Deploying CarePilot Dictate with MDM (configuration profile)

A macOS configuration profile (.mobileconfig) lets IT lock two CarePilot Dictate settings on every managed Mac: whether the app updates itself, and how long it waits before signing out an inactive user.

This article is for IT administrators who manage Macs with an MDM such as Jamf Pro, Kandji, Microsoft Intune or Mosyle. When a setting is managed, users see it as locked in Dictate with the note "Managed by your organization." Removing the profile gives control back to the user.

Managed settings apply to the Mac app only. Windows installs are not affected by a configuration profile.

You need three things:

Policies are read when Dictate launches. After you install, change or remove a profile, users must fully quit Dictate from its menu bar icon and reopen it. Closing the settings window is not enough, because the app keeps running in the menu bar.

You can deploy either a complete .mobileconfig file or just the settings, depending on what your MDM accepts.

This profile turns off in-app updates and signs users out after 15 minutes of inactivity. The file is unsigned. Most MDMs sign profiles when they deliver them.

Use this when your MDM asks for a preference domain (com.carepilot.dictate) and a plist file separately.

Menu names change between MDM versions. Check your vendor's documentation if a path below does not match.

The profile supports two keys. Leave a key out to keep the user in control of that setting.

What counts as activity. Only using Dictate itself: interacting with its window or dictating. Typing in other apps does not keep a user signed in. Sleep and restarting the app do not reset the timer. Dictate does not track system-wide keystrokes to measure this.

The seven-day limit still applies. Every sign-in expires after seven days, even when the timeout is 0 (Never).

Invalid values fall back to the stricter setting. Dictate logs a configuration warning and then:

Common mistakes that count as invalid: strings such as "true" or "15", decimal numbers such as 15.0, negative numbers, and timeouts from 1 to 4 or above 120.

Profile values only. Dictate reads only settings that an MDM profile enforces. Values set with defaults write on a Mac are ignored for policy.

Test on one enrolled Mac before rolling out widely. Use a test account, not a clinician's live account.

The profile is installed, but Dictate still lets users change the settings. Dictate reads policy only at launch. Have the user quit Dictate from the menu bar and reopen it. If the settings are still unlocked, check that the preference domain is exactly com.carepilot.dictate.

The timeout is 15 minutes, but I set something else. The value was probably invalid, so Dictate used its 15-minute fallback. Make sure the value is an integer (<integer>, not <string> or <real>) and is 0 or between 5 and 120.

Updates are off, but I never set DisableAppUpdates to true. An invalid value, such as the string "false", turns updates off. Use a real Boolean (<false/>) or remove the key.

Where do I find the configuration warning? In Dictate's log on the affected Mac, at ~/Library/Logs/com.carepilot.dictate/. Warnings start with [mdm].

Users lost dictation access after we turned off updates. Their installed version is probably below CarePilot's minimum supported version. Deploy the current Dictate release through your MDM. Turning off in-app updates does not exempt a Mac from the minimum version.

Can I still push new versions with my MDM when updates are off? Yes. The profile only blocks Dictate's own updater. Replacing the app through your MDM or another install process still works.

What happens to a user's own setting when we remove the profile? The user's saved setting returns after they restart Dictate. Managed values never overwrite the user's own preferences.

Does this work on Windows? No. Configuration profiles are a macOS feature, and Windows installs of Dictate are not affected.