> For the complete documentation index, see [llms.txt](https://missiveapp.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://missiveapp.com/docs/device-management/managed-configuration.md).

# Managed configuration (MDM)

Enforce settings on the Missive desktop app across your fleet using the tools you already deploy with: an MDM (Jamf, Kandji, Mosyle, Intune, Rippling), Group Policy, or a registry file. Settings you push this way are locked, so users can't change them from inside Missive.

Today there is one managed setting: **disabling the in-app auto-updater**.

{% hint style="info" %}
This page is for IT administrators deploying Missive across an organization. If you're a single user, you don't need any of this.
{% endhint %}

## Why disable the in-app updater

On managed machines, users usually don't have administrator rights. When Missive's in-app updater runs on macOS, it needs to authenticate a privileged helper-tool prompt that those users can't approve, so the update fails.

The fix is to turn off the in-app updater through managed configuration and deliver Missive updates through your own deployment tooling (your MDM, Group Policy, or software distribution system) instead.

{% hint style="info" %}
Missive has two layers of updates, and this setting only affects one of them:

* **App updates** (the Electron wrapper installed on disk) are infrequent. Installing them writes to disk and, on macOS, needs administrator rights. This is what the `AutoUpdate` setting disables.
* **Interface updates** (the web assets) ship about every two weeks and are what users see most often. They apply with a quick reload, write nothing to disk, and need no administrator rights, so they keep working normally even with the in-app updater disabled.
  {% endhint %}

## How it works

A managed setting is read from the first source that defines it:

1. **macOS** - a configuration profile (`.mobileconfig`) targeting Missive's preference domain.
2. **Windows** - Group Policy under `SOFTWARE\Policies\Missive` (the machine-wide `HKEY_LOCAL_MACHINE` takes precedence over the per-user `HKEY_CURRENT_USER`).

An OS-native policy is always authoritative, so a user can't re-enable something you've disabled.

{% hint style="warning" %}
Managed configuration is read once when Missive launches. After you push or change a setting, the app must be **fully quit and reopened** for it to take effect.
{% endhint %}

### Available setting

| Setting     | macOS key                                  | Windows value                                                | Type    |
| ----------- | ------------------------------------------ | ------------------------------------------------------------ | ------- |
| Auto-update | `AutoUpdate` (domain `com.missiveapp.osx`) | `AutoUpdate` (`REG_DWORD` under `SOFTWARE\Policies\Missive`) | boolean |

Set auto-update to **false** (macOS) or **0** (Windows) to disable the in-app updater.

## Template files

Download the ready-made templates referenced below:

| File                                                                                                      | Platform | Use                                   |
| --------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------- |
| [`com.missiveapp.osx.mobileconfig`](https://downloads.missiveapp.com/mdm/com.missiveapp.osx.mobileconfig) | macOS    | Full configuration profile            |
| [`missive-policies.reg`](https://downloads.missiveapp.com/mdm/missive-policies.reg)                       | Windows  | Registry file                         |
| [`missive.admx`](https://downloads.missiveapp.com/mdm/missive.admx)                                       | Windows  | Group Policy template (definitions)   |
| [`missive.adml`](https://downloads.missiveapp.com/mdm/missive.adml)                                       | Windows  | Group Policy template (en-US strings) |

## macOS

### Recommended: paste into your MDM

Every MDM has a payload called something like **Application & Custom Settings** or **Custom Preference Domain**. Set the preference domain to `com.missiveapp.osx` and supply these settings. Your MDM wraps them in a profile for you:

```xml
<dict>
  <key>AutoUpdate</key>
  <false/>
</dict>
```

### Advanced: deploy the full profile

For scripted deploys or MDMs without a custom-settings interface, deploy the ready-made profile [`com.missiveapp.osx.mobileconfig`](https://downloads.missiveapp.com/mdm/com.missiveapp.osx.mobileconfig). Before distributing it, regenerate the `PayloadUUID` and `PayloadIdentifier` values for your organization and sign the profile. It contains exactly the snippet above wrapped in the profile envelope.

### Verify on a managed Mac

Forced values land in `/Library/Managed Preferences`, not the app's regular domain, so a plain `defaults read com.missiveapp.osx` won't show them. Read the managed file instead:

```sh
# Device-scoped profile:
defaults read "/Library/Managed Preferences/com.missiveapp.osx" AutoUpdate   # -> 0 when disabled

# User-scoped profile (substitute the short username):
defaults read "/Library/Managed Preferences/$USER/com.missiveapp.osx" AutoUpdate
```

## Windows

### Recommended: import the registry file

Import [`missive-policies.reg`](https://downloads.missiveapp.com/mdm/missive-policies.reg) (double-click, or push it through your management tooling). It sets the policy machine-wide under `HKEY_LOCAL_MACHINE`.

### Advanced: Group Policy template

For domain-managed fleets, deploy the ADMX/ADML template:

{% stepper %}
{% step %}

### Copy the definitions file

Copy [`missive.admx`](https://downloads.missiveapp.com/mdm/missive.admx) to `%SystemRoot%\PolicyDefinitions\`, or to your domain's Central Store.
{% endstep %}

{% step %}

### Copy the language file

Copy [`missive.adml`](https://downloads.missiveapp.com/mdm/missive.adml) to the matching `en-US\` folder (`%SystemRoot%\PolicyDefinitions\en-US\`).
{% endstep %}

{% step %}

### Configure the policy

The Missive auto-update setting now appears in the Group Policy editor, where you can disable it.
{% endstep %}
{% endstepper %}

### Verify on a managed PC

```bat
reg query "HKLM\SOFTWARE\Policies\Missive" /v AutoUpdate
```

## After you disable updates

With the in-app updater off, Missive won't update the app (the Electron wrapper) on its own. Deliver new versions through your own deployment tooling so managed machines stay on a current build.

Interface updates are unaffected. Users still get the regular interface improvements through a reload, with no disk writes and no administrator rights required. App updates are rare, so in practice you'll only need to push a new build occasionally.

## Related

* [Organization settings](/docs/administration/organization-settings.md) - Configure organization-wide behavior
* [Security](/docs/administration/security.md) - How Missive protects your team's data


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://missiveapp.com/docs/device-management/managed-configuration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.