DeploymentDevicesDeploy with your MDM

Deploy with Microsoft Intune

Push the Workforce desktop client to macOS and Windows from a single Intune tenant

Intune covers both platforms, so this page has a tab for each. Read Plan your deployment first, and download the packages and the macOS configuration profile from Devices → Deployment.

1. Upload the configuration profile

  1. Devices → macOS → Manage devices → Configuration → Create → New policy
  2. Profile type Templates → Custom
  3. Name it Merge Workforce desktop client, deployment channel Device channel
  4. Upload merge-workforce-client.mobileconfig
  5. Assign to a test device group
  6. Create

The profile downloads with EnrollmentToken, OrgSlug, and the API URLs already filled in. Edit it before uploading only to add optional keys in the com.merge.workforceclient preference domain, for example the mismatch-alert hint:

<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>{{userprincipalname}}</string>
<key>PolicyMode</key>
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Intune substitutes the assigned user here, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac.

Devices with no primary user are fine

Intune only substitutes {{userprincipalname}} on devices that have a primary user, so shared Macs enrolled without user affinity leave it unresolved. They still enroll and still resolve identity normally, because identity comes from the employee’s one-time sign-in, not from this key. Omit it on those fleets.

2. Verify the profile landed

defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist

You should see your token and slug. If you set ExpectedIdentity and it still reads {{userprincipalname}}, the device has no primary user, which is harmless: it only disables the mismatch alert. The token is case-sensitive and Intune does not validate it, so a mis-cased variant like {{UserPrincipalName}} deploys as a literal string on every device.

3. Add the app

  1. Apps → All apps → Create, platform macOS, app type macOS app (PKG)
  2. Upload Merge-Workforce-macOS.pkg
  3. Minimum operating system: macOS 13.0
  4. Leave Ignore app version at No. The client does not update itself; you upgrade it by uploading a newer package to this app, and Intune installs it wherever the installed version is older
  5. Assign as Required to the same test group
  6. Create

4. Confirm enrollment

sudo launchctl list | grep com.merge.workforceclient

This should print a line for the daemon. The device appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.

Roll out to your fleet

On macOS, change the assignment on the configuration profile first, confirm it has propagated, then change the assignment on the app. On Windows the app is the only assignment. Stage with Intune groups or assignment filters: a small canary group first, then broader groups. The client does not update itself yet. To upgrade, upload the newer package to the same app and Intune installs it wherever the installed version is older.

Next steps

Troubleshooting

Enrollment, identity resolution, coexistence

Privacy and data collection

What to share with your security team