Add Iru as a posture provider
Available on: Enterprise
Firezone syncs device inventory and Prism security data from Iru, formerly Kandji. The posture integration evaluates macOS and iOS/iPadOS fields. FileVault, firewall, and several startup security checks apply only to macOS.
Before you begin
Complete the shared prerequisites. You need an Iru administrator who can create API tokens, your tenant's API subdomain and region, and a managed test device. Prism data must be available in your Iru subscription for the checks that depend on it.
Create an API token
- In Iru, open Settings → Access and select Add API Token.
- Give the token a name such as Firezone posture and a description, then create it. Copy the token when shown.
- Configure its permissions using the table below and save them.
- Record the tenant API URL shown under Settings → Access. For
https://acme.api.kandji.io, enteracmeas the Firezone Subdomain. Also note whether your tenant is hosted in the United States or European Union.
The vendor's API token guide covers token creation and permission management.
| Endpoint permission | Evidence supplied |
|---|---|
GET /api/v1/devices | Required device inventory, enrollment, OS version, and last check-in. |
GET /api/v1/prism/device_information | Additional hardware and operating system details. |
GET /api/v1/prism/filevault | FileVault status and key escrow metadata. |
GET /api/v1/prism/application_firewall | Firewall status and settings. |
GET /api/v1/prism/gatekeeper_and_xprotect | Gatekeeper status and XProtect versions. |
GET /api/v1/prism/startup_settings | Secure Boot level, System Integrity Protection, and Signed System Volume. |
GET /api/v1/prism/activation_lock | Activation Lock status. |
Grant the required inventory permission and the Prism permissions for the evidence your Policies need. Firezone does not need device write permissions.
Verification tests access to the device inventory. It can succeed without Prism access. If a Prism endpoint is unavailable or its permission is omitted, its fields remain empty. Removing access also clears previously synced values from that category on the next successful sync of the remaining data.
Add the provider
- In Firezone, open Settings → Device Posture → Add posture provider and select Iru.
- Enter a Name, select the tenant's Region, and enter its Subdomain.
- Paste the token into API Token and select Verify Now.
- After Verified appears, select Create.
- Use Sync Now from the provider's actions menu and wait for Last Synced to update.
- Open your test device's Posture tab. Check both the matched Iru record and the individual Prism fields you intend to require.
Use the Iru Device Trust guide to provision a
certificate-attested inventory ID or serial. Firezone uses the kandji-id
certificate claim for Iru inventory IDs.
Use Iru evidence in Policies
Iru supplies Disk encryption, Firewall enabled, Recently seen, Secure boot and system integrity, OS up to date, and Managed by an MDM. Follow the Policy setup steps to enable them.
For Iru, Secure boot and system integrity requires full Secure Boot, SIP, SSV, and Gatekeeper. Enable both the startup settings and Gatekeeper Prism permissions to supply this evidence. Recently seen uses Iru's device check-in time, rather than Firezone's inventory sync time.
To require FileVault evidence specifically from Iru, use the JSON tab.
{ "field": "iru.filevault_enabled", "op": "is", "value": true }
This field applies to macOS. See the Iru attribute reference for additional fields and platform limits.
Troubleshooting
If verification fails, check the region, API subdomain, token, and permission
to read /api/v1/devices. Use the API subdomain from Iru's Access page.
If devices appear but FileVault or firewall values are missing, check the corresponding Prism permission and subscription access. Then confirm Iru has collected that category for the device and select Sync Now in Firezone.
If a synced record does not appear on the Firezone device, compare the inventory ID and serial with the device's attested identity. Broader platform support in Iru's other products does not expand this posture integration's macOS and iOS/iPadOS applicability.
To replace a revoked token, edit the provider, enter the new token, verify, and save. See provider management for sync status and recovery steps.
Need help? See all support options.