Deploy with Iru

This deploys the client through Iru. The macOS steps below are the detailed path; Windows devices in an Iru tenant are covered at the end. Read Plan your deployment first, and download the packages and the configuration profile from Devices → Deployment.

macOS

1. Add the Custom Profile

1. Library → Add New → Custom Profile
2. Name it Merge Workforce desktop client
3. Upload merge-workforce-client.mobileconfig from the dashboard
4. Assign it to your test Blueprint by placing it on the Assignment Map (all Iru Blueprints are Assignment Maps)
5. Save

The profile already carries the system extension allowlist, content filter, privacy preferences with full disk access, and managed login item payloads, with your EnrollmentToken, OrgSlug, and API URLs filled in at download. Edit it before uploading only to add optional keys in the com.merge.workforceclient preference domain, for example the mismatch-alert hint:

<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>$EMAIL</string>
<key>PolicyMode</key>
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. $EMAIL is an Iru Global Variable that substitutes the assigned user’s email, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac.

2. Add the Custom App

1. Library → Add New → Custom App
2. Name it Merge Workforce desktop client
3. Upload Merge-Workforce-macOS.pkg
4. Install type: Installer Package
5. Install enforcement: choose Install once per device. The client does not update itself yet; to upgrade, upload the newer package to this Library Item
6. Assign to the same test Blueprint once the profile is confirmed on your test devices
7. Save

3. Confirm on a test Mac

The agent checks in every 15 minutes on its own. To force one on a test Mac:

sudo iru run

Then verify:

defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
sudo launchctl list | grep com.merge.workforceclient

The preferences should show your token and slug, and the second command should print a line for the daemon. The device then appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.

4. Roll out to your fleet

Add both Library Items to your production Blueprints, profile first, and confirm the profile has reached devices before the app since Iru does not sequence Library Items. Iru has no percentage-based staged rollout for Library Items, so stage by scope instead: assign both items to a small canary Blueprint or Assignment Map rule first, then widen. The client does not update itself yet. To upgrade, upload the newer package to the same Library Item and stage it the same way.

Windows devices

Windows needs no permission pre-approval, so the deployment is much simpler than the macOS one: deliver the MSI with your organization’s values as install properties. Iru has built-in Windows profile Library Items, but the client takes its settings on the install command, not from a profile.

1. Add a Windows Custom App Library Item: upload a .zip containing Merge-Workforce-Windows.msi, and add a detection rule, which Iru requires. The MergeWorkforceClient service or the MSI product code both work
2. Set the install command to msiexec /i Merge-Workforce-Windows.msi /qn followed by the MSI install properties copied from Devices → Deployment. Without them the client runs local-only and the device never appears in Devices
3. Confirm with Get-Service MergeWorkforceClient in an elevated PowerShell session

The exact Library Item names differ from the macOS flow above. If a step does not match what you see, Deploy with any other MDM documents the platform contract in MDM-neutral terms, and everything there applies.

Next steps