> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Iru Agent and MDM
> Learn how the Iru Agent works alongside MDM on macOS and Windows. Understand agent capabilities, communication protocols, and management features.
This guide applies to Mac computers and Windows devices
As of **April 8, 2026**, apps were updated from **Kandji** 
to **Iru** 
branding. The **Agent** app name changed from **Kandji Agent** to **Iru Agent**. Please update **scripts, automations, and utilities** that still reference the old app names.
### About the macOS Agent
Iru Endpoint's proprietary macOS agent extends the functionality of our platform beyond what the MDM framework can achieve by itself. The Iru Agent for macOS is custom-built using Swift, a streamlined programming language specifically designed for **Apple devices**. Additionally, the Iru Agent installs and uses a system extension leveraging Apple's Endpoint Security framework, both for added device management functionality as well as for EDR and Vulnerability Management.
#### Actions performed by the Iru Agent
Blocks applications specified in the App Blocking Library Item and presents the Iru Endpoint dialog window to end users. Handled by the Iru system extension to ensure blocks happen as quickly and effectively as possible.
Installs and enforces updates for Auto Apps. On limited networks, background update downloads may be deferred until enforcement is due soon. See [Downloads on limited networks](#downloads-on-limited-networks) below.
Collects the full application list and other system details the MDM framework cannot always pull. Application inventory data in Prism is gathered by the Iru system extension, allowing it to be made available in near real-time.
Installs DMG, PKG, and ZIP files and runs audit, pre-install, and post-install scripts. Can force restarts when that option is enabled. See also [Configure the Mac Custom App Library Item](/en/endpoint/library/library-items-profiles/configure-the-custom-apps-library-item).
Installs Custom Printers with downloadable files. On limited networks, background downloads may be deferred until enforcement is due soon. See [Downloads on limited networks](#downloads-on-limited-networks) below.
EDR and its associated scans are completed using the Iru Agent.
Most Parameters go beyond the MDM framework. For example, the Manage SSH Config parameter requires the Iru Agent to write to the SSH config file.
All scripts are run as root by the Iru Agent.
Vulnerability Management and its associated scans are completed using the Iru Agent.
#### Downloads on limited networks
When macOS reports that the current connection is constrained (for example Low Data Mode), expensive (for example a mobile hotspot), or both, the Iru Agent adjusts when it downloads managed software.
During background processing at [check-in](/en/endpoint/devices/device-check-in/device-check-in), the agent defers Auto App update downloads and Custom Printer file downloads on limited networks unless the install is due within 8 hours. When enforcement is approaching, the agent proceeds with the download and records the reason in the agent log.
For installs, updates, and reinstalls that a user starts in [Iru Self Service](/en/endpoint/settings/self-service/self-service-for-macos) or the Iru menu bar app, the agent warns before downloading on a limited connection. The message reflects the network type macOS detected.
The agent still downloads managed software without deferral in these cases:
* First-time installs, including Library Items selected for install during [Automated Device Enrollment](/en/endpoint/settings/apple-integrations/configure-automated-device-enrollment)
* Forced installs from [Vulnerability Response](/en/endpoint/vulnerability-management/configure-the-vulnerability-response-library-item)
Agent logs record deferrals, proceed decisions, and user cancellations so you can see why an install or update ran or did not run. See [Troubleshooting Agent Check-Ins](/en/endpoint/devices/device-check-in/troubleshooting-agent-check-ins) for log locations and related steps.
```text agent.log theme={null}
AutoApp Discord: deferring download because network is constrained
AutoApp Firefox: network is constrained, proceeding with download due to impending enforcement at 2025-11-12 23:00:00 +0000
AutoApp Asana: network is expensive and constrained, proceeding with download due to impending enforcement at 2023-09-29 16:00:00 +0000
Install/update of 1Password 8 cancelled by user on limited network.
```
### About the MDM Framework
Using Apple's MDM framework in macOS, iOS, iPadOS, and tvOS, you can deploy and configure apps and settings, collect device information, and remotely lock or wipe devices. This can be done with corporate-owned as well as Bring Your Own Device (BYOD) devices.
One advantage of using Apple's MDM framework is how quickly it can communicate with devices. That means commands (such as to lock or erase devices) are implemented almost instantly. This is made possible by the [Apple Push Notification service (APNs)](/en/endpoint/settings/apple-integrations/configure-apple-push-notification-service). Apple devices are constantly polling APNs for notifications requesting that managed devices check in with their MDM servers. Because of this constant polling, management of online devices can happen almost instantly.
#### Actions performed by MDM
Installs apps acquired via Apple Business or Apple School Manager using the MDM protocol (formerly VPP). See also [Add Apps from Apps and Books](/en/endpoint/settings/apple-integrations/add-apps-from-apps-and-books-to-iru-endpoint).
Enrolls devices during Setup Assistant using the MDM protocol (formerly DEP).
When a macOS device enrolls into Iru Endpoint, one of the first commands is `InstallEnterpriseApplication` to install the Iru Agent.
Automatically sends `InstallEnterpriseApplication` when the device checked in via MDM in the last 7 days but not via the Iru Agent in the last 7 days. See [Troubleshooting Agent Check-Ins](/en/endpoint/devices/device-check-in/troubleshooting-agent-check-ins) if the agent is not checking in.
Delivers commands such as those in the device Action menu through the MDM protocol.
When users download the enrollment profile from the enrollment portal, device enrollment is handled through the MDM protocol.
Delivers MDM configuration profiles to the device. See [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) for how profiles and Library Items are managed.
### About the Windows Agent
Windows devices in Iru Endpoint are managed through a combination of Windows MDM (mobile device management) and the Iru Agent. The Iru Agent handles application management (installation and upgrade) and gathers application inventory from devices; MDM handles device policies and configuration. The agent checks in every 15 minutes. Devices are enrolled via the [Enrollment Portal](/en/endpoint/enrollment/windows/configuring-windows-enrollment); the agent is installed automatically as part of MDM enrollment.
#### Actions performed by the Iru Agent
Retrieves and enforces policies assigned to Blueprints that are not deployed through the MDM channel.
Installation and updates for assigned Auto Apps are handled via the Iru Agent.
Installs MSI and EXE installers delivered in a zip archive. See also [Configure the Windows Custom App Library Item](/en/endpoint/library/library-items-profiles/configure-the-windows-custom-app-library-item).
Collects and submits the full application inventory to Iru Endpoint on each check-in. See [Device Check-In](/en/endpoint/devices/device-check-in/device-check-in) for check-in frequency and behavior.
The agent updates itself to a newer version when available.
The Iru Agent runs custom PowerShell scripts assigned through Library Items.
### About the MDM Framework
Windows includes a built-in management component that communicates with the management server using the [MDM protocol](https://learn.microsoft.com/en-us/windows/client-management/mdm-overview). Using Windows MDM, you can enroll Windows devices, deploy configuration profiles and system policies, and send commands such as wipe or retire. When you make changes in the Iru Endpoint Web App, requests are sent via [Windows Push Notification Services (WNS)](https://learn.microsoft.com/en-us/windows/client-management/push-notification-windows-mdm). Managed Windows devices that are online typically respond within minutes.
#### Actions performed by MDM
Establishes the MDM connection during enrollment and installs the Iru Agent as part of the process. See [Windows Enrollment](/en/endpoint/getting-started/enrollment/windows-enrollment) and [User Experience with Windows Enrollment](/en/endpoint/enrollment/windows/user-experience-with-windows-enrollment).
Delivers Wi-Fi, Windows Firewall, BitLocker, and other system policies through the MDM channel. These align with Microsoft's [MDM security baseline](https://learn.microsoft.com/en-us/windows/client-management/mdm-overview#mdm-security-baseline). Configure via Library Items such as [Wi-Fi](/en/endpoint/library/library-items-profiles/configure-the-wi-fi-library-item), [Windows Firewall](/en/endpoint/library/library-items-profiles/configure-the-windows-firewall-library-item), and [BitLocker](/en/endpoint/library/library-items-profiles/configure-the-bitlocker-library-item).
Commands such as wipe or retire a device and deploy a configuration profile are sent via WNS and typically apply within minutes when the device is online.
Runs a full sync every 24 hours to validate system configuration against admin intent, remediate drift, and collect daily device information (system info, hardware inventory, policy status).
Delivers configuration profiles through the MDM protocol. See [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) for how Library Items and profiles are managed.
For Windows agent troubleshooting (force check-in, reinstall), see [Troubleshooting Agent Check-Ins](/en/endpoint/devices/device-check-in/troubleshooting-agent-check-ins). Windows agent logs are located at `%ProgramData%\kandji\agent\logs`.