Deploy with Mosyle

This deploys the client to macOS through Mosyle Business or Mosyle Fuse. Mosyle manages Apple platforms only, so if you also run Windows, pair this with Intune, Configuration Manager, or any other MDM for that half of the fleet. Read Plan your deployment first, and download the package and configuration profile from Devices → Deployment.

1. Upload the configuration profile

1. Management → Management Profiles → Certificates / Custom Profiles → Add new profile
2. Name it Merge Workforce desktop client
3. Upload merge-workforce-client.mobileconfig
4. Enable the option to replace Mosyle variables, otherwise %Email% deploys as a literal string
5. Assign to a test device group
6. Save

The profile downloads with EnrollmentToken, OrgSlug, and the API URLs already filled in. Edit it before uploading only to add optional keys in the com.merge.workforceclient preference domain, for example the mismatch-alert hint:

<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>%Email%</string>
<key>PolicyMode</key>
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Mosyle substitutes the assigned user here (%Email% is case-sensitive and resolves only on devices with an assigned user), and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac. Omit the key if your fleet has no reliable user assignment.

2. Deploy the package

Mosyle installs signed packages through Management → Install PKG:

1. On the PKGs tab, Add new package and upload Merge-Workforce-macOS.pkg
2. On the Profiles tab, Add new profile, select the package
3. Assign to the same test device group
4. Save

Mosyle installs the package once per assignment. The client does not update itself yet; to upgrade, upload the newer package to this Custom App. Leave the profile as it is, since it does not change between versions.

3. Confirm on a test Mac

defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
sudo launchctl list | grep com.merge.workforceclient

The preferences should show your token and slug, and the second command should print a line for the daemon. The device appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.

4. Roll out to your fleet

Assign the profile to your production device groups first, confirm it has propagated on devices in each group, then assign the app. Stage by splitting device groups: canary first, then the rest. The client does not update itself yet. To upgrade, upload the newer package to the same Custom App and stage it the same way.

Next steps