Secure sensitive resources with hardware-bound device identity for Iru (formerly Kandji)

Iru manages device enrollment, configuration, and policy for your Apple fleet, along with its own security and compliance features. Smallstep adds certificate-based device identity and certificate lifecycle management for authenticating Macs to resources: a certificate authority that issues only to approved devices from your synced inventory, keys generated in the Secure Enclave, and automated renewal and offboarding.

Wi-Fi, VPN, and applications then enforce that identity through EAP-TLS, mutual TLS, VPN certificate authentication, or an identity provider integration.

You create a dedicated API token in Iru under Access, API tokens, with the Device List and Device ID permissions, and give Smallstep that token plus your organization’s API URL. Smallstep runs a partial inventory sync every hour and a full sync every eight hours, and by default new devices need approval in the Smallstep console.

Smallstep then provides the SCEP URL, SCEP challenge, and root certificate fingerprint that you add to Iru as a SCEP Library item. The Connect Iru tutorial walks through each step.

Yes. Kandji announced its rebrand to Iru in October 2025, and existing Kandji tenants connect the same way. Iru is moving tenant and enrollment URLs from kandji.io to iru.com, with a December 1, 2026 upgrade deadline. API endpoints are unchanged: api.kandji.io keeps working and api.iru.com also works, so copy the API URL exactly as your Iru API tokens page shows it.

No. Smallstep’s hosted CA serves the SCEP endpoint directly, and because it is reachable from the public internet, Iru-managed Macs enroll without an NDES server, a Windows CA, or a SCEP proxy on your network.

Workloads that depend on Active Directory, such as domain controller certificates, can stay on AD CS while you move Mac certificates to Smallstep in phases. The AD CS page covers the wider migration.

A static challenge is an enrollment secret shared by every SCEP payload, so on its own it says nothing about which device is asking. Smallstep limits its role accordingly. The SCEP certificate Iru delivers is a provisional identity, tagged with the device ID and its Blueprint, and it is used only to let the Smallstep Agent begin enrollment. Scoping the SCEP profile to the Blueprint you intend to enroll limits who receives the challenge. The credentials that reach Wi-Fi, VPN, and applications are issued afterward, from the device identity the agent establishes with keys in the Secure Enclave.

With MDMs that support dynamic challenges, such as Jamf Pro, Intune, and Workspace ONE, Smallstep uses a unique, single-use challenge per device instead.

Iru distributes the Smallstep Agent as a Custom App installer package, alongside a Custom Profile that carries your team slug and a Login and Background Items entry that keeps the agent running. The configuration profile goes on the same Blueprint as the SCEP profile so the agent can find its enrollment certificate. The agent supports Apple silicon Macs (M1 or later) running macOS 13 or later, installed for a single user, and uses the provisional certificate from the SCEP profile to enroll with your Smallstep team. Intel Macs in your Iru fleet are outside this path.

The agent generates its keys in the Secure Enclave, but agent-based enrollment cannot itself prove to Smallstep that a key resides in a genuine Apple Secure Enclave, so Smallstep classifies those credentials as Smallstep attested. The stronger proof on Apple devices comes from Apple’s Managed Device Attestation through an MDM ACME payload, which Iru can deliver as a Custom Profile; Smallstep documents the setup with Jamf Pro today.

Devices must be assigned to a Blueprint in Iru to sync. Macs outside any Blueprint do not appear in your Smallstep inventory, so they cannot enroll. Synced devices are not approved automatically by default. Your enrollment policy decides whether they wait for an administrator's review or are approved based on their source. Use a dedicated Blueprint to scope a pilot, then widen the assignment as you roll out.

The workflow covers Apple silicon Macs that run the Smallstep Agent. Other devices in your Iru tenant, such as Intel Macs, iPhone, iPad, and Windows or Android devices, are not enrolled through this path.

In the SCEP Library item, you enable automatic profile redistribution and set how many days before expiration Iru should redeploy the profile. Iru defaults to 30 days. That keeps the agent's provisional enrollment certificate from lapsing, while the credentials the agent manages renew on their own shorter schedule.

The agent is what turns the provisional SCEP identity into a Smallstep device identity with keys in the Secure Enclave. It also manages the credentials Macs use for Wi-Fi, SSH, browser TLS, VPN, and identity provider integrations, and renews them in the background. On Iru, the agent is the documented path to all of these.

Many applications cannot use hardware-bound keys directly. For those, the agent issues short-lived provisioned credentials, authenticating to the CA with its own hardware-bound key. Assurance levels vary by application and platform, and Smallstep publishes that matrix in its documentation.

Smallstep issues EAP-TLS client certificates only to approved devices from your synced inventory and can host the RADIUS service or work with your own. On Iru-managed Macs, the Smallstep Agent requests the client certificate with its key in the Secure Enclave, trusts your RADIUS server, and creates the Wi-Fi network profile, which needs the Location permission on macOS. Users join the network without passwords.

Smallstep replaces VPN passwords and exportable certificate files with device-bound credentials. The Smallstep Agent manages IPsec VPN connections directly, though always-on and device-wide VPNs are not yet supported in Smallstep-managed configurations. Smallstep also supports native certificate authentication and RADIUS/EAP-TLS for VPNs based on SSL/TLS and IKEv2. Confirm support for your specific gateway during evaluation.

Smallstep runs a partial sync from Iru every hour and a full sync every eight hours. Once a device drops out of that inventory, Smallstep stops issuing and renewing its credentials, and short certificate lifetimes limit how long existing ones stay useful.

Where you need an immediate cutoff, Advanced Authorities support active revocation through CRL and OCSP, which takes effect only where the relying party, such as your RADIUS server or VPN gateway, checks revocation status.

Yes. Smallstep syncs devices from Iru, Jamf, Intune, Workspace ONE, Fleet, Google Workspace, and other supported MDMs into one inventory, and your authorities and protected resources are defined in Smallstep. Adding or replacing an MDM still takes work: connecting its inventory sync, redeploying bootstrap and configuration profiles, and re-enrolling devices through the new channel. What you avoid is standing up a new certificate authority and new trust anchors for your Wi-Fi, VPN, and applications.

Iru now manages Windows and Android as well as Apple devices, but Smallstep’s Iru integration is documented for macOS. For Windows, Smallstep documents Intune, Workspace ONE, and JumpCloud, and syncs them into the same inventory. Admins can add devices that are not in an MDM, including Linux endpoints, through the Smallstep API, and users can self-register a device with the agent, which by default requires an administrator’s approval. Linux devices with a TPM attest the same way Windows devices do.

Every certificate traces to a device in your inventory and the policy that authorized it, instead of to a shared challenge password. That gives auditors a device-level record of what could reach Wi-Fi, VPN, and internal apps, and supports controls that call for authenticating devices as well as users.

Smallstep's hosted CA is reachable from the public internet, so Macs enroll and renew credentials wherever they are, without a VPN connection back to an on-premises SCEP server.