Deploy with Mosyle

This deploys the client to macOS through Mosyle Business or Mosyle Fuse. Mosyle manages Apple platforms only, so if you also run Windows, pair this with Intune, Group Policy, or any other MDM for that half of the fleet. Read Plan your deployment first, and download the package and configuration profile from Devices → Deployment.

Assign the profile before the package, and confirm it landed before assigning the app: Mosyle does not enforce delivery order, so on a newly enrolled Mac both can arrive together. If the package installs first, macOS shows the employee a blocked extension prompt; the profile still approves the extension when it arrives, no restart needed, but the employee has already seen the dialog.

1. Upload the configuration profile

1. Management → Management Profiles → Certificates / Custom Profiles → Add new profile
2. Name it Merge Workforce desktop client
3. Upload merge-workforce-client.mobileconfig
4. Enable the option to replace Mosyle variables, otherwise %Email% deploys as a literal string
5. Assign to a test device group
6. Save

The profile downloads with EnrollmentToken, OrgSlug, and the API URLs already filled in. Edit it before uploading only to add optional keys in the com.merge.workforceclient preference domain, for example the mismatch-alert hint:

1
<key>EnrollmentToken</key>
2
<string>YOUR_ENROLLMENT_TOKEN</string>
3
<key>OrgSlug</key>
4
<string>acme</string>
5
<key>ExpectedIdentity</key>
6
<string>%Email%</string>
7
<key>PolicyMode</key>
8
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Mosyle substitutes the assigned user here (%Email% is case-sensitive and resolves only on devices with an assigned user), and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac. Omit the key if your fleet has no reliable user assignment.

2. Deploy the package

Mosyle installs signed packages through Management → Install PKG:

1. On the PKGs tab, Add new package and upload MergeWorkforceClient-<version>.pkg
2. On the Profiles tab, Add new profile, select the package
3. Assign to the same test device group
4. Save

Mosyle installs the package once per assignment. Leave it assigned and do not recreate the profile for new versions: the client updates itself through its own signed update channel, and an MDM reinstall on top produces duplicate extension activations.

3. Confirm on a test Mac

$
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
$
sudo launchctl list | grep com.merge.workforceclient
$
systemextensionsctl list | grep -i merge

The extension should read [activated enabled] and the preferences should show your token and slug. The device appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.

4. Roll out to your fleet

Assign the profile to your production device groups first, confirm it has propagated on devices in each group, then assign the app. Stage by splitting device groups: canary first, then the rest. Once installed, the client keeps itself current through its own signed update channel.

Uninstall

Unassign both items, then run the uninstaller through a Custom Command:

$
sudo /usr/local/bin/merge-workforce-client-uninstall

Unassigning the app does not remove an installed package, and removing only the profile leaves a client without permissions, which reads as broken rather than absent.

Next steps