This guide applies to Mac computers, iOS devices, iPadOS devices, Apple TV, and Apple Vision Pro
Apple Business Manager is now Apple Business. Apple School Manager is unchanged. For more information, see Introducing Apple Business and Apple Business Manager is now Apple Business.
As of April 8, 2026, apps were updated from Kandji 
to Iru 
branding. App names changed from Kandji Self Service to Iru Self Service and from Kandji Agent to Iru Agent. The manual enrollment portal now uses Iru branding. Please update scripts, automations, and utilities that still reference the old app names.
to Iru branding. App names changed from Kandji Self Service to Iru Self Service and from Kandji Agent to Iru Agent. The manual enrollment portal now uses Iru branding. Please update scripts, automations, and utilities that still reference the old app names.How It Works
Iru Endpoint supports two approaches: Automated Device Enrollment (ADE) for corporate-owned devices (they enroll automatically during setup), and manual enrollment through the Enrollment Portal for Bring Your Own Device (BYOD). For ADE, you assign devices in Apple Business or Apple School Manager to Iru Endpoint, then assign them to a Blueprint in Iru Endpoint. For manual enrollment, you share the Enrollment Portal link and Enrollment code with users; they enter the Enrollment code, then sign in (if you require authentication) and install the enrollment profile. In both cases, devices are assigned to a Blueprint and configured according to your policies.Automated Device Enrollment (ADE)
ADE allows devices to enroll automatically during the initial setup process. This is the recommended method for corporate-owned devices.Prerequisites
- Apple Push Notification service (APNs) configured in Iru Endpoint
- Apple Business or Apple School Manager account configured
- Automated Device Enrollment token set up in Iru Endpoint
- Devices added to your Apple Business or Apple School Manager account
- Blueprints configured for device assignment
ADE Enrollment Flow
When users set up their devices, each device connects to Apple’s servers during setup and Iru Endpoint automatically applies the assigned Blueprint. Each device gets enrolled and configured according to your policies, then the user completes setup with pre-configured settings.Assign devices in Apple Business or Apple School Manager
1
Navigate to Devices
In Apple Business or Apple School Manager, navigate to Devices.
2
Select Devices
Select the devices you want to assign.
3
Assign to MDM
Choose Assign to Mobile Device Management (MDM) Server.
4
Select Iru Endpoint
Select Iru Endpoint as the MDM server.
5
Confirm Assignment
Confirm the assignment when prompted.
Configure Blueprint assignment
1
Navigate to Automated Device Enrollment
In Iru Endpoint, navigate to Enrollment → Automated Device Enrollment.
2
Filter and View Devices
Filter by Awaiting Enrollment (or All) to view unenrolled devices.
3
Assign to Blueprint
Select the devices and assign them to the appropriate Blueprint.
4
Configure Authentication (optional)
Configure any required authentication settings. See Require Authentication with Automated Device Enrollment for details.
5
Confirm and Sync
Confirm devices appear and use Fetch devices to sync from Apple if they do not.
ADE Library Item Assignment
Optionally set or override the ADE Library Item for a device (or multiple devices) instead of using the one from its Blueprint or Blueprint Routing.1
Navigate to Automated Device Enrollment
In Iru Endpoint, go to Enrollment → Automated Device Enrollment.
2
Filter and Select Devices
Filter by Awaiting Enrollment (or All) to view unenrolled devices, then select the device(s) whose ADE Library Item you want to set or override.
3
View the ADE Library Item Column
The ADE Library Item column shows the name of the ADE Library Item assigned to the Blueprint selected for enrollment or Blueprint Routing, or None if none is assigned.
4
Unlink from Blueprint
To override the assignment so you can choose a different ADE Library Item, click Unlink from Blueprint or Unlink from Blueprint Routing, whichever appears.
5
Re-link or select an ADE Library Item
Once unlinked, choose Re-link to Blueprint or Re-link to Blueprint Routing, or select an ADE Library Item from the list. You can do this for one device or for many via multi-select.
A direct assignment is sticky and will always apply to the device unless you manually re-link it to the Blueprint or Blueprint Routing. Re-linking can be done one device at a time or in bulk.
Manual Enrollment
Manual enrollment allows users to enroll their devices through the Iru Endpoint Enrollment Portal.Setup Manual Enrollment
1
Configure Enrollment Portal
a. Go to Endpoint → Enrollment → Manual Enrollment in Iru Endpoint.b. Ensure the Enrollment Portal is active.c. Determine which Blueprint you want devices to be added to after enrollment.
2
Configure Authentication
a. Click the Blueprint and select Require authentication if you want users to authenticate prior to enrollment.b. This integrates with your Single Sign-On (SSO) configuration for secure enrollment. If you see a banner that No single sign-on connections are configured, go to Access (Account Menu Button → Access) and configure Single sign-on, then return and select Require authentication. See SSO Setup for setup steps.
3
Share Enrollment Information
a. Copy the Enrollment Portal link from Enrollment → Manual Enrollment.b. Copy the Enrollment code for the Blueprint you chose.c. Share the Enrollment Portal link and Enrollment code with your end users.d. Provide a short note that they’ll enter the Enrollment code, then sign in (if required), and follow on-screen prompts to complete enrollment.
User Enrollment Process
When users access the Enrollment Portal, they’ll enter the provided Enrollment code and authenticate using SSO if you’ve enabled that option. They then download and install the enrollment profile to complete enrollment and receive device configuration.Enrollment Authentication
SSO Authentication
To enhance security, you can require SSO authentication during enrollment. Configure SSO in Iru Endpoint (see SSO Setup), then enable Require authentication on your Blueprint. Users will authenticate with their identity provider before enrollment.Enrollment Codes
Each Blueprint has a unique Enrollment code that users need to enroll their devices. You can share codes directly with users, use SSO authentication to automatically assign users to the correct Blueprint, or create multiple Blueprints for different user groups or departments.Best Practices
Test your Blueprints on designated testing devices before enrolling production hardware. Use Automated Device Enrollment for corporate-owned devices, as it provides the best user experience. Enable SSO authentication for secure enrollment and provide clear instructions to users about the enrollment process. You can monitor enrollment success and troubleshoot issues using the Activity Page.Troubleshooting
Trial Tenant Device Limit
Trial tenants are limited to a total of 10 devices. Once this limit is reached, a banner will be displayed until the device count becomes less than 10 again.Common Issues
If devices aren’t appearing, check your Apple Business or Apple School Manager configuration and device assignment. For enrollment failures, verify your Blueprint configuration and network connectivity. If you’re seeing authentication issues, check that SSO is configured correctly and that users have the right access.Support Resources
Check the Activity Page for enrollment logs and errors, and review Device records for enrollment status. Contact Support if you need additional assistance.Related Articles
Blueprint Routing
Configure dynamic Blueprint assignment during device enrollment using Assignment Rules
Configuring Apple Enrollment
Configure Apple device enrollment with Automated Device Enrollment (ADE)
User Experience with Apple Enrollment
What to expect when enrolling your device through the Enrollment Portal
Configure Require Authentication for Enrollment
Configure authentication requirements for device enrollment across Apple, Windows, and Android platforms
Next Steps
After setting up Apple enrollment:1
Test Enrollment
Test the process with a few devices and monitor compliance and policy enforcement on the Activity Page.
2
Set Up Enrollment for Other Platforms (optional)
To enroll Windows or Android devices as well, see Windows Enrollment or Android Enrollment.