> This page is for Workforce.
> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.
# Deploy with Workspace ONE
> Step-by-step Omnissa Workspace ONE UEM deployment of the Merge Workforce desktop client for macOS and Windows, including the macOS permission profiles and the Windows install properties.
Workspace ONE UEM (formerly VMware Workspace ONE, now Omnissa) manages both platforms, so this page has a tab for each. Read [Plan your deployment](/merge-workforce/devices/deployment-overview) first, and download the packages and the macOS configuration profile from **Devices → Deployment**.
#### macOS
### 1. Upload the configuration profile
1. **Resources → Profiles & Baselines → Profiles → Add → Add Profile → macOS → Device Profile**
2. Name it `Merge Workforce desktop client`
3. Add one **Custom Settings** payload per payload in `merge-workforce-client.mobileconfig`: paste each payload's inner `PayloadContent` dictionary into its own Custom Settings box, using **+** for the next one
4. Assign to a test smart group
5. Save and publish
The Custom Settings box expects a single payload dictionary, not the whole file: pasting the full `.mobileconfig` with its Configuration wrapper produces a profile that fails to install. The profile downloads with `EnrollmentToken`, `OrgSlug`, and the API URLs already filled in; edit the `com.merge.workforceclient` preference payload before pasting only to add optional keys, for example the mismatch-alert hint:
```xml maxLines=20
EnrollmentToken
YOUR_ENROLLMENT_TOKEN
OrgSlug
YOUR_ORGANIZATION_ID
ExpectedIdentity
{EmailAddress}
PolicyMode
observe
```
`ExpectedIdentity` is an optional hint and is **not** an identity source. Identity is resolved by Merge from a verified IdP sign-in, so nothing in this file can decide who the employee is. `{EmailAddress}` is a Workspace ONE lookup value resolved from the enrollment user, and the client uses it only to raise a mismatch alert.
### 2. Deploy the package
1. Generate the metadata plist for `Merge-Workforce-macOS.pkg` with the **Omnissa Admin Assistant**; Workspace ONE will not accept the bare PKG
2. **Resources → Apps → Native → Internal → Add Application File**, and upload the PKG together with the metadata plist
3. Confirm macOS **Software Management** is enabled: delivery runs through the Intelligent Hub, which enforces the version in the uploaded metadata. The client does not update itself yet; to upgrade, upload the newer PKG with fresh metadata and the Hub installs it wherever the installed version is older
4. Assign to the same smart group
### 3. Confirm
```bash
defaults read /Library/Managed\ Preferences/com.merge.workforceclient.plist
sudo launchctl list | grep com.merge.workforceclient
```
This should print a line for the daemon. The device appears in **Devices** within a minute, and shows the resolved employee once they complete the one-time sign-in.
#### Windows
On Windows there is no permission prompt to pre-empt and no separate configuration to deliver. The MSI takes your organization's values as install properties on the install command.
### 1. Deploy the package
1. **Resources → Apps → Native → Internal → Add Application File**
2. Upload `Merge-Workforce-Windows.msi`
3. **Install command:** `msiexec /i Merge-Workforce-Windows.msi /qn` followed by the **MSI install properties** copied from **Devices → Deployment**, which carry your enrollment token, organization id, and API URLs:
```text
msiexec /i Merge-Workforce-Windows.msi /qn ENROLLMENTTOKEN="" APIBASEURL="" ORGSLUG="" DASHBOARDURL=""
```
4. **Install context:** Device
5. Assign to a smart group filtered to Windows 10 build 19044 or later. Use the smart group's OS version filter for this; app install conditions cover files, registry, disk space, and power, not OS build
Without the properties the MSI still installs, but the client runs local-only and the device never appears in **Devices**.
### 2. Confirm
In an elevated PowerShell session:
```powershell
Get-Service MergeWorkforceClient
& 'C:\Program Files\Merge\merge-workforce-client.exe' doctor
```
The service should be **Running**, and `doctor` should print your organization id and API URLs with source `installer-registry`. The device appears in **Devices** within a minute. The Merge icon appears in the signed-in employee's system tray within a minute of the install completing, and the device shows the resolved employee once they click **Sign in** there and complete the one-time sign-in.
## Identity on Workspace ONE fleets
Identity needs nothing from Workspace ONE: the employee completes a one-time sign-in from the menu bar prompt, and Merge binds the verified identity to the device. See [Assigning identity at deployment](/merge-workforce/devices/deployment-overview#assigning-identity-at-deployment).
## Roll out to your fleet
On macOS, change the assignment on the profile first, confirm it has applied, then change the assignment on the app. On Windows the app is the only assignment. Stage with smart groups: a small canary group first, then the rest. The client does not update itself yet. To upgrade, upload the newer package to the same app and stage it the same way.
## Next steps
#### [Troubleshooting](/merge-workforce/devices/troubleshooting)
Enrollment, identity resolution, coexistence
#### [Privacy and data collection](/merge-workforce/devices/privacy-and-data-collection)
What to share with your security team