> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Deploy with Jamf Pro

> Step-by-step Jamf Pro deployment of the Merge Workforce desktop client, including the PPPC, system extension, and content filter payloads macOS requires.

This deploys the client to macOS through Jamf Pro. Jamf Pro manages Apple platforms only, so if you also run Windows, pair this with [Intune](/merge-workforce/devices/deploy/intune), [Configuration Manager](/merge-workforce/devices/deploy/configuration-manager), or [any other MDM](/merge-workforce/devices/deploy/other-mdm) for that half of the fleet. Read [Plan your deployment](/merge-workforce/devices/deployment-overview) first, and download the package and configuration profile from **Devices → Deployment**.

## 1. Upload the configuration profile

The profile from the dashboard already contains the system extension allowlist (which covers the Endpoint Security extension type), content filter, privacy preferences, and managed login item payloads, with your `EnrollmentToken`, `OrgSlug`, and API URLs filled in at download. You only edit it to add optional keys.

1. Optional: open `merge-workforce-client.mobileconfig` in a profile editor such as iMazing Profile Editor to add optional keys like `ExpectedIdentity` in the `com.merge.workforceclient` preference domain. Edit before uploading: Jamf Pro cannot edit signed uploaded profiles, may modify unsigned ones, and does not render the managed login items payload for editing at all
2. **Computers → Configuration Profiles → Upload**, and select `merge-workforce-client.mobileconfig`
3. **Scope** to your test smart group for now
4. Save

Set these values in the preference domain payload:

```xml maxLines=20
<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>$EMAIL</string>
<key>PolicyMode</key>
<string>observe</string>
```

`ExpectedIdentity` is an optional hint and is **not** an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Jamf substitutes the assigned user here, and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac. The variable is case-sensitive (`$EMAIL`, not `$email`) and substitutes only on computers with an assigned user in inventory. Omit it entirely if your Jamf inventory has no reliable email.

> **Do not hardcode it**
>
> A literal email here makes every Mac in scope expect the same employee, so every correctly resolved identity raises a mismatch alert. Use a Jamf variable or leave the key out.

## 2. Verify the profile landed

On a test Mac:

```bash
sudo profiles show -type configuration | grep -A2 workforceclient
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
```

You should see your token and slug. If you set `ExpectedIdentity` and it still reads `$EMAIL`, Jamf had no value to substitute, which is harmless: it only disables the mismatch alert.

## 3. Upload and deploy the package

1. Upload `Merge-Workforce-macOS.pkg` in **Settings → Computer management → Packages**. In Jamf Pro 11.4 and later, in-console upload requires a cloud distribution point; with an on-premises file share distribution point, place the package on the share manually
2. **Computers → Policies → New**
3. **General:** name it `Merge Workforce desktop client`, trigger **Recurring check-in**, execution frequency **Once per computer**
4. **Packages:** add the package, action **Install**
5. **Scope:** your test smart group
6. Save, then run **Recurring check-in** on a test Mac with `sudo jamf policy`

## 4. Confirm enrollment

On the test Mac:

```bash
sudo launchctl list | grep com.merge.workforceclient
```

This should print a line for the daemon. Then open **Devices** in the dashboard: the device appears within a minute, and shows the resolved employee once they complete the one-time sign-in.

## 5. Scope to the fleet

Create a smart group for the devices you want covered, for example all Macs on macOS 13 or later:

| Criteria                 | Operator              | Value  |
| ------------------------ | --------------------- | ------ |
| Operating System Version | greater than or equal | `13.0` |

Change the scope on the configuration profile first, wait for it to propagate, then change the scope on the policy. Roll the profile and package out to a small canary smart group before your whole fleet.

## Next steps

#### [Troubleshooting](/merge-workforce/devices/troubleshooting)

Enrollment, identity resolution, macOS permission prompts

#### [Privacy and data collection](/merge-workforce/devices/privacy-and-data-collection)

What to share with your security team