Deploy with any other MDM

Use this if your MDM does not have its own guide, including JumpCloud, Ivanti Neurons, ManageEngine Endpoint Central, Sophos Central, Rippling, Hexnode, Miradore, and Chef or Ansible-driven fleets. Everything the client needs is a signed package, a handful of configuration values, and on macOS four permission payloads.

What your MDM has to be able to do

If your MDM cannot deliver a custom configuration profile on macOS, it cannot deploy this client to Macs. The four payloads below are not optional: without them macOS prompts the employee at every permission gate, which defeats a managed deployment. Windows has no equivalent constraint, so a Windows-only fleet needs far less from its MDM.

macOS

1. Deliver the configuration profile

Download merge-workforce-client.mobileconfig from Devices → Deployment. It contains all four payloads, with your EnrollmentToken, OrgSlug, and API URLs already filled in:

The com.merge.workforceclient preference domain arrives pre-filled with these keys:

<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>PolicyMode</key>
<string>observe</string>

Upload it as a custom or signed profile, scoped to the device rather than the user, and confirm it has applied before installing the package:

defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist

2. Install the package

installer -pkg Merge-Workforce-macOS.pkg -target /

3. Confirm

sudo launchctl list | grep com.merge.workforceclient

This should print a line for the daemon.

Windows

1. Install the package with your organization’s properties

The MSI takes its configuration as install properties, so there is nothing to deliver separately. Copy the MSI install properties from Devices → Deployment, which carry your enrollment token, organization id, and API URLs, and append them to the install command:

msiexec /i Merge-Workforce-Windows.msi /qn ENROLLMENTTOKEN="<your enrollment token>" APIBASEURL="<your device API base URL>" ORGSLUG="<your organization id>" DASHBOARDURL="<your dashboard URL>"

If your MDM has a separate field for MSI properties or command-line arguments, paste the properties there and leave the command as msiexec /i Merge-Workforce-Windows.msi /qn. Without the properties the MSI still installs, but the client runs local-only and the device never appears in Devices.

The MSI installs a background service and a tray app. The Merge icon appears in the signed-in employee’s system tray within a minute of the install completing. Require Windows 10 build 19044 or later as an install condition where your MDM supports one. Windows 10 reached end of support in October 2025, so Windows 10 devices also need Extended Security Updates enrollment.

2. Confirm

In an elevated PowerShell session:

Get-Service MergeWorkforceClient
& 'C:\Program Files\Merge\merge-workforce-client.exe' doctor

The service should be Running, and doctor should print your organization id and API URLs with source installer-registry.

Identity without a supported MDM connection

Identity needs nothing from your MDM: the employee completes a one-time sign-in from the menu bar prompt, and Merge binds the verified identity to the device. See Assigning identity at deployment.

Verify the whole thing worked

Whatever the MDM, the check is the same: the device appears in Devices within a minute of the service starting, and shows the resolved employee once they complete the one-time sign-in. If it stays unattributed, work through Troubleshooting.

Next steps