Webinar: Workbrew 2.0: Secure the software your company runs
Register now
Getting Started
Guide

Enable the Workbrew app

Adam Selby & Petros Amoiridis

The Workbrew app is available for Devices running macOS 26 or later, alongside the Workbrew Agent. The Workbrew app is enabled by default for Workspaces created on or after 14 October 2026. For Workspaces created earlier, an administrator needs to enable it.

Until it is enabled, the Workbrew app only shows version information about Workbrew. It isn't added to login items, the Dock or the menu bar, so the only place your users see it is in their list of applications. Once enabled, the Workbrew app lets your users install, update and request software without the brew CLI.

Before enabling the app, check these things

The Workbrew app is another interface to the same Workbrew that your users already use through brew in their terminal. All the Policies you have configured in Workbrew also apply to the Workbrew app, and it gives your users no new access. The Workbrew app only allows your users to take actions they can already take today with the brew CLI.

Two settings determine what people see once the app is enabled:

  • A Cask Allowlist configures the app's Discover tab to display the casks you've approved. Users can still browse additional casks and request installation, unless Package Requests are turned off. Without a Cask Allowlist, people can install any cask from the app, the same as they already can with brew.
  • Package Requests can be turned off for the whole Workspace if your organization handles software requests somewhere else.

See How to block cask self-installs for details on both.

Devices on macOS 15 or earlier don't receive the Workbrew app.

Enable the app

  1. Sign in to the Workbrew Console as an administrator.
  2. Find the Workbrew app banner near the top of the page, reading "The Workbrew app is here".
  3. Click Get the Workbrew app on the banner, then confirm that you want to enable the Workbrew app.

Enabling the app can't be undone from the Workbrew Console.

Enabling the app doesn't install it yet. Devices that already have the Workbrew app show the full app within a few minutes, with Discover, Installed and Updates, plus a menu bar icon. A Requests tab appears once someone sends a Package Request. Other Devices get it the next time the Workbrew installer package runs on them, by hand or through your MDM. People using the brew CLI see no change, and the same Policies govern both. If Package Requests are turned off for your Workspace, the Requests tab isn't visible.

Administrators can enable the Workbrew app when it makes the most sense for their organization. Workbrew will enable it for all Workspaces in a future release.

If you have questions or concerns about enabling the app, email help@workbrew.com.

Installing via PKG (including via MDM)

Releases of the Workbrew installer before 2.0.0 don't include the Workbrew app. If your MDM policy points at an older Workbrew package, it doesn't install the app.

Once your MDM policy uses a newer Workbrew installer, whether you updated it or an automated process did, every Device that runs it installs the Workbrew app alongside the Agent. That includes new Devices and Devices that already have Workbrew.

The installer doesn't know which Workspace it's being installed into, so it installs the Workbrew app either way. If the app isn't enabled for your Workspace yet, it only shows version information until you enable it.

To skip installing the app, create a marker file on a Device before the package runs. The installer checks for it every time the package runs, on new Devices and on Devices that already have Workbrew.

install -d -m 755 -o root -g wheel /opt/workbrew/etc
touch /opt/workbrew/etc/no-workbrew-app

If your MDM runs the installer directly and supports custom installer choices, you can pass a plist file that skips the app. Save this as no-app.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
  <dict>
    <key>choiceIdentifier</key>
    <string>com.workbrew.WorkbrewApp</string>
    <key>choiceAttribute</key>
    <string>selected</string>
    <key>attributeSetting</key>
    <integer>0</integer>
  </dict>
</array>
</plist>

Then pass it to the installer:

installer -pkg Workbrew.pkg -target / -applyChoiceChangesXML no-app.plist

If you have any trouble with the plist file approach, email help@workbrew.com.