Managed configuration (MDM)

Enforce Missive desktop app settings across managed machines with MDM, Group Policy, or a registry file. For IT administrators.

Enforce settings on the Missive desktop app across your fleet using the tools you already deploy with: an MDM (Jamf, Kandji, Mosyle, Intune, Rippling), Group Policy, or a registry file. Settings you push this way are locked, so users can't change them from inside Missive.

Today there is one managed setting: disabling the in-app auto-updater.

This page is for IT administrators deploying Missive across an organization. If you're a single user, you don't need any of this.

Why disable the in-app updater

On managed machines, users usually don't have administrator rights. When Missive's in-app updater runs on macOS, it needs to authenticate a privileged helper-tool prompt that those users can't approve, so the update fails.

The fix is to turn off the in-app updater through managed configuration and deliver Missive updates through your own deployment tooling (your MDM, Group Policy, or software distribution system) instead.

Missive has two layers of updates, and this setting only affects one of them:

• App updates (the Electron wrapper installed on disk) are infrequent. Installing them writes to disk and, on macOS, needs administrator rights. This is what the AutoUpdate setting disables.
• Interface updates (the web assets) ship about every two weeks and are what users see most often. They apply with a quick reload, write nothing to disk, and need no administrator rights, so they keep working normally even with the in-app updater disabled.

How it works

A managed setting is read from the first source that defines it:

1. macOS - a configuration profile (.mobileconfig) targeting Missive's preference domain.
2. Windows - Group Policy under SOFTWARE\Policies\Missive (the machine-wide HKEY_LOCAL_MACHINE takes precedence over the per-user HKEY_CURRENT_USER).

An OS-native policy is always authoritative, so a user can't re-enable something you've disabled.

Managed configuration is read once when Missive launches. After you push or change a setting, the app must be fully quit and reopened for it to take effect.

Available setting

Setting	macOS key	Windows value	Type
Auto-update	AutoUpdate (domain com.missiveapp.osx)	AutoUpdate (REG_DWORD under SOFTWARE\Policies\Missive)	boolean

Set auto-update to false (macOS) or 0 (Windows) to disable the in-app updater.

Template files

Download the ready-made templates referenced below:

File	Platform	Use
com.missiveapp.osx.mobileconfig	macOS	Full configuration profile
missive-policies.reg	Windows	Registry file
missive.admx	Windows	Group Policy template (definitions)
missive.adml	Windows	Group Policy template (en-US strings)

macOS

Recommended: paste into your MDM

Every MDM has a payload called something like Application & Custom Settings or Custom Preference Domain. Set the preference domain to com.missiveapp.osx and supply these settings. Your MDM wraps them in a profile for you:

<dict>
  <key>AutoUpdate</key>
  <false/>
</dict>

Advanced: deploy the full profile

For scripted deploys or MDMs without a custom-settings interface, deploy the ready-made profile com.missiveapp.osx.mobileconfig. Before distributing it, regenerate the PayloadUUID and PayloadIdentifier values for your organization and sign the profile. It contains exactly the snippet above wrapped in the profile envelope.

Verify on a managed Mac

Forced values land in /Library/Managed Preferences, not the app's regular domain, so a plain defaults read com.missiveapp.osx won't show them. Read the managed file instead:

# Device-scoped profile:
defaults read "/Library/Managed Preferences/com.missiveapp.osx" AutoUpdate   # -> 0 when disabled

# User-scoped profile (substitute the short username):
defaults read "/Library/Managed Preferences/$USER/com.missiveapp.osx" AutoUpdate

Windows

Recommended: import the registry file

Import missive-policies.reg (double-click, or push it through your management tooling). It sets the policy machine-wide under HKEY_LOCAL_MACHINE.

Advanced: Group Policy template

For domain-managed fleets, deploy the ADMX/ADML template:

1

Copy the definitions file

Copy missive.admx to %SystemRoot%\PolicyDefinitions\, or to your domain's Central Store.

2

Copy the language file

Copy missive.adml to the matching en-US\ folder (%SystemRoot%\PolicyDefinitions\en-US\).

3

Configure the policy

The Missive auto-update setting now appears in the Group Policy editor, where you can disable it.

Verify on a managed PC

reg query "HKLM\SOFTWARE\Policies\Missive" /v AutoUpdate

After you disable updates

With the in-app updater off, Missive won't update the app (the Electron wrapper) on its own. Deliver new versions through your own deployment tooling so managed machines stay on a current build.

Interface updates are unaffected. Users still get the regular interface improvements through a reload, with no disk writes and no administrator rights required. App updates are rare, so in practice you'll only need to push a new build occasionally.

Related

• Organization settings - Configure organization-wide behavior
• Security - How Missive protects your team's data