# Iru Configuration

Integrating Iru (previously Kandji) with Twingate to verify macOS devices and enforce requirements for managed device access.

### Business & Enterprise only

Note that our Iru (previously Kandji) integration is limited to the Business and Enterprise product plans. See our [pricing page](/content/pricing/index.html) for more information.

## [background permalink](/content/docs/iru-configuration#background/index.html) Background

Twingate integrates with Iru so that admins can set it as a requirement to sign in to Twingate or access private Resources. When Iru is selected as a trust method within Device Security, it can be incorporated into Security Policies. Only macOS devices that are verified through the Iru integration will be considered to satisfy the Trusted Profile and be allowed to access private Resources.

### [how it works permalink](/content/docs/iru-configuration#how-it-works/index.html) How it works

Twingate integrates with Iru by using the Iru API to pull a list of devices managed under the configured tenant. The Twingate Client returns the device serial number and matches it to the list of serial numbers from Iru. Devices are considered Iru-verified if they meet the following requirements:

- Its serial number is returned by Iru
- Has reported to Iru within the past 7 days
- Has the Iru agent installed
- Has an MDM profile installed
- Has not been removed from Iru

## [generate an api key permalink](/content/docs/iru-configuration#generate-an-api-key/index.html) Generate an API Key

- In the Iru web app, open **Settings** in the left panel
- Click on **Access** in the top bar
- Scroll down to _API Token_ and select **Add Token**
- Type a _Name_ and _Description_ for your token
- Save your _API token_. You’ll need it later

## [configure the api token permalink](/content/docs/iru-configuration#configure-the-api-token/index.html) Configure the API Token

- When the _Manage API Permissions_ modal pops up, click on **Configure**
- Under Devices, select _Device details_ and _Device list_

## [configuring the iru integration in twingate permalink](/content/docs/iru-configuration#configuring-the-iru-integration-in-twingate/index.html) Configuring the Iru integration in Twingate

### [1 in twingate navigate to settings and then select device integration permalink](/content/docs/iru-configuration#1-in-twingate-navigate-to-settings-and-then-select-device-integration/index.html) 1\. In Twingate, navigate to Settings and then select Device Integration

### [2 select connect next to iru and input your iru credentials permalink](/content/docs/iru-configuration#2-select-connect-next-to-iru-and-input-your-iru-credentials/index.html) 2\. Select Connect next to Iru and input your Iru credentials.

Enter your Iru URL with the format `<subdomain>.api.kandji.io` or `<subdomain>.api.eu.kandji.io`

### [3 after the integration is configured the device settings page will show the current status of the integration permalink](/content/docs/iru-configuration#3-after-the-integration-is-configured-the-device-settings-page-will-show-the-current-status-of-the-integration/index.html) 3\. After the integration is configured, the Device Settings page will show the current status of the integration

## [incorporating iru into security policies permalink](/content/docs/iru-configuration#incorporating-iru-into-security-policies/index.html) Incorporating Iru into Security Policies

After the Iru integration has been set up, it can be configured into Device Security Trusted Profiles.

For macOS, create a Trusted Profile and require Iru as a Trust Method. Only devices considered Iru-verified will satisfy the requirements of this Trusted Profile. This Trusted Profile can now be incorporated into Security Policies.

## [troubleshooting permalink](/content/docs/iru-configuration#troubleshooting/index.html) Troubleshooting

After the Iru integration is set up, the Device Settings page will show the status as “Waiting to sync”. During this time, devices may be missing the correct Iru verification state. After a few minutes, the Device Integration page will show the most recent sync time, and devices will correctly show their state on their device details page.

A device can be listed as **Iru not verified** for the following reasons:

- The device is not managed by Iru
- The device has not reported back to Iru within the past 7 days
- The Iru agent has been uninstalled from the device
- The device does not have an MDM profile installed
- The device has been removed from Iru

In the case of a **recoverable error (e.g. the Iru API is unresponsive)**, the Iru integration will show that it has failed to sync and indicate the time of the last successful sync. The Device Settings page will reflect the time of the last successful sync. When we are able to reach the Iru API, the errors will be resolved automatically.

In the case of an **unrecoverable error (e.g. the Iru credentials are no longer valid, have been deleted, or the permissions have been altered)**, the Iru integration will stop attempting to connect. Admins will be notified via email that the Iru integration needs attention. For these errors, we recommend reconfiguring the integration and inputting new API client information.

Last updated 5 months ago.