How to block cask self-installs

By default, users with brew access can self-install casks the same way they would with vanilla Homebrew. If your organization needs to restrict which casks users can install, or block cask self-installs entirely, create a Cask Allowlist Policy. It is available with the Governance upgrade and on Business and Enterprise plans. These restrictions are enforced universally for all users with brew access, regardless of whether they are in the admin or workbrew_users group.

If you only need to block a handful of specific casks by name rather than restrict every cask, use a Forbidden Casks policy instead. See Declare policies to block software packages.

Create a Cask Allowlist#

A Cask Allowlist Policy lets you define exactly which casks users are permitted to self-install. Any cask not on the list is blocked. This only applies to device-user-invoked commands. Commands pushed from the Workbrew Console are not affected.

With the Governance upgrade, a Policy targets All Devices, No Devices (to pause it) or a single Device. Business and Enterprise plans can also target a Device Group.

Allow specific casks only#

1. Go to Policies in the sidebar
2. Click New Policy > Casks Allowlist
3. Search for and add the casks you want to permit (for example visual-studio-code, zoom, slack)
4. Choose the Devices to target
5. Click Create policy

Users on targeted Devices can now only self-install casks that appear on this list. All other cask self-installs are blocked.

Block all cask self-installs#

To forbid all cask self-installs, create a Cask Allowlist with no casks:

1. Go to Policies in the sidebar
2. Click New Policy > Casks Allowlist
3. Do not add any casks to the list
4. Choose the Devices to target
5. Click Create policy

An empty Cask Allowlist blocks all cask self-installs on the targeted Devices. You can still provision casks via Default Packages or Commands from the Workbrew Console.

Let users request blocked casks#

When a Cask Allowlist blocks an install, the user can ask for the cask instead of giving up. The error on the Device tells them how:

The following casks are not allowed by your Workbrew administrator: zoom
Run `brew workbrew request zoom` to ask your admin to allow it.

From the Workbrew app, or by running brew workbrew request <cask> in the terminal, they send a Package Request to your Workspace.

Requests appear under Policies → Package Requests in the Workbrew Console. Click Review on a request to see the cask, tap, version and requesting Device, then:

• Approve it, choosing an approval scope. All Devices adds the cask to the allowlist workspace-wide. You can also approve it for a Device Group, or for just the requesting Device. A reason is optional
• Deny it. A reason is required, and is shown to the user

The user is notified of the decision on their Device.

Turn off Package Requests#

If your organization already handles software requests elsewhere, for example in a help desk or ITSM tool, you can keep the Cask Allowlist and turn requests off under Settings → Workspace → Disable Package Requests.

Each Device picks up the change on its next check-in. From then on, the error for a blocked cask no longer suggests brew workbrew request, and running it anyway fails with:

Package requests are disabled for your workspace.
Contact your Workbrew administrator to request access.

The Console hides existing requests without deleting them, and Package Requests disappears from the sidebar. Uncheck the setting to bring them back. Devices need Workbrew Agent 1.10.9 or later to hide the suggestion and refuse requests.

Alternative: block all casks with a Brew Configuration#

If you want to block every cask, including installs and upgrades pushed from the Workbrew Console, you can instead create a Brew Configuration that sets the HOMEBREW_FORBID_CASKS environment variable. Brew Configurations are available on the same plans as Cask Allowlist Policies.

1. Go to Brew Configurations in the sidebar
2. Click New Brew Configuration
3. Set the variable name to HOMEBREW_FORBID_CASKS and the value to 1
4. Choose the Devices to target
5. Click Create Brew Configuration

This blocks all cask self-installs on targeted Devices.

Note that unlike a Cask Allowlist, this Brew Configuration is global: it also blocks cask installs and upgrades pushed from the Workbrew Console. If you need to install or upgrade a specific cask via the Workbrew Console, temporarily remove the Brew Configuration for that Device or Device Group first.

Team plan#

The Team plan, with or without the Vulnerability Patching upgrade, does not include Cask Allowlist Policies or Brew Configurations. Users on those Workspaces can self-install any cask.

If you need cask restrictions, add the Governance upgrade or move to a Business or Enterprise plan. See workbrew.com/pricing for details.