> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MDM connections

> Connect a mobile device management service to Iru Identity so Apple platform devices and Windows PCs can enroll and be recognized as managed for device trust.

An **MDM connection** links Iru to your mobile device management (MDM) service so
devices can enroll and so Iru can recognize them as **managed** in
[device-trust](/en/identity/authentication/device-trust) decisions. You manage
these under **Policies → MDM Connections**.

## Choose a connection type

When you choose **+ MDM Connection**, Iru Identity asks you to **Select a connection type**:

| Type                      | What it does                                                    |
| ------------------------- | --------------------------------------------------------------- |
| **Iru Endpoint Instance** | Pre-populate connection fields from your Iru Endpoint instance. |
| **Custom MDM Connection** | Create a custom MDM connection with manual entry.               |

## Connection settings

A connection has a **display name** and covers one or both platforms:

<Tabs>
  <Tab title="Apple">
    | Setting          | What it is                                                                     |
    | ---------------- | ------------------------------------------------------------------------------ |
    | **APNs topic**   | The Apple Push Notification service topic the MDM uses to reach Apple devices. |
    | **Check-in URL** | The URL Apple devices check in to during and after enrollment.                 |
  </Tab>

  <Tab title="Windows">
    | Setting                   | What it is                                                        |
    | ------------------------- | ----------------------------------------------------------------- |
    | **Provider ID**           | The identifier the MDM presents to Windows during enrollment.     |
    | **Discovery service URL** | The endpoint Windows devices use to discover enrollment settings. |
  </Tab>
</Tabs>

<Tip>
  Not sure where to find these values? Run the **Collect MDM details** helper
  scripts on a device already enrolled in your MDM; the macOS script returns the
  **APNs topic** and **Check-in URL**, and the Windows script returns the
  **Provider ID** and **Discovery service URL**. See
  [Resources](/en/identity/authentication/deploy-iru-access#resources).
</Tip>

## Enrollment profiles

For Apple platforms, download configuration profiles from **Policies → MDM
Connections** in Iru Identity. Click the download button to the left of **+ MDM
Connection**, then choose **macOS Profile** or **iOS Profile**. These configure
**Iru Access** on a managed device (its privacy permissions and single sign-on
extension) for deployment through your MDM; they don't enroll the device into
MDM itself.

## Connection secrets

A connection uses a **client secret** that you can rotate from the connection's
**Client secrets** list:

* **Rotate** issues a new secret while the previous one keeps working for **24
  hours**, so you can update the MDM before the old secret stops. The previous
  secret shows an **Expires Soon** badge until it expires.
* **Invalidate** ends a secret immediately; use it if a secret may have been
  exposed.

## How this relates to device trust

A connected MDM is how Iru can tell that a device is **managed**. Combined with the
health signals the [Iru Access](/en/identity/authentication/device-trust) app
reports, your [authentication policies](/en/identity/authentication/authentication-policies)
can require a known, managed, healthy device before granting access.

## Where to go next

<CardGroup cols={2}>
  <Card title="Device trust" icon="laptop" href="/en/identity/authentication/device-trust">
    Use managed and health signals as conditions in a policy.
  </Card>

  <Card title="Authenticators" icon="key" href="/en/identity/authentication/authenticators">
    How users install and register Iru Access on their devices.
  </Card>
</CardGroup>