# Himmelblau configuration. See himmelblau.conf(5) and
# https://himmelblau-idm.org/docs/reference/himmelblau-conf/
#
# No tenant settings are needed: `domain` defaults to the domain of the first
# user who signs in, and that user joins the device to Entra ID. Restrict who
# may sign in with pam_allow_groups (group object IDs or UPNs).

[global]
# Enroll the device in Intune and apply/report compliance policies.
apply_policy = true
# Fedora's admin group; members of sudo_groups (Entra group object IDs) are
# added to it.
local_sudo_group = wheel
# Linux admins: members get wheel (sudo) at sign-in, and lose it again within
# local_groups_reconcile_interval after leaving the group.
sudo_groups = c3b1cfcc-7834-47eb-948b-a22204276453
# Home directories named after the account (e.g. /home/jdoe), with a UPN alias.
home_attr = CN
home_alias = SPN
use_etc_skel = true