Frequently asked questions

How can I install Workbrew on my Device?#

Download the package from the Download page in the Workbrew Console, install it, then open the Workbrew app and follow the enrollment steps. To enroll someone else's Device without giving them Console access, use Add Devices → Invite a device on the Devices page. For MDM-based deployments, see the deployment guides. The manual install route is still available for scripted setups.

How can I find which Devices already have Homebrew installed?#

If you have not deployed Workbrew yet, you can run a small detection script through your MDM to inventory existing Homebrew installations across your fleet. See how to detect Homebrew across your fleet. Once Workbrew is deployed, the Workbrew Console reports this automatically for every Device.

How do you upgrade the Workbrew Installer?#

The Workbrew Installer is automatically and periodically upgraded. If you wish to upgrade manually, download the latest Workbrew Installer .pkg for macOS (or .sh for Linux/Windows Subsystem for Linux (in beta)) and install it on your Device.

How often do Devices send information and run commands?#

The Workbrew Agent on Devices will send information to and run commands from the Workbrew Console every 15 minutes (assuming they're awake and connected to the internet). You can force a Device to check in by running brew update or sudo launchctl kickstart -k system/com.workbrew.workbrew-agent.

Which users can run brew on a Device?#

After Workbrew deployment, the brew CLI is available to all users in the admin or workbrew_users groups.

Users with administrator privileges (the admin group) implicitly have brew CLI access. The Workbrew Console reports this as "Granted via Sudo".

We recommend granting brew CLI access to all Standard Users on your Devices. This can be done through Managed brew access in the Workbrew Console, which automatically identifies Human User Accounts and adds them to the workbrew_users group, or by adding users to the workbrew_users group via MDM. The Workbrew Console reports this as "Granted via Workbrew".

Users with brew access can self-install formulae and casks, subject to any Policies. Policies are enforced universally for all users, regardless of whether they are in the admin or workbrew_users group. Administrators can restrict or block cask self-installs and provision casks via Default Packages.

Users not in either group cannot run brew and are reported as "Access Denied" in the Workbrew Console.

What happens if Workbrew is installed on a Device but not added on the Devices page?#

Devices configured with an API key will automatically add themselves to the Workbrew Console's Devices page on their first check-in. A Device that was removed from the Workbrew Console does not add itself again. It stays off the Devices page until Workbrew is uninstalled from it and installed again, as described in Decommission a Device or move it to another Workspace. Devices not configured with an API key will use the Workbrew improved security configuration (for example multiple users) but can't communicate with the Workbrew Console.

Why does Workbrew need to add a /etc/sudoers.d/workbrew file?#

Some casks (never formulae) installed via Homebrew require sudo access to complete their installation. Since sudo normally prompts end-users for a password, that doesn’t work well for installs that are centrally managed via Workbrew. To handle this securely and non-interactively:

• Workbrew adds a config file at /etc/sudoers.d/workbrew
• This file grants passwordless sudo access, but only to a specific system user: _workbrewd
• _workbrewd is the user account that runs the Workbrew Agent, which is a background daemon
• This limited sudo access allows Workbrew to safely and silently install those packages without giving broader root privileges to end-users and maintain the principle of least privilege

What is the Workbrew app?#

The Workbrew app gives people a graphical way to browse the software catalog, install software and see what is outdated, subject to all of your existing Policies. Everything available in the app is also available through the brew CLI. It is available for Devices running macOS 26 or later.

How do I enable the Workbrew app?#

For Workspaces created on 14 October 2026 or later, the Workbrew app is enabled by default and no action is necessary. For Workspaces created earlier, an administrator enables it from the Workbrew app banner in the Workbrew Console. Enable the Workbrew app has the steps and what to check first.

What is a read-only Device?#

A read-only Device has Workbrew installed, but Workbrew does not manage Homebrew on the Device. Instead, Workbrew reports what is installed only, meaning no Commands, Default Packages, Policies or Brew Configurations affect a Device. New Workspaces start read-only, and a Workspace that was already managing Homebrew stays managed. See What changes on a Device when Workbrew manages Homebrew for the two modes and Turn on Homebrew management for the steps.

Do read-only Devices count toward my subscription?#

Yes. Every Device enrolled in the Workspace counts, whichever mode it is in.

Why did my Homebrew services stop?#

Workbrew stops the Homebrew services that users started when it starts managing Homebrew on a Device. Start the service again with brew services start. See How does Workbrew handle brew services? for the details.

How can I uninstall Workbrew?#

Run the uninstaller by executing sudo /opt/workbrew/sbin/uninstall from a Terminal. This will bring the Device back to ‘vanilla’ Homebrew (e.g. /opt/homebrew/bin/brew). To uninstall from an MDM script that runs as root, set SUDO_USER first, as described in Decommission a Device or move it to another Workspace.

How do I contact Workbrew?#

Please see the Contact page.