Deploying Granola on managed devices: MDM, Intune and Jamf

TL;DR: IT and security teams need meeting tools installed in a controlled way, with sign-in tied to corporate identity and access removed when someone leaves. Granola can be deployed on managed Windows and Mac devices through standard MDM workflows. MDM handles app deployment and managed settings, SSO controls how users sign in, and SCIM manages access as people join or leave. IT teams package the standard Windows .exe or macOS .dmg installers themselves. Granola does not yet provide step-by-step managed installation support for Jamf, Kandji, Omnissa Workspace ONE, FleetDM, WinGet, or similar tools. The SSO-only sign-in setting is applied separately through MDM after deployment. System-wide MDM installs can block Granola's auto-update, so the IT team must handle updates manually in that case, using the installer and version endpoints provided in Granola's managed installations documentation.

Granola fits into a managed-device rollout through three main pieces: MDM (Intune or Jamf) handles application deployment and device-level configuration, SSO handles how users authenticate, and SCIM manages user access as people join or leave the organization.

System requirements for managed Granola rollouts

Granola runs on macOS and Windows as the primary platforms for managed enterprise deployment. Granola captures device audio and transcribes in real time, so it needs an internet connection. Users need microphone access granted at the OS level, and on macOS they also need Screen & System Audio permission.

Granola MDM and OS compatibility guide

The table below shows the minimum OS version and installation method for each platform. Granola provides standard installer files (.dmg for macOS and .exe for Windows), but does not pre-package these into .intunewin or .pkg formats.

If an organization needs to wrap the installer for MDM or patch-management tooling, the managed installations page explains how Granola's update mechanism works, which endpoints are available for downloading the latest installers (https://api.granola.ai/v1/download-latest for macOS and https://api.granola.ai/v1/download-latest-windows for Windows), how to pin a specific version using the static CloudFront redirect URL, and how to poll https://api.granola.ai/v1/get-versions to detect new releases for manual packaging workflows.

How MDM, SSO and SCIM fit together

• MDM handles device and application configuration. The MDM platform (Intune, Jamf, or another tool) deploys the Granola installer and enforces the DisableOAuth setting, which removes personal Google and Microsoft sign-in from the app and requires users to authenticate through SSO instead. Configure SSO before enabling DisableOAuth. The setting does not sign out people who are already signed in.
• SSO handles authentication. Once DisableOAuth is enforced, users must sign in through the organization's identity provider (Okta, Microsoft Entra ID, JumpCloud, or another SAML/SCIM provider). SSO is configured separately in Granola's workspace settings and the identity provider.
• SCIM handles user lifecycle management. When a user is added to the identity-provider group your admin configures for Granola access, SCIM creates their account. When they are removed, SCIM deactivates it.

MDM gets Granola onto managed devices and applies supported application settings. The DisableOAuth setting is one example: when enforced through MDM, it removes personal sign-in options and requires users to authenticate through the organization's identity provider.

SSO then controls how that authentication works, giving the organization central control over who can access Granola and how. SCIM keeps access aligned with the employee lifecycle, creating accounts when people join and deactivating them when they leave. A complete managed rollout uses all three: MDM for the application and device layer, SSO for authentication, and SCIM for user lifecycle management.

Deploy Granola with Microsoft Intune

Windows

A Windows .exe installer is available through Granola's managed-installations endpoint. The installer does not ship as a pre-built .intunewin file, so IT teams who want to distribute Granola as an Intune Win32 app need to prepare one using Microsoft's Win32 Content Prep Tool (IntuneWinAppUtil.exe). Microsoft requires that Win32 apps deployed through Intune support silent installation. Before packaging the Granola .exe, confirm that it supports a silent or unattended install mode. Granola's documentation does not currently confirm this, so check with Granola support before proceeding with the Win32 workflow.

Organizations can package Granola's Windows .exe for Intune, assign it to the appropriate device or user groups, and use Intune to monitor deployment. Granola's DisableOAuth setting can then be enforced separately through MDM when the organization requires SSO-only sign-in. Configure SSO before enabling DisableOAuth. See Granola's MDM configuration documentation for the current configuration instructions, and the managed installations documentation for packaging details.

macOS

Granola provides a macOS .dmg installer through its managed-installations endpoint. Microsoft Intune supports deployment of macOS DMG applications when the DMG contains an app bundle, which allows IT teams to add the Granola .dmg directly to Intune as a macOS DMG app.

Organizations can add the Granola .dmg to their Intune macOS application workflow, assign it to the appropriate managed Macs, and monitor deployment through Intune. DisableOAuth can be deployed separately as a managed configuration when SSO-only sign-in is required. Configure SSO before enabling DisableOAuth.

Deploy Granola with Jamf Pro

Granola does not yet provide step-by-step Jamf deployment instructions and does not offer a pre-built Jamf-specific package. Granola's recommended default is to install the app in a way that allows it to keep itself up to date. A system-wide or MDM-wrapped install can block Granola's auto-update mechanism, which means the IT team must then manage updates manually using the installer and version endpoints in Granola's managed installations documentation. If your organization still needs to deploy through Jamf Pro, the standard workflow below applies.

IT teams can take Granola's macOS .dmg installer through their normal Jamf packaging and policy workflow, scope the deployment to managed Macs, and configure DisableOAuth separately if SSO-only sign-in is required. Configure SSO before enabling DisableOAuth. Granola does not provide a pre-built Jamf-specific package and does not yet provide step-by-step Jamf deployment instructions.

SSO handles authentication and SCIM handles user lifecycle management independently of Jamf.

What a managed Granola rollout looks like

Granola provides a Windows .exe installer and a macOS .dmg installer through its managed-installations endpoint. Neither is pre-packaged for Intune or Jamf, so IT teams take the installers through their standard application deployment workflows and scope them to the appropriate managed devices or users.

After the application is deployed, supported MDM settings such as DisableOAuth can be applied separately. Enforcing DisableOAuth removes personal sign-in options from the app and requires users to authenticate through the organization's identity provider.

Before rolling out to the full organization, the deployment should be tested with a small pilot group. This allows the IT team to confirm that the installer, managed settings, and SSO sign-in all behave as expected before broader deployment. Once the pilot is successful, the same deployment can be expanded to the wider organization.

Set up SSO and SCIM for Granola access

SSO and SCIM are the core of a managed Granola deployment. They handle authentication and user lifecycle management so organizations do not have to provision users manually. SSO and SCIM are available on the Enterprise plan only, and require at least 50 active workspace members or an Enterprise subscription with a minimum commitment of 50 seats.

Configure SSO for Granola

Granola supports SAML 2.0 and OIDC for single sign-on. Supported identity providers include Okta, Microsoft Entra ID, JumpCloud, and other SAML/SCIM providers.

Configure SCIM for Granola access

SCIM automates user provisioning and deprovisioning. When a user is added to the identity-provider group your admin configures for Granola access, SCIM creates their Granola account. When they are removed, SCIM deactivates the account.

From the administrator's perspective, SSO and SCIM are configured once in Granola's workspace settings and the organization's identity provider. After that, access is managed through identity groups rather than manual provisioning. From the user's perspective, they sign in through the organization's identity provider. Because SSO and SCIM are configured separately from MDM, organizations can set them up and validate them with a pilot group before enforcing SSO-only sign-in more broadly through MDM.

Set org-wide access and privacy controls

Enterprise admins control transparency settings, data retention, and model training opt-out from the Granola admin dashboard. These settings apply org-wide and individual users can't override them.

Granola data retention policies

Org-wide transcript retention windows can be configured, and Granola removes transcripts automatically on a schedule without manual intervention. Enterprise admins control retention periods through the admin dashboard.

Users can also delete specific parts of a transcript while keeping the rest intact. This gives individuals control over what's stored without forcing them to delete entire meeting notes.

Enterprise administrators can configure transparency controls, retention windows, and model training opt-out once, and those settings apply to all users without requiring individual management. Organizations should also review Granola's security and compliance documentation as part of their normal SaaS approval process.

Pilot and rollout

Before deploying Granola to the full organization, run a structured pilot with 5 to 10 representative users across both Windows and macOS. The purpose is to confirm that the technical setup works across representative devices before broad deployment.

During the pilot, validate:

1. Application deployment through Intune or Jamf reaches the pilot devices as expected.
2. Users can sign in through SSO, SCIM provisioning creates their accounts, required permissions are granted, and DisableOAuth behaves correctly if it is being enforced.

Deployment checklist

• Set up the Granola Enterprise workspace, SSO, and SCIM. SSO and SCIM require the Enterprise plan and at least 50 active workspace members or an Enterprise subscription with a minimum commitment of 50 seats.
• Confirm managed devices meet the supported macOS and Windows requirements.
• Prepare the Granola installer through the organization's normal Intune or Jamf workflow.
• Apply DisableOAuth through MDM if SSO-only sign-in is required.
• Pilot the deployment with 5 to 10 representative users.
• Expand the deployment after validating installation, authentication, provisioning, and access controls.

A managed Granola rollout comes together when each layer is in place: MDM handles the application, SSO handles sign-in, and SCIM handles access over time. When the pilot confirms everything works as expected, the same workflow scales to the full organization without additional configuration. From that point, day-to-day access management runs through the organization's identity provider rather than through Granola directly.

Try Granola for free! When you're ready to roll it out across your organization, see Granola's managed installations documentation for current packaging and configuration details, or review the security and compliance documentation as part of your SaaS approval process.

FAQs

Can Granola be deployed through MDM?

Yes. Granola can be deployed through standard MDM workflows, including Microsoft Intune and Jamf Pro. Granola provides a Windows .exe installer and a macOS .dmg installer that organizations can use within their normal MDM packaging and deployment workflows. Granola does not ship pre-built Intune or Jamf packages. Depending on the organization's configuration, users may still need to complete operating-system permission prompts or authenticate through SSO after the application is installed.

What permissions does Granola require on managed devices?

Granola requires microphone access and, on macOS, Screen & System Audio permission to transcribe calls. Calendar access enables meeting detection and pre-meeting briefs, and Granola requests all permissions through standard OS prompts.

Can we enforce Granola settings organization-wide?

Yes. Enterprise admins can enforce transparency controls (in-chat notification and video watermark), data retention windows, and model training opt-out across the entire organization. Individual users can't override these settings.

Does Granola support air-gapped or offline environments?

No. Granola requires an internet connection for transcription, SSO authentication, and SCIM provisioning, with no offline mode or on-premises deployment option.

What happens to user data when someone leaves the company?

When a user is removed from the SCIM group, Granola deactivates their account, but their meeting notes remain in the workspace unless deleted manually.

Can Granola integrate with other tools after deployment?

Yes. Granola offers integrations with Slack, Notion, HubSpot, Affinity, Attio, and Zapier on Business and Enterprise plans. The Zapier integration video shows how to connect Granola with over 8,000 apps.

Key terms glossary

MDM (Mobile Device Management): Software that manages devices at the OS level, enforcing policies like password requirements, app restrictions, and remote wipe.

Intune: Microsoft's cloud-based device management platform. It manages Windows and macOS devices and sends device compliance state to Microsoft Entra Conditional Access, which allows or blocks access to corporate resources.

Jamf Pro: Apple device management platform for macOS and iOS. It manages device settings, distributes App Store apps, and integrates with Microsoft Entra ID for device compliance.

SSO (Single Sign-On): Authentication method that lets users sign in to multiple applications with one set of credentials. Granola supports SAML 2.0 and OIDC for SSO.

SCIM (System for Cross-domain Identity Management): Protocol for automating user provisioning and deprovisioning between identity providers and SaaS applications. When a user is added to a SCIM group, Granola creates their account automatically.

SAML (Security Assertion Markup Language): XML-based standard for exchanging authentication and authorization data between an identity provider and a service provider. Granola uses SAML 2.0 for SSO.

Configuration profile: A macOS or iOS settings file (.mobileconfig) that controls device behavior. Granola's MDM configuration documentation covers how to configure supported app settings through MDM on macOS and Windows.