📒 Files selected for processing (3)

• website/api/policies/is-cloud-customer.js
• website/config/custom.js
• website/config/policies.js

💤 Files with no reviewable changes (2)

• website/api/policies/is-cloud-customer.js
• website/config/custom.js

---

Walkthrough

The Microsoft proxy route policy is changed from is-cloud-customer validation to an unconditional bypass. The obsolete commented shared-secret configuration fields for the compliance proxy are removed.

Possibly related issues

• fleetdm/fleet#47702: Directly tracks removing the Microsoft proxy shared-secret check.

Possibly related PRs

• fleetdm/fleet#49414: Also removes Microsoft proxy shared-secret gating and changes access control to Fleet Premium licensing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the main change: removing the API key requirement for Microsoft compliance proxy requests.
Description check	✅ Passed	The description includes the related issue, testing, and a clear what/why summary, which matches the template well.
Linked Issues check	✅ Passed	The changes satisfy the issue's coding objective by allowing Microsoft proxy requests without the MS-API-KEY.
Out of Scope Changes check	✅ Passed	The config comment cleanup and policy removal are directly related to dropping the API key requirement.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 47699-website-microsoft-proxy-no-api-key

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}