> ## Documentation Index
> Fetch the complete documentation index at: https://docs.granola.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Granola with MDM

> Configure Granola settings across managed macOS and Windows devices.

IT admins can use mobile device management (MDM) to configure Granola across managed macOS and Windows devices.

Granola currently supports one managed setting:

| Setting        | Type    | Default | What it does                                                                       |
| -------------- | ------- | ------- | ---------------------------------------------------------------------------------- |
| `DisableOAuth` | Boolean | `false` | Removes personal Google and Microsoft account sign-in. Users must use SSO instead. |

<Warning>
  Make sure SSO is configured for your workspace before enabling `DisableOAuth`. This setting changes the sign-in options shown in the app; it does not configure SSO or sign out people who are already signed in.
</Warning>

## macOS

Deploy a managed preferences profile to the device channel with:

* Preference domain: `com.granola.app`
* Key: `DisableOAuth`
* Type: Boolean
* Value: `true`

MDM tools commonly support two ways to configure these preferences. Choose one:

* **App or custom settings:** Set the preference domain to `com.granola.app` and use the following property list as the settings content:

```xml theme={null}
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>DisableOAuth</key>
    <true/>
</dict>
</plist>
```

* **Complete configuration profile:** Upload the complete `.mobileconfig` below.

<Accordion title="disable-granola-oauth.mobileconfig">
  ```xml theme={null}
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
  <dict>
      <key>PayloadContent</key>
      <array>
          <dict>
              <key>PayloadContent</key>
              <dict>
                  <key>com.granola.app</key>
                  <dict>
                      <key>Forced</key>
                      <array>
                          <dict>
                              <key>mcx_preference_settings</key>
                              <dict>
                                  <key>DisableOAuth</key>
                                  <true/>
                              </dict>
                          </dict>
                      </array>
                  </dict>
              </dict>
              <key>PayloadDisplayName</key>
              <string>Granola managed preferences</string>
              <key>PayloadIdentifier</key>
              <string>ai.granola.disable-oauth.managed-preferences</string>
              <key>PayloadType</key>
              <string>com.apple.ManagedClient.preferences</string>
              <key>PayloadUUID</key>
              <string>2A0BD827-1DB1-44F1-9E78-690BDB3C972B</string>
              <key>PayloadVersion</key>
              <integer>1</integer>
          </dict>
      </array>
      <key>PayloadDescription</key>
      <string>Requires people to sign in to Granola with SSO.</string>
      <key>PayloadDisplayName</key>
      <string>Granola sign-in settings</string>
      <key>PayloadIdentifier</key>
      <string>ai.granola.disable-oauth</string>
      <key>PayloadOrganization</key>
      <string>Granola</string>
      <key>PayloadScope</key>
      <string>System</string>
      <key>PayloadType</key>
      <string>Configuration</string>
      <key>PayloadUUID</key>
      <string>699C98C4-FD47-4BA9-8C54-02F5C9CBB0BD</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
  </dict>
  </plist>
  ```
</Accordion>

## Windows

Create the following registry value in the device context:

| Registry path                                  | Value name     | Type        | Value |
| ---------------------------------------------- | -------------- | ----------- | ----- |
| `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Granola` | `DisableOAuth` | `REG_DWORD` | `1`   |

You can configure the value directly in your MDM, or deploy it with PowerShell:

```powershell theme={null}
$path = "HKLM:\SOFTWARE\Policies\Granola"

New-Item -Path $path -Force
New-ItemProperty -Path $path -Name "DisableOAuth" -PropertyType DWord -Value 1 -Force
```

Run the script as an administrator or in the MDM's system context.

## Verify the setting

Deploy the setting to a test device, then fully quit and reopen Granola. On the sign-in screen:

* **Sign in with Google** and **Sign in with Microsoft** should not appear.
* The SSO email field should appear automatically.

To allow OAuth sign-in again, remove the managed setting or set it to `false` on macOS or `0` on Windows, then fully quit and reopen Granola.

If you need help with your MDM, contact us at **[hey@granola.so](mailto:hey@granola.so)**.