> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Configure Require Authentication for Enrollment
> Require user authentication during device enrollment in Iru Endpoint. Configure identity verification for Apple, Windows, and Android platforms.
This guide applies to all device platforms
## What is Require Authentication?
Require authentication is an enrollment setting that requires the enrolling user to complete single sign-on before device enrollment can finish. You choose which SSO connection to use from those configured in **Access** ([**Account Menu Button**](/en/iru/platform-overview/account-menu) → **Access**).
Require authentication can also be used alongside [Blueprint Routing](/en/endpoint/enrollment/blueprint-routing), which dynamically assigns devices to Blueprints during enrollment using Assignment Rules.
As of **April 8, 2026**, apps were updated from **Kandji** 
to **Iru** 
branding. The manual enrollment portal now uses Iru branding.
## Manual Enrollment (All Devices)
On the **Enrollment** page, open the **Manual Enrollment** tab. For each Blueprint, you can enable **Require authentication** so users who enroll through the enrollment portal must complete SSO sign-in before enrollment continues.
### Authentication Methods
Require authentication for manual enrollment supports [Passkeys](/en/iru/access/passkeys-and-social-login#passkeys), [Google Social and Microsoft Social](/en/iru/access/passkeys-and-social-login#social-login), [Custom SAML](/en/endpoint/integrations/single-sign-on-integrations/saml-based-single-sign-on), and [Native SSO](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on).
### Prerequisites
* Enrollment configured for your platform: [Apple](/en/endpoint/enrollment/apple/configuring-apple-enrollment), [Windows](/en/endpoint/enrollment/windows/configuring-windows-enrollment), or [Android](/en/endpoint/enrollment/android/configuring-android-enrollment)
* If using Custom SAML or Native SSO: a working [SSO configuration](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on) in **Access**
* If using Google Social or Microsoft Social: [Limit Authentication to Domain](/en/iru/access/passkeys-and-social-login#limit-authentication-to-domain) enabled for that connection in **Access**
**User experience**: Share platform-specific enrollment instructions with your users: [Apple](/en/endpoint/enrollment/apple/user-experience-with-apple-enrollment), [Windows](/en/endpoint/enrollment/windows/user-experience-with-windows-enrollment), or [Android](/en/endpoint/enrollment/android/user-experience-with-android-enrollment).
### Configuring Require Authentication with Manual Enrollment
Select **Enrollment** in the navigation bar.
Navigate to the **Manual Enrollment** tab.
Scroll down to the Blueprint you want. Click the Blueprint tile or the **chevron** (down arrow) on the row to expand it.
Click **Edit Settings**.
Check the **Require authentication** box.
Choose a connection from the dropdown menu.
To use Google Social or Microsoft Social for **Require authentication** during enrollment, **Limit Authentication to Domain** must be enabled for that connection. See [Limit Authentication to Domain](/en/iru/access/passkeys-and-social-login#limit-authentication-to-domain) in Passkeys & Social Login.
If desired, check **Assign user to device record**.
When enabled, this option tries to match the authenticated user to a user in your directory integration(s) by email address. If a match is found, the user is automatically assigned to the device.
Click **Save**.
## Automated Device Enrollment (Apple only)
### Authentication Methods
Require authentication for Automated Device Enrollment supports only [Custom SAML](/en/endpoint/integrations/single-sign-on-integrations/saml-based-single-sign-on), [Google Workspace Native](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on-with-google-workspace-native), and [Microsoft Entra ID Native](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on-with-microsoft-entra-id-native) authentication methods.
### Prerequisites
* A working [SSO configuration](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on) in **Access**
* Apple devices with Automated Device Enrollment configured. See [Configure Automated Device Enrollment](/en/endpoint/settings/apple-integrations/configure-automated-device-enrollment).
### Configuring Require Authentication with Automated Device Enrollment
To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article. If you already have an Automated Device Enrollment Library Item, open it, click **Edit**, and skip to step 3.
Give the new Automated Device Enrollment Library Item a **Name**.
Assign it to your [Blueprints](/en/endpoint/getting-started/blueprints-and-library/configuring-blueprints).
Check **Require authentication**. This requires a user to authenticate through single sign-on during device enrollment.
Under **Connection**, select the single sign-on connector to use for authentication.
Optionally, check **Assign user to device record** to automatically assign the authenticated user to the device.
When enabled, this option tries to match the authenticated user to a user in your directory integration(s) by email address. If a match is found, the user is automatically assigned to the device.
When **Assign user to device record** is enabled, optionally check **Prefill initial account creation details** to prepopulate the new computer account in Setup Assistant with the assigned user's details.
If you're using [Passport](/en/endpoint/library/passport/configure-the-passport-library-item), make sure to turn off **Prefill initial account creation details** and **Lock pre-filled account creation details**. These settings conflict with Passport's account creation process and can cause Setup Assistant errors.
Optionally check **Lock pre-filled account creation details**. If enabled, the user cannot modify the account creation details.
Configure any remaining settings and click **Save**.
## Considerations
### General
An SSO connection does not need to have **Enable Tenant Authentication** turned on to be used for Require authentication. Only enable tenant authentication if you also want Iru Endpoint admins to use that same connection to sign in to the Iru Endpoint Web App.
If you use the same connection for both admin access and device enrollment, your end users will see the Iru Endpoint app in their identity provider's catalog. This won't give them admin access to your Iru Endpoint tenant.
### Apple
When using Google Workspace as your identity provider, you must create your SSO connection [using Custom SAML](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on-with-google-workspace-saml). The [built-in Google Workspace integration](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on-with-google-workspace-native) will cause a 403 error during enrollment.
Here's what happens depending on the user's 2-Step Verification status:
**Already set up**: Users see the normal Google authentication window with options for text, authenticator app, or backup codes.
**Past enrollment period**: Users get an error message about not meeting the 2-Step Verification policy. They'll need to contact their admin to resolve this.
**Never enabled, still in grace period**: Users will see a 404 error.
If you're using [Passport](/en/endpoint/library/passport/configure-the-passport-library-item), make sure to turn off **Prefill initial account creation details** and **Lock pre-filled account creation details**. These settings conflict with Passport's account creation process and can cause Setup Assistant errors.
### Windows
Make sure the user enrolling the device has local administrator rights on the Windows machine.
Make sure the device has internet access and Microsoft Edge browser. You'll also need to open the required firewall ports for enrollment to work. For more information, see [Microsoft's documentation on MDM enrollment](https://learn.microsoft.com/en-us/windows/client-management/mdm-enrollment-of-windows-devices#connect-your-windows-device-to-work-using-a-deep-link).
During enrollment, users will see a "This site is trying to open Microsoft account" prompt. Tell them to click **Open** to continue the process.
### Android
Make sure Android devices are in a factory restored state before attempting enrollment.
Enrollment creates a work profile that keeps work and personal data completely separate. Work apps go in the work profile, while personal apps stay in the personal profile.
## Related Articles
Configure Apple device enrollment with Automated Device Enrollment (ADE)
Windows device enrollment and management setup
Android device enrollment and work profile setup
What to expect when enrolling your device through the enrollment portal
What to expect when enrolling your Windows device through the enrollment portal
What to expect when enrolling your Android devices and setting up a work profile