> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Deploy with Mosyle

> Step-by-step Mosyle deployment of the Merge Workforce desktop client, including device group assignment and the macOS permission payloads it requires.

This deploys the client to macOS through Mosyle Business or Mosyle Fuse. Mosyle manages Apple platforms only, so if you also run Windows, pair this with [Intune](/merge-workforce/devices/deploy/intune), [Configuration Manager](/merge-workforce/devices/deploy/configuration-manager), or [any other MDM](/merge-workforce/devices/deploy/other-mdm) for that half of the fleet. Read [Plan your deployment](/merge-workforce/devices/deployment-overview) first, and download the package and configuration profile from **Devices → Deployment**.

## 1. Upload the configuration profile

1. **Management → Management Profiles → Certificates / Custom Profiles → Add new profile**
2. Name it `Merge Workforce desktop client`
3. Upload `merge-workforce-client.mobileconfig`
4. Enable the option to replace Mosyle variables, otherwise `%Email%` deploys as a literal string
5. Assign to a test device group
6. Save

The profile downloads with `EnrollmentToken`, `OrgSlug`, and the API URLs already filled in. Edit it before uploading only to add optional keys in the `com.merge.workforceclient` preference domain, for example the mismatch-alert hint:

```xml maxLines=20
<key>EnrollmentToken</key>
<string>YOUR_ENROLLMENT_TOKEN</string>
<key>OrgSlug</key>
<string>YOUR_ORGANIZATION_ID</string>
<key>ExpectedIdentity</key>
<string>%Email%</string>
<key>PolicyMode</key>
<string>observe</string>
```

`ExpectedIdentity` is an optional hint and is **not** an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. Mosyle substitutes the assigned user here (`%Email%` is case-sensitive and resolves only on devices with an assigned user), and the client uses it only to raise a mismatch alert if a different employee is resolved on that Mac. Omit the key if your fleet has no reliable user assignment.

## 2. Deploy the package

Mosyle installs signed packages through **Management → Install PKG**:

1. On the **PKGs** tab, **Add new package** and upload `Merge-Workforce-macOS.pkg`
2. On the **Profiles** tab, **Add new profile**, select the package
3. Assign to the same test device group
4. Save

Mosyle installs the package once per assignment. The client does not update itself yet; to upgrade, upload the newer package to this Custom App. Leave the profile as it is, since it does not change between versions.

## 3. Confirm on a test Mac

```bash
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
sudo launchctl list | grep com.merge.workforceclient
```

The preferences should show your token and slug, and the second command should print a line for the daemon. The device appears in **Devices** within a minute, and shows the resolved employee once they complete the one-time sign-in.

## 4. Roll out to your fleet

Assign the profile to your production device groups first, confirm it has propagated on devices in each group, then assign the app. Stage by splitting device groups: canary first, then the rest. The client does not update itself yet. To upgrade, upload the newer package to the same Custom App and stage it the same way.

## Next steps

#### [Troubleshooting](/merge-workforce/devices/troubleshooting)

Enrollment, identity resolution, macOS permission prompts

#### [Privacy and data collection](/merge-workforce/devices/privacy-and-data-collection)

What to share with your security team