Deploy with Workspace ONE

On macOS, assign the profile before the app. If the app installs first, macOS shows the employee a blocked extension prompt; the profile still approves the extension when it arrives, no restart needed, but the employee has already seen the dialog.

1. Upload the configuration profile

1. Resources → Profiles & Baselines → Profiles → Add → Add Profile → macOS → Device Profile
2. Name it Merge Workforce desktop client
3. Add one Custom Settings payload per payload in merge-workforce-client.mobileconfig: paste each payload’s inner PayloadContent dictionary into its own Custom Settings box, using + for the next one
4. Assign to a test smart group
5. Save and publish

The Custom Settings box expects a single payload dictionary, not the whole file: pasting the full .mobileconfig with its Configuration wrapper produces a profile that fails to install. The profile downloads with EnrollmentToken, OrgSlug, and the API URLs already filled in; edit the com.merge.workforceclient preference payload before pasting only to add optional keys, for example the mismatch-alert hint:

1
<key>EnrollmentToken</key>
2
<string>YOUR_ENROLLMENT_TOKEN</string>
3
<key>OrgSlug</key>
4
<string>acme</string>
5
<key>ExpectedIdentity</key>
6
<string>{EmailAddress}</string>
7
<key>PolicyMode</key>
8
<string>observe</string>

ExpectedIdentity is an optional hint and is not an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. {EmailAddress} is a Workspace ONE lookup value resolved from the enrollment user, and the client uses it only to raise a mismatch alert.

2. Deploy the package

1. Generate the metadata plist for MergeWorkforceClient-<version>.pkg with the Omnissa Admin Assistant; Workspace ONE will not accept the bare PKG
2. Resources → Apps → Native → Internal → Add Application File, and upload the PKG together with the metadata plist
3. Confirm macOS Software Management is enabled: delivery runs through the Intelligent Hub, which enforces the version in the uploaded metadata. Because the client updates itself, upload fresh metadata when you advance versions, otherwise the Hub reinstalls the old version over a self-updated client
4. Assign to the same smart group

3. Confirm

$
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
$
sudo launchctl list | grep com.merge.workforceclient
$
systemextensionsctl list | grep -i merge

The extension should read [activated enabled]. The device appears in Devices within a minute, and shows the resolved employee once they complete the one-time sign-in.