> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Apple BYOD Management

> Set up Bring Your Own Device (BYOD) management for Apple devices in Iru Endpoint. Enroll personal iPhone, iPad, and Mac devices with user-initiated flow.

<Callout icon="apple" color="#B84A7A" iconType="regular">This guide applies to Apple devices</Callout>

Iru Endpoint provides Bring Your Own Device (BYOD) management capabilities for Apple devices through manual enrollment, allowing organizations to securely manage employee-owned iPhones, iPads, and Mac computers.

### What is BYOD Management?

BYOD management enables organizations to apply essential security policies and deploy corporate resources to employee-owned Apple devices through manual enrollment. This approach focuses on business-critical configurations for employee-owned devices.

<Note>
  As of **April 8, 2026**, apps were updated from **Kandji** <img className="inline dark:hidden" src="https://mintcdn.com/iru/20OhJ3wZmF4DKbOd/assets/media/images/kandji-bee-light-icon.png?fit=max&auto=format&n=20OhJ3wZmF4DKbOd&q=85&s=3ac73eb9098c090ac2838a4902a70e35" alt="" style={{ height: '1em', width: 'auto', maxHeight: '1em', verticalAlign: '-0.125em', margin: '0 0.05em' }} width="400" height="284" data-path="assets/media/images/kandji-bee-light-icon.png" /><img className="hidden dark:inline" src="https://mintcdn.com/iru/20OhJ3wZmF4DKbOd/assets/media/images/kandji-bee-dark-icon.png?fit=max&auto=format&n=20OhJ3wZmF4DKbOd&q=85&s=1d4b643c8e1903aabdb072fdf211f2de" alt="" style={{ height: '1em', width: 'auto', maxHeight: '1em', verticalAlign: '-0.125em', margin: '0 0.05em' }} width="400" height="284" data-path="assets/media/images/kandji-bee-dark-icon.png" /> to **Iru** <img src="https://mintcdn.com/iru/8j4H0SpqtcKJ5JUM/assets/media/svgs/Iru-Logomark-OnLight-16-Dashboard.svg?fit=max&auto=format&n=8j4H0SpqtcKJ5JUM&q=85&s=befa6ce99e1df18d397deb65aec8edaf" alt="" style={{ display: 'inline', height: '1em', width: 'auto', maxHeight: '1em', verticalAlign: '-0.125em', margin: '0 -0.08em 0 0', padding: 0 }} width="14" height="15" data-path="assets/media/svgs/Iru-Logomark-OnLight-16-Dashboard.svg" /> branding. App names changed from **Kandji Self Service** to **Iru Self Service** and from **Kandji Agent** to **Iru Agent**. The manual enrollment portal now uses Iru branding. Please update **scripts, automations, and utilities** that still reference the old app names.
</Note>

### How BYOD Management Works

BYOD management in Iru Endpoint uses manual enrollment to establish a management relationship with employee-owned devices. When employees enroll their personal devices, Iru Endpoint installs a management profile that enables the organization to apply security policies and deploy corporate resources while respecting device ownership.

The management profile provides a secure channel for policy enforcement and app distribution without requiring device supervision. This approach focuses on essential business configurations rather than comprehensive device control.

### BYOD Capabilities

Iru Endpoint supports essential management capabilities for BYOD devices:

#### Security and Compliance

* **Passcode enforcement** - Require strong passcodes and biometric authentication
* **Device encryption** - Ensure FileVault is enabled on Mac computers
* **Certificate deployment** - Install device identity certificates for conditional access
* **Network security** - Configure Wi-Fi and VPN profiles for secure connectivity

#### Application Management

* **Corporate app deployment** - Install and manage business applications
* **App configuration** - Configure corporate apps with organization-specific settings
* **App updates** - Ensure corporate applications stay current
* **App distribution** - Deploy required business applications to managed devices

#### System Management

* **Operating system updates** - Enforce macOS and iOS updates for security
* **System preferences** - Configure essential system settings
* **Screen lock policies** - Enforce screen lock requirements on iOS devices
* **Login window customization** - Apply organization branding on macOS devices

### Setting Up BYOD Management

Create a dedicated Blueprint specifically for BYOD devices to ensure appropriate policy separation:

<Steps>
  <Step title="Navigate to Blueprints">
    Navigate to **Blueprints** in Iru Endpoint.
  </Step>

  <Step title="Create New Blueprint">
    Click **Create Blueprint**.
  </Step>

  <Step title="Configure Blueprint Name">
    Enter a descriptive name like "BYOD" or "Employee Devices".
  </Step>

  <Step title="Configure BYOD Policies">
    Add Library Items to your BYOD Blueprint. You can deploy any Library Items that are supported on unsupervised devices. Here are some common suggestions:

    * **Passcode Library Item** - Set appropriate passcode requirements
    * **FileVault Library Item** - Ensure Mac encryption is enabled
    * **Wi-Fi Library Item** - Configure corporate network access
    * **Certificate Library Item** - Deploy device identity certificates
    * **Custom Apps** - Install essential business applications

    <Note>
      Some Library Items require device supervision and won't work on BYOD devices. For details on which restrictions are available on supervised vs. unsupervised devices, see [Apple's supervision documentation](https://support.apple.com/guide/deployment/restrictions-for-supervised-devices-dep6b5ae23e9/1/web/1.0).
    </Note>
  </Step>

  <Step title="Navigate to Manual Enrollment">
    Navigate to **Enrollment** → **Manual Enrollment**.
  </Step>

  <Step title="Configure Enrollment Portal Settings">
    Configure the **Enrollment Portal** settings.
  </Step>

  <Step title="Select BYOD Blueprint for Enrollment">
    Select your BYOD Blueprint for enrollment.
  </Step>

  <Step title="Copy Enrollment Information">
    Copy the **Enrollment Portal link** and **Enrollment code**.
  </Step>
</Steps>

### User Enrollment Experience

Once you've set up the enrollment portal, employees can enroll their devices by visiting the Enrollment Portal link you provide and entering the Enrollment code. If you've enabled authentication, they'll be prompted to sign in with their corporate credentials after entering the code.

The device will then display the management profile details, showing employees exactly what permissions and policies will be applied. After they review and approve the management permissions, Iru Endpoint automatically applies your configured policies and installs any required apps.

### Best Practices for BYOD

<Steps>
  <Step title="Focus on Essential Policies">
    Apply only necessary security and productivity policies to avoid overly restrictive management of personal devices.
  </Step>

  <Step title="Communicate Clearly">
    Explain to employees what will and won't be managed on their personal devices.
  </Step>

  <Step title="Review Policies Regularly">
    Periodically assess and update BYOD policies to ensure they remain appropriate and effective.
  </Step>

  <Step title="Ensure Network Access">
    Configure profiles to ensure corporate resources are accessible through managed connections.
  </Step>

  <Step title="Plan Certificate Management">
    Plan for certificate renewal and distribution to maintain secure access to corporate resources.
  </Step>
</Steps>

### Enrollment Portal Configuration

Share the enrollment information with your employees:

```text lines theme={null}
Enrollment Portal link: https://your-tenant.iru.com/enroll
Enrollment code: [Your BYOD Blueprint Enrollment code]
```