Deploy Wispr Flow via MDM

Last updated: August 6, 2026

Available on: Mac, Windows (MDM-managed devices)

Roll Wispr Flow out to your fleet with pre-authorized permissions, silent installs, and admin-controlled update frequency. Covers permission profiles, per-provider deployment, and enterprise data policies for macOS and Windows. Most deployments take 15–30 minutes per MDM.

Note: The MDM section lives in the Wispr Flow admin portal at admin.wisprflow.ai (sign in as a team admin). Use the Copy link button on each download card for direct URLs. Some downloads (.mobileconfig, .ps1, and .zsh files) arrive as .zip archives — unzip them before deployment.

Quick start

Install Wispr Flow: download the installer for your platform (Windows .msi, Mac Apple Silicon .pkg, or Mac Intel .pkg) from the MDM section of admin.wisprflow.ai and upload it to your MDM as a silent install.
Pre-grant Accessibility on Mac: download and unzip the Accessibility configuration profile, then deploy the .mobileconfig via your MDM so users don't grant Accessibility manually.
Set the update policy (optional): download and unzip the update policy file for your platform (Mac managed config .mobileconfig or Windows PowerShell script), then deploy it to control how often Flow checks for updates.

macOS permission profiles

Only Accessibility can be pre-granted via MDM. Microphone and System Audio access for third-party apps require a one-time native user prompt and cannot be pre-granted.

Permission	Why
Accessibility	Required for text insertion into applications
Microphone	Required for speech-to-text dictation
System Audio	Required for meeting notetaking (captures meeting audio). Requires macOS 14.4 or later; macOS 12 and 13 cannot grant it due to an Apple-side limitation, which does not block other Flow features.

Note: Screen Capture permission (used for context-aware features) is requested at runtime when needed. It is not in the provided MDM profile and is not shown during onboarding.

Note: For macOS 14.4+ fleets, pre-authorize System Audio via a PPPC profile using the identifiers in the MDM section of admin.wisprflow.ai. See Platform-specific deployment → macOS for what users see during Notetaker onboarding.

App identity info

These details are required when configuring your MDM:

Property	Value
Developer	Wispr AI INC (Apple Developer identity used in code signing and notarization). On Windows, the CompanyName field reads Wispr AI. Both are valid — admins matching by publisher should accept either string.

Note: The bundle identifier, helper app identifier, Team ID, and code requirement string for your PPPC profile are in the MDM section of admin.wisprflow.ai. One helper app bundle identifier covers both Accessibility and System Audio pre-authorization.

The app is signed, notarized, and Gatekeeper-compliant; you do not need to disable Gatekeeper. Wispr Flow appears in both the menu bar and the Dock on macOS, and users can hide the Dock icon in settings for menu-bar-only mode.

MDM-managed auto-update policy

Admins control how often Wispr Flow checks for and applies updates. With a policy set, the update icon button in the Settings sidebar is disabled and hovering shows the tooltip "Updates managed by your organization.
Next check: {date}".

Update frequency options

Value	Behavior
`auto`	Default. Checks frequently throughout the day.
`weekly`	Checks once per week.
`bi-weekly`	Checks every two weeks.
`monthly`	Checks every 30 days.

Note: Policy changes require an app restart. The tooltip's next-check date shows only the day (e.g. "Fri, May 15"). With no policy value on either platform, the app falls back to auto.

Additional auto-update behaviors

Updates are deferred during active dictation and active meeting recording, and wait a short period after the last dictation action so a restart never interrupts a work session.
On first download, Flow adds a small randomized delay before the first install attempt to spread restarts across the fleet.
If an install or download fails repeatedly, auto-updates back off between retries and then pause on that version instead of looping.
If updates keep failing — or an installed update fails to apply (version unchanged after restart) — an in-app "Update Error" notification appears with Restart and Contact Us buttons.

Deploying the update policy

macOS

Download the managed config .mobileconfig from the MDM section of admin.wisprflow.ai, unzip it, and deploy it via your MDM (Jamf, Kandji, Mosyle, Intune, Rippling, etc.). The profile sets the UpdateFrequency value under managed preferences for Wispr Flow.

Windows

Two options are available:

PowerShell script: Download and unzip the update-frequency script, then deploy it as a post-install script (suitable for script-based MDMs like Rippling or Chef).
Registry / policy template: Set the Wispr Flow UpdateFrequency policy value (documented in the admin portal) via Intune, SCCM, GPO, or any registry-capable MDM.

Corporate network and TLS inspection (proxy support)

Wispr Flow supports deployment behind corporate TLS-inspecting proxies (such as Zscaler). The app automatically widens its certificate trust store to include your organization's system root certificates, so dictation, audio upload, and meeting summaries work on inspected networks.

To disable this behavior, admins can turn off system trust-store widening via a managed configuration setting. Contact Wispr support for details.

Platform-specific deployment

macOS

Upload the architecture-specific .pkg (Apple Silicon or Intel) to your MDM — the macOS app ships in separate builds.
Deploy to target devices. The PKG installs silently to /Applications with no user interaction.
Deploy the unzipped Accessibility configuration profile to pre-grant Accessibility.
Run the Restore App Ownership script: download it from the MDM section of admin.wisprflow.ai, unzip it, and deploy it via your MDM so Flow can apply future updates without prompting for admin credentials.
Verify: launch Wispr Flow on a test device. The Permissions onboarding page shows Accessibility granted with a green checkmark. Users see a one-time native Microphone prompt the first time Flow needs the microphone.

The auto-updater is enabled by default; control cadence with the MDM-managed auto-update policy above.

The minimum system version is macOS 12.0 (Monterey), enforced at runtime with the dialog "Wispr Flow requires MacOS 12.0 or later."

Note: On the Permissions page, the first click on the microphone card shows the native macOS dialog; any subsequent click opens System Settings → Privacy & Security → Microphone. At runtime, if microphone permission was previously denied, the app opens System Settings automatically; if it has never been requested, the app sends a notification instead.

Note: With Wispr Notetaker, users on macOS 14.4+ see a System Audio card during onboarding that opens System Settings when clicked. On macOS 12 and 13, the card instead shows Allow and Restart buttons, because granting screen-recording access there requires an app restart; this does not block onboarding or other features.

Windows

Upload the Wispr Flow .msi installer to your MDM as a line-of-business app.
Run a silent install: msiexec /i "Wispr Flow.msi" /quiet
Verify: confirm %ProgramFiles%\Wispr Flow\ exists on a target device and launch the app. Application data is stored at %APPDATA%\Wispr Flow\.

Accessibility is not required on Windows. The Permissions onboarding page still renders: with mic access granted, the microphone card shows a green checkmark and Continue is immediately available; otherwise the card shows an Open Settings button that opens Windows Settings → Privacy → Microphone.

To uninstall silently, run msiexec /x "Wispr Flow.msi" /quiet, or use the fixed upgrade GUID published in the admin portal (works regardless of version).

Note: Wispr Flow ships three Windows installer artifacts. Use the machine-wide MDM .msi, which installs to %ProgramFiles%\Wispr Flow\, for enterprise deployment; the per-user .msi (bundled with the .exe) and per-user .exe install to %LOCALAPPDATA%\WisprFlow\ and are for individual users. Enable both the global Microphone access toggle and the Let desktop apps access your microphone sub-toggle — setting only one may not be sufficient.

MDM provider quick start

Jamf Pro

Upload the .pkg via Settings → Packages.
Create a deployment policy targeting the right computers or groups.
Deploy the PPPC profile: Configuration Profiles → Upload → select the unzipped Accessibility .mobileconfig.
Deploy the Restore App Ownership script: download and unzip it from the admin portal, then upload it as a script in your deployment policy.
Update by uploading a new PKG and creating a new policy, or use Patch Management.

Kandji

Navigate to Library → Custom Apps → Add Custom App and upload the .pkg.
Add an optional audit script to verify /Applications/Wispr Flow.app exists.
Deploy the PPPC profile: Library → Custom Profiles → Add Profile and upload the unzipped Accessibility .mobileconfig.
Deploy the Restore App Ownership script: download and unzip it from the admin portal, then add it via Library → Custom Scripts.
Update by replacing the PKG in the Custom App.

Microsoft Intune

macOS:

Navigate to Apps → macOS → Add → Line-of-business app and upload the .pkg.
Deploy the PPPC profile: Devices → Configuration profiles → Create profile → Templates → Custom and upload the unzipped Accessibility .mobileconfig.
Deploy the update policy the same way, uploading the unzipped managed config .mobileconfig.
Deploy the Restore App Ownership script: download and unzip it from the admin portal, then add it via Devices → Scripts.

Windows:

Navigate to Apps → Windows → Add → Line-of-business app and upload the Wispr Flow .msi.
Set the silent install command: msiexec /i "Wispr Flow.msi" /quiet
Set the update policy by deploying the Wispr Flow UpdateFrequency registry value (documented in the admin portal) via a Configuration profile or Settings Catalog.

Rippling

macOS:

Navigate to IT → Device Management → Software, upload the architecture-specific .pkg, and set install type to "silent."
Deploy the unzipped Accessibility .mobileconfig via IT → Device Management → Configuration Profiles.
Deploy the unzipped managed config .mobileconfig via Configuration Profiles to set the update frequency policy.
Deploy the Restore App Ownership script: download and unzip it from the admin portal, then add it as a post-install script.

Windows:

Navigate to IT → Device Management → Software, upload the Wispr Flow .msi, and set install type to "silent."
Deploy the unzipped update-frequency PowerShell script as a post-install script to set the update frequency policy.

Mosyle

Navigate to Management → Apps → Custom Apps and upload the .pkg.
Deploy the PPPC profile via Management → Profiles → Custom Profiles, uploading the unzipped Accessibility .mobileconfig.
Deploy the Restore App Ownership script: download and unzip it from the admin portal, then add it via Management → Scripts.

Munki

Import the PKG: munkiimport "Wispr Flow.pkg"
Deploy PPPC profiles separately via your MDM (Munki does not manage profiles).

Munki handles version comparison for updates automatically.

Fleet

Add the PKG to the software library or use a custom policy.
Deploy PPPC profiles via Fleet's MDM profile management.
Verify installation by querying installed apps for "Wispr Flow."

Enterprise data policies

Enterprise admins configure additional data policies in the admin portal. In the desktop app, team admins see an Admin portal button in Team settings; regular members see Contact admins, which opens a free-text message dialog delivered to team admins.

Note: Enterprise-only admin-portal settings include ZDR, Cloud Sync policy, Data Sharing policy, Local Data Deletion, Enforce SSO, Auto-Invite by Domain, IP Allowlist, app deny-list, browser URL deny-list, notetaker transcript retention, and note-sharing controls. These require an Enterprise (Flow Business) subscription, labeled "Enterprise" in the app, and are unavailable on individual or Team-only plans. IP Allowlist visibility additionally requires Wispr support to enable it.

Privacy and retention

Zero Data Retention (ZDR): Locks Privacy Mode ON for all team members; users cannot disable it. Admins enable or disable ZDR in the admin portal.
Privacy mode (admin control): Set to Enforced for everyone, which locks Privacy Mode on for all members, or Managed individually, which lets each user control it. With Privacy mode "Enforced for everyone" and Cloud sync "Disabled for everyone," Zero Data Retention status is active for the team.
Cloud sync (admin control): Set to Disabled for everyone, which prevents transcripts and audio from being stored on Wispr's servers and turns off features requiring cloud sync (Wispr Notetaker, cross-device Scratchpad sync), or Managed individually. Also locked off automatically when a HIPAA BAA is signed.
Data Sharing (admin control): Prevents team members from sharing usage data (audio, transcripts, edits) with Wispr for AI training and improvement. Can also be locked off by HIPAA settings or organization privacy settings.
Local Data Deletion: Three levels — Store Normally (default), Delete After 24 Hours (deletes transcripts and polish history older than 24 hours), or Never Store (immediately deletes all transcripts and polish history and prevents new local storage). Choosing Never Store or Delete After 24 Hours shows a confirmation dialog; switching back to Store Normally applies immediately without one. When the enterprise enforces Delete After 24 Hours, Store Normally is filtered out but users can still choose between the other two; when it enforces Never Store, the dropdown is fully locked with a "Managed by your organization" tooltip. Under either policy the Your Voice tab in Insights is hidden because Voice Profile requires locally stored transcripts; Your Usage and Leaderboard are unaffected.
HIPAA Business Associate Agreement (BAA): Enterprise admins manage the BAA in the admin portal; individual users can view and sign one in the app, entering their legal name to confirm. Signing locks Privacy Mode ON and disables Data Sharing and Cloud Sync account-wide while active. The BAA is account-wide (one signature per user), not per-device, and individual non-enterprise users can revoke it from Settings → Data & Privacy to lift the locks. To enforce Privacy Mode for all team members, also enable ZDR — BAA and ZDR are independent and both can lock Privacy Mode. For enterprise non-admins, the in-app HIPAA button opens the admin portal home; for enterprise admins with no org BAA signed, it opens the admin portal Settings page. Team-plan members and individual users see the in-app sign dialog. For some organizations Wispr locks the ZDR toggle at the admin-portal level, so only Wispr support can modify Privacy Mode; this lock is independent of BAA signing. If your ZDR toggle is uneditable, contact support.

Warning: Selecting Never Store immediately deletes all locally stored transcripts and polish history on the device. This cannot be undone, and no new local data is stored while the policy is active.

Identity and access

Enforce SSO: Requires all team members to authenticate via your SSO provider. Enforcement is domain-based and applies to all users whose email domain matches your registered domain(s), and supports SCIM directory sync for automated provisioning. The Enforce SSO toggle appears only after SSO is connected, and requires an active Enterprise subscription with live billing — if billing has lapsed, enforcement is not applied even when enabled.
Auto-Invite by Domain: Users with matching email domains can request to join your enterprise team. With auto-accept configured, requests are approved immediately; otherwise they go to admins.
IP Allowlist: When access is blocked, the user is signed out and shown a full-screen block page titled "Your network isn't allowed" (no trailing period), with Retry and Sign Out buttons. The subtitle includes the enterprise name in bold when known (e.g. "Your admin at {EnterpriseName} only allows Wispr on approved networks. Switch networks or contact your admin."); otherwise a generic subtitle is shown. The admin portal UI is gated — contact Wispr to enable it.

SCIM directory sync

With SCIM directory sync enabled, all user management happens in your identity provider: the invite button is hidden, join request Approve/Deny buttons are hidden (rows with name, email, and avatar remain visible), and the "Other domain users" tab is replaced with "User management is controlled by your identity provider via SCIM. Please add users through your identity provider."

SCIM provisioning respects your seat cap. Seat-cap blocks are final and do not fall back to email invitation; other provisioning failures fall back to a regular email invitation through the standard invite flow with the default Member role.

SCIM-provisioned users receive the default Member role; Admin or IT Admin roles must be assigned manually in the admin portal. The IT Admin role is non-billable; Admin, SuperAdmin, and Member roles are billable.

SCIM users who already belong to a different enterprise are silently skipped (no invite fallback).
Users with previously rejected join requests are blocked from re-requesting.
Users with a pending admin invitation who request to join themselves auto-accept the pending invitation immediately.

Compliance documentation

Enterprise customers can request SOC 2 Type II compliance documentation by contacting Wispr support.

Common issues

Dictation, audio upload, or meeting summaries fail behind a TLS-inspecting corporate proxy

On machines with custom or duplicated root certificates, Flow's corporate proxy compatibility could be silently disabled, causing dictation, audio upload, and meeting summaries to fail on networks with TLS inspection (e.g. Zscaler). This was fixed in a recent update; update Wispr Flow to the latest version to resolve. No user data or trust was affected.

Restore App Ownership script fails with "No such file or directory" on macOS (Kandji and other MDMs)

Copying the .zsh script contents from a browser introduced Windows-style line endings, which caused the script to fail. To resolve:

Download the Restore App Ownership zip from the MDM section of admin.wisprflow.ai.
Unzip the archive to get the .zsh script.
Deploy the unzipped script via your MDM. Do not copy-paste the script contents from a browser.

Wispr Flow crashes on launch on Windows (graphics-related crash)

Some Windows users across Intel, NVIDIA, and AMD GPUs saw Wispr Flow fail to start because of an error initializing the graphics process. Fixed in a subsequent release; update Wispr Flow to the latest version to resolve.

Microphone list is empty in settings after a recent upgrade on Windows

After a recent Windows upgrade, some users saw a blank microphone selection dialog with no audio devices listed. Fixed in a subsequent release; update Wispr Flow to the latest version to resolve.

Windows users incorrectly told microphone privacy is disabled (MDM/GPO-managed devices)

On some Windows machines — particularly those managed by MDM/GPO policies or third-party privacy tools — Flow showed a "microphone privacy disabled" error and blocked dictation even when the microphone worked. Fixed in a subsequent release; update Wispr Flow to the latest version to resolve, then confirm both Windows microphone toggles described in the Windows deployment section are enabled.

Clicking to grant permissions opens the wrong System Settings pane on macOS 26 (Tahoe)

On macOS 26 (Tahoe), clicking to grant Accessibility, Microphone, or Screen Capture permissions during onboarding could open the wrong System Settings pane or nothing at all. Fixed in current versions; update Wispr Flow to the latest version to resolve.

"Your Voice" tab in Insights shows "Unlocks in 2,000 words" and never progresses

Users on a Local Data Deletion policy saw the Your Voice tab permanently stuck at "Unlocks in 2,000 words" because Voice Profile requires locally stored transcripts. The tab is now hidden for affected users; update Wispr Flow to the latest version to resolve. It reappears if the policy returns to Store Normally.

FAQs

Do end users need to do anything after deployment?

Yes. Users go through onboarding on first launch, setting data sharing preferences: whether their data is stored in the cloud (Cloud Sync) and whether usage data helps improve Flow's AI (Data Sharing). Both can be adjusted later in Settings → Data and Privacy, and either can be locked by enterprise policy (ZDR, HIPAA BAA, or admin-controlled settings).

On macOS with the PPPC profile deployed, Accessibility shows as granted; users still see a one-time native Microphone prompt, plus a System Audio step on macOS 14.4+ if they set up Notetaker.

What happens if I deploy without the configuration profile?

Users are prompted to grant Accessibility manually in System Settings on first launch; the app guides them, but it requires user interaction. For microphone access, users see a native macOS dialog the first time Flow needs the microphone.

Can I use this profile for non-managed devices?

No. The configuration profile is for MDM-managed deployments only. On non-managed devices, users follow the standard installation process and approve Accessibility manually.

What MDM solutions are supported?

Instructions are provided for Jamf Pro, Kandji, Microsoft Intune, Rippling, Mosyle, Munki, and Fleet. The configuration profile works with any MDM that supports custom .mobileconfig profiles. For other MDMs, contact Wispr support.

I deployed a new update policy but nothing changed

Policy changes take effect on the next app launch. Have the user quit and relaunch Wispr Flow for the new cadence to apply.

Permissions are not pre-granted after deploying the PPPC profile (macOS)

Deploy the profile to the device, not just the user, and verify it under System Settings → Profiles on the target device. On macOS 15+, a restart may be needed after profile installation. If a permission request stalls, the user sees an error toast and can retry.

How do I pre-authorize System Audio for Notetaker on macOS 14.4+ fleets?

Deploy a PPPC profile that includes the System Audio permission entry for Wispr Flow, using the bundle identifier and code requirement string from the MDM section of admin.wisprflow.ai. Deploy it before users launch Notetaker onboarding.

The app fails to launch after PKG install (macOS)

Check Console.app for crash logs related to Wispr Flow, then verify the app signature with codesign --verify --deep /Applications/Wispr\ Flow.app.

The MSI fails when deployed via MDM (Windows)

Deploy as SYSTEM, not user context, and use the machine-wide MDM .msi installer — not the .exe or the per-user .msi.

How do I check the installed version?

macOS: Run defaults read /Applications/Wispr\ Flow.app/Contents/Info.plist CFBundleShortVersionString
Windows: Check the registry under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for the Wispr Flow entry. When auditing paths, the machine-wide MDM .msi installs to %ProgramFiles%\Wispr Flow\ and the per-user .exe to %LOCALAPPDATA%\WisprFlow\.

How do I uninstall Wispr Flow?

macOS: Delete /Applications/Wispr Flow.app. Optionally remove user data at ~/Library/Application Support/Wispr Flow/.
Windows: Uninstall via Add/Remove Programs, or silently with msiexec /x "Wispr Flow.msi" /quiet (recommended with the fixed upgrade GUID published in the admin portal for MDM scripts). Optionally remove user data at %APPDATA%\Wispr Flow\.

The machine-wide MDM MSI always installs to %ProgramFiles%\Wispr Flow\; users cannot pick a custom location. msiexec applies to the .msi build only — the .exe build is uninstalled via Add/Remove Programs.

What does "helper service persistent failure" mean?

The native helper app failed to start after multiple retries, which triggers a persistent notification. Verify the helper app exists at the expected path inside Wispr Flow.app/Contents and check Accessibility permissions.

Limitations and notes

MDM deployment is supported on Mac and Windows only.
The macOS app ships in separate Apple Silicon and Intel builds. Intel builds are blocked from running under Rosetta 2, so M-series Macs must receive the Apple Silicon .pkg.
On macOS, only Accessibility can be pre-granted with the provided profile; Microphone cannot be pre-granted for third-party apps, so users are prompted on first use. System Audio (required for Notetaker on macOS 14.4+) can be pre-authorized via a custom PPPC profile using the identifiers in the MDM section of admin.wisprflow.ai.
System Audio capture requires macOS 14.4 or later. Devices on macOS 12 and 13 see an Allow/Restart card during Notetaker onboarding and cannot grant it, but can use all other Flow features.
When an MDM-managed update frequency policy is active, end users cannot override the setting.
Three Enterprise admin-level roles exist — Admin, SuperAdmin, and IT Admin — and all grant admin-portal access. SCIM provisioning assigns only the default Member role, so Admin and IT Admin must be assigned manually in the admin portal.
Auto-Invite is an enterprise-wide toggle. A separate per-domain capture-policy mechanism (off / require) is available in the admin portal for DNS-verified domains, but client-side enforcement is not yet rolled out to users.
The macOS PKG is signed with Developer ID Installer: Wispr AI INC and notarized.
macOS distribution includes .zip, .dmg, and .pkg builds per architecture; use .pkg for MDM deployment. On Windows, a Microsoft Store MSIX distribution also exists, distinct from the .exe and .msi installers.

Still need help?

Reach out to Wispr support if:

You need help configuring one of the MDM providers listed above.
Permissions are not granting correctly after profile deployment.
You need help with enterprise data policies, SOC 2 documentation, or the corporate proxy / TLS inspection trust-store setting.

Include your MDM provider, OS version, Wispr Flow version, and what you have already tried. Most MDM issues are resolved in one or two replies.