> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cluely.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MDM Permissions

> Configure Cluely to transcribe your meetings from Microphone and System Audio

## Overview

This guide provides IT administrators with the necessary steps to ensure Cluely's automatic updates work properly on managed work computers. Cluely uses secure, signed updates to deliver new features and security patches to ensure optimal performance and security.

## "An Update Is Ready To Start"

If you are getting a native macOS Update Helper request every 5- 15 minutes, \*\*please note that these are not Update Requests. \*\*Cluely only releases every 2 days. You are using Cluely on a laptop that is strictly IT or MDM managed.

Cluely requests system access every 5 minutes to refresh for calendar events, audio changes, and update checking. This is not something we can disable, but you can intro your IT team to our sales team to get Cluely approved system wide.

In the meantime, please use Cluely on a non-work laptop.

## Common Issues

### Update Helper: Admin Password

Seeing a request to enter MacOS password to approve an update? This is a sign you have a corporate managed device and an **IT Admin did not approve or install Cluely**. The root of the problem is that these apps were installed system-wide (and thus triggering the work level approval), instead of local user storage.

1. \*\*Local Applications Fix: \*\*\
   The immediate workaround is to copy Cluely to a place where your current user has write access:  `killall Slack && rsync -av --delete /Applications/Slack.app/ ~/Applications/Slack.app/ && open ~/Applications/Slack.app `

   (if you prefer the Finder, drag and drop instead).\
   \
   Now when the Cluely application's built-in update mechanism tries to write to its files, it can. No more annoying pop-up windows!
2. **Delete the Cluely.dmg and Have an IT Admin Install Cluely Instead**

## Network Requirements

### Required Domain Whitelisting

To allow Cluely auto-updates, whitelist the following domains in your firewall, proxy, and network security settings:

**Core Cluely Services:**

* `platform.cluely.com`
* `service.transcribe.cluely.com`
* `app.cluely.com`
* `desktop.cluely.com`
* `desktop.app.cluely.com`
* `flags.cluely.com`
* `img.cluely.com`

**Update-Specific Endpoints:**

* `updates.cluely.com` (primary update server)
* `downloads.cluely.com` (update package downloads)
* `api.cluely.com` (update check API)

### Network Protocol Requirements

Ensure the following protocols are allowed:

* **HTTPS (443)** - For secure update downloads and API communication
* **WebSocket Secure (WSS)** - For real-time update notifications
* **HTTP/2** - For efficient update package delivery

### Corporate Network Considerations

If your organization uses:

* **Corporate Proxy**: Configure proxy settings to allow Cluely update traffic
* **SSL Inspection**: Add Cluely domains to SSL inspection bypass list
* **Content Filtering**: Whitelist Cluely domains to prevent update blocking

## Code Signing Certificate Management

Cluely signs all update packages with digital certificates to ensure authenticity and integrity. You must recognize and trust these certificates on managed devices.

<Tabs>
  <Tab title="macOS">
    ### 1. Retrieve Cluely's Code-Signing Certificate

    Download the latest Cluely application from [cluely.com/downloads](https://cluely.com/downloads) and extract the certificate information:

    ```bash theme={null}
    # Navigate to the downloaded Cluely.app
    cd /Applications/Cluely.app

    # Display code-signing information
    codesign -dv --verbose=4 /Applications/Cluely.app

    # Get certificate details
    codesign -d --extract-certificates /Applications/Cluely.app
    ```

    Look for the `Authority` field in the output, which shows the certificate's Common Name (CN).

    ### 2. Configure Application Whitelisting

    **For Google Santa:**

    ```bash theme={null}
    # Whitelist by certificate SHA-256 hash
    sudo santactl rule --whitelist --certificate --sha256 <SHA-256_HASH>

    # Whitelist by team identifier
    sudo santactl rule --whitelist --teamid <TEAM_ID>
    ```

    **For Jamf Pro:**

    1. Navigate to Configuration Profiles
    2. Create new profile for Application & Custom Settings
    3. Add Cluely's team identifier to allowed applications
    4. Deploy to managed devices

    **For Microsoft Intune:**

    1. Go to Device Configuration > macOS > Configuration Profiles
    2. Create new profile with "Application & Custom Settings"
    3. Add Cluely's bundle identifier and team ID
    4. Assign to device groups

    ### 3. Gatekeeper Configuration

    Ensure Gatekeeper allows Cluely updates:

    ```bash theme={null}
    # Check current Gatekeeper status
    spctl --status

    # Allow Cluely specifically (if needed)
    sudo spctl --add /Applications/Cluely.app
    ```

    ### 4. Notarization Trust

    Cluely updates are notarized by Apple. Ensure your devices trust notarized applications:

    ```bash theme={null}
    # Verify notarization
    spctl --assess --verbose /Applications/Cluely.app
    ```
  </Tab>

  <Tab title="Windows">
    ### 1. Retrieve Cluely's Code-Signing Certificate

    Download the latest Cluely installer from [cluely.com/downloads](https://cluely.com/downloads):

    1. Right-click the installer file
    2. Select "Properties"
    3. Navigate to "Digital Signatures" tab
    4. Click on the certificate and select "View Certificate"
    5. Note the certificate details (Issuer, Subject, Thumbprint)

    ### 2. Add Certificate to Trusted Publishers

    **Method 1: Group Policy (Recommended)**

    1. Open Group Policy Management Console
    2. Navigate to Computer Configuration > Windows Settings > Security Settings > Public Key Policies
    3. Right-click "Trusted Publishers" and select "Import"
    4. Import Cluely's certificate
    5. Deploy policy to managed devices

    **Method 2: PowerShell (For individual devices)**

    ```powershell theme={null}
    # Import certificate to Trusted Publishers store
    Import-Certificate -FilePath "cluely-certificate.cer" -CertStoreLocation "Cert:\LocalMachine\TrustedPublisher"

    # Verify certificate installation
    Get-ChildItem -Path "Cert:\LocalMachine\TrustedPublisher" | Where-Object {$_.Subject -like "*Cluely*"}
    ```

    ### 3. Windows Defender Application Control (WDAC)

    If using WDAC, create a policy that allows Cluely:

    ```powershell theme={null}
    # Create WDAC policy for Cluely
    New-CIPolicy -FilePath "CluelyPolicy.xml" -Level FilePublisher -Fallback Hash -UserPEs

    # Add Cluely certificate to policy
    Add-SignerRule -FilePath "CluelyPolicy.xml" -CertificatePath "cluely-certificate.cer" -User
    ```

    ### 4. AppLocker Configuration

    Configure AppLocker to allow Cluely updates:

    1. Open Local Security Policy or Group Policy
    2. Navigate to Application Control Policies > AppLocker
    3. Create new rule for Cluely executable
    4. Use Publisher condition with Cluely's certificate
  </Tab>
</Tabs>

## Update Mechanism Configuration

### Automatic Update Settings

Cluely checks for updates automatically. Ensure these settings are configured:

**macOS:**

* System Preferences > Software Update (ensure automatic updates are enabled)
* Allow Cluely to run background processes for update checks

**Windows:**

* Windows Update settings should allow automatic updates
* Ensure Windows Defender doesn't block Cluely update processes

### Update Frequency

Cluely typically checks for updates:

* On application startup
* Every 24 hours when running
* When manually triggered by user

## Monitoring and Troubleshooting

### Update Status Monitoring

Monitor update success through:

**macOS:**

```bash theme={null}
# Check Cluely version
/Applications/Cluely.app/Contents/MacOS/Cluely --version

# View update logs
log show --predicate 'process == "Cluely"' --last 1h
```

**Windows:**

```powershell theme={null}
# Check Cluely version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | Where-Object {$_.DisplayName -like "*Cluely*"}

# View Windows Event Logs
Get-WinEvent -FilterHashtable @{LogName='Application'; ID=1000} | Where-Object {$_.Message -like "*Cluely*"}
```

### Common Issues and Solutions

**Updates Blocked by Antivirus:**

* Add Cluely update directories to antivirus exclusions
* Whitelist Cluely processes in real-time protection

**Network Connectivity Issues:**

* Verify all required domains are whitelisted
* Test connectivity to update servers
* Check proxy configuration

**Certificate Trust Issues:**

* Re-import Cluely's certificate
* Verify certificate hasn't expired
* Check certificate chain validation

## Security Considerations

### Certificate Validation

* Regularly verify Cluely's certificates haven't been revoked
* Monitor for certificate expiration dates
* Subscribe to Cluely security notifications

### Update Integrity

* All updates are cryptographically signed
* Verify update packages before deployment
* Monitor for any security advisories from Cluely

### Network Security

* Use HTTPS for all update communications
* Implement proper firewall rules
* Monitor update traffic for anomalies

## Best Practices

1. **Test Updates**: Deploy updates to a test group before organization-wide rollout
2. **Monitor Performance**: Track update success rates and user experience
3. **Document Changes**: Keep records of certificate updates and policy changes
4. **Regular Reviews**: Periodically review and update whitelist and certificate configurations
5. **User Communication**: Inform users about update schedules and expected behavior

## Support and Resources

For additional support with Cluely auto-updates on managed devices:

* **Technical Support**: Contact Cluely support with your organization's details
* **Certificate Updates**: Monitor [cluely.com/downloads](https://cluely.com/downloads) for certificate changes
* **Security Advisories**: Subscribe to Cluely security notifications
* **Documentation**: Refer to Cluely's enterprise documentation for additional configuration options

## Compliance and Audit

Maintain compliance with your organization's security policies by:

* Documenting all certificate installations
* Recording network whitelist configurations
* Auditing update success rates
* Maintaining logs of update activities
* Following your organization's change management procedures