Deploy Wispr Flow via MDM

Install the desktop app, apply the required Mac Accessibility profile and ownership script, and optionally manage updates. Verify permissions and text insertion on a test device before rollout.

Before you deploy

MDM is offered with Enterprise. Setup downloads are accessible to signed-in organization members, regardless of plan or admin role.

• Mac: macOS 12.0 or later is required; the installer rejects older systems. Match Apple Silicon and Intel PKGs to their respective Macs — the Intel PKG can install on Apple Silicon, but Flow shows Incorrect App Version and quits if it detects Rosetta 2.

• Windows: x64 is required; ARM devices are unsupported. Use the machine-wide MSI, not the per-user Setup.exe or Setup.msi.

1. Sign in to admin.wisprflow.ai.

2. Open Settings → Organization → MDM Rollout (Optional) → Start MDM Setup.

3. Complete Tell us how you manage Wispr Flow: select every MDM provider you use (Microsoft Intune, Jamf Pro, Kandji, Mosyle, Workspace ONE, JumpCloud, Rippling, Fleet, Munki, Other) and an update plan (Automatic or Manual), then select Continue.

4. Select the macOS tab (install, permissions, update policy, app ownership) or Windows tab (install, permissions, update behavior); the guide opens on the operating system you are viewing it from.

5. Download the installer from step 1, Download the installer, or select Copy link for its versioned URL. On macOS, pick the Apple Silicon or Intel installer to match your Macs.

6. Unzip downloaded profiles and scripts, which offer Download only, before deployment.

Installers are not zipped: Wispr Flow-v<version>.pkg and Wispr Flow-v<version>.msi. Substitute the downloaded filename in the commands below.

If your organization restricts outbound traffic or uses an IP allowlist, review Configure your network for Wispr Flow before rollout. Where TLS inspection is used, request an SSL-inspection bypass, not just an allowlist entry; inspection can slow dictation even when connections succeed.

Deploy on macOS

1. Upload the unzipped Accessibility .mobileconfig to your MDM and deploy it to the device, not just the user, before or alongside the app.

2. Upload the matching PKG to your MDM as a silent install.

3. Run the unzipped Restore app ownership .zsh script after installation, with a GUI user logged in.

4. Launch Flow on a test Mac and select Allow on the onboarding Microphone card.

5. Approve the prompt: “Allow Wispr Flow microphone access to transcribe your speech.”

The supplied profile pre-grants only Accessibility, users cannot remove it, and it stays valid across app updates without redeployment for each release. macOS cannot pre-grant Microphone access to third-party apps through MDM, and the profile grants neither System Audio nor Screen Recording; Notetaker requests computer-audio access separately on macOS 13 or later, and users can finish onboarding without it. Automation is not required for this deployment, but ChatGPT computer use can prompt for it and the profile cannot pre-grant it.

The PKG installs /Applications/Wispr Flow.app without interaction or customization. Keep that name and top-level location: elsewhere, renamed, or nested, Flow shows “Flow needs to be in the Applications folder to run.” and quits, offering to move itself where possible. If a PKG updates a running app, have users quit and relaunch to run the new version.

Deploy on Windows

The signed machine-wide MSI installs to C:\Program Files (x86)\Wispr Flow\; the installer offers no directory choice. Windows needs neither a permission profile nor Accessibility permission. Do not force microphone privacy to Deny, or dictation cannot start.

1. Upload the machine-wide MSI to your MDM for deployment as SYSTEM, not in user context.

2. Run msiexec /i "Wispr Flow-v<version>.msi" /qn.

3. Confirm C:\Program Files (x86)\Wispr Flow\ exists.

4. Launch Flow on a test Windows device and select Open Settings in Flow’s Microphone setup.

5. Enable both Microphone access and Let desktop apps access your microphone.

For publisher matching, the MSI manufacturer and file company name are Wispr AI; the certificate subject organization is Wispr AI, Inc. The MSI UpgradeCode {396D8B98-0A0D-5D72-8E7E-5D0C442674E9} stays constant, so new packages upgrade in place. The ProductCode changes with every build.

Only the Windows MSI row offers Copy stable link: https://dl.wisprflow.ai/windows/msi/latest. Once enabled, it redirects to the current machine-wide x64 MSI and advances only with releases that include an x64 MSI.

Find the deployment controls in your MDM

Other Mac MDMs must support custom .mobileconfig profiles; contact support if yours does not.

Choose how devices update

Automatic updates are enabled by default. UpdateFrequency is the only app preference managed through MDM; users cannot override an IT-set value, and it controls cadence on Mac and both Windows installation types. On Windows, both use REG_SZ; MSI AUTOUPDATE and policy AutoUpdate are separate on/off controls, not cadence controls.

Unknown values fall back to auto; matching ignores case and surrounding whitespace. With auto, Mac and Windows per-user Setup.exe installations check every 30 minutes to 5 hours.

1. Set your chosen value in the Mac profile wispr-flow-managed-config.mobileconfig for the Wispr Flow app identifier, or in Windows at HKLM\SOFTWARE\Policies\WisprAI\Flow\UpdateFrequency or wispr-flow-set-update-frequency.ps1 with $value.

2. Deploy the profile, registry value, or PowerShell script; run the Windows script as SYSTEM.

3. Restart Flow; policy changes take effect only after a restart.

The schedule starts with the first successful check; without one, Flow checks immediately. Between scheduled checks, Check for updates... is unavailable and Flow shows the next check date, and replacing a downloaded update also waits for the schedule. If Windows cannot read the policy, Flow uses the last-known setting, retained across restarts, or auto if none exists. See Configure auto-update policy via MDM.

Machine-wide MSI updates

With auto, the signed updater task \WisprAI\Wispr Flow Updater runs as SYSTEM five minutes after boot, one minute after logon, and daily between 3 and 5 p.m. local time, verifies the downloaded MSI, and installs it without an administrator password. It checks integrity, signature, version, and UpgradeCode, never downgrades, is hidden in Task Scheduler, runs on battery, and has a one-hour execution limit. Standard users can start, but not edit, the task through Flow’s update actions; manual checks run at most once every 15 minutes, and additional attempts refresh the reported update status.

To pin a version, set MSI property AUTOUPDATE=0 at installation, or set HKLM\SOFTWARE\Policies\WisprAI\Flow\AutoUpdate (DWORD) to 0, which locks the setting on the device. Policy takes precedence in both directions: a non-zero policy value re-enables updates even after installation with AUTOUPDATE=0. When MSI updates are disabled or the machine updater is missing, Settings and the Flow menu show non-clickable Updates are managed by your organization and manual checking is disabled.

When Flow restarts

Automatic restarts require an unlocked session and 20 minutes since Flow was last used — not an idle device. They wait during dictation, meetings, and replacement-update downloads; meeting-audio saving or uploading delays installation by up to 60 minutes. Where active-user deferral applies with auto, Flow also waits while you are working, and after three hours of accumulated waiting it asks A new version of Wispr Flow is ready, with Restart now and Later. Non-auto cadences skip only this active-user deferral; the capture protections and 20-minute wait still apply. To apply a downloaded update sooner, select Update ready, restart now? in the Flow menu or the equivalent Settings action.

Verify the rollout

1. Complete onboarding on each test device. Continue appears only after required permissions are granted; Flow rechecks them when saving and shows an error if any are missing.

2. Dictate a short phrase; confirm that text appears in the target app.

3. Check the installed version using the platform method below.

On Windows, initial permission status alone does not establish microphone access: a permission request must successfully access the microphone before completing, so verify with test dictation. MDM, Group Policy, and privacy tools can leave registry values out of sync with Windows, and missing or unreadable values can look enabled. If blocked, Flow shows Microphone access is disabled and “Windows microphone privacy settings are blocking Flow. Open Settings to enable access.” Select Open Settings to reach Privacy & security → Microphone, enable the two toggles listed above, and test again.

Each MSI self-update is a full MSI upgrade, so its registered version matches the running version.

Organization privacy restrictions

Users make onboarding privacy choices unless organization policy locks them. Organization privacy restrictions — including applicable Zero Data Retention or data-sharing policies, or a signed HIPAA BAA — keep data sharing off and disable both toggles, with the notice “Your organization has disabled the use of your data for model improvement.” User preference changes cannot override these locks, which come from organization settings on the signed-in account, not an MDM profile. Settings tooltips identify whether HIPAA or organization policy prohibits model training. Organization policies can also override local mute-while-dictating, context-awareness, and local-data retention preferences when account settings refresh.

Recover a blocked rollout

Remove or roll back a deployment

Still need help?

Contact support for deployment or network problems, or if Mac Accessibility is still missing after the checks above; include your MDM provider, OS version, Flow version, and the steps you tried.