Deploy the desktop app (admin)

To prevent users from installing applications, make the appropriate security changes to user workstations. 

To remove Check for Updates from the desktop app menu and prevent users from receiving desktop app update notifications, make the following registry/preference value changes.

Windows

You can change either of the following registry keys:

• HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory
• HKEY_LOCAL_MACHINE\Software\Interactive Intelligence\Purecloud\Directory

Add a new DWORD value called DisableUpdates, and set to 1 to prevent all updates.

Example: 

"DisableUpdates"=dword:00000001

Mac

In the preferences file ~/Library/Preferences/com.inin.purecloud.directory.plist, add a new Boolean value called “DisableUpdates”, and set to true to prevent all updates. 

Example: 

<key>DisableUpdates</key>

<true/>

Routinely use a third-party tool to check the appcast XML file and notify you when an updated desktop app release version is available.

Windows

https://apps.mypurecloud.com/directory-windows/appcast-x64.xml

Mac

https://apps.mypurecloud.com/directory-mac/appcast.xml

To push out the desktop app installation and updates, use a third-party software deployment tool such as Microsoft System Center Configuration Manager (SCCM). This tool can deploy the app to users on specified days and times.

To preconfigure a default region, apply the region key and URL from the following table:

Windows

Preconfigure these registry entries to a particular region using the previous table:

• HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory\Region
• HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory\Region\URL

For example, to preconfigure the Frankfurt region, add a registry entry for key HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory\Region and set it to the string de, and add a registry entry for key HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory\Region\URL and set it to the string https://apps.mypurecloud.de/directory.

Mac

Use the following default commands:

• > defaults write com.inin.purecloud.directory region 
• > defaults write com.inin.purecloud.directory regionURL

Example:

C:UsersAdministratorDesktop>genesys-cloud-windows-2.1.582.exe /quiet

To force the desktop app client to run as a WebRTC Media Helper, make the following registry/preference value changes.

Windows

In the registry key HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory, add a new DWORD value called “RunAsMediaHelper”, and set to 1 to make active. 

Example: 

"RunAsMediaHelper"=dword:00000001

Mac

In the preferences file ~/Library/Preferences/com.inin.purecloud.directory.plist, add a new Boolean value called “runAsMediaHelper”, and set to true to make it active. 

Example: 

<key>runAsMediaHelper</key>

<true/>

For more information, see About WebRTC Media Helper.

To force the installation to ignore WebRTC softphone events, make the following registry/preference value changes:

Windows

You can change either of the following registry keys:

• HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory
• HKEY_LOCAL_MACHINE\Software\Interactive Intelligence\Purecloud\Directory

Add a new REG_SZ value called “DevUrl”, and set to “https://apps.mypurecloud.com/directory/?disableSoftphone=true” where apps.mypurecloud.com is your org’s home region.

The Windows desktop app, by default, includes functionality based on Microsoft’s CloudAP feature to streamline authentication in some SSO configurations. If your organization does not want to enable this functionality, you can change either of the following registry keys:

• HKEY_CURRENT_USER\Software\Interactive Intelligence\Purecloud\Directory
• HKEY_LOCAL_MACHINE\Software\Interactive Intelligence\Purecloud\Directory

Add a new DWORD value called “DisableMicrosoftCloudAP”, and set to 1 to disable the feature.

The desktop app uses the browser’s Local Network Access (LNA) rules: pages from a given origin can only reach private or local addresses (e.g., localhost, RFC 1918) if the origin is allowed. Genesys Cloud origins (e.g. https://apps.mypurecloud.com, your region’s apps URL) are always allowed. For any other origin, the app checks an administrator-defined allow list. If the requesting origin matches a pattern in the allow list, local network access is granted; otherwise it is denied.

Typical use case

SSO or device-trust solutions (e.g., Okta Fastpass, device binding) load content from a public origin (for example, https://your-org.okta.com) and must talk to a local endpoint (localhost or private IP). Adding the origin, or a pattern, to the allowlist allows the request to continue. If not in the allowlist, the request is blocked.

Patterns follow Chrome Enterprise URL pattern syntax. For more information about Chrome Enterprise URL pattern syntax, see Chrome URL patterns.

Examples:

• *: Allow all. Use with caution.
• [*.]okta.com: Allow okta.com and any subdomains.
• https://your-org.okta.com:*: Allow this host with any port.
• https://your-org.okta.com:443: Allow this host and this port.
  Notes:

  • Scheme and host are compared case-insensitively.
  • Omitted port in a pattern means default port only.
  • An asterisk (*) means any port.
  • The policy is read once at first use; restart the desktop app after you change the allowlist.

Windows

Use the same key as other desktop app settings:

• HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
Software\Policies\Genesys\GenesysCloud\LocalNetworkAccessAllowedForUrls

Create REG_SZ values whose names are integers (1, 2, 3, …). The data of each value is one URL pattern.

Example (Okta Fastpass):

Name: 1 → Data: "[*.]okta.com"
Name: 2 → Data: "https://your-org.okta.com"

Mac

Domain: com.inin.purecloud.directory
Key: LocalNetworkAccessAllowedForUrls (array of strings)

Example using defaults write (patterns with [or] need single quotes inside double quotes so that the shell does not interpret them):

defaults write com.inin.purecloud.directory LocalNetworkAccessAllowedForUrls -array "'[*.]okta.com'" "https://your-org.okta.com"

Single pattern:

defaults write com.inin.purecloud.directory LocalNetworkAccessAllowedForUrls -array "'[*.]okta.com'"

If the key exists and you want to add more patterns, use PlistBuddy or edit the plist directly; defaults write replaces the entire array. Restart the desktop app after changing the allow list.

The desktop app uses the Chromium Embedded Framework (CEF), which can run with the GPU process enabled or disabled. By default, the app starts with the GPU disabled (software rendering). On some computers, enabling the GPU can improve performance or fix display issues; on others, disabling it avoids GPU-related crashes or compatibility problems.

You can override the default by adding a registry value so that the app either keeps the GPU disabled (default) or enables it.

Windows

Use the same key as other desktop app settings:

• HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
\Software\Interactive Intelligence\Purecloud\Directory

Add a DWORD value named DisableGpu:

• DisableGpu = 1: GPU is disabled. The app passes Chromium the flags --disable-gpu and --disable-software-rasterizer. This value is the default if the value is missing.
• DisableGpu = 0: GPU is enabled. The app does not add the flags mentioned previously; thus Chromium may use the GPU process.

If the value exists in both HKLM and HKCU, the app follows the same precedence as other settings, typically HKLM over HKCU for machine-wide policy.

Example (enable the GPU):

"DisableGpu"=dword:00000000

Example (disable the GPU explicitly):

"DisableGpu"=dword:00000001

For changes to take effect, restart the desktop app.

The desktop app uses Chromium’s WebRTC stack, which can apply automatic gain control (AGC) to the microphone input. In some environments this feature can lower the mic level inappropriately (e.g., quiet or inconsistent volume). Administrators can disable this behavior so that the app does not automatically adjust input volume.

Windows

Use the same key as other desktop app settings:

• HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
\Software\Interactive Intelligence\Purecloud\Directory

Add a DWORD value named DisableInputVolumeAdjustment:

• DisableInputVolumeAdjustment = 0: Automatic input volume adjustment is enabled (normal WebRTC AGC behavior). This value is the default if the value is missing.
• DisableInputVolumeAdjustment = 1: Automatic input volume adjustment is disabled. The app passes Chromium the flag to disable the WebRtcAllowInputVolumeAdjustment feature so that the mic level is not automatically lowered.

If the value exists in both HKLM and HKCU, the app follows the same precedence as other settings, typically HKLM over HKCU for machine-wide policy.

Example (disable automatic mic gain control):

"DisableInputVolumeAdjustment"=dword:00000001

Example (re-enable, use default behavior):

"DisableInputVolumeAdjustment"=dword:00000000

For changes to take effect, restart the desktop app.

The desktop app uses Chromium’s WebRTC stack, which can negotiate post-quantum key agreement for DTLS (Chromium feature WebRtcPqcForDtls, ML-KEM). By default, this behavior is enabled. If your organization must disable post-quantum WebRTC DTLS—for example, for compatibility with certain network equipment, security policy, or troubleshooting—you can override the default with a registry value.

Windows

Use the same key as other desktop app settings:

• HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
\Software\Interactive Intelligence\Purecloud\Directory

Add a DWORD value named WebRtcPostQuantumKeyAgreement:

• WebRtcPostQuantumKeyAgreement = 1: Post-quantum key agreement for WebRTC DTLS is enabled. This is the default if the value is missing.
• WebRtcPostQuantumKeyAgreement = 0: Post-quantum key agreement is disabled. The app adds WebRtcPqcForDtls to Chromium’s disable-features list.

If the value exists in both HKLM and HKCU, the app uses the same precedence as for other settings: HKLM over HKCU.

Example (disable post-quantum WebRTC DTLS):

"WebRtcPostQuantumKeyAgreement"=dword:00000000

Example (explicitly enable, default behavior):

"WebRtcPostQuantumKeyAgreement"=dword:00000001

Restart the desktop app for changes to take effect.

Mac

Use the same preferences domain as other desktop app settings:

~/Library/Preferences/com.inin.purecloud.directory.plist

Domain for defaults write: com.inin.purecloud.directory

Add a Boolean key named WebRtcPostQuantumKeyAgreement:

• true: Post-quantum key agreement for WebRTC DTLS is enabled. This is the default if the key is missing.
• false: Post-quantum key agreement is disabled. The app adds WebRtcPqcForDtls to Chromium’s disable-features list.

Example using defaults write (disable post-quantum WebRTC DTLS):

defaults write com.inin.purecloud.directory WebRtcPostQuantumKeyAgreement -bool false

Example (explicitly enable, default behavior):

defaults write com.inin.purecloud.directory WebRtcPostQuantumKeyAgreement -bool true

Example in the plist:

<key>WebRtcPostQuantumKeyAgreement</key>
<false/>

Restart the desktop app for changes to take effect.

Administrators can deploy the same key via MDM or configuration profiles that manage com.inin.purecloud.directory.

A new administrator policy, DisableDeveloperTools, was added to the Genesys Cloud desktop app for Windows and Mac. When it is enabled, users cannot turn on developer mode in the app. The developer-only tools stay hidden and unavailable. 

By default, users can select Enable Developer Tools in the app’s Advanced Preferences window. This option adds developer-only commands: Show console and WebRTC Internals. Organizations that want to prevent users from opening these tools can now enforce this through the DisableDeveloperTools policy.

What the policy does when enabled

• When enabled, the Enable Developer Tools checkbox in Advanced Preferences is unavailable.
• Developer mode is forced off. This applies even if the user had enabled it before the policy was applied.
• Show console and WebRTC Internals are removed from the app menu and from the right-click context menu.
• Any attempt by the user to turn developer mode on is ignored.
• If the policy is absent or set to off, behavior is unchanged: users can enable developer tools themselves.

Windows

Use the same key as other desktop app settings:

• HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER
\Software\Interactive Intelligence\Purecloud\Directory

Add a DWORD value named DisableDeveloperTools:

• DisableDeveloperTools = 1: Policy is on, users cannot enable and use developer tools.
• DisableDeveloperTools = 0: Policy is off, user can enable and use Developer tools.

If the value exists in both HKLM and HKCU, the app uses the same precedence as for other settings: HKLM over HKCU. To enforce the policy, use HKLM; a value in HKCU can be changed by the user.

Example (prevent users from using developer tools):

"DisableDeveloperTools"=dword:00000001

Example (default behavior, user can use developer tools):

"DisableDeveloperTools"=dword:00000000

Restart the desktop app for changes to take effect.

Mac

Use a managed preference through MDM:

Deploy a Configuration Profile (Custom Settings / Application & Custom Settings) with domain com.inin.purecloud.directory. The managed preference appears in /Library/Managed Preferences.

Add a Boolean key named  DisableDeveloperTools:

• true: Policy is on, users cannot enable and use developer tools
• false: Policy is off, user can enable and use developer tools

This setting is honored only when delivered as a managed preference through MDM (a Configuration Profile). A value written locally by the user (for example defaults write com.inin.purecloud.directory DisableDeveloperTools -bool YES) is ignored, because users could otherwise set or clear it themselves. The app logs “DisableDeveloperTools ignored: not set via managed preferences”.

To verify on a device: sudo defaults read "/Library/Managed Preferences/com.inin.purecloud.directory"

Sample profile payload:

<key>DisableDeveloperTools</key>

<true/>

Restart the desktop app for changes to take effect.

The desktop app opens links in other applications only for allowed protocols (URL schemes). When a user clicks a link, for example in a chat message, the app checks the protocol of the link:

• Built-in protocols are always allowed: http, https, mailto, tel, callto, gcvideo, whatsapp, tg, geo.
• Custom protocols are allowed only if the administrator adds them to an allow list.
• Links with any other protocol are blocked. The app does not open them, and the page does not change.

Links that the app handles itself (for example about:, data:, and blob:) are not affected by this setting.

Typical use case

Your organization uses a desktop application that registers its own protocol, for example zoommtg:// or myapp://, and users need to open such links from the desktop app. Add the protocol to the allow list so that Windows opens the link in the registered application.

Requirements

A protocol is added to the allow list only if all of the following are true:

• The name is a valid protocol name: it starts with a letter and contains only letters, digits, +, -, and . (up to 64 characters).
• The protocol is registered in Windows, that is, an application has registered a handler for it (the HKEY_CLASSES_ROOT\<protocol> key contains the URL Protocol value).
• The protocol is not on the list of blocked protocols: file, javascript, vbscript, ms-msdt, search-ms, search. These protocols are never opened, even if they are in the allow list.

Entries that do not meet these requirements are ignored.

Windows

Use the following key:

• HKEY_LOCAL_MACHINE
  Software\Policies\Genesys\GenesysCloud\CustomProtocolAllowList

Create REG_SZ values. The data of each value is one protocol name, without : or //. The value names are not used, so you can use any names, for example integers (1, 2, 3, …). Names are not case-sensitive, and leading and trailing spaces are ignored.

Example:

Name: 1 → Data: "zoommtg"
Name: 2 → Data: "myapp"