> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Device Check In

> Learn how device check-in works for MDM and the Iru Agent. Understand check-in intervals, triggers, and how devices communicate with Iru Endpoint.

<Callout icon="earth-americas" color="#B84A7A" iconType="regular">This guide applies to all device platforms</Callout>

### About Device Check-In

Iru Endpoint uses different check-in mechanisms depending on the device platform. Each platform has specific check-in types that serve different purposes and occur at various frequencies. Understanding these check-ins helps you track device state, enforce policies, and ensure applications are deployed reliably.

<Note>
  As of **April 8, 2026**, apps were updated from **Kandji** <img className="inline dark:hidden" src="https://mintcdn.com/iru/20OhJ3wZmF4DKbOd/assets/media/images/kandji-bee-light-icon.png?fit=max&auto=format&n=20OhJ3wZmF4DKbOd&q=85&s=3ac73eb9098c090ac2838a4902a70e35" alt="" style={{ height: '1em', width: 'auto', maxHeight: '1em', verticalAlign: '-0.125em', margin: '0 0.05em' }} width="400" height="284" data-path="assets/media/images/kandji-bee-light-icon.png" /><img className="hidden dark:inline" src="https://mintcdn.com/iru/20OhJ3wZmF4DKbOd/assets/media/images/kandji-bee-dark-icon.png?fit=max&auto=format&n=20OhJ3wZmF4DKbOd&q=85&s=1d4b643c8e1903aabdb072fdf211f2de" alt="" style={{ height: '1em', width: 'auto', maxHeight: '1em', verticalAlign: '-0.125em', margin: '0 0.05em' }} width="400" height="284" data-path="assets/media/images/kandji-bee-dark-icon.png" /> to **Iru** <img src="https://mintcdn.com/iru/8j4H0SpqtcKJ5JUM/assets/media/svgs/Iru-Logomark-OnLight-16-Dashboard.svg?fit=max&auto=format&n=8j4H0SpqtcKJ5JUM&q=85&s=befa6ce99e1df18d397deb65aec8edaf" alt="" style={{ display: 'inline', height: '1em', width: 'auto', maxHeight: '1em', verticalAlign: '-0.125em', margin: '0 -0.08em 0 0', padding: 0 }} width="14" height="15" data-path="assets/media/svgs/Iru-Logomark-OnLight-16-Dashboard.svg" /> branding. App names changed from **Kandji Self Service** to **Iru Self Service** and from **Kandji Agent** to **Iru Agent**. The manual enrollment portal now uses Iru branding. Please update **scripts, automations, and utilities** that still reference the old app names.
</Note>

### How It Works

Device check-ins are the communication mechanism between managed devices and Iru Endpoint servers. They enable:

* Policy enforcement and compliance monitoring
* Application deployment and updates
* Device inventory collection
* Configuration profile management
* Real-time device management commands

The check-in frequency and mechanism vary by platform, with some using agent-based check-ins and others relying on MDM push notifications.

### Platform-Specific Check-In Details

<Tabs>
  <Tab title="macOS" icon="apple" iconType="brands">
    ### Recurring Check-In

    **Frequency:** Every 15 minutes\
    **Mechanism:** Iru Agent

    This check-in ensures that the Iru Agent is up-to-date, executes and enforces Blueprint parameters, and installs any pending Library Items such as custom scripts, printers, apps, and auto apps. Each item has a specific timeout period for installation.

    #### Order of Operations and Timeouts

    Library Items are processed in a specific sequence. Each type of Library Item is handled in an alphanumeric order, with uppercase letters taking precedence over lowercase ones. The timeout values define the maximum time allowed for each Library Item to complete its installation or execution before it is stopped. Additionally, each run is governed by a global timeout limit of 12 hours, which also applies to installations of Custom Apps and Apps and Books initiated through Self-Service.

    | **Priority** | **Operation**   | **Timeout**             |
    | ------------ | --------------- | ----------------------- |
    | 1            | Custom Scripts  | 1 hour per item         |
    | 2            | Custom Printers | 3 hours per item        |
    | 3            | Custom Apps     | 12 hours (global limit) |
    | 4            | Auto Apps       | 6 hours per item        |
    | 5            | Managed OS      | 12 hours (global limit) |

    #### Forcing a Recurring Check-In

    To force a recurring check-in, run the following command in Terminal:

    ```bash theme={null}
    sudo iru run
    ```

    ### Daily Check-In

    **Frequency:** Every 24 hours\
    **Mechanism:** Iru Agent

    This check-in includes all recurring check-in items and additional daily items like custom scripts, compliance scripts, and Blueprint parameters. It also involves securing home folders, checking application and system folders for appropriate permissions, and collecting daily computer information for submission to the Iru Endpoint tenant. The daily check-in follows the same sequence as the recurring one, starting after executing Blueprint Parameters. Once all Library Items are completed, the application inventory is sent back to Iru Endpoint.

    #### Forcing a Daily Check-In

    To force daily check-in, run the following command in Terminal:

    ```bash theme={null}
    sudo iru run --reset-daily
    ```

    A daily check-in can also be forced using the sync button in Self Service:

    <Steps>
      <Step title="Open Self Service">
        Open the **Iru Self Service** app.
      </Step>

      <Step title="Navigate to Device Info">
        Navigate to the **Device Info** section on the left.
      </Step>

      <Step title="Click Sync">
        Click **Sync**.
      </Step>
    </Steps>

    ### MDM Daily Check-In

    **Frequency:** Every 24 hours\
    **Mechanism:** Apple Push Notification Service (APNs) / MDM Framework

    This check-in involves executing the following MDM commands to update device information:

    * ProfileList
    * InstalledApplicationsList
    * SecurityInfo
    * CertificateList
    * AvailableOSUpdates
    * DeviceInformation

    #### Forcing an MDM Daily Check-In

    To force the daily MDM commands, run the following command in Terminal:

    ```bash theme={null}
    sudo iru update-mdm
    ```

    ### MDM Commands & Profiles

    **Frequency:** Instant\
    **Mechanism:** APNs / MDM Framework

    This check-in allows for instant execution of any MDM command, such as wiping a device, setting a device name, or installing applications. It also includes any profile deployed via a Library Item.

    #### How Instant is MDM Communication?

    MDM servers send a unique notification to the Apple Push Notification service, prompting managed devices to check in with their MDM server. Apple devices regularly poll APNs for these notifications, enabling almost immediate management of devices that are online. Consequently, there isn't a set check-in time for MDM commands, nor is there a way to enforce a check-in.
  </Tab>

  <Tab title="Windows" icon="microsoft" iconType="brands">
    ### Recurring Agent Check-In

    **Frequency:** Every 15 minutes\
    **Mechanism:** Iru Agent

    This check-in ensures that the Iru Agent is current, executes assigned policies, and processes app deployments. It also collects and submits application inventory on the same interval.

    During a recurring check-in, the Iru Agent:

    * Retrieves and enforces specific policies assigned to Blueprints that are not deployed through the MDM channel
    * Installs or updates assigned apps
    * Submits a complete app inventory to Iru Endpoint
    * Updates the agent to a newer version if available

    ### Event-Driven MDM Commands

    **Frequency:** Instant\
    **Mechanism:** Windows Push Notification Service (WNS) / MDM Framework

    When you deploy a policy via the Iru Endpoint web app, the request is sent immediately via WNS. Managed devices that are online typically respond within minutes.

    Examples of instant commands include:

    * Wipe or retire a device
    * Deploy a configuration profile

    <Note>
      There's no fixed check-in interval for event-driven commands. They depend on device connectivity and WNS availability.
    </Note>

    ### Forcing an MDM Check-In

    **Frequency:** On demand\
    **Mechanism:** MDM

    To force a full sync on a specific device from the Iru Endpoint Web App:

    <Steps>
      <Step title="Navigate to Device Record">
        Navigate to the device record.
      </Step>

      <Step title="Perform Check-In">
        Click **Perform Recurring Check-In**.
      </Step>
    </Steps>

    This forces all policies deployed via MDM to evaluate compliance and remediate if needed. It doesn't force a sync of the agent.

    ### MDM Daily Check-In

    **Frequency:** Every 24 hours\
    **Mechanism:** MDM

    A daily check-in evaluates all targeted policies and remediates anything that has drifted from admin intent. These tasks include:

    * Validating system configuration against admin intent and remediating if necessary
    * Collecting daily device information (system info, hardware inventory, policy status)

    ### Logs

    * **Iru Agent Logs**: `%ProgramData%\kandji\agent\logs`
    * **Windows MDM Logs**: Event Viewer → **Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider (Admin)**

    Use these logs to validate whether check-ins occurred and to identify failures in MDM or Agent processing.
  </Tab>

  <Tab title="iOS, iPadOS, tvOS, visionOS" icon="mobile-phone" iconType="solid">
    ### How is MDM Communication Instant?

    MDM servers send a particular type of notification to request managed devices to "Check in" with their MDM server. As part of Apple Push Notification service (APNs), Apple devices constantly poll Apple Push Notification service for **Notifications**. This results in near-instant management of online devices; as such, there is no defined "Check-in" time for MDM commands.

    ### MDM Daily Check-in

    **Frequency:** Every 24 hours\
    **Mechanism:** Apple Push Notification service/MDM framework\
    **Description:** A combination of the following MDM commands automatically initiated by Iru Endpoint:

    * ProfileList
    * InstalledApplicationsList
    * CertificateList
    * AvailableOSUpdates
    * DeviceInformation

    #### Forcing the MDM Daily Check-In

    <Steps>
      <Step title="Navigate to Device Record">
        Navigate to the device Record in your Iru Endpoint tenant.
      </Step>

      <Step title="Select Details Tab">
        Select the **Details** tab.
      </Step>

      <Step title="Update Device Information">
        Click **Update Now** under Device Information.
      </Step>
    </Steps>

    ### MDM Commands & Profiles

    **Frequency:** Instant\
    **Mechanism:** Apple Push Notification service/MDM framework\
    **Description:** Any MDM command, including:

    * EraseDevice
    * BlankPush
    * DeleteUser
    * SetDeviceName
    * UnlockUserAccount
    * InstallApplication
    * InstallProfile

    **Able to be Forced?** No

    ### Installed Application List

    **Frequency:** Every 24 hours\
    **Mechanism:** Apple Push Notification service/MDM framework\
    **Description:** An MDM command:

    * InstalledApplicationList

    #### Forcing the Installed Application List Daily Check-In

    <Steps>
      <Step title="Navigate to Device Record">
        Navigate to the device Record in your Iru Endpoint tenant.
      </Step>

      <Step title="Select Apps Tab">
        Select the **Apps** tab.
      </Step>

      <Step title="Update Application List">
        Click **Update Now** under the Last updated section.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Android" icon="android" iconType="brands">
    ### Event-Driven Status Reports

    **Frequency:** Near real-time (within seconds)\
    **Mechanism:** Google Pub/Sub notifications via Android Management API

    Android devices use an event-driven check-in system that's completely reliant on device status reports. When changes occur on the device, the device automatically reports these state changes to Google, who then relays the information to Iru Endpoint via [Pub/Sub notifications](https://developers.google.com/android/management/notifications). This mechanism works similarly to Apple's Declarative Device Management status reports, providing near real-time updates as changes happen.

    #### Pub/Sub Notification System

    The Android Management API uses Google Cloud Pub/Sub to deliver device notifications to Iru Endpoint. When something changes on an Android device, Google receives that information and immediately sends it to Iru Endpoint through Pub/Sub.

    This approach works well because Pub/Sub is designed to handle large volumes of messages reliably. If there's a temporary network issue, Pub/Sub will keep trying to deliver the notification until it reaches Iru Endpoint. Google also batches multiple device events together when they happen close together, which makes the system more efficient.

    The result is that you get near real-time updates about what's happening on your Android devices - app installations, policy changes, security updates, and other important events all show up in Iru Endpoint within seconds of occurring on the device.

    #### What Gets Reported

    Android devices automatically report various state changes including:

    * Application installations and updates
    * Device configuration changes
    * Security posture updates

    #### Event-Driven Benefits

    The Android event-driven approach offers several advantages:

    * **Immediate Response**: Device changes are reported as they happen, providing near real-time visibility
    * **Efficient Resource Usage**: Only reports actual changes rather than periodic status queries
    * **Reliable Delivery**: Pub/Sub ensures notifications reach Iru Endpoint even during network interruptions
    * **Comprehensive Monitoring**: Captures all significant device state changes automatically

    <Note>
      Android check-ins are event-driven and provide near real-time updates through Google's Pub/Sub notification system. This approach ensures immediate visibility into device changes without requiring manual check-in commands.
    </Note>
  </Tab>
</Tabs>

### Troubleshooting Check-In Issues

If devices aren't checking in as expected, see our [Troubleshooting Agent Check-In](/en/endpoint/devices/device-check-in/troubleshooting-agent-check-ins) guide for platform-specific troubleshooting steps.

### Best Practices

<CardGroup cols={2}>
  <Card title="Monitor Check-In Status" icon="eye">
    Regularly monitor device check-in status to identify issues early and ensure policy compliance.
  </Card>

  <Card title="Understand Platform Differences" icon="list-check">
    Be aware that different platforms use different check-in mechanisms and frequencies.
  </Card>

  <Card title="Use Force Check-In Sparingly" icon="hand">
    Force check-ins only when necessary, as they can impact device performance and battery life.
  </Card>

  <Card title="Review Logs Regularly" icon="file-text">
    Check agent and MDM logs to identify patterns in check-in failures or delays.
  </Card>
</CardGroup>