> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Iru Access

> Roll out the Iru Access app through your MDM so Mac computers, iPhone devices, iPad devices, and PCs are recognized as managed, or share it for BYO.

**Iru Access** carries each person's device-bound sign-in credential and reports
[device health](/en/identity/authentication/device-trust). *How* you deliver it
decides whether a device is recognized as **managed**:

* **Managed deployment** - installed and configured through your MDM. Iru
  recognizes the device as managed, so [authentication
  policies](/en/identity/authentication/authentication-policies) that require the
  **managed** attribute are satisfied.
* **Unmanaged deployment** - a personal or BYO device the person sets up
  themselves. It still registers a working authenticator and reports health
  signals, but it is **not** recognized as managed, so policies that require the
  managed attribute won't pass on it.

<Note>
  Both paths give the person a working Iru Access authenticator and report device
  health. The only difference is whether the device counts as **managed** for
  device-trust decisions.
</Note>

<Tabs>
  <Tab title="Managed">
    ## 1. Create an MDM connection

    An [MDM connection](/en/identity/authentication/mdm-connections) is what lets
    Iru recognize devices enrolled in your MDM as managed. Create one for each MDM
    instance you use with Iru Identity.

    1. Go to **Policies → MDM Connections** and add an **MDM Connection**.
    2. Give it a **display name** - we recommend your MDM server's domain.
    3. Choose a **platform**: Apple, Windows, or both.
    4. Enter the platform details:
       * **Apple** - the **APNs topic** and **Check-in URL** of your MDM server.
       * **Windows** - the **Provider ID** and **Discovery service URL** of your
         MDM server.

    <Tip>
      Not sure of those values? Run the matching **Collect MDM details** script
      from [Resources](#resources) on an already-enrolled device to read them off.
    </Tip>

    After the connection is created, deploy Iru Access to each platform below.

    ## macOS

    <Steps>
      <Step title="Deploy the Iru Access configuration profile" icon="file-shield">
        Download the **macOS profile** from your MDM connection and deploy it to
        your Macs. It already contains the Associated Domains and single sign-on
        extension settings - with your organization's domains filled in - so you
        don't have to assemble them by hand.

        <Expandable title="Building the profile by hand">
          If your MDM configures these as native payloads instead of an uploaded
          profile, replicate the following. Substitute `<your-iru-domain>` with
          each domain your connection uses (a connection may include more than
          one).

          * **Associated Domains** - application identifier
            `N5M3B34269.com.iru.Access`, with an associated domain of
            `authsrv:<your-iru-domain>` for each domain.
          * **Single sign-on extension** (Extensible SSO, **Redirect** type) -
            extension identifier `com.iru.Access.SSOExtension`, team identifier
            `N5M3B34269`, and these redirect URL values for each domain:

            ```
            https://<your-iru-domain>/api/v1/saml/sso
            https://<your-iru-domain>/api/v1/oauth/authorize
            https://<your-iru-domain>/api/v1/saml/login
            ```
          * **Managed login items** - allow team identifier `N5M3B34269` for
            `com.iru.Access`, `com.iru.Access.IruDaemon`, and `com.iru.Access.Menu`
            so the Iru Access helper, background service, and updater can run.
        </Expandable>
      </Step>

      <Step title="Deploy the Iru Access app" icon="box-archive">
        Upload the macOS package from the **Downloads** tab to your MDM
        and scope it to your Macs. If you use **Iru Endpoint**, you can add Iru
        Access directly from its app library instead.
      </Step>

      <Step title="Configure managed registration" icon="terminal">
        macOS registers without any user interaction using a short script your MDM
        runs (ideally on a schedule). It checks whether the device is already
        registered for your domain and, if not, registers it.

        <Info>
          Set `regToken` to your MDM connection's **client secret** and
          `regTokenDomain` to your Iru domain.
        </Info>

        ```zsh theme={null}
        #!/bin/zsh

        set -euo pipefail

        # Replace with your MDM connection's client secret and your Iru domain.
        regToken="mdm-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
        regTokenDomain="yourcompany.iru.com"

        iruAccessCLI="/Applications/Iru Access.app/Contents/MacOS/iru-access"

        # Current list of registered secrets
        listOutput="$("$iruAccessCLI" manage --list 2>/dev/null || true)"

        # Existing hash for this domain, if any
        existingHash="$(
          echo "$listOutput" \
          | awk -v domain="$regTokenDomain" '
              index($1, domain":") == 1 {
                split($1, a, ":");
                print a[2];
              }
            '
        )"

        # SHA-256 of the current token
        currentHash="$(printf '%s' "$regToken" | shasum -a 256 | awk '{print $1}')"

        # Already registered with this token? Nothing to do.
        if [[ -n "$existingHash" && "$existingHash" == "$currentHash" ]]; then
          echo "MDM registration token already registered"
          exit 0
        fi

        echo "Setting registration token for domain: $regTokenDomain"
        "$iruAccessCLI" manage --secret "$regToken" --domain "$regTokenDomain"

        exit $?
        ```
      </Step>
    </Steps>

    ## iOS, iPadOS, and visionOS

    <Steps>
      <Step title="Deploy the Iru Access configuration profile" icon="file-shield">
        Download the **iOS profile** from your MDM connection and deploy it to your
        devices.

        <Expandable title="Building the profile by hand">
          * **Associated Domains** - application identifier
            `N5M3B34269.com.iru.AccessMobile`, with an associated domain of
            `authsrv:<your-iru-domain>` for each domain your connection uses.
          * **Single sign-on extension** (Extensible SSO, **Redirect** type) -
            extension identifier `com.iru.AccessMobile.SSOExtension`, team
            identifier `N5M3B34269`, and these redirect URL values for each domain:

            ```
            https://<your-iru-domain>/api/v1/saml/sso
            https://<your-iru-domain>/api/v1/oauth/authorize
            ```
        </Expandable>
      </Step>

      <Step title="Deploy the Iru Access app" icon="app-store-ios">
        Distribute the Iru Access app (from the **Downloads** tab)
        through your MDM as a managed app, and scope it to your devices.
      </Step>

      <Step title="Configure managed registration" icon="gears">
        These platforms can't run the macOS script, so you supply the registration
        details through your MDM's **managed app configuration** for Iru Access
        (bundle ID `com.iru.AccessMobile`). Set two keys:

        * **`mdmSecret`** (String, required) - your MDM connection's **client
          secret**, the same value you pass to the macOS `--secret`.
        * **`mdmSecretDomain`** (String, required) - your **base** tenant domain,
          the same value as the macOS `--domain` (for example `yourcompany.iru.com`).

        <Warning>
          Set `mdmSecretDomain` to your **base** domain (`yourcompany.iru.com`) - not
          the `id.` subdomain that invitation links use
          (`yourcompany.id.iru.com`). If the `id.` subdomain is included, the secret
          isn't applied and the person falls back to entering it by hand.
        </Warning>

        ```xml Managed app configuration (plist) theme={null}
        <dict>
            <key>mdmSecret</key>
            <string>mdm-REPLACE-WITH-MDM-CONNECTION-CLIENT-SECRET</string>
            <key>mdmSecretDomain</key>
            <string>yourcompany.iru.com</string>
        </dict>
        ```

        <Note>
          This makes registration **credential-free** - the person never enters a
          secret, scans a QR code, or waits for manual approval - but it isn't fully
          silent like the macOS script. The person still opens their **invitation**
          (emailed to them, or a link you push to managed devices) or the in-app
          onboarding screen, taps **Continue**, and confirms with Face ID or Touch
          ID.
        </Note>

        <Info>
          Requires **iOS or iPadOS 18.4 or later**. **Apple Vision Pro is supported**
          too - Iru Access runs there as the iPad app and uses the same configuration.
        </Info>
      </Step>
    </Steps>

    ## Windows

    Windows deployment has two parts: a small command-line tool provisions your MDM
    connection's secret on the device, and the person completes registration from
    their invitation. There is no fully unattended path - Windows Hello always
    involves the person.

    <Steps>
      <Step title="Deploy the Iru Access app" icon="box-archive">
        Distribute the Windows package from the **Downloads** tab through your MDM
        and scope it to your PCs. Iru Access on Windows requires **Windows 11,
        version 24H2 or later** (the passkey plugin depends on it).
      </Step>

      <Step title="Provision the MDM secret" icon="terminal">
        Run the **`IruID.MdmSecretTool.exe`** command-line tool **elevated (as
        SYSTEM)** to store your MDM connection's client secret for your domain.
        Deliver it through your MDM as a Win32 app, a remediation, or a startup
        script. It's a separate tool from the app, not bundled inside it.

        ```powershell theme={null}
        # Store the secret (run elevated / as SYSTEM)
        IruID.MdmSecretTool.exe manage --secret "<CLIENT_SECRET>" --domain "yourcompany.iru.com"

        # Verify - prints "<domain>:<hash>", never the secret itself
        IruID.MdmSecretTool.exe manage --list

        # Rotate or remove
        IruID.MdmSecretTool.exe manage --clear "yourcompany.iru.com"
        ```

        <Warning>
          The `--secret` and `--domain` values are the same as on macOS and iOS:
          your connection's **client secret** and your **base** tenant domain
          (`yourcompany.iru.com`). Provision the secret with this tool rather than
          writing the registry directly - it's encrypted to the device, so a value
          pushed by raw registry or OMA-URI won't be usable.
        </Warning>
      </Step>

      <Step title="Complete registration" icon="windows">
        With the app deployed and the secret provisioned, the person opens their
        **invitation**, which launches Iru Access, and confirms with **Windows
        Hello**. Because the device is enrolled in your MDM and carries the
        provisioned secret, Iru recognizes it as **managed**.
      </Step>
    </Steps>

    <Note>
      Iru Access registers its **passkey plugin** with Windows automatically the
      first time it runs, after which it appears under **Settings ▸ Accounts ▸
      Passkeys ▸ Advanced options**. Turning that toggle **on** is owned by Windows
      and the person - it can't currently be forced on centrally through MDM. The
      [end-user guide](/en/identity/end-user/installing-iru-access) covers that
      step.
    </Note>
  </Tab>

  <Tab title="Unmanaged">
    ## Personal and BYO devices

    For personal or bring-your-own devices, there's nothing to configure in an MDM

    * just get Iru Access onto the device and let the person register from their
      invitation.

    * Share the appropriate link from the **Downloads** tab, or

    * Point people to the end-user walkthrough:
      [Installing Iru Access](/en/identity/end-user/installing-iru-access).

    <Note>
      Unmanaged devices still register a working authenticator and report health
      signals, but they are **not** recognized as managed. Policies that require
      the managed attribute won't pass on them - use a
      **managed deployment** for devices that need to meet those policies.
    </Note>
  </Tab>

  <Tab title="Downloads">
    ## Download links

    Share these with end users for unmanaged installs, or upload the packages to
    your MDM for managed deployment.

    | Platform                  | Download                                                                             |
    | ------------------------- | ------------------------------------------------------------------------------------ |
    | **macOS**                 | `https://updater.iru.com/iru-access-macOS/download`                                  |
    | **iOS, iPadOS, visionOS** | [Iru Access on the App Store](https://apps.apple.com/us/app/iru-access/id6752437810) |
    | **Windows**               | `https://updater.iru.com/iru-access-windows/download`                                |
  </Tab>
</Tabs>

## Resources

These helper scripts collect the MDM server details you need when creating a
connection. Run them on a device that is already enrolled in your MDM.

<AccordionGroup>
  <Accordion title="macOS - collect APNs topic and Check-in URL" icon="apple">
    Reads the **APNs topic** and **MDM Check-in URL** from an enrolled Mac.

    ```bash theme={null}
    sudo profiles -P -o stdout 2>/dev/null | awk '
    /CheckInURL = / {
        if (match($0, /"[^"]+"/)) {
            candidate_checkin = substr($0, RSTART+1, RLENGTH-2)
        }
    }
    /Topic = / {
        if (match($0, /"[^"]+"/)) {
            candidate_topic = substr($0, RSTART+1, RLENGTH-2)
        }
    }
    /PayloadType = "com.apple.mdm"/ {
        apns_topic = candidate_topic
        checkin_url = candidate_checkin
        print "APNs Topic: " apns_topic
        print "MDM Check-in URL: " checkin_url
        exit
    }
    '
    ```
  </Accordion>

  <Accordion title="Windows - collect Provider ID and Discovery service URL" icon="windows">
    Reads the MDM server's **Provider ID** and **Discovery service URL** from an
    enrolled Windows device. Run in PowerShell.

    ```powershell theme={null}
    [CmdletBinding()]
    param(
        [string]
        $ProviderId
    )

    $basePaths = @(
        "HKLM:\SOFTWARE\Microsoft\Enrollments",
        "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Enrollments"
    )

    $records = @()

    function Get-EnrollmentRecords {
        param(
            [Parameter(Mandatory)] [string] $Path,
            [string] $Filter
        )

        if (-not (Test-Path -Path $Path)) {
            return
        }

        Get-ChildItem -Path $Path -ErrorAction SilentlyContinue | ForEach-Object {
            $props = Get-ItemProperty -Path $_.PSPath -ErrorAction SilentlyContinue
            if (-not $props) {
                return
            }

            $record = [PSCustomObject]@{
                ProviderId          = $props.ProviderID
                DiscoveryServiceUrl = $props.DiscoveryServiceFullURL
                Upn                 = $props.UPN
                EnrollmentKey       = $_.PSChildName
            }

            if (-not $record.ProviderId) {
                return
            }

            if (-not $Filter -or ($record.ProviderId -ieq $Filter)) {
                $record
            }
        }
    }

    foreach ($path in $basePaths) {
        $records += Get-EnrollmentRecords -Path $path -Filter $ProviderId
    }

    if (-not $records) {
        Write-Warning "No enrollment records found under $($basePaths -join ', ')."
        return
    }

    $records |
        Sort-Object ProviderId, EnrollmentKey |
        Format-Table -AutoSize |
        Out-String -Width 4096 |
        Write-Output
    ```
  </Accordion>
</AccordionGroup>

## Where to go next

<CardGroup cols={2}>
  <Card title="Troubleshoot the macOS SSO extension" icon="bug" href="/en/identity/authentication/troubleshoot-macos-sso">
    Diagnose associated-domain approval and extension loading on a Mac.
  </Card>

  <Card title="MDM connections" icon="tower-broadcast" href="/en/identity/authentication/mdm-connections">
    Set up and manage the connection that makes a device count as managed.
  </Card>

  <Card title="Device trust" icon="laptop" href="/en/identity/authentication/device-trust">
    Require managed, healthy devices as a condition of access.
  </Card>

  <Card title="Installing Iru Access" icon="download" href="/en/identity/end-user/installing-iru-access">
    The end-user walkthrough for setting up Iru Access on a personal device.
  </Card>

  <Card title="Authenticators" icon="key" href="/en/identity/authentication/authenticators">
    How Iru Access fits alongside passkeys as an authenticator.
  </Card>
</CardGroup>