> This page is for Workforce.
> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.
# Deploy with any other MDM
> What any MDM has to deliver to deploy the Merge Workforce desktop client on macOS or Windows: the package, the configuration values, and on macOS the four permission payloads.
Use this if your MDM does not have its own guide, including JumpCloud, Ivanti Neurons, ManageEngine Endpoint Central, Sophos Central, Rippling, Hexnode, Miradore, and Chef or Ansible-driven fleets. Everything the client needs is a signed package, a handful of configuration values, and on macOS four permission payloads.
## What your MDM has to be able to do
| Requirement | macOS | Windows |
| ------------------------------------------------ | ------------------------------------------------ | ------------------------------------- |
| Install a signed package silently, as the device | `installer -pkg` or native pkg support | `msiexec /qn` or native MSI support |
| Deliver configuration to a system-wide location | Managed preferences payload, or a custom profile | Properties on the MSI install command |
| Pre-approve system permissions | **Required.** Custom profile payloads, see below | Not applicable |
| Re-evaluate required software | Recommended, so a removed client returns | Recommended |
If your MDM cannot deliver a custom configuration profile on macOS, it cannot deploy this client to Macs. The four payloads below are not optional: without them macOS prompts the employee at every permission gate, which defeats a managed deployment. Windows has no equivalent constraint, so a Windows-only fleet needs far less from its MDM.
## macOS
### 1. Deliver the configuration profile
Download `merge-workforce-client.mobileconfig` from **Devices → Deployment**. It contains all four payloads, with your `EnrollmentToken`, `OrgSlug`, and API URLs already filled in:
| Payload | Purpose |
| -------------------------------------------- | --------------------------------------------------------------------------------------- |
| `com.apple.system-extension-policy` | Approves the system extension in advance. Nothing uses it yet; network enforcement will |
| `com.apple.webcontent-filter` | Pre-approves network content filtering |
| `com.apple.TCC.configuration-profile-policy` | Grants full disk access, needed to read MCP configuration files |
| `com.apple.servicemanagement` | Marks the login item as managed, suppressing the notification |
The `com.merge.workforceclient` preference domain arrives pre-filled with these keys:
```xml maxLines=20
EnrollmentToken
YOUR_ENROLLMENT_TOKEN
OrgSlug
YOUR_ORGANIZATION_ID
PolicyMode
observe
```
Upload it as a custom or signed profile, scoped to the device rather than the user, and confirm it has applied before installing the package:
```bash
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
```
### 2. Install the package
```bash
installer -pkg Merge-Workforce-macOS.pkg -target /
```
### 3. Confirm
```bash
sudo launchctl list | grep com.merge.workforceclient
```
This should print a line for the daemon.
## Windows
### 1. Install the package with your organization's properties
The MSI takes its configuration as install properties, so there is nothing to deliver separately. Copy the **MSI install properties** from **Devices → Deployment**, which carry your enrollment token, organization id, and API URLs, and append them to the install command:
```powershell
msiexec /i Merge-Workforce-Windows.msi /qn ENROLLMENTTOKEN="" APIBASEURL="" ORGSLUG="" DASHBOARDURL=""
```
If your MDM has a separate field for MSI properties or command-line arguments, paste the properties there and leave the command as `msiexec /i Merge-Workforce-Windows.msi /qn`. Without the properties the MSI still installs, but the client runs local-only and the device never appears in **Devices**.
The MSI installs a background service and a tray app. The Merge icon appears in the signed-in employee's system tray within a minute of the install completing. Require Windows 10 build 19044 or later as an install condition where your MDM supports one. Windows 10 reached end of support in October 2025, so Windows 10 devices also need Extended Security Updates enrollment.
### 2. Confirm
In an elevated PowerShell session:
```powershell
Get-Service MergeWorkforceClient
& 'C:\Program Files\Merge\merge-workforce-client.exe' doctor
```
The service should be **Running**, and `doctor` should print your organization id and API URLs with source `installer-registry`.
## Identity without a supported MDM connection
Identity needs nothing from your MDM: the employee completes a one-time sign-in from the menu bar prompt, and Merge binds the verified identity to the device. See [Assigning identity at deployment](/merge-workforce/devices/deployment-overview#assigning-identity-at-deployment).
## Verify the whole thing worked
Whatever the MDM, the check is the same: the device appears in **Devices** within a minute of the service starting, and shows the resolved employee once they complete the one-time sign-in. If it stays unattributed, work through [Troubleshooting](/merge-workforce/devices/troubleshooting).
## Next steps
#### [Troubleshooting](/merge-workforce/devices/troubleshooting)
Enrollment, identity resolution, coexistence
#### [Plan your deployment](/merge-workforce/devices/deployment-overview)
Prerequisites, identity, and staged rollout