Workforce desktop clientDeploy with your MDM

Deploy with Group Policy or Configuration Manager

Push the Workforce desktop client to a domain-joined Windows fleet without Intune

Use this if your Windows fleet is domain-joined and managed with Active Directory rather than Intune. Group Policy delivers the configuration; either Group Policy software installation or Microsoft Configuration Manager (formerly SCCM) delivers the MSI. Read Plan your deployment first.

Download the MSI from Devices → Deployment, which also shows the install command with your organization’s values interpolated.

1. Configure the client

The client reads plain registry values, so a Group Policy Preferences item is all the configuration takes:

  1. Open Group Policy Management, create a GPO named Merge Workforce desktop client, and link it to the OU holding your target computers
  2. Edit it and go to Computer Configuration → Preferences → Windows Settings → Registry
  3. Create these values:
PathNameTypeValue
HKLM\SOFTWARE\Policies\Merge\WorkforceClientEnrollmentTokenREG_SZyour enrollment token
HKLM\SOFTWARE\Policies\Merge\WorkforceClientOrgSlugREG_SZacme
HKLM\SOFTWARE\Policies\Merge\WorkforceClientPolicyModeREG_SZobserve

There is no employee identity setting to configure, on any platform, by design: a registry value is writable by a local administrator, so it is never trusted as identity. Merge resolves identity itself, from a verified IdP sign-in.

Group Policy loses nothing here

Identity does not depend on your MDM or domain tooling: the employee completes a one-time sign-in from the menu bar and Merge binds the verified identity to the device. Group Policy fleets resolve identity exactly like every other deployment.

2. Deploy the MSI

Configuration Manager is the better option if you have it: you get per-collection phased deployment and real install reporting.

  1. Software Library → Application Management → Applications → Create Application
  2. Type Windows Installer (*.msi file) and point at MergeWorkforceClient-<version>.msi on a UNC share
  3. On the deployment type, set the installation program to msiexec /i MergeWorkforceClient-<version>.msi /qn
  4. On the Requirements tab, add an Operating system condition covering your Windows 10 and Windows 11 versions. The built-in condition selects OS versions from a list rather than a minimum build; to gate on build 19044 (21H2) exactly, create a custom global condition on the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber
  5. Distribute the content, then deploy to a test collection with purpose Required
  6. Once the test collection is healthy, deploy to your production collections

3. Confirm enrollment

On a target machine, in an elevated PowerShell session:

1Get-Service MergeWorkforceClient
2Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Merge\WorkforceClient'

The service should be Running. If the registry values are missing, run gpupdate /force and check gpresult /h report.html to confirm the GPO applied. The device appears in Devices within a minute of the service starting, and shows the resolved employee once they complete the one-time sign-in.

Uninstall

Configuration Manager: deploy the application with action Uninstall on the Deployment Settings page. Configuration Manager sets the purpose to Required automatically.

Group Policy: in the software installation package, choose All tasks → Remove → Immediately uninstall the software from users and computers. Machines uninstall at next restart.

Either way the service removes the network filters it created as it stops, so a machine that has lost the client is never left in a filtered state.

Next steps

Troubleshooting

Enrollment, identity resolution, coexistence

Privacy and data collection

What to share with your security team