Managed Settings
What an MDM can pin on a machine so the client arrives pointed at the right control plane with the right key file.
On this page (7)
Managed Settings Documentation
whisper whale syspolicy reads the platform policy store and reports the settings your MDM manages on this machine. It is configuration management: it decides what a command does when the command line says nothing. A machine that arrives already pointed at the right control plane, with the right key file, and with nobody invited to sign into a personal account by accident, is what a policy buys.
syspolicy list
whisper whale syspolicy list
Prints every setting this build honours, its value, and where that value came from. The APPLIES column is the point of the table: it names where the value changes what the binary does, and nothing is listed without one, so a setting you can write and read back but that nothing honours never appears here.
A policy that is installed but unreadable is reported as exactly that, never as an absent one.
To see what a given command actually resolved, after flags and the environment were applied on top, use whisper config. syspolicy list says what the policy asked for; whisper config says what won.
The settings
ControlURL (string)
The control-plane front door every command talks to. It fills --control-url when the command line did not pass one, so a managed host reaches your control plane with no per-user setup.
KeyFile (string)
The file the API key is read from, and the file whisper login <key> writes. It fills --key-file when the command line did not pass one, so a key your MDM already placed on the machine is the key every command uses.
AllowInteractiveLogin (bool)
Whether a person at this machine may sign in interactively. It is true unless you set it. When false, whisper login with no key argument refuses instead of opening the browser sign-in, bare whisper refuses instead of walking someone through one, and no command prompts for a key. whisper login <key> still saves a key you handed out.
How values are read
Keys are matched without regard to case. A boolean may be written as a real boolean, as true/false, yes/no or on/off, or as 1/0, because that is what an MDM profile, a .reg file and a hand-edited JSON file each produce. A value that cannot be used is reported and ignored, never half-applied.
syspolicy template
whisper whale syspolicy template > whisper.mobileconfig
whisper whale syspolicy template --platform windows > whisper-policy.reg
Prints a ready-to-install profile carrying every setting list reads: a .mobileconfig for macOS, a .reg file for Windows, and a JSON file for Linux. --platform takes macos, windows or linux, and defaults to this host.
The template is generated from the same catalogue the reader uses, so the profile and the thing that reads it cannot drift apart. Every value in it is a real one rather than a placeholder you have to remember to replace.
Read the KeyFile line before you install it. It points at the machine-wide path an MDM would provision a key at, not at the per-user default, so a machine with no key there ends up with no key from a file at all. Provision the key at that path, change the line, or drop it.
Which key to provision, and which scopes it needs for the work the machine will do, is keys and scopes. What the settings govern once the machine is up is inspect your fleet.