Iru (Kandji) Integration

Overview

The Iru (Kandji) integration connects your Iru MDM environment to Fencer for endpoint device inventory, vulnerability detection, and identity management. Once connected, Fencer automatically discovers all managed devices, imports vulnerability detections from Iru’s vulnerability management module, and syncs user identities into Fencer’s identity system. Device scans run daily (weekly on plans without daily scans), keeping your endpoint security posture up to date. In the catalog it is listed as Iru (Kandji).

Prerequisites

• An active Fencer organization with a valid subscription.
• The Administrator role in the Fencer organization.
• An Iru (Kandji) account with API access enabled.
• An Iru API token with the following permissions:
  • Users → List users
  • Users → Get user
  • Vulnerability Management → Detections List
  • Devices → Device list
  • Devices → Device details
  • Devices → Device library items
  • Devices → Device status

How it works

Fencer connects to the Iru API using a bearer token scoped to your Iru tenant. During setup, Fencer validates the token by querying the device, device detail, and vulnerability management endpoints to confirm the required permissions are in place.

Once connected, a background task fetches your full device inventory from Iru and creates corresponding device assets in Fencer. For each device, Fencer queries Iru’s vulnerability management API to retrieve detections matched by device serial number. Devices are tracked with their name, platform, OS version, MDM enrollment status, and agent installation status, plus the hardening signals Iru reports (disk encryption, firewall, screen lock, OS updates, and Blueprint compliance). Subsequent syncs create new devices and update existing ones based on serial number matching. An identity sync also runs automatically, importing Iru user accounts into Fencer’s identity management system.

Usage / Configuration

Generating an Iru API token

1. Log in to your Iru (Kandji) account as an administrator.
2. Navigate to Settings > Access > API Token.
3. Click Generate API Token.
4. Give the token a descriptive name (e.g., “Fencer Integration”).
5. Switch to the Permissions tab and enable the following:
   • Users → List users and Get user
   • Vulnerability Management → Detections List
   • Devices → Device list, Device details, Device library items, and Device status
6. Copy the generated token. You will need it in the next step.
7. Note your Iru subdomain from your account URL (e.g., if your URL is yourcompany.iru.io, your subdomain is yourcompany).

Caution

Store the API token securely. Fencer encrypts and stores the token after you submit the connection form.

Connecting Iru

1. Navigate to Admin > Integrations.
2. Click the Iru (Kandji) card, then click Continue.
3. Fill in the connection form:
   • Name (optional) — a friendly label for this connection. Defaults to the subdomain if left blank.
   • Subdomain — your Iru subdomain (e.g., yourcompany).
   • Use EU API endpoint — enable this if your Iru instance is hosted in the EU region (yourcompany.api.eu.kandji.io).
   • API token — the token you generated in the previous step.
4. Click Connect. Fencer validates the token against the Iru API.
5. On success, Fencer triggers an identity sync and begins discovering devices automatically.

Note

If a connection with the same subdomain was previously removed, reconnecting restores the existing record rather than creating a duplicate.

Editing a connection

1. Navigate to Admin > Integrations.
2. Click Edit on your Iru connection.
3. Update the name, subdomain, region, or API token as needed. Leave the token field blank to keep the existing token.
4. Optionally turn on Assign endpoint owners from Iru to set each device’s owner from the Iru assigned user when that person is a member of your Fencer organization. Owners assigned in Fencer are not overwritten.
5. Click Save changes.

Disconnecting Iru

1. Navigate to Admin > Integrations.
2. Click Remove on your Iru connection, then confirm.
3. Fencer clears the stored API token and soft-deletes the connection. Device syncs and scans stop immediately.

Examples

Device inventory sync

After connecting Iru, Fencer imports all managed devices. Each device record includes:

• Device name and unique device ID
• Platform (macOS, iOS, iPadOS, tvOS)
• OS version
• MDM enabled status
• Agent installed status

You can view your device inventory on Posture > Endpoint. Each device links back to its Iru device page for quick reference.

Vulnerability detections

Fencer pulls vulnerability detections from Iru’s vulnerability management module and associates them with the corresponding device by serial number. These detections feed into Fencer’s vulnerability management pipeline, where you can triage, assign, and track remediation alongside findings from other scanners.

Identity sync

Iru user accounts are synced into Fencer’s identity management system. The sync captures:

• Display name and email address
• Account status (active or archived/deprovisioned)
• Identity type classification

Archived users in Iru are automatically marked as deprovisioned in Fencer.

Troubleshooting

• “Unable to connect to Iru with the provided credentials.” — the API token is invalid, expired, or missing required permissions. Generate a new token in the Iru admin console with all required permissions enabled.
• Devices not appearing — verify the connection is healthy in Admin > Integrations. The initial device sync runs as a background task after connecting; it may take a few minutes for devices to appear.
• EU region errors — if your Iru account is in the EU region, ensure Use EU API endpoint is enabled on the connection form. The US and EU API endpoints are different.
• Identity sync shows fewer users than expected — Fencer imports non-archived user accounts from Iru. Archived users appear as deprovisioned rather than being excluded.

Related pages

• Integrations Overview
• Endpoint Scanning
• Device Inventory
• Identity Management
• Vulnerability Management