Iru (formerly Kandji) Security: Roles, SSO and API Tokens

An Iru tenant can push configuration to, lock, erase and read recovery secrets from every enrolled Mac, iPhone, iPad, Windows and Android device, so the admin sign-in, roles, enrolment settings and API tokens around it deserve the same protection as a domain controller. This guide explains how to run Iru (formerly Kandji) securely, using Iru's own documentation for every product detail (checked 8 November 2026). It covers the move from Kandji to Iru and its authentication changes, team member roles, SSO and passkeys, authenticated enrolment and Blueprint Routing, Automated Device Enrollment tokens, API tokens, the Activity feed and a hardening baseline. It is for endpoint engineers, identity teams and security architects who own an Iru tenant. These are customer-side settings in a shared responsibility model. For the category view, see the Mobile Device Management Security Guide.

This is an independent guide from NHI Mgmt Group, based on Iru's public documentation as of November 2026. It is not sponsored or reviewed by Iru. Product features change, so confirm settings against Iru's current documentation.

Key takeaways

Complete the Iru migration before 1 December 2026. Iru's support site asks Kandji tenants to migrate by that date; SAML, Google and Microsoft sign-in connections are rebuilt as part of it, so plan and test them.
Keep Administrator to a few people. Account Owner and Administrator alone manage settings, user management, integrations and API tokens; give everyone else Standard, Help Desk, Auditor or Secrets Auditor.
Treat device secrets as tier zero data. Secrets Auditor, Help Desk and above can read FileVault recovery keys and other device secrets, so assign those roles deliberately and review them.
Require authentication for enrolment. Require authentication on manual enrolment and in the ADE Library Item, so only directory users can enrol devices into your Blueprints.
Scope API tokens per integration. Each token has its own permission checkboxes and the secret is shown once; issue one token per integration, store it in a secrets manager and rotate it on a schedule.

How identity and access work in Iru

Iru brings Endpoint, Identity and Compliance products together in one tenant, with Apple as the foundation and Windows and Android management alongside. Administrators sign in to the web app through the Access settings in the Account Menu, where authentication methods, team members and API tokens are managed.

Moving from Kandji to Iru

Iru documents the upgrade as a short guided migration, with these security-relevant changes:

New domain: the tenant moves from subdomain.kandji.io to subdomain.iru.com, and the enrolment portal to subdomain.iru.com/enroll.
Passkeys: Standard Authentication (username, password and MFA) converts to a passkey.
SSO connections are rebuilt: SAML, Google and Microsoft connections are reconfigured with new ACS URLs, redirect URLs, SSO URLs and Entity IDs, either in a new identity provider application or by updating the existing one. Iru warns that incorrect configuration can lock admins out.
Sessions end: all active sessions close when the migration completes.

Enable Standard Authentication under Settings, Access, Authentication; sign in with it and set up TOTP MFA, saving the recovery code.
Select Start migration, review connections and prepare replacement SAML, Google and Microsoft settings in your identity provider.
Register and save a passkey, and send passkey invitations to other Standard Authentication admins.
Select Complete migration, sign in at the new domain with your passkey and test every other sign-in method.
If you use AD CS, replace the legacy connector on your Windows Server with the updated connector from the Iru tenant.

Authentication methods

Method	Where configured	Recommended use
Passkey	Access, Passkeys and Social Login	Phishing-resistant admin sign-in; keep at least one admin with a passkey as a recovery path
Google Social or Microsoft Social	Access, Authentication methods	Turn on Limit Authentication to Domain wherever these connections are used
Native SSO (Entra ID, Google Workspace) or SAML (Okta, JumpCloud, OneLogin, Custom SAML)	Access, Admin and authentication, Authentication methods, then Allow for tenant authentication	Primary admin sign-in, so identity provider MFA, Conditional Access and leaver processes apply

Decision guidance: organisations with an identity provider should make SSO the main admin sign-in and keep one or two break-glass passkey admins. Iru keeps passkey, Google Social and Microsoft Social available by default; after testing SSO in a private browser window, use Disable for tenant authentication on any method you do not need. Team members must be invited in Access before they can sign in with SSO. Small teams without an identity provider can run on passkeys alone. See Phishing-Resistant MFA Guide and How Single Sign On Works.

Admin roles and privileged access

Iru documents six team member roles. The table summarises the permission matrix.

Role	What it can do	Assign to
Account Owner	Full access, plus account permanence and transfer of ownership (Account Owner only)	One named senior owner
Administrator	Full access: company settings, user management, integrations, Apple integrations, self service settings and API tokens	Two to four platform owners
Standard	Administrator permissions except Settings: Blueprints, Parameters, Library Items, enrolment portal, device actions and device secrets	Endpoint engineers who build configuration
Help Desk	Read-only Blueprints and Library Items; all device actions, including lock, erase and delete device record; device secrets and local admin password (LAPS)	Service desk staff, with approval for erase actions
Secrets Auditor	Read-only access plus FileVault recovery keys, Activation Lock bypass codes, Recovery Lock password and device unlock PIN	A small recovery team
Auditor	Limited read-only access	Compliance and audit reviewers

Privileged access practices

Separate build from operate: Standard covers configuration work without Settings, so platform administration stays with a few Administrators.
Govern destructive actions: Help Desk can erase devices and delete device records. Back that power with a ticket and second-person approval for bulk or executive device actions.
Govern secret access: FileVault recovery keys and LAPS passwords are credentials. Grant Secrets Auditor to named people, and review who viewed a secret in Activity.
Account Owner continuity: any Administrator can reset the Account Owner's passkey, and only the Account Owner can transfer ownership. Record the owner in your privileged access inventory and plan a transfer when roles change.
Recovery: admins reset a team member's passkey and send a new registration request; social login users reset through their provider. Verify the requester by a second channel before any reset.

See SaaS Admin Account Protection.

Integrations, API tokens and service accounts

API tokens

API tokens live in the Account Menu under Access, API tokens, beside the tenant's own API hostname. Iru documents these behaviours:

Behaviour	Detail from Iru docs	Practice
Permissions	Per-token checkboxes, grouped by section (for example Blueprints Management); set at creation or later with Edit	Grant only the routes the integration calls
Secret display	Shown once at creation, with any MCP configuration	Copy straight into a secrets manager
Ownership	Anyone who can open Access can manage every token; deleting a team member deletes their tokens, suspending does not	Create integration tokens from a named owner account and record the owner
Audit	Token Activity records enabled routes and the caller's public IPv4 address	Alert on calls from unexpected addresses
Rate limit	10,000 requests per hour shared across all tokens	Use token Activity to find heavy callers
Revocation	Revoke from the token menu by typing its name; revoking deletes the token's Activity history; removing all permissions stops it and keeps history	During an investigation, remove permissions first, export evidence, then revoke

As of November 2026 the API overview describes no token lifetime setting, so set your own rotation interval (for example every 90 days for write-capable tokens) and follow Iru's recommendation of one token per integration so each can be replaced independently. See the API Key Management Guide.

Apple and other trust connections

Automated Device Enrollment token: created in Apple Business with a Managed Apple Account, then uploaded as a .p7m file. ADE tokens expire; renew from Integrations, Apple, Renew Token before the date shown in the web app. Do not disconnect ADE to renew.
Apple Push Notification service: required before ADE; track its renewal with the same owner.
Identity provider connections: SAML signing certificates and OIDC client secrets have their own lifetimes; record them in your certificate and secret inventory.
AD CS connector and Microsoft Device Compliance: both create trust with your Microsoft estate; restrict the connector host as a tier zero server.

See Apple Business Manager Security.

Logging and detection

The Activity page is a single newest-first feed covering Endpoint, Detections, Vulnerabilities, Compliance, Identity and Tenant events. Each row shows the action, user, time and category, with Show JSON for the raw record. Devices, Blueprints and Library Items also have their own Activity tabs. Filters include free-text search, date ranges from the last 24 hours to the last 30 days or custom, administrator, category and activity type. For long-term retention and SIEM correlation, Iru documents an Amazon S3 Activity Log Integration that exports tenant activity across accounts; ingest that bucket into your SIEM.

Event to alert on	Why it matters	Response
Team member invited or role changed to Administrator	New full control of every device	Confirm against an approved change
Authentication method added, allowed or disabled for tenant authentication	Changes who can sign in	Verify with the identity team the same day
API token created or permissions edited	New machine access to device management	Match to a ticket and secrets register entry
Bulk lock, erase or delete device record	Possible destructive misuse	Page the endpoint lead immediately
FileVault key, LAPS password or Activation Lock bypass code viewed	Credential access to a device	Check for a matching support ticket
Blueprint or Library Item change affecting security settings	Fleet-wide configuration drift	Review in change control
Remote Shell or live response session	Interactive access to an endpoint	Confirm the analyst and case

Metrics that show it is working: number of Administrators (target four or fewer); percentage of admins signing in through SSO or passkey; API tokens with an owner and rotation date (target 100 percent); days until ADE and APNs renewal; percentage of enrolments that required authentication; secret views with a matching ticket.

Hardening baseline

Area	Setting	Recommended value
Admin sign-in	Authentication methods	SSO allowed for tenant authentication; unused social methods disabled after testing; two break-glass passkey admins
Social connections	Limit Authentication to Domain	On for every Google Social or Microsoft Social connection
Roles	Team member roles	One Account Owner, two to four Administrators, Standard and Help Desk for daily work
Manual enrolment	Enrollment, Manual Enrollment, Edit Settings, Require authentication	On for every Blueprint, with Assign user to device record
Automated enrolment	ADE Library Item, Require authentication	On; with Google Workspace use Custom SAML as Iru advises; turn off prefill and lock options when using Passport
Placement	Blueprint Routing assignment rules	Route devices to the right Blueprint at enrolment
Device controls	Passcode and FileVault Library Items	Assigned to every macOS Blueprint, with keys escrowed to Iru
Endpoint protection	EDR and Vulnerability Response Library Items	Assigned fleet-wide where licensed
API	API tokens	One per integration, minimum permissions, rotated on schedule
Logs	Amazon S3 Activity Log Integration	Exported to SIEM with retention to your policy

Rollout order

Migrate and secure sign-in: complete the Iru upgrade, rebuild SSO, register passkeys and disable unused methods after testing.
Right-size roles: move staff from Administrator to Standard, Help Desk or the auditor roles.
Secure enrolment: turn on Require authentication for one pilot Blueprint and the ADE Library Item, enrol test devices, then extend to all Blueprints. Roll back by clearing the setting on the Blueprint.
Tokens: inventory API tokens, reissue them with minimum permissions and record owners.
Logging: connect the S3 export to the SIEM and build the alerts above.
Operate: quarterly review of roles, tokens, authentication methods and renewal dates; apply Iru agent and platform updates promptly.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
Admin SSO and passkeys	PR.AA-01, PR.AA-02	IA-2, IA-5	6	A.5.17, A.8.5
Roles and least privilege	PR.AA-05	AC-2, AC-6	5, 6	A.5.15, A.8.2
Enrolment and device inventory	ID.AM-01	CM-8	1	A.5.9, A.8.1
Blueprints and configuration	PR.PS-01	CM-6	4	A.8.9
Activity logging	PR.PS-04, DE.CM-03	AU-2, AU-6	8	A.8.15, A.8.16

Common misconfigurations

Migration left late: rebuilding SAML, Google and Microsoft connections under deadline pressure invites lockouts. Migrate early and test every method.
Everyone an Administrator: daily device work does not need Settings or API tokens. Use Standard and Help Desk.
Secrets roles handed out widely: FileVault keys and LAPS passwords unlock devices. Limit Secrets Auditor and Help Desk and review secret views.
Open enrolment: a Blueprint without Require authentication lets anyone with the portal link enrol a device. Turn it on for every Blueprint.
Tokens tied to a departing admin: deleting that team member deletes their tokens and breaks integrations. Create integration tokens from a named owner account and plan handover.
Revoking first during an investigation: revoking deletes token Activity. Remove permissions, export evidence, then revoke.
Expired ADE token: new devices stop syncing from Apple Business. Track and renew before expiry.

Practitioner checklist

Complete the Kandji to Iru migration and test every sign-in method before 1 December 2026.
Make SSO the main admin sign-in, keep two break-glass passkey admins and disable unused methods.
Limit Account Owner and Administrator, and use Standard, Help Desk, Auditor and Secrets Auditor.
Turn on Require authentication for manual enrolment and in the ADE Library Item.
Reissue API tokens per integration with minimum permissions, record owners and rotate them.
Track ADE, APNs and identity provider certificate renewal dates with named owners.
Export Activity to your SIEM and alert on role, authentication, token, secret and erase events.
Review roles, tokens and authentication methods quarterly.

Iru (formerly Kandji) Security: Roles, SSO, Enrolment and API Tokens