Deploy with Workspace ONE

1. Upload the configuration profile

1. Resources → Profiles & Baselines → Profiles → Add → Add Profile → macOS → Device Profile
2. Name it Merge Workforce desktop client
3. Add one Custom Settings payload per payload in merge-workforce-client.mobileconfig: paste each payload’s inner PayloadContent dictionary into its own Custom Settings box, using + for the next one
4. Assign to a test smart group
5. Save and publish

The Custom Settings box expects a single payload dictionary, not the whole file: pasting the full .mobileconfig with its Configuration wrapper produces a profile that fails to install. The profile downloads with EnrollmentToken, OrgSlug, and the API URLs already filled in; edit the com.merge.workforceclient preference payload before pasting only to add optional keys, for example the mismatch-alert hint:

<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>{EmailAddress}</string>
<key>PolicyMode</key>
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. {EmailAddress} is a Workspace ONE lookup value resolved from the enrollment user, and the client uses it only to raise a mismatch alert.

2. Deploy the package

1. Generate the metadata plist for Merge-Workforce-macOS.pkg with the Omnissa Admin Assistant; Workspace ONE will not accept the bare PKG
2. Resources → Apps → Native → Internal → Add Application File, and upload the PKG together with the metadata plist
3. Confirm macOS Software Management is enabled: delivery runs through the Intelligent Hub, which enforces the version in the uploaded metadata. The client does not update itself yet; to upgrade, upload the newer PKG with fresh metadata and the Hub installs it wherever the installed version is older
4. Assign to the same smart group

3. Confirm

defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
sudo launchctl list | grep com.merge.workforceclient

This should print a line for the daemon. The device appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.