Workforce desktop clientDeploy with your MDM

Deploy with Microsoft Intune

Push the Workforce desktop client to macOS and Windows from a single Intune tenant

Intune covers both platforms, so this page has a tab for each. Read Plan your deployment first, and download the packages and the macOS configuration profile from Devices → Deployment.

On macOS, assign the configuration profile before the app. If the app installs first, macOS shows the employee a blocked extension prompt; the profile still approves the extension when it arrives, no restart needed, but the employee has already seen the dialog.

1. Upload the configuration profile

  1. Devices → macOS → Manage devices → Configuration → Create → New policy
  2. Profile type Templates → Custom
  3. Name it Merge Workforce desktop client, deployment channel Device channel
  4. Upload merge-workforce-client.mobileconfig
  5. Assign to a test device group
  6. Create

The profile downloads with EnrollmentToken, OrgSlug, and the API URLs already filled in. Edit it before uploading only to add optional keys in the com.merge.workforceclient preference domain, for example the mismatch-alert hint:

1<key>EnrollmentToken</key>
2<string>YOUR_ENROLLMENT_TOKEN</string>
3<key>OrgSlug</key>
4<string>acme</string>
5<key>ExpectedIdentity</key>
6<string>{{userprincipalname}}</string>
7<key>PolicyMode</key>
8<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Intune substitutes the assigned user here, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac.

Devices with no primary user are fine

Intune only substitutes {{userprincipalname}} on devices that have a primary user, so shared Macs enrolled without user affinity leave it unresolved. They still enroll and still resolve identity normally, because identity comes from the employee’s one-time sign-in, not from this key. Omit it on those fleets.

2. Verify the profile landed

$defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist

You should see your token and slug. If you set ExpectedIdentity and it still reads {{userprincipalname}}, the device has no primary user, which is harmless: it only disables the mismatch alert. The token is case-sensitive and Intune does not validate it, so a mis-cased variant like {{UserPrincipalName}} deploys as a literal string on every device.

3. Add the app

  1. Apps → All apps → Create, platform macOS, app type macOS app (PKG)
  2. Upload MergeWorkforceClient-<version>.pkg
  3. Minimum operating system: macOS 13.0
  4. Set Ignore app version to Yes, so Intune does not reinstall over the client’s own updates when the installed version stops matching the uploaded package
  5. Assign as Required to the same test group
  6. Create

4. Confirm enrollment

$sudo launchctl list | grep com.merge.workforceclient
$systemextensionsctl list | grep -i merge

The extension should read [activated enabled]. The device appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.

Roll out to your fleet

Change the assignment on the configuration profile first, confirm it has propagated, then change the assignment on the app. Stage with Intune groups or assignment filters: a small canary group first, then broader groups. Once installed, the client keeps itself current through its own signed update channel.

Uninstall

macOS: the macOS app (PKG) type has no Uninstall assignment, so deploy a shell script that runs the bundled uninstaller (sudo /usr/local/bin/merge-workforce-client-uninstall), then unassign the app and the configuration profile.

Windows: change the app assignment to Uninstall. Intune calls msiexec /x and the service removes its own network filters as it stops.

Next steps

Troubleshooting

Enrollment, identity resolution, coexistence

Privacy and data collection

What to share with your security team