Set up Device Trust with Iru (Kandji) on macOS

Complete the Iru (Kandji) setup before deploying these profiles.

Deploy all macOS certificate and VPN profiles through the Device channel, not the User channel. For custom profiles, set PayloadScope to System. Firezone needs the identity in the system Keychain.

Use the shared certificate values for the subject, both URI SANs, key usage, and CA template. Deploy the public CA chain as described in the provider setup before issuing the identity.

Deploy the profiles

Apple requires the certificate identity and Firezone VPN payload to be in the same .mobileconfig file. Use an Iru Custom Profile rather than separate SCEP and VPN Library Items.

Create an unsigned .mobileconfig containing an SCEP payload and a Custom VPN payload. You can use a profile editor to create the file. Use payload types com.apple.security.scep and com.apple.vpn.managed, respectively.
Enter the SCEP URL, CA name, and challenge with values for your CA. Iru's SCEP enrollment supports a static challenge.
Set the subject to CN=dev.firezone.device-trust and add these two URI SAN entries:
```
firezone://kandji-id/$DEVICE_ID
firezone://serial/$SERIAL_NUMBER
```
Set the SCEP key type to RSA, key size to 2048 or 4096, and Key Usage to Signing. Ensure the CA template includes Client Authentication.
Set AllowAllAppsAccess=true and KeyIsExtractable=false in the SCEP payload.
Add accountSlug and any other managed configuration values to the VPN payload's VendorConfig dictionary.

Configure the VPN payload with these values:

Setting	Value
Connection name	`Firezone`
Connection type	Custom VPN (`VPNType=VPN`)
VPN identifier (`VPNSubType`)	`dev.firezone.firezone`
Server address (`VPN.RemoteAddress`)	`127.0.0.1`
Authentication (`VPN.AuthenticationMethod`)	`Certificate`
Identity (`VPN.PayloadCertificateUUID`)	The SCEP payload's `PayloadUUID`

Generate new payload UUIDs. Set VPN.PayloadCertificateUUID to the SCEP payload's PayloadUUID.
In Iru Endpoint, add a Custom Profile Library Item, upload the unsigned .mobileconfig, and assign it to the target Blueprint.
Allow a test Mac to check in. Confirm that the certificate and Firezone VPN configuration were installed together, then connect Firezone.

Iru's global variables populate both SAN entries at deployment. In the SCEP payload's SubjectAltName dictionary, use an array for uniformResourceIdentifier to include both URIs.

On macOS, the SCEP payload must contain AllowAllAppsAccess=true when the key is created. If it was omitted, reissue the identity; updating the profile alone does not repair the key's access control.

Settings supplied through a managed policy, including accountSlug, become read-only in the Firezone Client. Users cannot change those values while the policy is applied.

Verify access and renewal

In Settings → Device Trust, confirm that both SANs contain the test device's inventory ID and serial number, with no unresolved profile variables.

Connect the test Client and open a Resource protected by Require attestation. Test reissuing and redistributing the custom profile before assigning it broadly; the SCEP Library Item's automatic redistribution setting does not configure this custom profile. Preserve the device ID and serial SANs, the fixed common name, and the VPN payload's certificate reference.

Need help? See all support options.