> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MDM connections

> Connect a mobile device management service to Iru Identity so Apple platform devices and Windows PCs can enroll and be recognized as managed for device trust.

An **MDM connection** links Iru to your mobile device management (MDM) service so
devices can enroll and so Iru can recognize them as **managed** in
[device-trust](/en/identity/authentication/device-trust) decisions. You manage
these under **Policies → MDM Connections**.

## Choose a connection type

When you add a connection, you pick how to set it up:

| Type                      | What it does                                                                                              |
| ------------------------- | --------------------------------------------------------------------------------------------------------- |
| **Iru Endpoint Instance** | Pre-populates the connection fields from your Iru Endpoint instance, so there is little to enter by hand. |
| **Custom MDM Connection** | Lets you enter the connection details manually for another MDM.                                           |

## Connection settings

A connection has a **display name** and covers one or both platforms:

<Tabs>
  <Tab title="Apple">
    | Setting          | What it is                                                                     |
    | ---------------- | ------------------------------------------------------------------------------ |
    | **APNs topic**   | The Apple Push Notification service topic the MDM uses to reach Apple devices. |
    | **Check-in URL** | The URL Apple devices check in to during and after enrollment.                 |
  </Tab>

  <Tab title="Windows">
    | Setting                   | What it is                                                        |
    | ------------------------- | ----------------------------------------------------------------- |
    | **Provider ID**           | The identifier the MDM presents to Windows during enrollment.     |
    | **Discovery service URL** | The endpoint Windows devices use to discover enrollment settings. |
  </Tab>
</Tabs>

<Tip>
  Not sure where to find these values? Run the **Collect MDM details** helper
  scripts on a device already enrolled in your MDM to read them off - the macOS
  script returns the **APNs topic** and **Check-in URL**, and the Windows script
  returns the **Provider ID** and **Discovery service URL**. See
  [Resources](/en/identity/authentication/deploy-iru-access#resources).
</Tip>

## Enrollment profiles

For Apple platforms, you can **download configuration profiles** (macOS and iOS)
from the connection. These configure **Iru Access** on a managed device - its
privacy permissions and single sign-on extension - for deployment through your
MDM; they don't enroll the device into MDM itself.

## Connection secrets

A connection uses a **client secret** that you can rotate from the connection's
**Client secrets** list:

* **Rotate** issues a new secret while the previous one keeps working for **24
  hours**, so you can update the MDM before the old secret stops. The previous
  secret shows an **Expires Soon** badge until it expires.
* **Invalidate** ends a secret immediately - use it if a secret may have been
  exposed.

## How this relates to device trust

A connected MDM is how Iru can tell that a device is **managed**. Combined with the
health signals the [Iru Access](/en/identity/authentication/device-trust) app
reports, your [authentication policies](/en/identity/authentication/authentication-policies)
can require a known, managed, healthy device before granting access.

## Where to go next

<CardGroup cols={2}>
  <Card title="Device trust" icon="laptop" href="/en/identity/authentication/device-trust">
    Use managed and health signals as conditions in a policy.
  </Card>

  <Card title="Authenticators" icon="key" href="/en/identity/authentication/authenticators">
    How people install and register Iru Access on their devices.
  </Card>
</CardGroup>