Deploy with Configuration Manager
Push the Workforce desktop client to a domain-joined Windows fleet without Intune
Use this if your Windows fleet is domain-joined and managed with Microsoft Configuration Manager (formerly SCCM) rather than Intune. Read Plan your deployment first.
Download the MSI from Devices → Deployment, which also shows the MSI install properties with your organization’s values already filled in. The client takes all of its configuration from those properties, so there is no Group Policy or registry step.
Group Policy installs an MSI unmodified, with no way to pass properties, so the client would run local-only and never enroll. Use Configuration Manager, or an MDM that can run an install command, for domain-joined fleets.
1. Create the application
- Software Library → Application Management → Applications → Create Application
- Type Windows Installer (*.msi file) and point at
Merge-Workforce-Windows.msion a UNC share - On the deployment type, set the installation program to
msiexec /i Merge-Workforce-Windows.msi /qnfollowed by the install properties copied from Devices → Deployment:
- On the Requirements tab, add an Operating system condition covering your Windows 10 and Windows 11 versions. The built-in condition selects OS versions from a list rather than a minimum build; to gate on build 19044 (21H2) exactly, create a custom global condition on the registry value
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber - Distribute the content, then deploy to a test collection with purpose Required
- Once the test collection is healthy, deploy to your production collections
Anyone who can read the deployment type can read the token, and it enrolls any device that presents it. Restrict the application’s security scope to the administrators who need it.
There is no employee identity setting to configure, on any platform, by design. Merge resolves identity itself, from a verified IdP sign-in: the employee clicks Sign in in the tray once and Merge binds the verified identity to the device. See Assigning identity at deployment.
2. Confirm enrollment
On a target machine, in an elevated PowerShell session:
The service should be Running, and doctor should print your organization id and API URLs with source installer-registry. The device appears in Devices within a minute of the service starting. The Merge icon appears in the signed-in employee’s system tray within a minute of the install completing, and the device shows the resolved employee once they complete the one-time sign-in.
Uninstall
Deploy the application with action Uninstall on the Deployment Settings page. Configuration Manager sets the purpose to Required automatically. The service removes the network filters it created as it stops, so a machine that has lost the client is never left in a filtered state.