Enterprise app and URL deny-list: blocking dictation in specific apps and websites

Last updated: August 6, 2026

Available on: Mac, Windows (Enterprise plan only — admin portal configuration)

The app deny-list lets organization admins block Wispr Flow dictation in specific apps or websites across their entire organization. When a user tries to dictate in a blocked app or site, Flow silently disables and shows them a notification — no per-device IT setup needed.

What it is

The deny-list is a centrally managed list of apps and browser URLs where Wispr Flow dictation is disabled organization-wide. Admins configure it once in the admin portal, and the policy applies automatically to all members of the organization.

Two types of entries are supported: apps (identified by macOS bundle ID or Windows process name) and browser URLs (identified by canonical host, such as chatgpt.com, which also covers all subdomains). End users see a notification and a hub status indicator when dictation is blocked — they are not left guessing.

When to use it

Use the deny-list when you want to:

  • Prevent dictation in apps or websites that handle sensitive or regulated information (e.g. internal finance tools, legal matter platforms)

  • Comply with a policy that restricts voice input in certain environments

  • Block dictation on specific AI or productivity websites where your organization has data handling requirements

  • Apply a uniform restriction across your whole organization without configuring each device individually

How it works in Flow

Overview

Deny-list rules are set in the admin portal and pushed to all organization members automatically. When a member focuses on or attempts to dictate in a blocked app or browser URL, Flow detects this and disables dictation for that context.

Key behaviors

  • User notification: When dictation is attempted in a blocked app or site, the user sees a notification: "Voice-to-text is disabled in [app name]." The notification explains that their administrator has disabled dictation there.

  • Hub status indicator: The Flow hub shows a "Voice-to-text disabled" status while the user is in a blocked app or site, so the current state is always visible.

  • App blocking (Mac): Apps are blocked by their macOS bundle ID (e.g. com.apple.mail).

  • App blocking (Windows): Apps are blocked by their Windows process name (e.g. outlook.exe).

  • Browser URL blocking: Blocking applies by canonical host — entering chatgpt.com also blocks chat.chatgpt.com and all other subdomains.

  • Organization-wide scope: Deny-list rules apply to every member of your organization. There is no per-user override.

  • Localization: User-facing notifications are displayed in the user's language. Flow supports 20+ languages.

How to manage the deny-list

Deny-list management is done in the Wispr Flow admin portal under Organization settings. You must be an organization admin on an Enterprise plan to access this section.

Add an entry

  1. Sign in to the Wispr Flow admin portal.

  2. Go to Organization settings, then open the Deny-list section.

  3. Select whether you are blocking an app or a browser URL.

  4. Enter the app's bundle ID (Mac) or process name (Windows), or the canonical host for a URL (e.g. chatgpt.com).

  5. Save the entry. The rule applies to all organization members automatically.

Edit or remove an entry

  1. Go to Organization settings → Deny-list in the admin portal.

  2. Locate the entry you want to change.

  3. Edit the identifier and save, or remove the entry to re-enable dictation for that app or site.

Note: If your organization is being wound down, you can still remove existing deny-list entries, but adding new ones may not be available.

Finding the right identifier

To block an app, you need its correct identifier. Use the accordion below for your platform.

Finding a macOS bundle ID

The bundle ID is a unique string that identifies an app on macOS (e.g. com.apple.mail for Mail, com.google.Chrome for Chrome).

  1. Open Terminal.

  2. Run: osascript -e 'id of app "AppName"' — replace AppName with the name of the app as it appears in Finder.

  3. Copy the output (e.g. com.microsoft.Outlook) and paste it into the deny-list entry field.

Bundle IDs are case-sensitive. Enter them exactly as returned by the command above.

Finding a Windows process name

The process name is the executable file name for the app (e.g. outlook.exe, chrome.exe).

  1. Open Task Manager (Ctrl + Shift + Esc).

  2. Find the app in the Processes list while it is running.

  3. Right-click the app and select "Go to details" to see the exact process name in the Details tab.

  4. Copy the name including the .exe extension and paste it into the deny-list entry field.

Process names are case-insensitive on Windows, but enter them exactly as shown in Task Manager to avoid errors.

Entering a browser URL

Enter the canonical host — the root domain without https://, paths, or query strings.

  • Correct: chatgpt.com

  • Incorrect: https://chat.chatgpt.com/c/1234

Blocking chatgpt.com automatically covers all subdomains (e.g. chat.chatgpt.com, auth.chatgpt.com). You do not need to add subdomains separately.

FAQs

Why is dictation disabled for me in a specific app?

Your organization's administrator has added that app or website to the deny-list. When dictation is blocked, you'll see a notification explaining this. Contact your IT or admin team if you believe this is an error.

Can individual users override the deny-list?

No. The deny-list is an organization-wide policy set by admins. Individual users cannot disable or bypass it.

Does blocking a browser URL block the entire browser, or just that site?

Only that site and its subdomains are blocked. Dictation continues to work normally on all other sites in the same browser.

Can I block the same app on both Mac and Windows?

Yes. Add separate entries — one using the macOS bundle ID and one using the Windows process name — to block the same app on both platforms.

Who can manage the deny-list?

Only organization admins on an Enterprise plan can add, edit, or remove deny-list entries. The deny-list section is not visible to standard members or on non-Enterprise plans.

How quickly does a new deny-list entry take effect?

Entries are applied organization-wide automatically after saving. Members may need to relaunch Flow or wait a short time for the change to sync to their device.

Limitations and notes

  • The deny-list is available on Enterprise plans only. It does not appear in Organization settings for other plan types.

  • App blocking uses macOS bundle ID on Mac and process name on Windows. A separate entry is required for each platform.

  • Browser URL blocking applies to the canonical host and all its subdomains. Blocking by specific URL path or query string is not supported.

  • The deny-list applies to the entire organization. Per-user or per-team rules are not currently supported.

  • Organizations being wound down can remove existing entries but may not be able to add new ones.