Deploy Iru Access

Iru Access carries each user’s device-bound sign-in credential and reports device health. How you deliver it decides whether a device is recognized as managed:

Managed deployment: installed and configured through your MDM. Iru recognizes the device as managed, so authentication policies that require the managed attribute are satisfied.
Unmanaged deployment: a personal or BYO device the user sets up themselves. It still registers a working authenticator and reports health signals, but it is not recognized as managed, so policies that require the managed attribute won’t pass on it.

Both paths give the user a working Iru Access authenticator and report device health. The only difference is whether the device counts as managed for device-trust decisions.

Managed deployment

Install and configure Iru Access through your MDM so enrolled devices count as managed for device trust.

Create an MDM connection

An MDM connection is what lets Iru recognize devices enrolled in your MDM as managed. Create one for each MDM instance you use with Iru Identity.

In Iru Identity, go to Policies → MDM Connections and choose + MDM Connection.
Under Select a connection type, pick one:
- Iru Endpoint Instance: Pre-populate connection fields from your Iru Endpoint instance.
- Custom MDM Connection: Create a custom MDM connection with manual entry.
Give the connection a display name. We recommend your MDM server’s domain.
Choose a platform: Apple, Windows, or both.
Enter the platform details:
- Apple: the APNs topic and Check-in URL of your MDM server.
- Windows: the Provider ID and Discovery service URL of your MDM server.

Not sure of those values? See Resources for helper scripts you can run on an already-enrolled device to read them off.

After the connection is created, deploy Iru Access to each platform below.

macOS

Deploy the Iru Access configuration profile

In Iru Identity, on Policies → MDM Connections, click the download button to the left of + MDM Connection, then choose macOS Profile. Deploy the profile to your Macs. It already contains the Associated Domains and single sign-on extension settings (with your organization’s domains filled in), so you don’t have to assemble them by hand.

Show Building the profile by hand

If your MDM configures these as native payloads instead of an uploaded profile, replicate the following. Substitute <your-iru-domain> with each domain your connection uses (a connection may include more than one).

Associated Domains: application identifier N5M3B34269.com.iru.Access, with an associated domain of authsrv:<your-iru-domain> for each domain.
Single sign-on extension (Extensible SSO, Redirect type): extension identifier com.iru.Access.SSOExtension, team identifier N5M3B34269, and these redirect URL values for each domain:
https://<your-iru-domain>/api/v1/saml/sso https://<your-iru-domain>/api/v1/oauth/authorize https://<your-iru-domain>/api/v1/saml/login
Managed login items: allow team identifier N5M3B34269 for com.iru.Access, com.iru.Access.IruDaemon, and com.iru.Access.Menu so the Iru Access helper, background service, and updater can run.

Deploy the Iru Access app

With Iru Endpoint: add the Iru Access Auto App for Mac from Auto Apps in the Library, assign it through a Blueprint, and scope it to your Macs. See Auto Apps Overview.With another MDM: download Iru Access for macOS, upload the package to your MDM, and scope it to your Macs.

Download the registration script

Copy the Iru Access managed registration script from the Iru Support GitHub repository.

Configure the script

In the USER INPUT section near the top of the file, set regToken to your MDM connection’s client secret and regTokenDomain to your base tenant domain:

# USER INPUT
regToken="mdm-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
regTokenDomain="yourcompany.iru.com"

Deploy the script with Iru Endpoint

Add a Mac Custom Script Library Item from the Library, paste the modified script into Audit Script, and assign it through the same Blueprint as the Iru Access app. Set Execution Frequency to Run every 15 minutes so the script retries at each check-in until Iru Access is installed and the secret is stored. Because the script is idempotent, Run daily also works if you prefer less frequent runs. See Custom Scripts Overview (Mac tab).

Deploy the script with another MDM

Upload the modified script using your platform’s custom script or policy tooling. Run it on a recurring schedule after Iru Access is installed so new devices pick up the secret once the app is present.

iOS, iPadOS, and visionOS

Requirements

iOS and iPadOS: Devices must run 18.4 or later.
Apple Vision Pro: Iru Access installs as the iPad app.

Deploy the Iru Access configuration profile

In Iru Identity, on Policies → MDM Connections, click the download button to the left of + MDM Connection, then choose iOS Profile. Deploy the profile to your devices.

Show Building the profile by hand

Single sign-on extension (Extensible SSO, Redirect type): extension identifier com.iru.AccessMobile.SSOExtension, team identifier N5M3B34269, and these redirect URL values for each domain:
https://<your-iru-domain>/api/v1/saml/sso https://<your-iru-domain>/api/v1/oauth/authorize

Deploy the Iru Access app

Distribute Iru Access on the App Store through your MDM as a managed app, and scope it to your devices.

Configure managed registration

In your MDM, set managed app configuration on Iru Access (bundle ID com.iru.AccessMobile). Set two keys:

mdmSecret (String, required): your MDM connection’s client secret.
mdmSecretDomain (String, required): your base tenant domain (for example yourcompany.iru.com).

Set mdmSecretDomain to your base domain (yourcompany.iru.com), not the id. subdomain that invitation links use (yourcompany.id.iru.com). If the id. subdomain is included, the secret isn’t applied and the user falls back to entering it by hand.

Managed app configuration (plist)

<dict>
    <key>mdmSecret</key>
    <string>mdm-REPLACE-WITH-MDM-CONNECTION-CLIENT-SECRET</string>
    <key>mdmSecretDomain</key>
    <string>yourcompany.iru.com</string>
</dict>

With this configuration, registration is credential-free: the user never enters a secret, scans a QR code, or waits for manual approval. They still open their invitation (emailed to them, or a link you push to managed devices) or the in-app onboarding screen, tap Continue, and confirm with Face ID or Touch ID.

With Iru Endpoint, apply this dictionary through Set app configuration on the Iru Access App Store app. See Using AppConfig for deployment steps.

Windows

Requirements

Windows 11 24H2 or 25H2

Windows deployment has two parts: deploy Iru Access through your MDM, then store your MDM connection’s client secret on each PC with the registration script. Registration still requires the user to open their invitation and confirm with Windows Hello.

Deploy the Iru Access app

With Iru Endpoint: add the Iru Access Auto App for Windows from Auto Apps in the Library, assign it through a Blueprint, and scope it to your PCs. See Auto Apps Overview.With another MDM: download Iru Access for Windows, upload the package to your MDM, and scope it to your PCs.

Download the registration script

Copy the Iru Access managed registration script from the Iru Support GitHub repository.

Deploy the script with Iru Endpoint

Add a Windows Custom Script Library Item from the Library, upload the script, and assign it through the same Blueprint as the Iru Access app. In Command line parameters, pass your client secret and base tenant domain:

manage --secret <client-secret> --domain yourcompany.iru.com

Use your connection’s client secret and base tenant domain (yourcompany.iru.com) — the same values as on macOS and iOS. Store the client secret with this script rather than writing the registry directly. It’s encrypted to the device, so a value pushed by raw registry or OMA-URI won’t be usable.

Set Execute in to 64 bit. Windows Custom Scripts run once per device when assigned. See Custom Scripts Overview (Windows tab).

Deploy the script with another MDM

Deploy the script using whatever script or PowerShell policy tooling your platform supports. Pass the manage --secret and --domain arguments your MDM allows, and run elevated so the script can write to HKLM:

.\iru_access_managed_registration_windows.ps1 manage --secret <client-secret> --domain yourcompany.iru.com

Verify or rotate (optional)

To confirm the secret is stored or to clear it, run the script from an elevated PowerShell session with arguments. See Microsoft’s Getting Started with PowerShell for how to open PowerShell as an administrator.

# Verify — prints "<domain>:<hash>", never the secret itself
.\iru_access_managed_registration_windows.ps1 manage --list

# Rotate or remove
.\iru_access_managed_registration_windows.ps1 manage --clear "yourcompany.iru.com"

Complete registration

With the app deployed and the client secret stored, the user opens their invitation, which launches Iru Access, and confirms with Windows Hello. Because the device is enrolled in your MDM and carries the stored client secret, Iru recognizes it as managed.

Iru Access registers its passkey plugin with Windows automatically the first time it runs, after which it appears under Settings ▸ Accounts ▸ Passkeys ▸ Advanced options. Turning that toggle on is owned by Windows and the user. It can’t currently be forced on centrally through MDM. The end-user guide covers that step.

Unmanaged deployment

For personal or bring-your-own devices, there is nothing to configure in an MDM. The user installs Iru Access and registers from their invitation.

macOS

Share Iru Access for macOS with the user. They download and install it, then register from their invitation. For step-by-step guidance, see Installing Iru Access.

iOS, iPadOS, and visionOS

Share Iru Access on the App Store or their invitation link with the user. They install the app, then register. Requirements

iOS and iPadOS: The device must run 18.4 or later.
Apple Vision Pro: Install from the App Store as the iPad app.

For step-by-step guidance, see Installing Iru Access.

Windows

Share Iru Access for Windows with the user. They download and install it, then register from their invitation. Requirements

Windows 11 24H2 or 25H2

For step-by-step guidance, see Installing Iru Access.

Unmanaged devices still register a working authenticator and report health signals, but they are not recognized as managed. Policies that require the managed attribute won’t pass on them. Use a managed deployment for devices that need to meet those policies.

Resources

Run these helper scripts on a device already enrolled in your MDM to collect the MDM server details you need when creating a connection. Both are maintained in the Iru Support GitHub repository.

macOS: collect APNs topic and Check-in URL

The macOS Collect MDM details script reads the APNs topic and MDM Check-in URL from an enrolled Mac.

Windows: collect Provider ID and Discovery service URL

The Windows Collect MDM details script reads the MDM server’s Provider ID and Discovery service URL from an enrolled Windows device. Run it in PowerShell.

Where to go next

Troubleshoot the macOS SSO extension

Diagnose associated-domain approval and extension loading on a Mac.

MDM connections

Set up and manage the connection that makes a device count as managed.

Device trust

Require managed, healthy devices as a condition of access.

Installing Iru Access

The end-user walkthrough for setting up Iru Access on a personal device.

Authenticators

How Iru Access fits alongside passkeys as an authenticator.

Getting Started

Directory

Applications

Authentication & Policies

Administration

Architecture & Security

End-user guide

Deploy Iru Access

Managed deployment

Create an MDM connection

macOS

iOS, iPadOS, and visionOS

Windows

Unmanaged deployment

macOS

iOS, iPadOS, and visionOS

Windows

Resources

Where to go next

Troubleshoot the macOS SSO extension

MDM connections

Device trust

Installing Iru Access

Authenticators

​Managed deployment

​Create an MDM connection

​macOS

​iOS, iPadOS, and visionOS

​Windows

​Unmanaged deployment

​macOS

​iOS, iPadOS, and visionOS

​Windows

​Resources

​Where to go next

Troubleshoot the macOS SSO extension

MDM connections

Device trust

Installing Iru Access

Authenticators

Managed deployment

Create an MDM connection

macOS

iOS, iPadOS, and visionOS

Windows

Unmanaged deployment

macOS

iOS, iPadOS, and visionOS

Windows

Resources

Where to go next