> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Deploy with Iru

> Step-by-step Iru deployment of the Merge Workforce desktop client on macOS, plus what to do for Windows devices managed by Iru.

This deploys the client through Iru. The macOS steps below are the detailed path; Windows devices in an Iru tenant are covered at the end. Read [Plan your deployment](/merge-workforce/devices/deployment-overview) first, and download the packages and the configuration profile from **Devices → Deployment**.

## macOS

## 1. Add the Custom Profile

1. **Library → Add New → Custom Profile**
2. Name it `Merge Workforce desktop client`
3. Upload `merge-workforce-client.mobileconfig` from the dashboard
4. Assign it to your test Blueprint by placing it on the Assignment Map (all Iru Blueprints are Assignment Maps)
5. Save

The profile already carries the system extension allowlist, content filter, privacy preferences with full disk access, and managed login item payloads, with your `EnrollmentToken`, `OrgSlug`, and API URLs filled in at download. Edit it before uploading only to add optional keys in the `com.merge.workforceclient` preference domain, for example the mismatch-alert hint:

```xml maxLines=20
<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>$EMAIL</string>
<key>PolicyMode</key>
<string>observe</string>
```

`ExpectedIdentity` is an optional hint and is **not** an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. `$EMAIL` is an Iru Global Variable that substitutes the assigned user's email, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac.

> **Devices with no assigned user are fine**
>
> `$EMAIL` substitutes only on devices that have an assigned user. Devices without one still enroll and still resolve identity normally; they get no mismatch alerting. Omit the key entirely if your fleet has no reliable user assignment.

## 2. Add the Custom App

1. **Library → Add New → Custom App**
2. Name it `Merge Workforce desktop client`
3. Upload `Merge-Workforce-macOS.pkg`
4. **Install type:** Installer Package
5. **Install enforcement:** choose **Install once per device**. The client does not update itself yet; to upgrade, upload the newer package to this Library Item
6. Assign to the same test Blueprint once the profile is confirmed on your test devices
7. Save

## 3. Confirm on a test Mac

The agent checks in every 15 minutes on its own. To force one on a test Mac:

```bash
sudo iru run
```

Then verify:

```bash
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
sudo launchctl list | grep com.merge.workforceclient
```

The preferences should show your token and slug, and the second command should print a line for the daemon. The device then appears in **Devices** within a minute, and shows the resolved employee once they complete the one-time sign-in.

## 4. Roll out to your fleet

Add both Library Items to your production Blueprints, profile first, and confirm the profile has reached devices before the app since Iru does not sequence Library Items. Iru has no percentage-based staged rollout for Library Items, so stage by scope instead: assign both items to a small canary Blueprint or Assignment Map rule first, then widen. The client does not update itself yet. To upgrade, upload the newer package to the same Library Item and stage it the same way.

## Windows devices

Windows needs no permission pre-approval, so the deployment is much simpler than the macOS one: deliver the MSI with your organization's values as install properties. Iru has built-in Windows profile Library Items, but the client takes its settings on the install command, not from a profile.

1. Add a Windows Custom App Library Item: upload a `.zip` containing `Merge-Workforce-Windows.msi`, and add a detection rule, which Iru requires. The `MergeWorkforceClient` service or the MSI product code both work
2. Set the install command to `msiexec /i Merge-Workforce-Windows.msi /qn` followed by the **MSI install properties** copied from **Devices → Deployment**. Without them the client runs local-only and the device never appears in **Devices**
3. Confirm with `Get-Service MergeWorkforceClient` in an elevated PowerShell session

The exact Library Item names differ from the macOS flow above. If a step does not match what you see, [Deploy with any other MDM](/merge-workforce/devices/deploy/other-mdm) documents the platform contract in MDM-neutral terms, and everything there applies.

## Next steps

#### [Troubleshooting](/merge-workforce/devices/troubleshooting)

Enrollment, identity resolution, macOS permission prompts

#### [Privacy and data collection](/merge-workforce/devices/privacy-and-data-collection)

What to share with your security team