Deploy with any other MDM

Use this if your MDM does not have its own guide, including JumpCloud, Ivanti Neurons, ManageEngine Endpoint Central, Sophos Central, Rippling, Hexnode, Miradore, and Chef or Ansible-driven fleets. Everything the client needs is a signed package, a handful of configuration values, and on macOS four permission payloads.

What your MDM has to be able to do

If your MDM cannot deliver a custom configuration profile on macOS, it cannot deploy this client to Macs. The four payloads below are not optional: without them macOS prompts the employee at every permission gate, which defeats a managed deployment. Windows has no equivalent constraint, so a Windows-only fleet needs far less from its MDM.

macOS

1. Deliver the configuration profile

Download merge-workforce-client.mobileconfig from Devices → Deployment. It contains all four payloads, with your EnrollmentToken, OrgSlug, and API URLs already filled in:

The com.merge.workforceclient preference domain arrives pre-filled with these keys:

1
<key>EnrollmentToken</key>
2
<string>YOUR_ENROLLMENT_TOKEN</string>
3
<key>OrgSlug</key>
4
<string>acme</string>
5
<key>PolicyMode</key>
6
<string>observe</string>

Upload it as a custom or signed profile, scoped to the device rather than the user, and confirm it has applied before installing the package:

$
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist

2. Install the package

$
installer -pkg MergeWorkforceClient-<version>.pkg -target /

3. Confirm

$
sudo launchctl list | grep com.merge.workforceclient
$
systemextensionsctl list | grep -i merge

The extension should read [activated enabled].

Windows

1. Deliver the configuration

Any of these three, whichever your MDM supports:

1
New-Item -Path 'HKLM:\SOFTWARE\Policies\Merge\WorkforceClient' -Force
2
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Merge\WorkforceClient' -Name 'EnrollmentToken' -Value 'YOUR_ENROLLMENT_TOKEN'
3
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Merge\WorkforceClient' -Name 'OrgSlug' -Value 'acme'
4
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Merge\WorkforceClient' -Name 'PolicyMode' -Value 'observe'

1
msiexec /i MergeWorkforceClient-<version>.msi /qn ENROLLMENTTOKEN=YOUR_ENROLLMENT_TOKEN ORGSLUG=acme POLICYMODE=observe

2. Install the package

1
msiexec /i MergeWorkforceClient-<version>.msi /qn

Require Windows 10 build 19044 or later as an install condition where your MDM supports one. Windows 10 reached end of support in October 2025, so Windows 10 devices also need Extended Security Updates enrollment.

3. Confirm

1
Get-Service MergeWorkforceClient
2
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Merge\WorkforceClient'

Identity without a supported MDM connection

Identity needs nothing from your MDM: the employee completes a one-time sign-in from the menu bar prompt, and Merge binds the verified identity to the device. See Assigning identity at deployment.

Verify the whole thing worked

Whatever the MDM, the check is the same: the device appears in Devices within a minute of the service starting, and shows the resolved employee once they complete the one-time sign-in. If it stays unattributed, work through Troubleshooting.

Next steps