> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Upgrade to Iru
> Upgrade your existing Kandji account to the Iru platform. Follow the migration steps and understand what changes for your team.
Your managed devices, configurations, and data stay with you through the upgrade.
As part of our transition to Iru, Kandji is deprecated. The deadline to upgrade is **December 1, 2026**.
Iru brings Endpoint, Identity, and Compliance together on one platform. It builds on Kandji with a new interface and expanded capabilities. Apple is still our foundation, and a dedicated Apple team continues to grow. After you upgrade, you can also manage Windows and Android devices alongside your Apple fleet.
The upgrade moves your Kandji tenant to Iru's domain and authentication service. See the [Frequently Asked Questions](#frequently-asked-questions) for more.
Logo, app names, and branding on managed devices.
Web app navigation, tenant domain, and relocated pages.
### Before you upgrade
Complete these steps before you start the upgrade. Standard Authentication is the recommended sign-in method so you can finish the upgrade without getting locked out of the tenant. During the upgrade, Standard Authentication is converted to a passkey. After the upgrade is complete, you can configure and test other sign-in methods without losing access.
During the upgrade process, if you get locked out or have any issues, [contact Iru Support](/en/iru/iru-support/access-to-iru-support) immediately for assistance.
Skip this step if Standard Authentication is already enabled.
1. In the Kandji web app, navigate to **Settings**.
2. Select the **Access** tab and find the **Authentication** section.
3. Select the ellipsis next to **Standard Authentication**.
4. Select **Enable**.
5. In the confirmation modal, select **Enable**.
Log out of your Kandji tenant.
Sign in to your Kandji tenant with your username and password. Do not use social login or another SSO option.
Skip this step if you already configured multifactor authentication (MFA) for Standard Authentication.
1. When prompted, scan the registration QR code with a time-based one-time password (TOTP) app, such as Apple Passwords or Google Authenticator.
2. Enter the TOTP code shown in the app.
3. Select **Continue**.
4. Copy your **Recovery Code** and store it in a safe place.
5. Select the **I have safely recorded this code** checkbox.
6. Select **Continue**.
Continue with [Start Upgrade](#complete-the-upgrade).
### Complete the upgrade
These steps walk you through reviewing and reconfiguring your authentication connections, then completing the migration. After it finishes, all active sessions in the Kandji web app will end, including your own, and you will need to re-authenticate with your new configuration. Sign in at your Iru domain, `{{subdomain}}.iru.com`.
When you log in to the Kandji web app, select **Settings** in the left navigation, then select **Access**. You will see a card prompting you to upgrade to unified authentication. Select **Start migration** to begin.
If **Standard Authentication** is not listed as **Active** in the migration mapping, return to [Before you upgrade](#before-you-upgrade) and complete those steps first.
Look over your current authentication setup and configure replacements for SAML, Google, and Microsoft connections. Follow the Iru [Single Sign-On](/en/endpoint/integrations/single-sign-on-integrations/single-sign-on) guides for each connection type. Some configuration details have changed, so you cannot reuse how you configured the connection in Kandji.
You are creating a new SSO connection that will replace your existing one. Either use a new app in your identity provider (IdP) or update all ACS URLs, Redirect URLs, SSO URLs, and Entity IDs to match the new values. If Standard Authentication is not enabled, **incorrect configuration could result in getting locked out of your Iru tenant entirely**.
The migration converts Standard Authentication to a passkey, which replaces your username, password, and MFA. Register a passkey and save it where you can retrieve it when you sign in after the upgrade. Send passkey invitations to other administrators who also use Standard Authentication. For more information, see [Passkeys and Social Login](/en/iru/access/passkeys-and-social-login).
On macOS, if you or another administrator is prompted for a passkey but the expected one is not listed, open **System Settings > Privacy & Security > Passkeys Access for Web Browsers** and turn on access for the browser in use. Then close and re-open that browser and try authenticating again. If a team member is locked out after a reset, see [Iru Account Recovery](/en/iru/access/iru-account-recovery).
You can select **Back** at any time during the upgrade to return to a previous step and make changes.
When finished, select **Continue** to proceed.
Review your settings and select Make changes if needed. When the settings are correct, check the box to confirm, then select **Complete migration** to finish the upgrade.
When the upgrade is complete, all logged-in administrators will be signed out of Kandji and need to re-authenticate with your new configuration. Log in using your new Iru domain at `{{subdomain}}.iru.com`.
If you go to your old Kandji URL (`{{subdomain}}.kandji.io`), you will see a **Your tenant has been migrated to Iru** screen. Select **Login to Iru** to continue to your Iru domain.
If you followed [Before you upgrade](#before-you-upgrade), sign in with the passkey you created and saved during the migration from Standard Authentication. That passkey replaces your username, password, and MFA.
The process typically takes just a few minutes, depending on your identity provider and the number of connections.
After you sign in with your passkey, you can log out and test the other sign-in methods you configured. If a method fails, sign back in with your passkey, update the configuration in **Access** ([**Account Menu Button**](/en/iru/platform-overview/account-menu) → **Access**), and test again. See [SSO Setup](/en/endpoint/getting-started/foundation/sso-setup) and [Passkeys and Social Login](/en/iru/access/passkeys-and-social-login).
If you used **Active Directory Certificate Services (AD CS)** in Kandji, the tenant upgrade does not replace the **legacy** AD CS Connector on your Windows Server. After you sign in to Iru Endpoint, uninstall that Connector on the server, install the **updated** Connector from your **Iru** tenant, and complete registration approval. Follow [Migrating from Kandji to Iru with AD CS](/en/endpoint/integrations/certificate-services/active-directory-certificate-services/active-directory-certificate-services-ad-cs-integration-overview#migrating-from-kandji-to-iru-with-ad-cs) in **AD CS Integration: Overview** for the full workflow, including when the integration may still show **Connected** until you remove the legacy package.
### Frequently Asked Questions
The deadline to upgrade is **December 1, 2026**. The upgrade process is available in **Settings** > **Access** when you log in to the Kandji web app. Follow the [steps above](#before-you-upgrade) to complete the upgrade.
The upgrade process typically takes just a few minutes, depending on your identity provider and the number of connections.
End users do not need to take any action. They will notice a slightly updated sign-in experience during device enrollment and the new enrollment portal domain (`{{subdomain}}.iru.com/enroll` instead of `{{subdomain}}.kandji.io/enroll`).
Email [support@iru.com](mailto:support@iru.com) or [contact Iru Support](/en/iru/iru-support/access-to-iru-support) if you need help with the upgrade process or have questions.
The upgrade process includes a review step where you can confirm your settings before completing the transition.
### Related Articles
After you sign in to Iru, use these articles to see what looks different, where settings and pages moved, and how to finish authentication setup for any additional SSO connections you need.
Logo, app names, and branding on managed devices.
Web app navigation, tenant domain, and relocated pages.
Tenant-wide settings, including Access, at the bottom of the sidebar.
Set up single sign-on for your tenant after the upgrade.
Iru SSO connection guides for Google, Microsoft, Okta, and other identity providers.
Passkeys, social login, and authenticator management.
