Setup guide
Setting up MIRA at your company
You don't need an IT department. Inviting your team takes about 10 minutes, and people install MIRA themselves. If you manage your computers with device management (MDM), you can push it out so nobody sees a prompt.
People install it themselves
No IT tools needed. Everyone installs the app from our site, and you invite them from the dashboard.
Four steps →
We use device management
Intune, Jamf, Kandji, Google Admin or similar: push MIRA out so nobody sees a prompt.
Silent installs and values →
Four steps
- 1
Invite your people
In the dashboard, open Members and invite everyone by email. Invitations come from noreply@tapmira.com. Do this first: people can only create a MIRA account with an address you invited.
- 2
Everyone installs MIRA
Each person opens tapmira.com/download on their phone and on their computer. The invitation email has the same links.
On the phone
Install MIRA from the App Store or Google Play and allow what it asks for. The app walks them through it.
On the computer
If the person is an administrator on their computer, they just confirm. If not, someone who is does this part with them: a few minutes per computer. On a Mac, turning on the website blocker and updates work the same way. Every device is explained below.
- 3
Sign in and tap the card
Everyone signs in with the email address they were invited with, then taps their card when MIRA asks: at the top of an iPhone, on the back of an Android phone. They join your company automatically.
- 4
Check it works
Start a test session by tapping the card. Within a few seconds the apps and websites on the block list are blocked on the phone and the computer. Ending a session early uses one of the month's Emergency Exits, so test with a short timer (1 minute) and let it end by itself.
That's it. Everything below is detail for when you need it.
Stuck? Write to support@tapmira.com and we'll help you through it.
At a glance
What each device asks for
What people see when they install MIRA, and where an administrator is needed.
Windows 10 (version 1809) or 11, 64-bit. Installer signed by MIRA Labs OU.
What the person sees
- Downloads MIRA.Installer.exe from the download page and runs it.
- Edge may say the file "isn't commonly downloaded", and Windows may say "Windows protected your PC". They keep the file, then click More info → Run anyway. These are warnings about a new release that few people have downloaded yet, not virus detections: the file is signed by MIRA Labs OÜ. Deployment tools never show them.
- Windows asks for administrator approval (the UAC prompt, showing MIRA Labs OÜ as the verified publisher).
- MIRA opens and they sign in. Nothing else to approve.
Where an admin is needed
- Once, to install. MIRA installs a background service and a network driver that do the blocking. Both need an admin to install.
- Updates never need an admin. MIRA offers each new version and the person clicks Update now. It installs with no Windows prompt, through a scheduled task set up during the first install. Someone who keeps clicking Later stays on the old version, so you can also push new versions with your deployment tool.
Watch out for
- Endpoint security (Defender for Endpoint, CrowdStrike and similar) may flag the network driver MIRA uses to block websites (WinDivert). If installs fail or websites aren't blocked, allow C:\Program Files\MIRA.
- Uninstalling version 1.4.56 or older left MIRA's background service running. Update to 1.4.57 or later first, then uninstall.
- Shared or reassigned PCs: each person's sign-in and settings stay in %LOCALAPPDATA%\MiraWindows after uninstalling. Delete that folder for each person.
- ARM computers (for example Surface Pro X or Snapdragon laptops): apps are blocked, websites are not yet. Use the Chrome or Edge extension there for websites.
macOS 14 (Sonoma) or later. Downloaded from our site, signed and notarized by Apple.
What the person sees
- Opens the .dmg from the download page and drags MIRA into Applications.
- Clicks Turn On the Website Blocker in MIRA. macOS says a system extension was blocked; they open System Settings → Privacy & Security and click Allow.
- macOS asks to add a proxy configuration. They click Allow. This one needs no admin.
- In the first focus session, macOS asks once per browser whether MIRA may control it (Safari, Chrome, Edge and others). No admin needed. This only replaces a blocked site's page with MIRA's Blocked page: refused, websites are still blocked, they just show the browser's own error page.
Where an admin is needed
- Installing into Applications asks for an admin password on a standard account.
- Allowing the system extension asks for an admin password on a standard account.
- Every update asks for an admin password on a standard account, because only admins can change apps in Applications. If your people don't have admin rights, push MIRA's updates with your MDM.
Watch out for
- Clicking Don't Allow on the browser question: macOS doesn't ask again. Turn it back on in System Settings → Privacy & Security → Automation → MIRA, or pre-approve it with the PPPC payload above.
- Firefox can't be controlled by any app, so a blocked site already open in Firefox when a session starts keeps working until the tab is closed. New visits are blocked.
- Another content filter or VPN that also intercepts traffic can conflict. If websites aren't blocked, check whether one is installed.
iOS 17 or later. From the App Store.
What the person sees
- Installs MIRA from the App Store and signs in.
- Allows Screen Time access and notifications when MIRA asks.
- Taps their card to the top of the phone.
Where an admin is needed
Nowhere. Everything is approved by the person on their own device.
Android 7.0 or later. From Google Play.
What the person sees
- Installs MIRA from Google Play and signs in.
- Turns on Usage access, Display over other apps, battery optimisation off, and notifications. MIRA walks them through each one.
- For website blocking, allows a VPN connection. It runs only on the phone: no traffic is sent to us.
Where an admin is needed
Nowhere. Everything is approved by the person on their own device.
Watch out for
- An always-on company VPN: Android allows one VPN at a time, so website blocking can't run next to it. App blocking still works. Use the Chrome extension or computer apps for websites instead.
The MIRA extension from the Chrome Web Store. Works in Chrome and Edge.
What the person sees
- Adds the extension and signs in with the same account as their phone.
Where an admin is needed
Nowhere. Everything is approved by the person on their own device.
Watch out for
- Firefox and Safari have no MIRA extension. On a Mac, the Mac app covers Safari.
With device management
Push MIRA out from your device management, so nobody sees an install or approval prompt. People still sign in and tap their card themselves.
To do it for everyone in advance
- Deploy the installer silently with Intune (as a Win32 app), SCCM or any software deployment tool. Nobody sees a prompt.
- Install command: MIRA.Installer.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART. It takes under a minute, needs no restart, and MIRA opens for the signed-in person by itself.
- Success code 0. Detect the install by the file C:\Program Files\MIRA\App\MIRA.exe.
- Uninstall: Settings → Apps → MIRA, or the uninstaller in C:\Program Files\MIRA with the same silent flags.
Values for your MDM
- Installer
- https://github.com/Kaljurahn/mira-windows-releases/releases/latest
- Silent install
- MIRA.Installer.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
- Install folder
- C:\Program Files\MIRA
- Service name
- MiraWindowsService
- Detection
- C:\Program Files\MIRA\App\MIRA.exe
- Silent uninstall
- "C:\Program Files\MIRA\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART
To do it for everyone in advance
- Deploy the app with your MDM (Jamf, Kandji, Intune, Mosyle).
- Add a System Extensions payload that allows MIRA's network extension. The approval prompt then never appears.
- Add a Privacy Preferences Policy Control (PPPC) payload that lets MIRA send Apple Events to your browsers, so the per-browser question never appears.
- Optionally, a Notifications payload allowing MIRA's alerts.
Values for your MDM
- Team ID
- M87GY63Y6R
- App bundle ID
- com.miradial.mira
- System extension bundle ID
- com.miradial.mira.MiraNetworkFilter
- System extension type
- Network extension
- Apple Events receivers
- com.apple.Safari, com.google.Chrome, com.microsoft.edgemac, com.brave.Browser, company.thebrowser.Browser
To do it for everyone in advance
- Push the App Store app through your MDM. The person still allows Screen Time themselves: Apple doesn't let MDM grant it for an app.
Values for your MDM
- App Store
- https://apps.apple.com/app/id6755740469
To do it for everyone in advance
- Approve MIRA in managed Google Play and assign it to your users.
- If your phones use a work profile, install MIRA in the personal profile. An app inside the work profile can only see and block work apps.
Values for your MDM
- Package name
- com.miradial.miraapp
To do it for everyone in advance
- Force-install it with the ExtensionInstallForcelist policy (Google Admin console, Intune or Group Policy). Edge uses the same policy and value.
- If you block extensions by default, add the ID to ExtensionInstallAllowlist.
- A force-installed extension can't be turned off or removed by the person, so browser blocking can't be skipped that way.
Values for your MDM
- Extension ID
- hfiglllncckhbfghfnhnnfeccoogcecc
- Force-install value
- hfiglllncckhbfghfnhnnfeccoogcecc;https://clients2.google.com/service/update2/crx
Only if…
Most companies can skip all of these. Open one only if it applies to you.
Your network filters outbound traffic
Allow these over HTTPS (port 443). If your network is unrestricted, skip this section.
Required on every device
Sign-in, syncing sessions between a person's devices, and our backend.
- identitytoolkit.googleapis.com
- securetoken.googleapis.com
- firestore.googleapis.com
- us-central1-mira--app.cloudfunctions.net
Required for phones
Push notifications, which start and stop sessions on other devices within seconds. Apple also uses TCP 5223, Google TCP 5228 to 5230.
- *.push.apple.com
- mtalk.google.com
- fcm.googleapis.com
Required for installing and updating computers
Windows downloads from GitHub. Mac updates come from our own server.
- github.com
- api.github.com
- objects.githubusercontent.com
- release-assets.githubusercontent.com
- mira--app.web.app
- tapmira.com
Admins only
The dashboard, where you invite people and see team totals.
- app.tapmira.com
Recommended
Crash reports, stored in the EU. Without them we can't see what went wrong on your devices.
- *.ingest.de.sentry.io
Only if you use the integration
Google Calendar, Microsoft Calendar and Teams, Slack.
- accounts.google.com
- oauth2.googleapis.com
- www.googleapis.com
- login.microsoftonline.com
- graph.microsoft.com
- slack.com
If firestore.googleapis.com is blocked, a card tap still blocks the device it was tapped on, but not the person's other devices. If you inspect HTTPS traffic and devices stop syncing, exclude the Google domains above from inspection.
Invitations don't arrive
Invites come from noreply@tapmira.com. If your mail filter quarantines new senders, allow the tapmira.com domain, or people never get their invite.
Microsoft 365 restricts apps
If your tenant doesn't let users approve apps themselves, an admin grants consent to MIRA once in Microsoft Entra. Only needed if you use Focus Blocks or Teams status.
Google Workspace restricts third-party apps
If your Workspace restricts third-party apps, allow MIRA under Security → API controls. Only needed if you use Focus Blocks.
Slack requires app approval
If your workspace requires approval for apps, approve MIRA once. Only needed for Slack status syncing.
What data leaves
Sessions someone marks Personal are never shown to admins, not individually and not in any total. Full detail is in the Privacy Policy. A Data Processing Agreement is available from info@tapmira.com.
Stuck? We'll do it with you.
Email support@tapmira.com with the platform and what you saw, or ask for a short call with your IT person and we'll go through the rollout together.
Contact support