Deploy Wispr Flow via MDM

Last updated: September 7, 2026

Available on: Mac, Windows (MDM-managed devices)

Roll Wispr Flow out to your fleet with pre-authorized permissions, silent installs, and admin-controlled updates. Covers permission profiles, per-provider deployment, and enterprise data policies for macOS and Windows.

Note: Downloads and identifiers live in the MDM section of the Wispr Flow admin portal at admin.wisprflow.ai (sign in as a team admin). Use Copy link on each download card for direct URLs. .mobileconfig, .ps1, and .zsh files arrive as .zip archives — unzip before deployment.

Quick start

  1. Download the installer for your platform (Windows .msi, Mac Apple Silicon .pkg, or Mac Intel .pkg) and upload it to your MDM as a silent install.

  2. Deploy the unzipped Accessibility configuration profile (.mobileconfig) on Mac so users don't grant Accessibility manually.

  3. Deploy the optional update policy file — Mac managed config .mobileconfig or Windows PowerShell script — to control update check frequency.

macOS permissions and app identity

Wispr Flow uses Accessibility to insert text into applications and Microphone for dictation. Only Accessibility can be pre-granted via MDM; Microphone access for third-party apps requires a one-time native user prompt.

Match the developer as Wispr AI INC. On Windows, the CompanyName field reads Wispr AI; admins matching by publisher should accept either string.

The app is signed, notarized, and Gatekeeper-compliant — do not disable Gatekeeper. On macOS, Wispr Flow appears in both the menu bar and the Dock; users can hide the Dock icon in settings for menu-bar-only mode.

Use these identifiers when authoring or validating permission profiles:

  • Bundle Identifier: com.electron.wispr-flow

  • Team ID: C9VQZ78H85

  • Developer: Wispr AI INC

  • Code requirement string: identifier "com.electron.wispr-flow" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = C9VQZ78H85

MDM-managed auto-update policy

Admins control how often Wispr Flow checks for and applies updates; users cannot override it.

Update frequency options

Value

Behavior

auto

Default. Checks periodically and defers updates during active use.

weekly

Checks once per week; updates apply immediately when found.

bi-weekly

Checks every two weeks; updates apply immediately when found.

monthly

Checks monthly; updates apply immediately when found.

Note: Policy changes require an app restart. Value matching is case-insensitive and whitespace-tolerant; missing, invalid, or unknown values fall back to auto on both platforms. Any cadence other than auto also disables Flow's deferral until the user steps away — the admin cadence takes priority. Checks only run when the device is awake and online.

How update deferral and failures behave

  • Deferred during dictation: active dictation always blocks updates, regardless of cadence.

  • Staggered first install: a delay after the first download spreads restarts across the fleet.

  • Failure handling: repeated install or download failures back off between retries, then pause on that version instead of looping. An "Update Error" notification with Restart and Contact Us appears if updates keep failing or an installed update leaves the version unchanged after restart.

Deploying the update policy

macOS

Download and unzip the managed config .mobileconfig from the admin portal, then deploy it via your MDM (Jamf, Kandji, Mosyle, Intune, Rippling, and others). The profile sets the UpdateFrequency key for Wispr Flow's managed preferences.

Windows

Choose either option:

  • PowerShell script: unzip wispr-flow-set-update-frequency.ps1 and deploy it as a post-install script running as SYSTEM (for script-based MDMs like Rippling or Chef). Edit the $value variable before deploying; the shipped default is weekly. It writes UpdateFrequency to HKLM:\SOFTWARE\Policies\WisprAI\Flow; verify results in your MDM's script execution logs.

  • Registry / policy template: set value name UpdateFrequency, type REG_SZ, at HKLM\SOFTWARE\Policies\WisprAI\Flow via Intune, SCCM, GPO, or any registry-capable MDM.

Corporate network and TLS inspection

Wispr Flow deploys behind corporate TLS-inspecting proxies and automatically trusts your organization's system root certificates, so dictation and audio upload work on inspected networks.

Platform-specific deployment

macOS

Minimum system version is macOS 12.0 (Monterey), enforced at runtime with the dialog "Wispr Flow requires MacOS 12.0 or later." The auto-updater is enabled by default; control cadence with the update policy above.

The app must be installed in /Applications (or ~/Applications, /System/Applications). If staged elsewhere it shows "Move Flow to Applications folder — Flow needs to be in the Applications folder to run." and quits.

  1. Upload the architecture-specific .pkg (Apple Silicon or Intel) to your MDM.

  2. Deploy to target devices. The PKG installs silently to /Applications with no user interaction.

  3. Deploy the unzipped Accessibility configuration profile to pre-grant Accessibility.

  4. Deploy the unzipped Restore App Ownership script from the admin portal. Flow self-updates only when the installed .app bundle is writable by the current user, so this script is required for the auto-updater to work after an MDM install and to avoid admin credential prompts.

  5. Verify: launch Wispr Flow on a test device. The Permissions onboarding page shows Accessibility granted with a green checkmark. Users see a one-time native Microphone prompt the first time Flow needs the microphone.

Note: A PKG installed over a running instance of Wispr Flow — for example, an MDM-pushed update — leaves the running app operating from its original bundle. Have users quit and relaunch to run the updated version.

Note: On the Permissions page, the first click on the microphone card shows the native macOS dialog; later clicks open System Settings → Privacy & Security → Microphone. At runtime, if microphone permission was previously denied, the app opens System Settings automatically; if it has never been requested, the app sends a notification instead.

Windows

Accessibility is not required on Windows. Wispr Flow requires x64 Windows; on non-x64 (e.g. ARM) devices the app shows "Unsupported Windows Architecture — Wispr Flow requires x64 architecture" and quits.

  1. Upload the Wispr Flow .msi installer to your MDM as a line-of-business app.

  2. Run a silent install: msiexec /i "Wispr Flow.msi" /quiet

  3. Verify: confirm %ProgramFiles%\Wispr Flow\ exists on a target device and launch the app. Application data is stored at %APPDATA%\Wispr Flow\.

On the Permissions onboarding page, an ungranted mic card shows Open Settings, which opens Windows Settings → Privacy → Microphone. Enable both the global Microphone access toggle and the Let desktop apps access your microphone sub-toggle — setting only one may not be sufficient.

Note: Use the machine-wide MDM Wispr Flow.msi, which installs to %ProgramFiles%\Wispr Flow\, for enterprise deployment (Intune, SCCM, Chef, Chocolatey). The per-user Wispr Flow Setup.exe installs to %LOCALAPPDATA%\WisprFlow\ for individual self-install and needs no administrator rights. To capture its exit code in a script, use Start-Process -Wait, because launching it from a terminal returns immediately.

MDM provider quick start

Jamf Pro

  1. Upload the .pkg via Settings → Packages.

  2. Create a deployment policy targeting the right computers or groups; use Smart Groups to target by department or user group.

  3. Deploy the permission profile: Configuration Profiles → Upload → select the unzipped Accessibility .mobileconfig.

  4. Upload the unzipped Restore App Ownership script as a script in your deployment policy.

  5. Update by uploading a new PKG and creating a new policy, or use Patch Management.

Kandji

  1. Navigate to Library → Custom Apps → Add Custom App and upload the .pkg.

  2. Add an optional audit script to verify /Applications/Wispr Flow.app exists.

  3. Deploy the permission profile: Library → Custom Profiles → Add Profile and upload the unzipped Accessibility .mobileconfig.

  4. Add the unzipped Restore App Ownership script via Library → Custom Scripts.

  5. Update by replacing the PKG in the Custom App.

Warning: Deploy the Restore App Ownership script as an Auto App → Postinstall script. With Custom Script → Audit & Enforce for self-healing, a non-zero exit causes Kandji to reinstall the app and undo the ownership fix (the shipped script always exits 0).

Microsoft Intune

macOS:

  1. Navigate to Apps → macOS → Add → Line-of-business app and upload the .pkg.

  2. Deploy the permission profile: Devices → Configuration profiles → Create profile → Templates → Custom and upload the unzipped Accessibility .mobileconfig.

  3. Deploy the update policy the same way, uploading the unzipped managed config .mobileconfig.

  4. Add the unzipped Restore App Ownership script via Devices → Scripts.

Windows:

  1. Navigate to Apps → Windows → Add → Line-of-business app and upload the Wispr Flow .msi.

  2. Set the silent install command: msiexec /i "Wispr Flow.msi" /quiet

  3. Set the UpdateFrequency registry value at HKLM\SOFTWARE\Policies\WisprAI\Flow (type REG_SZ) via a Configuration profile or Settings Catalog.

Rippling

macOS:

  1. Navigate to IT → Device Management → Software, upload the architecture-specific .pkg, and set install type to "silent."

  2. Deploy the unzipped Accessibility .mobileconfig via IT → Device Management → Configuration Profiles.

  3. Deploy the unzipped managed config .mobileconfig via Configuration Profiles to set the update frequency policy.

  4. Add the unzipped Restore App Ownership script as a post-install script.

Windows:

  1. Navigate to IT → Device Management → Software, upload the Wispr Flow .msi, and set install type to "silent."

  2. Deploy the unzipped update-frequency PowerShell script as a post-install script.

Mosyle

  1. Navigate to Management → Apps → Custom Apps and upload the .pkg.

  2. Deploy the permission profile via Management → Profiles → Custom Profiles, uploading the unzipped Accessibility .mobileconfig.

  3. Add the unzipped Restore App Ownership script via Management → Scripts.

Munki

  1. Import the PKG: munkiimport "Wispr Flow.pkg". Set installer_type appropriately and add an installcheck_script verifying /Applications/Wispr Flow.app exists and its version.

  2. Deploy the Accessibility profile separately via your MDM; Munki does not manage profiles but handles version comparison for updates automatically.

Fleet

  1. Add the PKG to the software library or use a custom policy.

  2. Deploy the Accessibility profile via Fleet's MDM profile management.

  3. Verify installation by querying installed apps: SELECT * FROM apps WHERE name = 'Wispr Flow'.

Enterprise data policies

Team and Enterprise admins configure data policies in the admin portal. In the desktop app, team admins see an Admin portal button in Team settings; regular members see Contact admins, which opens a message dialog delivered to team admins.

Note: Zero data retention, Data sharing policy, Local data deletion, Enforce SSO, Auto-Invite by Domain, MDM deployment, and SCIM directory sync require an Enterprise subscription. Dictation cloud storage policy is available to Team plan admins with an active subscription, as well as Enterprise admins. Unavailable controls appear disabled; hover one to see the requirement.

Privacy and retention

  • Improve the model for everyone: Disabled for everyone locks the toggle OFF for all members, so their audio, transcripts, and edits are not used to evaluate or improve Wispr's AI models; Managed individually lets each user control it. When locked OFF, the toggle is disabled with a subtitle naming their organization. HIPAA or organization privacy settings can also lock it off.

  • Dictation cloud storage: Disabled for everyone prevents dictation data from being stored on Wispr's servers and turns off cross-device personalization and transcript retention; Managed individually leaves it to users. Also locked off automatically when a HIPAA BAA is signed.

  • Zero Data Retention (ZDR): enable or disable it in the admin portal; it locks Improve the model for everyone OFF for all team members. ZDR is active for the team when both that setting and Dictation cloud storage are "Disabled for everyone." For some organizations Wispr locks the ZDR toggle so only Wispr support can modify it — if yours is uneditable, contact support.

  • Local Data Deletion: Store Normally (default), Delete After 24 Hours (deletes transcripts and polish history older than 24 hours), or Never Store (immediately deletes all transcripts and polish history and prevents new local storage). The two deletion levels show a confirmation dialog; switching back to Store Normally applies immediately. Enforcing Delete After 24 Hours filters out Store Normally but leaves users the other two options; enforcing Never Store locks the dropdown with a "Managed by your organization" tooltip. Your Usage and Leaderboard in Insights are unaffected.

  • Diagnostics: local log files are written to %APPDATA%\Wispr Flow\Logs on Windows and ~/Library/Logs/Wispr Flow on macOS.

  • HIPAA Business Associate Agreement (BAA): Enterprise admins manage the BAA in the admin portal via a View and accept BAA button; individual users view and sign one in the app by entering their legal name. An active BAA disables data sharing for all users, stops transcription data from being used to train or improve models, and disables Dictation cloud storage account-wide. The BAA is account-wide (one signature per user), not per-device, and individual non-enterprise users can revoke it from Settings → Data & Privacy to lift the locks. BAA and ZDR are independent; enable ZDR as well to prevent model-training use for all team members. For enterprise non-admins, the in-app HIPAA button opens the admin portal home; for enterprise admins with no org BAA signed, it opens the admin portal Settings page. Team-plan members and individual users see the in-app sign dialog.

Warning: Selecting Never Store immediately deletes all locally stored transcripts and polish history on the device and cannot be undone. Cloud-synced content is not affected.

Identity and access

  • Enforce SSO: requires all team members to authenticate via your SSO provider. Enforcement is domain-based and applies to all users whose email domain matches your registered domain(s). The toggle appears only after SSO is connected and requires an active Enterprise subscription with live billing — if billing has lapsed, enforcement is not applied even when enabled.

  • Auto-Invite by Domain: users with matching email domains can request to join your enterprise team. With auto-accept configured, requests are approved immediately; otherwise they go to admins.

SCIM directory sync

With SCIM directory sync enabled, all user management happens in your identity provider: the invite button is hidden, join request Approve/Deny buttons are hidden (rows with name, email, and avatar remain visible), and the "Other domain users" tab is replaced with "User management is controlled by your identity provider via SCIM. Please add users through your identity provider."

  • SCIM provisioning respects your seat cap. Seat-cap blocks are final and do not fall back to email invitation; other provisioning failures fall back to a regular email invitation through the standard invite flow with the default Member role.

  • SCIM-provisioned users receive the default Member role; Admin or IT Admin roles must be assigned manually in the admin portal. The IT Admin role is non-billable; Admin, SuperAdmin, and Member roles are billable.

  • SCIM users who already belong to a different enterprise are silently skipped (no invite fallback).

  • Users with previously rejected join requests are blocked from re-requesting.

  • Users with a pending admin invitation who request to join themselves auto-accept the pending invitation immediately.

Compliance documentation

Enterprise customers can request SOC 2 Type II compliance documentation by contacting Wispr support.

FAQs

Do end users need to do anything after deployment?

Yes. On first launch, onboarding asks whether their data helps improve Wispr's AI models (Improve the model for everyone) and whether their dictation data is stored in the cloud (Dictation cloud storage). Both can be adjusted later in Settings → Data & Privacy, and either can be locked by enterprise policy.

What happens if I deploy without the configuration profile?

Users grant Accessibility manually in System Settings on first launch; the app guides them, but it requires user interaction. For microphone access, users see a native macOS dialog the first time Flow needs the microphone.

Can I use this profile for non-managed devices?

No. The configuration profile is for MDM-managed deployments only. On non-managed devices, users follow the standard installation process and approve Accessibility manually.

What MDM solutions are supported?

Instructions are provided for Jamf Pro, Kandji, Microsoft Intune, Rippling, Mosyle, Munki, and Fleet. The configuration profile works with any MDM that supports custom .mobileconfig profiles. For other MDMs, contact Wispr support.

I deployed a new update policy but nothing changed

Policy changes take effect on the next app launch — have the user quit and relaunch Wispr Flow. On Windows, if the policy cannot be read after repeated attempts, the app uses the last persisted policy (or auto) for that session; a restart on a less-loaded machine resolves it.

Permissions are not pre-granted after deploying the profile (macOS)

Deploy the profile to the device, not just the user, and verify it under System Settings → Profiles on the target device. On macOS 15+, a restart may be needed after profile installation. If a permission request stalls, the user sees an error toast and can retry.

The app fails to launch after PKG install (macOS)

Check Console.app for crash logs related to Wispr Flow, then verify the app signature with codesign --verify --deep /Applications/Wispr\ Flow.app.

The MSI fails when deployed via MDM (Windows)

Deploy as SYSTEM, not user context, and use the machine-wide MDM .msi installer — not the .exe or the per-user .msi.

The Restore App Ownership script fails with "No such file or directory" (macOS)

Copying the .zsh script contents from a browser introduces Windows-style line endings, which cause the failure. Download the Restore App Ownership zip from the admin portal, unzip it, and deploy the unzipped .zsh file via your MDM instead of pasting its contents.

How do I check the installed version?

  • macOS: run defaults read /Applications/Wispr\ Flow.app/Contents/Info.plist CFBundleShortVersionString

  • Windows: check the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for the Wispr Flow entry.

How do I uninstall Wispr Flow?

  • macOS: delete /Applications/Wispr Flow.app. Optionally remove user data at ~/Library/Application Support/Wispr Flow/.

  • Windows: uninstall via Add/Remove Programs, or silently with msiexec /x "Wispr Flow.msi" /quiet (use the fixed upgrade GUID from the admin portal for MDM scripts, which works regardless of version). Optionally remove user data at %APPDATA%\Wispr Flow\. msiexec applies to the .msi build only — uninstall the .exe build via Add/Remove Programs.

What does "helper service persistent failure" mean?

The helper app failed to start after multiple retries, which triggers a persistent notification. Verify the helper app exists at the expected path inside Wispr Flow.app/Contents and check Accessibility permissions.

Limitations and notes

  • MDM deployment requires an Enterprise subscription and is available on Mac and Windows.

  • The macOS app ships in separate Apple Silicon and Intel builds. Intel builds are blocked from running under Rosetta 2, so M-series Macs must receive the Apple Silicon .pkg.

  • On macOS, only Accessibility can be pre-granted; Microphone cannot be pre-granted for third-party apps, so users are prompted on first use.

  • When an MDM-managed update frequency policy is active, end users cannot override the setting.

  • Three Enterprise admin-level roles exist — Admin, SuperAdmin, and IT Admin — and all grant admin-portal access. Auto-Invite is an enterprise-wide toggle.

  • The macOS PKG is signed with Developer ID Installer: Wispr AI INC and notarized.

  • macOS distribution includes .zip, .dmg, and .pkg builds per architecture; use .pkg for MDM deployment. On Windows, a Microsoft Store MSIX distribution also exists, distinct from the .exe and .msi installers. The machine-wide MDM MSI always installs to %ProgramFiles%\Wispr Flow\; users cannot pick a custom location.

Still need help?

Reach out to Wispr support if:

  • You need help configuring one of the MDM providers listed above.

  • Permissions are not granting correctly after profile deployment.

  • You need help with enterprise data policies, SOC 2 documentation, or the corporate proxy / TLS inspection trust-store setting.

Include your MDM provider, OS version, Wispr Flow version, and what you have already tried. Most MDM issues are resolved in one or two replies.