Iru (Kandji)

Iru (Kandji) is a modern Apple device management platform that provides zero-touch deployment, automated compliance, and intelligent device management for macOS, iOS, and iPadOS. Connecting Iru (Kandji) to Harmony enables automated device provisioning, AI-powered troubleshooting, and seamless endpoint management workflows.

What the Iru (Kandji) Integration Enables

Capability	Description
Device Inventory	Sync all managed Apple devices with real-time status
Compliance Automation	Monitor and enforce security baselines automatically
Remote Actions	Execute lock, restart, and erase commands
Custom Script Deployment	Deploy and manage custom scripts across devices using Kandji's blueprint-based architecture
Connected Peripheral Discovery	Automatically discover monitors and peripherals attached to managed devices
Installed Software Discovery	Surface installed applications across your managed Apple devices in the Applications view

Prerequisites

Before configuring the Kandji integration, ensure you have:

• Kandji Administrator Access: Admin or full access role in Kandji
• API Token: Generated from Kandji settings
• Harmony Account: Active Harmony workspace with integration permissions

Configuration in Kandji

Step 1: Generate API Token

1. Log in to your Kandji tenant at https://[your-tenant].kandji.io
2. Click Access in the left sidebar
3. Click the API tokens tab
4. Click Add Token

Kandji API Token Setup

1. Configure the token:

   • Name: "Harmony Integration"
   • Copy the token immediately (it won't be shown again)
   • Configure Permissions:

     • Blueprint Management: POST + PATCH + GET
     • Users: GET
     • Prism Categories: GET
     • Audit Log: GET
     • Library Items: GET
     • Custom Scripts: POST + PATCH + GET
     • Device Information: GET
     • Device Secrets: FileVault Recovery Key, Unlock PIN
     • Device Actions: Lock, Restart
2. Click Save

Kandji Save API Token

Configuration in Harmony

Step 1: Navigate to Integrations

1. Log in to your Harmony dashboard
2. Go to Settings > Integrations
3. Find Iru (Kandji) and click to Connect

Kandji Harmony Connect

Step 2: Enter API Credentials

Provide the following information:

• Instance name: A friendly name for this connection (e.g., "Kandji Production")
• Base URL: Your Kandji API URL (e.g., https://yourcompany.api.kandji.io)
• API token: The token you generated in Step 1

Click Connect

Kandji API Credentials

What Harmony Syncs from Kandji

• Device Inventory: All managed devices with hardware details, fetched using an efficient paginated approach for fast and reliable syncing even across large device fleets
• Device Status: Online/offline status, last check-in time
• Compliance State: Security compliance and parameter status
• Installed Apps: Applications and versions on each device, surfaced in the Applications view with noise filtered out via an ignore list
• User Information: Assigned user for each device (devices with empty user fields are handled gracefully)
• FileVault Status: Encryption status for Macs
• OS Versions: Current macOS/iOS/iPadOS versions
• Connected Peripherals: Monitors and other hardware attached to managed devices, discovered via osquery-based custom scripts

Custom Script Deployment

Harmony supports deploying custom scripts to your Kandji-managed devices directly from the platform. Kandji's blueprint-based architecture is handled automatically, so your existing blueprints are never modified.

Key capabilities include:

• Automatic blueprint cloning: Harmony clones your existing Kandji blueprints and assigns scripts to the clones, leaving your originals untouched.
• Device-targeted deployment: Scripts can be targeted to specific devices, with Harmony grouping devices by blueprint and managing assignments accordingly.
• Fleet-wide deployment: When no device filter is set, scripts are assigned directly to all blueprints without unnecessary cloning, making deployment faster and more efficient.
• Parallelized API calls: API requests during deployment are parallelized to reduce overall deployment time.
• osquery-based hardware discovery: Custom scripts collect hardware data in an OS-agnostic way, keeping your asset inventory accurate across macOS and other supported platforms.

Installed Software Discovery

Harmony automatically discovers installed software on your Apple devices through the Kandji integration. Harmony fetches the list of applications installed across your managed devices and surfaces them in the Applications view, giving you visibility into your software landscape without any manual effort.

• An ignore list filters out system-level entries and other noise that is not relevant to your software management workflow.
• You can sort applications by user count to quickly identify widely used or underutilized software.

Use Cases

Automated Onboarding

Zero-touch deployment for new employees:

1. New employee record created in HRIS
2. Harmony detects new hire in Engineering
3. Device assigned to "Developer Blueprint" in Kandji
4. Employee receives Mac via mail
5. Device auto-enrolls via Apple Business Manager
6. All apps and settings configured automatically
7. User receives welcome message with setup guide

Compliance Monitoring

Proactive security management:

Scenario: MacBook falls out of compliance

1. Kandji reports FileVault not enabled
2. Harmony detects compliance violation
3. Sends Slack message to user: "Your Mac needs FileVault encryption enabled for security"
4. Provides step-by-step enablement guide
5. Monitors until compliance restored
6. Logs resolution in ticket system

Software Requests

Self-service app deployment:

• User: "I need Figma installed"
• Harmony AI:

  1. Verifies Figma is in Kandji library
  2. Checks user's blueprint permissions
  3. Initiates deployment via Kandji
  4. Monitors installation progress
  5. Confirms with user when complete

Device Troubleshooting

Intelligent endpoint support:

• User: "My Mac is running slowly"
• Harmony queries Kandji for device health
• Identifies issues (low storage, outdated OS)
• Recommends cleanup and updates
• Guides user through resolution
• Verifies performance improvement

Offboarding Automation

Secure device management during exits:

1. Employee offboarding initiated in HRIS
2. Harmony retrieves employee's devices from Kandji
3. Applies "Offboarding" tag to devices
4. Sends notification to manager for device retrieval
5. After confirmation, executes remote lock
6. Schedules full erase after data backup
7. Removes device from Kandji after completion

Troubleshooting

Data & Privacy

Data Handling

• Device data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Harmony caches device metadata; full data remains in Kandji
• User privacy respected per Apple's privacy features
• Data retention configurable based on requirements
• All data processing complies with GDPR and CCPA

Compliance

• GDPR: Full compliance with EU data protection regulations
• CCPA: California privacy law compliance
• SOC 2 Type II: Both Kandji and Harmony maintain certification
• Apple Requirements: Adheres to Apple's device management standards
• Audit Logging: All actions logged for compliance reporting

Access Control

• API token permissions are scoped to required actions only
• Harmony respects Kandji's role-based access control
• Integration can be disabled instantly from Harmony settings
• API token can be revoked immediately in Kandji
• All remote actions require appropriate permissions