Deploy with Iru

This deploys the client through Iru. The macOS steps below are the detailed path; Windows devices in an Iru tenant are covered at the end. Read Plan your deployment first, and download the packages and the configuration profile from Devices → Deployment.

macOS

Iru does not guarantee the order Library Items install in, so sequence the rollout yourself: assign the profile, confirm it has landed on your test devices, then assign the app. If the app installs first, macOS shows the employee a blocked extension prompt; the profile still approves the extension when it arrives, no restart needed, but the employee has already seen the dialog.

1. Add the Custom Profile

1. Library → Add New → Custom Profile
2. Name it Merge Workforce desktop client
3. Upload merge-workforce-client.mobileconfig from the dashboard
4. Assign it to your test Blueprint by placing it on the Assignment Map (all Iru Blueprints are Assignment Maps)
5. Save

The profile already carries the system extension allowlist, content filter, privacy preferences with full disk access, and managed login item payloads, with your EnrollmentToken, OrgSlug, and API URLs filled in at download. Edit it before uploading only to add optional keys in the com.merge.workforceclient preference domain, for example the mismatch-alert hint:

1
<key>EnrollmentToken</key>
2
<string>YOUR_ENROLLMENT_TOKEN</string>
3
<key>OrgSlug</key>
4
<string>acme</string>
5
<key>ExpectedIdentity</key>
6
<string>$EMAIL</string>
7
<key>PolicyMode</key>
8
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. $EMAIL is an Iru Global Variable that substitutes the assigned user’s email, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac.

2. Add the Custom App

1. Library → Add New → Custom App
2. Name it Merge Workforce desktop client
3. Upload MergeWorkforceClient-<version>.pkg
4. Install type: Installer Package
5. Install enforcement: choose Install once per device, not Audit and enforce. The client updates itself through its own signed update channel, and Iru reinstalling it on top produces duplicate extension activations
6. Assign to the same test Blueprint once the profile is confirmed on your test devices
7. Save

3. Confirm on a test Mac

The agent checks in every 15 minutes on its own. To force one on a test Mac:

$
sudo iru run

Then verify:

$
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
$
sudo launchctl list | grep com.merge.workforceclient
$
systemextensionsctl list | grep -i merge

The preferences should show your token and slug, and the extension should read [activated enabled]. The device then appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.

4. Roll out to your fleet

Add both Library Items to your production Blueprints, profile first, and confirm the profile has reached devices before the app since Iru does not sequence Library Items. Iru has no percentage-based staged rollout for Library Items, so stage by scope instead: assign both items to a small canary Blueprint or Assignment Map rule first, then widen. Once installed, the client keeps itself current through its own signed update channel.

Uninstall

Unassign both Library Items, then deploy the uninstaller as a Custom Script, or run it locally:

$
sudo /usr/local/bin/merge-workforce-client-uninstall

Unassigning the Custom App does not remove an already-installed package, and unassigning the profile alone leaves the client installed without permissions, which looks like a broken client rather than an absent one. Always run the uninstaller.

Windows devices

Windows needs no permission pre-approval, so the deployment is much simpler than the macOS one: deliver the MSI and the configuration values. Iru has built-in Windows profile Library Items, but the client’s settings live under its own registry path, so they travel with the install command or a Custom Script instead.

1. Add a Windows Custom App Library Item: upload a .zip containing MergeWorkforceClient-<version>.msi, set the install command msiexec /i MergeWorkforceClient-<version>.msi /qn, and add a detection rule, which Iru requires. The MergeWorkforceClient service or the MSI product code both work
2. Deliver the configuration either as MSI properties on that command (ENROLLMENTTOKEN=... ORGSLUG=acme POLICYMODE=observe) or as REG_SZ values under HKLM\SOFTWARE\Policies\Merge\WorkforceClient via a Custom Script
3. Confirm with Get-Service MergeWorkforceClient in an elevated PowerShell session

The exact Library Item names differ from the macOS flow above. If a step does not match what you see, Deploy with any other MDM documents the platform contract in MDM-neutral terms, and everything there applies.

Next steps