> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/mdm/kandji.md).
# Iru (Kandji)
Iru (Kandji) is a modern Apple device management platform that provides zero-touch deployment, automated compliance, and intelligent device management for macOS, iOS, and iPadOS. Connecting Iru (Kandji) to Harmony enables automated device provisioning, AI-powered troubleshooting, and seamless endpoint management workflows.
### What the Iru (Kandji) Integration Enables
| Capability | Description |
| ------------------------------ | ------------------------------------------------------------------------------------------- |
| Device Inventory | Sync all managed Apple devices with real-time status |
| Compliance Automation | Monitor and enforce security baselines automatically |
| Remote Actions | Execute lock, restart, and erase commands |
| Custom Script Deployment | Deploy and manage custom scripts across devices using Kandji's blueprint-based architecture |
| Connected Peripheral Discovery | Automatically discover monitors and peripherals attached to managed devices |
| Installed Software Discovery | Surface installed applications across your managed Apple devices in the Applications view |
### Prerequisites
Before configuring the Kandji integration, ensure you have:
* **Kandji Administrator Access**: Admin or full access role in Kandji
* **API Token**: Generated from Kandji settings
* **Harmony Account**: Active Harmony workspace with integration permissions
### Configuration in Kandji
#### Step 1: Generate API Token
1. Log in to your Kandji tenant at `https://[your-tenant].kandji.io`
2. Click **Access** in the left sidebar
3. Click the **API tokens** tab
4. Click **Add Token**
5. Configure the token:
* **Name**: "Harmony Integration"
* **Copy the token immediately** (it won't be shown again)
* **Configure Permissions**:
* Blueprint Management: POST + PATCH + GET
* Users: GET
* Prism Categories: GET
* Audit Log: GET
* Library Items: GET
* Custom Scripts: POST + PATCH + GET
* Device Information: GET
* Device Secrets: FileVault Recovery Key, Unlock PIN
* Device Actions: Lock, Restart
6. Click **Save**
### Configuration in Harmony
#### Step 1: Navigate to Integrations
1. Log in to your Harmony dashboard
2. Go to **Settings** > **Integrations**
3. Find **Iru (Kandji)** and click to **Connect**
#### Step 2: Enter API Credentials
Provide the following information:
* **Instance name**: A friendly name for this connection (e.g., "Kandji Production")
* **Base URL**: Your Kandji API URL (e.g., `https://yourcompany.api.kandji.io`)
* **API token**: The token you generated in Step 1
Click **Connect**
### What Harmony Syncs from Kandji
* **Device Inventory**: All managed devices with hardware details, fetched using an efficient paginated approach for fast and reliable syncing even across large device fleets
* **Device Status**: Online/offline status, last check-in time
* **Compliance State**: Security compliance and parameter status
* **Installed Apps**: Applications and versions on each device, surfaced in the Applications view with noise filtered out via an ignore list
* **User Information**: Assigned user for each device (devices with empty user fields are handled gracefully)
* **FileVault Status**: Encryption status for Macs
* **OS Versions**: Current macOS/iOS/iPadOS versions
* **Connected Peripherals**: Monitors and other hardware attached to managed devices, discovered via osquery-based custom scripts
### Custom Script Deployment
Harmony supports deploying custom scripts to your Kandji-managed devices directly from the platform. Kandji's blueprint-based architecture is handled automatically, so your existing blueprints are never modified.
Key capabilities include:
* **Automatic blueprint cloning**: Harmony clones your existing Kandji blueprints and assigns scripts to the clones, leaving your originals untouched.
* **Device-targeted deployment**: Scripts can be targeted to specific devices, with Harmony grouping devices by blueprint and managing assignments accordingly.
* **Fleet-wide deployment**: When no device filter is set, scripts are assigned directly to all blueprints without unnecessary cloning, making deployment faster and more efficient.
* **Parallelized API calls**: API requests during deployment are parallelized to reduce overall deployment time.
* **osquery-based hardware discovery**: Custom scripts collect hardware data in an OS-agnostic way, keeping your asset inventory accurate across macOS and other supported platforms.
### Installed Software Discovery
Harmony automatically discovers installed software on your Apple devices through the Kandji integration. Harmony fetches the list of applications installed across your managed devices and surfaces them in the **Applications** view, giving you visibility into your software landscape without any manual effort.
* An ignore list filters out system-level entries and other noise that is not relevant to your software management workflow.
* You can sort applications by user count to quickly identify widely used or underutilized software.
### Use Cases
Automated Onboarding
Zero-touch deployment for new employees:
1. New employee record created in HRIS
2. Harmony detects new hire in Engineering
3. Device assigned to "Developer Blueprint" in Kandji
4. Employee receives Mac via mail
5. Device auto-enrolls via Apple Business Manager
6. All apps and settings configured automatically
7. User receives welcome message with setup guide
Compliance Monitoring
Proactive security management:
Scenario: MacBook falls out of compliance
1. Kandji reports FileVault not enabled
2. Harmony detects compliance violation
3. Sends Slack message to user: "Your Mac needs FileVault encryption enabled for security"
4. Provides step-by-step enablement guide
5. Monitors until compliance restored
6. Logs resolution in ticket system
Software Requests
Self-service app deployment:
* User: "I need Figma installed"
* Harmony AI:
1. Verifies Figma is in Kandji library
2. Checks user's blueprint permissions
3. Initiates deployment via Kandji
4. Monitors installation progress
5. Confirms with user when complete
Device Troubleshooting
Intelligent endpoint support:
* User: "My Mac is running slowly"
* Harmony queries Kandji for device health
* Identifies issues (low storage, outdated OS)
* Recommends cleanup and updates
* Guides user through resolution
* Verifies performance improvement
Offboarding Automation
Secure device management during exits:
1. Employee offboarding initiated in HRIS
2. Harmony retrieves employee's devices from Kandji
3. Applies "Offboarding" tag to devices
4. Sends notification to manager for device retrieval
5. After confirmation, executes remote lock
6. Schedules full erase after data backup
7. Removes device from Kandji after completion
### Troubleshooting
### Data & Privacy
Data Handling
* Device data encrypted in transit (TLS 1.2+) and at rest (AES-256)
* Harmony caches device metadata; full data remains in Kandji
* User privacy respected per Apple's privacy features
* Data retention configurable based on requirements
* All data processing complies with GDPR and CCPA
Compliance
* **GDPR**: Full compliance with EU data protection regulations
* **CCPA**: California privacy law compliance
* **SOC 2 Type II**: Both Kandji and Harmony maintain certification
* **Apple Requirements**: Adheres to Apple's device management standards
* **Audit Logging**: All actions logged for compliance reporting
Access Control
* API token permissions are scoped to required actions only
* Harmony respects Kandji's role-based access control
* Integration can be disabled instantly from Harmony settings
* API token can be revoked immediately in Kandji
* All remote actions require appropriate permissions
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.harmony.io/integrations/mdm/kandji.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.