# Managed Settings

> The managed values the Whisper client honours on a host, where each one applies, how they are parsed, and the MDM profile that delivers them.

*Source: https://www.whisper.security/docs/whalenet/settings*
*Published: 2026-09-19*
*Last updated: 2026-09-19*

---
`whisper whale syspolicy` reads the platform policy store and reports the settings your MDM manages on this machine. It is configuration management: it decides what a command does when the command line says nothing. A machine that arrives already pointed at the right control plane, with the right key file, and with nobody invited to sign into a personal account by accident, is what a policy buys.

## `syspolicy list` {#list}

```bash
whisper whale syspolicy list
```

Prints every setting this build honours, its value, and where that value came from. The `APPLIES` column is the point of the table: it names where the value changes what the binary does, and nothing is listed without one, so a setting you can write and read back but that nothing honours never appears here.

A policy that is installed but unreadable is reported as exactly that, never as an absent one.

To see what a given command actually resolved, after flags and the environment were applied on top, use `whisper config`. `syspolicy list` says what the policy asked for; `whisper config` says what won.

## The settings {#settings}

### `ControlURL` (string)

The control-plane front door every command talks to. It fills `--control-url` when the command line did not pass one, so a managed host reaches your control plane with no per-user setup.

### `KeyFile` (string)

The file the API key is read from, and the file `whisper login <key>` writes. It fills `--key-file` when the command line did not pass one, so a key your MDM already placed on the machine is the key every command uses.

### `AllowInteractiveLogin` (bool)

Whether a person at this machine may sign in interactively. It is true unless you set it. When false, `whisper login` with no key argument refuses instead of opening the browser sign-in, bare `whisper` refuses instead of walking someone through one, and no command prompts for a key. `whisper login <key>` still saves a key you handed out.

## How values are read {#parsing}

Keys are matched without regard to case. A boolean may be written as a real boolean, as `true`/`false`, `yes`/`no` or `on`/`off`, or as `1`/`0`, because that is what an MDM profile, a `.reg` file and a hand-edited JSON file each produce. A value that cannot be used is reported and ignored, never half-applied.

## `syspolicy template` {#template}

```bash
whisper whale syspolicy template > whisper.mobileconfig
whisper whale syspolicy template --platform windows > whisper-policy.reg
```

Prints a ready-to-install profile carrying every setting `list` reads: a `.mobileconfig` for macOS, a `.reg` file for Windows, and a JSON file for Linux. `--platform` takes `macos`, `windows` or `linux`, and defaults to this host.

The template is generated from the same catalogue the reader uses, so the profile and the thing that reads it cannot drift apart. Every value in it is a real one rather than a placeholder you have to remember to replace.

**Read the `KeyFile` line before you install it.** It points at the machine-wide path an MDM would provision a key at, not at the per-user default, so a machine with no key there ends up with no key from a file at all. Provision the key at that path, change the line, or drop it.

Which key to provision, and which scopes it needs for the work the machine will do, is [keys and scopes](/docs/control-plane/auth). What the settings govern once the machine is up is [inspect your fleet](/docs/whalenet/inspect).