Deploy Wispr Flow via MDM

Last updated: June 19, 2026

Available on: Mac, Windows (MDM-managed devices)

Roll Wispr Flow out to your fleet with pre-authorized permissions, silent installs, and admin-controlled update frequency. This guide covers permission profiles, per-provider deployment steps, and enterprise data policies for macOS and Windows. Most deployments take 15–30 minutes per MDM.

Note: The MDM section lives in the Wispr Flow admin portal at admin.wisprflow.ai (sign in as a team admin). Use the Copy link button on each download card to get direct URLs. Some downloads (.mobileconfig and .ps1 files) may be delivered as .zip archives — unzip them before deployment.

Quick start

Follow these three steps to deploy Wispr Flow to your fleet. See the sections below for provider-specific instructions and enterprise data policies.

Install Wispr Flow. Download the installer for your platform (Windows .msi, Mac Apple Silicon .pkg, or Mac Intel .pkg) from the MDM section of admin.wisprflow.ai and upload it to your MDM as a silent install.
Pre-grant Accessibility on Mac. Download wispr-flow-accessibility.mobileconfig.zip, unzip it, and deploy the .mobileconfig file via your MDM so Mac users don't have to grant Accessibility manually.
Set the update policy (optional). Download the update policy file for your platform (Mac wispr-flow-managed-config.mobileconfig.zip or Windows wispr-flow-set-update-frequency.ps1.zip), unzip it, and deploy the file to control how often Flow checks for updates.

macOS permission profiles

Wispr Flow needs two macOS permissions. Only Accessibility can be pre-granted via MDM — macOS does not allow MDM pre-grant of microphone access for third-party apps, so users will see a one-time microphone prompt on first use.

Permission	Why
Accessibility	Required for text insertion into applications
Microphone	Required for speech-to-text dictation

The wispr-flow-accessibility.mobileconfig profile grants Accessibility only. Users get a one-time native Microphone prompt the first time Flow needs the microphone.

Note: Screen Capture permission (used for context-aware features) is requested at runtime when needed. It is not included in the provided MDM profile and is not shown during onboarding.

App identity info

These details are required when configuring your MDM:

Property	Value
Bundle Identifier	`com.electron.wispr-flow`
Helper App Bundle Identifier	`com.electron.wispr-flow.accessibility-mac-app` (include this in your PPPC profile alongside the main app identifier)
Team ID	`C9VQZ78H85`
Developer	Wispr AI INC (Apple Developer identity, used in code signing and notarization). On Windows, the CompanyName field in app metadata is Wispr AI (without "INC"). Both are valid; IT admins matching by publisher should be prepared for either string.
Code Requirement	`identifier "com.electron.wispr-flow" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = C9VQZ78H85`

Note: The code requirement string is generated by Apple's codesign tool at build time. Treat the value above as "verify on your signed copy" — IT admins should confirm the exact string on the signed binary using:
codesign -d --requirements - /Applications/Wispr\ Flow.app

The app is signed, notarized, and Gatekeeper-compliant. You do not need to disable Gatekeeper for deployment. Wispr Flow appears in both the menu bar and the Dock on macOS; users can hide the Dock icon in settings to switch the app to menu-bar-only mode.

MDM-managed auto-update policy

IT administrators can control how often Wispr Flow checks for and applies updates. When a policy is set, end users cannot override it — the Settings sidebar displays a message indicating that updates are managed by their organization, along with the next scheduled check date.

Update frequency options

Value	Behavior
`auto`	Default. Checks for updates periodically in the background.
`weekly`	Checks once per week.
`bi-weekly`	Checks every two weeks.
`monthly`	Checks every 30 days.

Note: Policy changes require an app restart to take effect. The next scheduled check date appears in the Settings sidebar update-button tooltip and shows only the day (e.g. "Fri, May 15"), not the hour. On Windows, if no policy value is present, the app falls back to auto.

Additional auto-update behaviors

Users may notice the following auto-update behaviors:

Update checks happen periodically in the background, not on a fixed clock.
Updates are deferred during active dictation and during an active meeting recording, with a short delay after dictation ends before an update is applied.
Failed updates retry with backoff before pausing. If updates continue to fail, an in-app "Update Error" notification appears with Restart and Contact Us buttons.

Deploying the update policy

macOS

Download wispr-flow-managed-config.mobileconfig.zip from the MDM section of admin.wisprflow.ai, unzip to get wispr-flow-managed-config.mobileconfig, and deploy it via your MDM (Jamf, Kandji, Mosyle, Intune, Rippling, etc.). The profile sets the UpdateFrequency value under managed preferences at com.electron.wispr-flow.

Windows

Two options are available:

PowerShell script: Download wispr-flow-set-update-frequency.ps1.zip, unzip to get wispr-flow-set-update-frequency.ps1, and deploy it as a post-install script (suitable for script-based MDMs like Rippling or Chef).
Registry / policy template: Set the registry value HKLM\SOFTWARE\Policies\WisprAI\Flow\UpdateFrequency (REG_SZ) directly via Intune, SCCM, GPO, or any registry-capable MDM.

Platform-specific deployment

macOS

Upload the architecture-specific .pkg (Apple Silicon or Intel) to your MDM. The macOS app ships in separate builds — deploy the one that matches your fleet.
Deploy to target devices. The PKG installs silently to /Applications with no user interaction.
Deploy wispr-flow-accessibility.mobileconfig (unzipped) to pre-grant Accessibility.
Verify: launch Wispr Flow on a test device. The Permissions onboarding page should show Accessibility as already granted with a green checkmark. Users will see a one-time native macOS Microphone prompt the first time Flow needs the microphone.

The auto-updater is enabled by default. Auto-updates are deferred during active dictation and during an active meeting recording session. Admins can control update frequency via the MDM-managed auto-update policy above.

The macOS minimum system version is macOS 12.0 (Monterey). This is enforced at runtime — the in-app dialog states "Wispr Flow requires MacOS 12.0 or later."

Note: On the Permissions onboarding page, clicking the microphone card shows the native macOS dialog. If denied, clicking again opens System Settings → Privacy & Security → Microphone. At runtime, if microphone permission was previously denied, the app opens System Settings automatically when access is needed.

Windows

Upload Wispr Flow-v{version}.msi to your MDM as a line-of-business app.
Run a silent install: msiexec /i "Wispr Flow-v{version}.msi" /quiet
Verify: confirm %ProgramFiles%\Wispr Flow\ exists on a target device and launch the app. Application data is stored at %APPDATA%\Wispr Flow\.

On Windows, Accessibility is not required. The Permissions onboarding page only shows the Microphone card, with an "Open Settings" button that opens Windows Settings → Privacy → Microphone. The page is skipped automatically when Flow detects that mic access is already granted.

To uninstall silently, run msiexec /x "Wispr Flow-v{version}.msi" /quiet or use the fixed upgrade GUID (works regardless of version): msiexec /x {396d8b98-0a0d-5d72-8e7e-5d0c442674e9} /quiet.

Note: Wispr Flow ships two Windows installers. Use the .msi for MDM/enterprise deployment. The .exe is for individual users and installs to %LOCALAPPDATA%\WisprFlow\. Flow checks microphone access at runtime — MDM/GPO policies that set registry-level microphone privacy values do not affect whether Flow can access the microphone.

MDM provider quick start

Jamf Pro

Upload the .pkg via Settings → Packages.
Create a deployment policy targeting the right computers or groups.
Deploy the PPPC profile: Configuration Profiles → Upload → select wispr-flow-accessibility.mobileconfig (unzipped).
Update by uploading a new PKG and creating a new policy, or use Patch Management.

Kandji

Navigate to Library → Custom Apps → Add Custom App and upload the .pkg.
Add an optional audit script to verify /Applications/Wispr Flow.app exists.
Deploy the PPPC profile: Library → Custom Profiles → Add Profile and upload wispr-flow-accessibility.mobileconfig (unzipped).
Update by replacing the PKG in the Custom App.

Microsoft Intune

macOS:

Navigate to Apps → macOS → Add → Line-of-business app and upload the .pkg.
Deploy the PPPC profile: Devices → Configuration profiles → Create profile → Templates → Custom and upload wispr-flow-accessibility.mobileconfig (unzipped).
Deploy the update policy: Devices → Configuration profiles → Create profile → Templates → Custom and upload wispr-flow-managed-config.mobileconfig (unzipped).

Windows:

Navigate to Apps → Windows → Add → Line-of-business app and upload Wispr Flow-v{version}.msi.
Set the silent install command: msiexec /i "Wispr Flow-v{version}.msi" /quiet
Set the update policy by deploying the registry value HKLM\SOFTWARE\Policies\WisprAI\Flow\UpdateFrequency (REG_SZ) via a Configuration profile or Settings Catalog.

Rippling

macOS:

Navigate to IT → Device Management → Software and upload the architecture-specific .pkg.
Set install type to "silent."
Deploy wispr-flow-accessibility.mobileconfig (unzipped) via IT → Device Management → Configuration Profiles.
Deploy wispr-flow-managed-config.mobileconfig (unzipped) via Configuration Profiles to set the update frequency policy.

Windows:

Navigate to IT → Device Management → Software and upload Wispr Flow-v{version}.msi.
Set install type to "silent."
Deploy wispr-flow-set-update-frequency.ps1 (unzipped) as a post-install script to set the update frequency policy.

Mosyle

Navigate to Management → Apps → Custom Apps and upload the .pkg.
Deploy the PPPC profile via Management → Profiles → Custom Profiles and upload wispr-flow-accessibility.mobileconfig (unzipped).

Munki

Import the PKG: munkiimport "Wispr Flow.pkg"
Deploy PPPC profiles separately via your MDM (Munki does not manage profiles).

Munki handles version comparison for updates automatically.

Fleet

Add the PKG to the software library or use a custom policy.
Deploy PPPC profiles via Fleet's MDM profile management.
Verify installation with: SELECT * FROM apps WHERE name = 'Wispr Flow'

Enterprise data policies

Enterprise admins can configure additional data policies for their team through the Wispr Flow admin portal. In the desktop app, team admins see an "Admin portal" button in Team settings that opens the portal. Regular team members see a "Contact admins" button instead, which opens a dialog with a free-text message that is delivered to team admins.

Note: The Enterprise Plan–only settings are ZDR, Local Data Deletion, and Enforce SSO. These require an Enterprise (Flow Business) subscription and are not available on individual or Team-only plans. Users see this plan labeled "Enterprise" in the app. IP Allowlist additionally requires Wispr to enable visibility — Enterprise customers must contact Wispr support to turn it on.

Privacy and retention

Zero Data Retention (ZDR): Locks Privacy Mode ON for all team members. Users cannot disable it.
Privacy mode (admin control): Enterprise admins can set this to Enforced for everyone — which locks Privacy Mode on for all team members — or Managed individually, which lets each user control the setting themselves. When set to "Enforced for everyone" and Cloud sync is set to "Disabled for everyone," Zero Data Retention status is active for the team.
Cloud sync (admin control): Enterprise admins can set this to Disabled for everyone — which prevents transcripts and audio from being stored on Wispr's servers and turns off features that require cloud sync (such as Wispr Notetaker and cross-device Scratchpad sync) — or Managed individually, which lets each user control the setting themselves. This setting is also automatically locked off when a HIPAA BAA is signed.
Data Sharing (admin control): Enterprise admins can prevent team members from sharing usage data (audio, transcripts, and edits) with Wispr for AI training and improvement. This setting can also be locked off by HIPAA settings or organization privacy settings.
Local Data Deletion: Three policy levels are available — Store Normally (default), Delete After 24 Hours (deletes transcription history and AI editing data older than 24 hours), or Never Store (never writes transcription or AI editing data to the local device). Selecting Never Store or Delete After 24 Hours shows a confirmation dialog the user must accept. Switching back to Store Normally applies immediately without a confirmation dialog. Selecting Delete After 24 Hours also immediately deletes existing data older than 1 day (not only future writes). When the enterprise enforces Delete After 24 Hours, the dropdown is not fully locked — Store Normally is filtered out of the choices and the description text changes to a "restricted" variant, but users can still choose between Delete After 24 Hours and Never Store. When the enterprise enforces Never Store, the dropdown is fully locked with a "Managed by your organization" tooltip. When Delete After 24 Hours or Never Store is active, the Your Voice tab in the Insights page is hidden for affected users because Voice Profile requires locally stored transcripts; the Your Usage and Leaderboard tabs are unaffected.
HIPAA Business Associate Agreement (BAA): Enterprise admins manage the BAA through the admin portal. Individual users can view and sign a BAA directly within the app. Signing permanently locks Privacy Mode ON, and also disables Data Sharing and Cloud Sync account-wide; these cannot be re-enabled from any device after signing. The BAA is account-wide (one signature per user), not per-device. To enforce Privacy Mode for all team members, also enable ZDR. BAA and ZDR are independent — both can lock Privacy Mode. For users on an active Flow Business (Enterprise) plan who have not yet signed an org-level BAA, the in-app HIPAA button redirects to the admin portal. Team-plan members and individual (non-enterprise) users still see the in-app sign dialog. For HIPAA-signed organizations, Wispr may lock the ZDR toggle so it cannot be edited; if your ZDR toggle is uneditable, contact support.

Warning: When Never Store is activated, all previously stored transcription history and AI editing data on the device is immediately deleted — it does not just prevent future writes. Signing a BAA is also irreversible, and the signer must enter their legal name to confirm. ZDR, by contrast, can be enabled or disabled by enterprise admins through the admin portal.

Identity and access

Enforce SSO: Requires all team members to authenticate via your organization's SSO provider. SSO enforcement is domain-based and applies to all users whose email domain matches your enterprise's registered domain(s). Supports SCIM directory sync for automated user provisioning. The Enforce SSO toggle in the admin portal is only visible after SSO is connected. SSO enforcement also requires the enterprise to have live billing — if the subscription has lapsed, Enforce SSO is not applied even when the setting is enabled.
Auto-Invite by Domain: Users with matching email domains can request to join your enterprise team. If auto-accept is configured, requests are approved immediately; otherwise, they go to admins for approval.
IP Allowlist: When access is blocked by IP allowlist, the user is signed out and shown a full-screen block page. The subtitle includes the enterprise name when known (e.g. "Your IP address is not allowed by {EnterpriseName}"); when the enterprise name is unavailable, a generic subtitle is shown instead. The page includes Retry and Sign Out buttons. The IP Allowlist UI in the admin portal is gated — Enterprise customers must contact Wispr to enable it.

Note: SSO enforcement requires an active Enterprise subscription.

SCIM directory sync

When SCIM directory sync is enabled, the invite button is hidden, join request approve and deny actions are hidden, and the other domain users tab shows: "User management is controlled by your identity provider via SCIM." All user management must be done through your identity provider.

SCIM provisioning respects your seat cap. If the cap is exceeded, new user provisioning is blocked — a seat-cap-exceeded SCIM attempt does not fall back to email invitation; seat-cap blocks are final. If automatic provisioning fails for other reasons, the system falls back to sending a regular email invitation through the standard invite flow with the default Member role.

SCIM-provisioned users are added with the default Member role. Admin or IT Admin roles must be assigned manually after the user is provisioned, via the admin portal. The IT Admin role is non-billable (it does not consume a paid seat); Admin, SuperAdmin, and Member roles are billable.

Compliance documentation

Enterprise customers can request SOC 2 Type II compliance documentation by contacting Wispr support.

Common issues

Wispr Flow crashes on launch on Windows (GPU-related crash)

Some Windows users — across Intel, NVIDIA, and AMD GPUs — saw crashes where Wispr Flow failed to start because of an error initializing the graphics process. This was fixed in a subsequent release. Update Wispr Flow to the latest version to resolve.

Microphone list is empty in settings after a recent upgrade on Windows

After a recent Windows upgrade, some users saw a blank microphone selection dialog in settings with no audio devices listed. This was fixed in a subsequent release. Update Wispr Flow to the latest version to resolve.

Windows users incorrectly told microphone privacy is disabled (MDM/GPO-managed devices)

On some Windows machines — particularly those managed by MDM/GPO policies or third-party privacy management tools — Wispr Flow incorrectly showed a "microphone privacy disabled" error and blocked dictation, even when the microphone was working. Fixed in a subsequent release; Flow now checks microphone access at runtime instead of relying on registry values. Update Wispr Flow to the latest version to resolve.

After updating, make sure both the global Microphone access toggle and the Let desktop apps access your microphone sub-toggle in Windows Settings are enabled. Registry/GPO-level changes that only affect one of these may not be sufficient.

Clicking to grant permissions opens the wrong System Settings pane on macOS 26 (Tahoe)

On macOS 26 (Tahoe), clicking to grant Accessibility, Microphone, or Screen Capture permissions during onboarding could open the wrong System Settings pane or nothing at all. Fixed in current versions. Update Wispr Flow to the latest version to resolve.

"Your Voice" tab in Insights shows "Unlocks in 2,000 words" and never progresses

Users on a Local Data Deletion policy (Delete After 24 Hours or Never Store) previously saw the Your Voice tab in Insights permanently stuck at "Unlocks in 2,000 words" because Voice Profile requires locally stored transcripts. The tab is now hidden for affected users. Update Wispr Flow to the latest version to resolve. The Your Voice tab will reappear if the policy is changed back to Store Normally.

FAQs

Do end users need to do anything after deployment?

Yes. Users still go through onboarding when they first launch Wispr Flow. During onboarding, users set their data sharing preferences — they can independently control whether their data is stored in the cloud (Cloud Sync) and whether their usage data helps improve Flow's AI (Data Sharing). These settings can also be adjusted later in Settings → Data and Privacy. Either or both can be locked by enterprise policy (ZDR, HIPAA BAA, or admin-controlled Cloud Sync/Data Sharing settings).

On macOS with the PPPC profile deployed, the Permissions page shows Accessibility as already granted. Users see a one-time native macOS prompt for Microphone access.

What happens if I deploy without the configuration profile?

Users are prompted to manually grant Accessibility permissions in System Settings the first time they launch Wispr Flow. The app guides them through it, but it requires user interaction. For microphone access, users see a native macOS permission dialog the first time Flow needs the microphone.

Can I use this profile for non-managed devices?

No. The configuration profile is for MDM-managed deployments only. On non-managed devices, users follow the standard installation process and approve Accessibility permissions manually.

What MDM solutions are supported?

Instructions are provided for Jamf Pro, Kandji, Microsoft Intune, Rippling, Mosyle, Munki, and Fleet. The .mobileconfig profile works with any MDM that supports custom configuration profiles. For other MDM solutions, contact Wispr support.

Can admins control how often Wispr Flow updates?

Yes. See the MDM-managed auto-update policy section above for available frequency values and deployment details. When a policy is active, users cannot change this setting and will see a message in the Settings sidebar confirming that updates are managed by their organization.

Can admins control Cloud Sync and Data Sharing independently?

Yes. Enterprise admins have separate controls for Cloud Sync and Data Sharing in the admin portal. Setting Cloud sync to "Disabled for everyone" prevents transcripts and audio from being stored on Wispr's servers and turns off features that depend on it (Wispr Notetaker and cross-device Scratchpad sync). Disabling Data Sharing prevents usage data from being used to train or improve Flow's AI models. Either or both can be locked independently of each other, and both are automatically locked off when a HIPAA BAA is signed.

I deployed a new update policy but nothing changed

Policy changes take effect on the next app launch. After deploying a new policy via your MDM, have the user quit and relaunch Wispr Flow for the new cadence to apply.

Will users on a data deletion policy see the Voice Profile / "Your Voice" tab?

No. See the Local Data Deletion bullet above — when Delete After 24 Hours or Never Store is enforced, the Your Voice tab is hidden for those users. The Your Usage and Leaderboard tabs remain available.

Permissions are not pre-granted after deploying the PPPC profile (macOS)

Make sure the profile is deployed to the device, not just the user. On macOS 15+, a restart may be needed after profile installation. Verify the profile is installed by checking System Settings → Profiles on the target device. If a permission request stalls, the user sees an error toast and may need to retry.

The app fails to launch after PKG install (macOS)

Check Console.app for crash logs related to com.electron.wispr-flow. Verify the app signature with codesign --verify --deep /Applications/Wispr\ Flow.app.

The MSI fails when deployed via MDM (Windows)

Make sure you are deploying as SYSTEM, not user context. Use the .msi installer, not the .exe.

How do I check the installed version?

macOS: Run defaults read /Applications/Wispr\ Flow.app/Contents/Info.plist CFBundleShortVersionString
Windows: Check the registry at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall for the Wispr Flow entry.

How do I uninstall Wispr Flow?

macOS: Delete /Applications/Wispr Flow.app. Optionally remove user data at ~/Library/Application Support/Wispr Flow/.
Windows: Uninstall via Add/Remove Programs, or silently with msiexec /x "Wispr Flow-v{version}.msi" /quiet. The GUID approach msiexec /x {396d8b98-0a0d-5d72-8e7e-5d0c442674e9} /quiet is recommended for MDM scripts. Optionally remove user data at %APPDATA%\Wispr Flow\.

The MSI always installs to %ProgramFiles%\Wispr Flow\ — users cannot pick a custom install location.

What does "helper service persistent failure" mean?

If the native helper app fails to start after multiple retries, a persistent notification appears. Verify the helper app exists at the expected path inside Wispr Flow.app/Contents and check Accessibility permissions.

Limitations and notes

MDM deployment is supported on Mac and Windows only.
The macOS app ships in separate Apple Silicon (arm64) and Intel (x86_64) builds — deploy the architecture that matches your fleet.
On macOS, only Accessibility can be pre-granted via MDM. Microphone access cannot be pre-granted for third-party apps, so users will be prompted on first use.
When an MDM-managed update frequency policy is active, the setting cannot be overridden by end users.
SCIM provisioning currently assigns the default Member role only; Admin and IT Admin roles must be assigned manually in the admin portal.
Granular per-domain capture policies are in development; the currently shipped Auto-Invite is an enterprise-wide toggle.

Still need help?

Reach out to Wispr support if:

You need help configuring one of the MDM providers listed above.
Permissions are not granting correctly after profile deployment.
You need help configuring enterprise data policies or requesting SOC 2 documentation.

When you write in, include your MDM provider, OS version, the Wispr Flow version, and what you have already tried. Most MDM issues are resolved in one or two replies.