> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Deploy with Configuration Manager

> Deploy the Merge Workforce desktop client to Windows with Microsoft Configuration Manager, passing your organization's values as MSI install properties.

Use this if your Windows fleet is domain-joined and managed with Microsoft Configuration Manager (formerly SCCM) rather than Intune. Read [Plan your deployment](/merge-workforce/devices/deployment-overview) first.

Download the MSI from **Devices → Deployment**, which also shows the **MSI install properties** with your organization's values already filled in. The client takes all of its configuration from those properties, so there is no Group Policy or registry step.

> **Group Policy software installation is not supported**
>
> Group Policy installs an MSI unmodified, with no way to pass properties, so the client would run local-only and never enroll. Use Configuration Manager, or an MDM that can run an install command, for domain-joined fleets.

## 1. Create the application

1. **Software Library → Application Management → Applications → Create Application**
2. Type **Windows Installer (\*.msi file)** and point at `Merge-Workforce-Windows.msi` on a UNC share
3. On the deployment type, set the installation program to `msiexec /i Merge-Workforce-Windows.msi /qn` followed by the install properties copied from **Devices → Deployment**:

```text
msiexec /i Merge-Workforce-Windows.msi /qn ENROLLMENTTOKEN="<your enrollment token>" APIBASEURL="<your device API base URL>" ORGSLUG="<your organization id>" DASHBOARDURL="<your dashboard URL>"
```

4. On the Requirements tab, add an **Operating system** condition covering your Windows 10 and Windows 11 versions. The built-in condition selects OS versions from a list rather than a minimum build; to gate on build 19044 (21H2) exactly, create a custom global condition on the registry value `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber`
5. Distribute the content, then deploy to a test collection with purpose **Required**
6. Once the test collection is healthy, deploy to your production collections

> **The installation program carries your enrollment token**
>
> Anyone who can read the deployment type can read the token, and it enrolls any device that presents it. Restrict the application's security scope to the administrators who need it.

There is no employee identity setting to configure, on any platform, by design. Merge resolves identity itself, from a verified IdP sign-in: the employee clicks **Sign in** in the tray once and Merge binds the verified identity to the device. See [Assigning identity at deployment](/merge-workforce/devices/deployment-overview#assigning-identity-at-deployment).

## 2. Confirm enrollment

On a target machine, in an elevated PowerShell session:

```powershell
Get-Service MergeWorkforceClient
& 'C:\Program Files\Merge\merge-workforce-client.exe' doctor
```

The service should be **Running**, and `doctor` should print your organization id and API URLs with source `installer-registry`. The device appears in **Devices** within a minute of the service starting. The Merge icon appears in the signed-in employee's system tray within a minute of the install completing, and the device shows the resolved employee once they complete the one-time sign-in.

## Next steps

#### [Troubleshooting](/merge-workforce/devices/troubleshooting)

Enrollment, identity resolution, coexistence

#### [Privacy and data collection](/merge-workforce/devices/privacy-and-data-collection)

What to share with your security team