> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Iru Access

> Roll out the Iru Access app through your MDM so Mac computers, iPhone devices, iPad devices, and PCs are recognized as managed, or share it for BYO.

**Iru Access** carries each user's device-bound sign-in credential and reports
[device health](/en/identity/authentication/device-trust). *How* you deliver it
decides whether a device is recognized as **managed**:

* **Managed deployment:** installed and configured through your MDM. Iru
  recognizes the device as managed, so [authentication
  policies](/en/identity/authentication/authentication-policies) that require the
  **managed** attribute are satisfied.
* **Unmanaged deployment:** a personal or BYO device the user sets up
  themselves. It still registers a working authenticator and reports health
  signals, but it is **not** recognized as managed, so policies that require the
  managed attribute won't pass on it.

<Note>
  Both paths give the user a working Iru Access authenticator and report device
  health. The only difference is whether the device counts as **managed** for
  device-trust decisions.
</Note>

## Managed deployment

Install and configure Iru Access through your MDM so enrolled devices count as
**managed** for [device trust](/en/identity/authentication/device-trust).

### Create an MDM connection

An [MDM connection](/en/identity/authentication/mdm-connections) is what lets
Iru recognize devices enrolled in your MDM as managed. Create one for each MDM
instance you use with Iru Identity.

1. In Iru Identity, go to **Policies → MDM Connections** and choose **+ MDM Connection**.
2. Under **Select a connection type**, pick one:
   * **Iru Endpoint Instance:** Pre-populate connection fields from your Iru Endpoint instance.
   * **Custom MDM Connection:** Create a custom MDM connection with manual entry.
3. Give the connection a **display name**. We recommend your MDM server's domain.
4. Choose a **platform**: Apple, Windows, or both.
5. Enter the platform details:
   * **Apple:** the **APNs topic** and **Check-in URL** of your MDM server.
   * **Windows:** the **Provider ID** and **Discovery service URL** of your
     MDM server.

<Tip>
  Not sure of those values? See [Resources](#resources) for helper scripts you
  can run on an already-enrolled device to read them off.
</Tip>

After the connection is created, deploy Iru Access to each platform below.

### macOS

<Steps>
  <Step title="Deploy the Iru Access configuration profile">
    In Iru Identity, on **Policies → MDM Connections**, click the download
    button to the left of **+ MDM Connection**, then choose **macOS Profile**.
    Deploy the profile to your Macs. It already contains the Associated Domains
    and single sign-on extension settings (with your organization's domains filled
    in), so you don't have to assemble them by hand.

    <Expandable title="Building the profile by hand">
      If your MDM configures these as native payloads instead of an uploaded
      profile, replicate the following. Substitute `<your-iru-domain>` with
      each domain your connection uses (a connection may include more than
      one).

      * **Associated Domains:** application identifier
        `N5M3B34269.com.iru.Access`, with an associated domain of
        `authsrv:<your-iru-domain>` for each domain.
      * **Single sign-on extension** (Extensible SSO, **Redirect** type):
        extension identifier `com.iru.Access.SSOExtension`, team identifier
        `N5M3B34269`, and these redirect URL values for each domain:

        ```
        https://<your-iru-domain>/api/v1/saml/sso
        https://<your-iru-domain>/api/v1/oauth/authorize
        https://<your-iru-domain>/api/v1/saml/login
        ```
      * **Managed login items:** allow team identifier `N5M3B34269` for
        `com.iru.Access`, `com.iru.Access.IruDaemon`, and `com.iru.Access.Menu`
        so the Iru Access helper, background service, and updater can run.
    </Expandable>
  </Step>

  <Step title="Deploy the Iru Access app">
    **With Iru Endpoint:** add the **Iru Access** Auto App for Mac from
    **Auto Apps** in the Library, assign it through a Blueprint, and scope it to
    your Macs. See
    [Auto Apps Overview](/en/endpoint/library/auto-apps/auto-apps-overview).

    **With another MDM:** download
    [Iru Access for macOS](https://updater.iru.com/iru-access-macOS/download),
    upload the package to your MDM, and scope it to your Macs.
  </Step>

  <Step title="Download the registration script">
    Copy the
    [Iru Access managed registration script](https://github.com/kandji-inc/support/blob/main/Identity/iru-access-managed-registration/iru_access_managed_registration_macos.zsh)
    from the
    [Iru Support GitHub repository](https://github.com/kandji-inc/support/tree/main/Identity).
  </Step>

  <Step title="Configure the script">
    In the **USER INPUT** section near the top of the file, set `regToken` to your
    MDM connection's **client secret** and `regTokenDomain` to your **base** tenant
    domain:

    ```zsh theme={null}
    # USER INPUT
    regToken="mdm-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    regTokenDomain="yourcompany.iru.com"
    ```
  </Step>

  <Step title="Deploy the script with Iru Endpoint">
    Add a **Mac Custom Script** Library Item from the Library, paste the modified
    script into **Audit Script**, and assign it through the same Blueprint as the
    Iru Access app. Set **Execution Frequency** to **Run every 15 minutes** so the
    script retries at each check-in until Iru Access is installed and the secret is
    stored. Because the script is idempotent, **Run daily** also works if you
    prefer less frequent runs. See
    [Custom Scripts Overview](/en/endpoint/library/library-items-profiles/custom-scripts-overview)
    (Mac tab).
  </Step>

  <Step title="Deploy the script with another MDM">
    Upload the modified script using your platform's custom script or policy
    tooling. Run it on a recurring schedule after Iru Access is installed so new
    devices pick up the secret once the app is present.
  </Step>
</Steps>

### iOS, iPadOS, and visionOS

**Requirements**

* **iOS and iPadOS:** Devices must run **18.4 or later**.
* **Apple Vision Pro:** Iru Access installs as the iPad app.

<Steps>
  <Step title="Deploy the Iru Access configuration profile">
    In Iru Identity, on **Policies → MDM Connections**, click the download
    button to the left of **+ MDM Connection**, then choose **iOS Profile**.
    Deploy the profile to your devices.

    <Expandable title="Building the profile by hand">
      * **Single sign-on extension** (Extensible SSO, **Redirect** type):
        extension identifier `com.iru.AccessMobile.SSOExtension`, team
        identifier `N5M3B34269`, and these redirect URL values for each domain:

        ```
        https://<your-iru-domain>/api/v1/saml/sso
        https://<your-iru-domain>/api/v1/oauth/authorize
        ```
    </Expandable>
  </Step>

  <Step title="Deploy the Iru Access app">
    Distribute
    [Iru Access on the App Store](https://apps.apple.com/us/app/iru-access/id6752437810)
    through your MDM as a managed app, and scope it to your devices.
  </Step>

  <Step title="Configure managed registration">
    In your MDM, set **managed app configuration** on Iru Access (bundle ID
    `com.iru.AccessMobile`). Set two keys:

    * **`mdmSecret`** (String, required): your MDM connection's **client
      secret**.
    * **`mdmSecretDomain`** (String, required): your **base** tenant domain
      (for example `yourcompany.iru.com`).

    <Warning>
      Set `mdmSecretDomain` to your **base** domain (`yourcompany.iru.com`), not
      the `id.` subdomain that invitation links use
      (`yourcompany.id.iru.com`). If the `id.` subdomain is included, the secret
      isn't applied and the user falls back to entering it by hand.
    </Warning>

    ```xml Managed app configuration (plist) theme={null}
    <dict>
        <key>mdmSecret</key>
        <string>mdm-REPLACE-WITH-MDM-CONNECTION-CLIENT-SECRET</string>
        <key>mdmSecretDomain</key>
        <string>yourcompany.iru.com</string>
    </dict>
    ```

    <Note>
      With this configuration, registration is **credential-free**: the user
      never enters a secret, scans a QR code, or waits for manual approval. They
      still open their **invitation** (emailed to them, or a link you push to
      managed devices) or the in-app onboarding screen, tap **Continue**, and
      confirm with Face ID or Touch ID.
    </Note>

    With Iru Endpoint, apply this dictionary through **Set app configuration**
    on the Iru Access App Store app. See
    [Using AppConfig](/en/endpoint/library/library-items-profiles/using-appconfig)
    for deployment steps.
  </Step>
</Steps>

### Windows

**Requirements**

* **Windows 11 24H2 or 25H2**

Windows deployment has two parts: deploy **Iru Access** through your MDM, then
store your MDM connection's **client secret** on each PC with the registration
script. Registration still requires the user to open their invitation and confirm
with **Windows Hello**.

<Steps>
  <Step title="Deploy the Iru Access app">
    **With Iru Endpoint:** add the **Iru Access** Auto App for Windows from
    **Auto Apps** in the Library, assign it through a Blueprint, and scope it to
    your PCs. See
    [Auto Apps Overview](/en/endpoint/library/auto-apps/auto-apps-overview).

    **With another MDM:** download
    [Iru Access for Windows](https://updater.iru.com/iru-access-windows/download),
    upload the package to your MDM, and scope it to your PCs.
  </Step>

  <Step title="Download the registration script">
    Copy the
    [Iru Access managed registration script](https://github.com/kandji-inc/support/blob/main/Identity/iru-access-managed-registration/iru_access_managed_registration_windows.ps1)
    from the
    [Iru Support GitHub repository](https://github.com/kandji-inc/support/tree/main/Identity).
  </Step>

  <Step title="Deploy the script with Iru Endpoint">
    Add a **Windows Custom Script** Library Item from the Library, upload the
    script, and assign it through the same Blueprint as the Iru Access app. In
    [**Command line parameters**](/en/endpoint/library/library-items-profiles/custom-scripts-overview#command-line-parameters-optional),
    pass your client secret and base tenant domain:

    ```
    manage --secret <client-secret> --domain yourcompany.iru.com
    ```

    <Warning>
      Use your connection's **client secret** and **base** tenant domain
      (`yourcompany.iru.com`) — the same values as on macOS and iOS. Store the
      client secret with this script rather than writing the registry directly.
      It's encrypted to the device, so a value pushed by raw registry or OMA-URI
      won't be usable.
    </Warning>

    Set **Execute in** to **64 bit**. Windows Custom Scripts run once per device
    when assigned. See
    [Custom Scripts Overview](/en/endpoint/library/library-items-profiles/custom-scripts-overview)
    (Windows tab).
  </Step>

  <Step title="Deploy the script with another MDM">
    Deploy the script using whatever script or PowerShell policy tooling your
    platform supports. Pass the `manage --secret` and `--domain` arguments your
    MDM allows, and run elevated so the script can write to `HKLM`:

    ```powershell theme={null}
    .\iru_access_managed_registration_windows.ps1 manage --secret <client-secret> --domain yourcompany.iru.com
    ```
  </Step>

  <Step title="Verify or rotate (optional)">
    To confirm the secret is stored or to clear it, run the script from an
    elevated PowerShell session with arguments. See Microsoft's
    [Getting Started with PowerShell](https://learn.microsoft.com/en-us/powershell/scripting/learn/ps101/01-getting-started?view=powershell-7.5#starting-powershell-elevated-as-an-administrator)
    for how to open PowerShell as an administrator.

    ```powershell theme={null}
    # Verify — prints "<domain>:<hash>", never the secret itself
    .\iru_access_managed_registration_windows.ps1 manage --list

    # Rotate or remove
    .\iru_access_managed_registration_windows.ps1 manage --clear "yourcompany.iru.com"
    ```
  </Step>

  <Step title="Complete registration">
    With the app deployed and the client secret stored, the user opens their
    **invitation**, which launches Iru Access, and confirms with **Windows
    Hello**. Because the device is enrolled in your MDM and carries the
    stored client secret, Iru recognizes it as **managed**.
  </Step>
</Steps>

<Note>
  Iru Access registers its **passkey plugin** with Windows automatically the
  first time it runs, after which it appears under **Settings ▸ Accounts ▸
  Passkeys ▸ Advanced options**. Turning that toggle **on** is owned by Windows
  and the user. It can't currently be forced on centrally through MDM. The
  [end-user guide](/en/identity/end-user/installing-iru-access) covers that
  step.
</Note>

## Unmanaged deployment

For personal or bring-your-own devices, there is nothing to configure in an MDM.
The user installs Iru Access and registers from their invitation.

### macOS

Share
[Iru Access for macOS](https://updater.iru.com/iru-access-macOS/download)
with the user. They download and install it, then register from their
invitation. For step-by-step guidance, see
[Installing Iru Access](/en/identity/end-user/installing-iru-access).

### iOS, iPadOS, and visionOS

Share
[Iru Access on the App Store](https://apps.apple.com/us/app/iru-access/id6752437810)
or their invitation link with the user. They install the app, then register.

**Requirements**

* **iOS and iPadOS:** The device must run **18.4 or later**.
* **Apple Vision Pro:** Install from the App Store as the iPad app.

For step-by-step guidance, see
[Installing Iru Access](/en/identity/end-user/installing-iru-access).

### Windows

Share
[Iru Access for Windows](https://updater.iru.com/iru-access-windows/download)
with the user. They download and install it, then register from their
invitation.

**Requirements**

* **Windows 11 24H2 or 25H2**

For step-by-step guidance, see
[Installing Iru Access](/en/identity/end-user/installing-iru-access).

<Note>
  Unmanaged devices still register a working authenticator and report health
  signals, but they are **not** recognized as managed. Policies that require
  the managed attribute won't pass on them. Use a **managed deployment** for
  devices that need to meet those policies.
</Note>

## Resources

Run these helper scripts on a device already enrolled in your MDM to collect
the MDM server details you need when creating a connection. Both are maintained
in the
[Iru Support GitHub repository](https://github.com/kandji-inc/support/tree/main/Identity).

<AccordionGroup>
  <Accordion title="macOS: collect APNs topic and Check-in URL" icon="apple">
    The
    [macOS Collect MDM details script](https://github.com/kandji-inc/support/blob/main/Identity/iru-access-collect-mdm-details/collect_mdm_details_macos.zsh)
    reads the **APNs topic** and **MDM Check-in URL** from an enrolled Mac.
  </Accordion>

  <Accordion title="Windows: collect Provider ID and Discovery service URL" icon="windows">
    The
    [Windows Collect MDM details script](https://github.com/kandji-inc/support/blob/main/Identity/iru-access-collect-mdm-details/collect_mdm_details_windows.ps1)
    reads the MDM server's **Provider ID** and **Discovery service URL** from an
    enrolled Windows device. Run it in PowerShell.
  </Accordion>
</AccordionGroup>

## Where to go next

<CardGroup cols={2}>
  <Card title="Troubleshoot the macOS SSO extension" icon="bug" href="/en/identity/authentication/troubleshoot-macos-sso">
    Diagnose associated-domain approval and extension loading on a Mac.
  </Card>

  <Card title="MDM connections" icon="tower-broadcast" href="/en/identity/authentication/mdm-connections">
    Set up and manage the connection that makes a device count as managed.
  </Card>

  <Card title="Device trust" icon="laptop" href="/en/identity/authentication/device-trust">
    Require managed, healthy devices as a condition of access.
  </Card>

  <Card title="Installing Iru Access" icon="download" href="/en/identity/end-user/installing-iru-access">
    The end-user walkthrough for setting up Iru Access on a personal device.
  </Card>

  <Card title="Authenticators" icon="key" href="/en/identity/authentication/authenticators">
    How Iru Access fits alongside passkeys as an authenticator.
  </Card>
</CardGroup>