> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Deploy with Microsoft Intune

> Step-by-step Intune deployment of the Merge Workforce desktop client for both macOS and Windows, including the macOS permission profiles and the Windows install properties.

Intune covers both platforms, so this page has a tab for each. Read [Plan your deployment](/merge-workforce/devices/deployment-overview) first, and download the packages and the macOS configuration profile from **Devices → Deployment**.

#### macOS

### 1. Upload the configuration profile

1. **Devices → macOS → Manage devices → Configuration → Create → New policy**
2. Profile type **Templates → Custom**
3. Name it `Merge Workforce desktop client`, deployment channel **Device channel**
4. Upload `merge-workforce-client.mobileconfig`
5. Assign to a test device group
6. Create

The profile downloads with `EnrollmentToken`, `OrgSlug`, and the API URLs already filled in. Edit it before uploading only to add optional keys in the `com.merge.workforceclient` preference domain, for example the mismatch-alert hint:

```xml maxLines=20
<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>{{userprincipalname}}</string>
<key>PolicyMode</key>
<string>observe</string>
```

`ExpectedIdentity` is an optional hint and is **not** an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Intune substitutes the assigned user here, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac.

> **Devices with no primary user are fine**
>
> Intune only substitutes `{{userprincipalname}}` on devices that have a primary user, so shared Macs enrolled without user affinity leave it unresolved. They still enroll and still resolve identity normally, because identity comes from the employee's one-time sign-in, not from this key. Omit it on those fleets.

### 2. Verify the profile landed

```bash
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
```

You should see your token and slug. If you set `ExpectedIdentity` and it still reads `{{userprincipalname}}`, the device has no primary user, which is harmless: it only disables the mismatch alert. The token is case-sensitive and Intune does not validate it, so a mis-cased variant like `{{UserPrincipalName}}` deploys as a literal string on every device.

### 3. Add the app

1. **Apps → All apps → Create**, platform **macOS**, app type **macOS app (PKG)**
2. Upload `Merge-Workforce-macOS.pkg`
3. **Minimum operating system:** macOS 13.0
4. Leave **Ignore app version** at **No**. The client does not update itself; you upgrade it by uploading a newer package to this app, and Intune installs it wherever the installed version is older
5. Assign as **Required** to the same test group
6. Create

### 4. Confirm enrollment

```bash
sudo launchctl list | grep com.merge.workforceclient
```

This should print a line for the daemon. The device appears in **Devices** within a minute, and shows the resolved employee once they complete the one-time sign-in.

#### Windows

On Windows there is no permission prompt to pre-empt and no separate configuration to deliver. The MSI takes your organization's values as install properties, so the whole deployment is one line-of-business app.

### 1. Copy the install properties

Open **Devices → Deployment** in the Workforce dashboard and copy the **MSI install properties**. They are one line, generated with your enrollment token, organization id, and API URLs already filled in:

```text
ENROLLMENTTOKEN="<your enrollment token>" APIBASEURL="<your device API base URL>" ORGSLUG="<your organization id>" DASHBOARDURL="<your dashboard URL>"
```

> **The properties carry your enrollment token**
>
> Paste them straight into Intune rather than saving them in a file or ticket. The token enrolls any device that presents it.

### 2. Add the app

1. **Apps** in the left navigation → **Windows → Add**, app type **Line-of-business app**
2. Upload `Merge-Workforce-Windows.msi`
3. **App install context** is read from the MSI: a per-machine package shows **Device** and cannot be changed
4. Paste the install properties from step 1 into **Command-line arguments**, exactly as copied. Do not add `/qn` or `/norestart`; Intune already installs line-of-business MSIs silently
5. Leave **Ignore app version** at **No**. The client does not update itself; you upgrade it by uploading a newer MSI to this app, and Intune installs it wherever the installed version is older. Give every release a higher version number, since Intune treats a same-version MSI as already installed
6. Assign as **Required** to your test device group
7. Create

Without the properties the MSI still installs, but the client has no organization to enroll in and runs local-only, so the device never appears in **Devices**. If you have already deployed it that way, add the properties and let Intune reinstall, or push the uninstall assignment first.

### 3. Confirm enrollment

In an elevated PowerShell session on a test device:

```powershell
Get-Service MergeWorkforceClient
& 'C:\Program Files\Merge\merge-workforce-client.exe' doctor
```

The service should be **Running**, and `doctor` should print your organization id and API URLs with source `installer-registry`. The device appears in **Devices** within a minute. The Merge icon appears in the signed-in employee's system tray within a minute of the install completing, and the device shows the resolved employee once they click **Sign in** there and complete the one-time sign-in.

## Roll out to your fleet

On macOS, change the assignment on the configuration profile first, confirm it has propagated, then change the assignment on the app. On Windows the app is the only assignment. Stage with Intune groups or assignment filters: a small canary group first, then broader groups. The client does not update itself yet. To upgrade, upload the newer package to the same app and Intune installs it wherever the installed version is older.

## Next steps

#### [Troubleshooting](/merge-workforce/devices/troubleshooting)

Enrollment, identity resolution, coexistence

#### [Privacy and data collection](/merge-workforce/devices/privacy-and-data-collection)

What to share with your security team