What exactly is IRU (Kandji)?
When mapping out the IT logistics in our Pre-Boarding Playbook, getting a physical laptop to an employee is only half the battle. Securing that laptop is the true challenge. IRU (formerly known as Kandji) is a cloud-based Mobile Device Management (MDM) platform explicitly designed to secure and manage Apple fleets.
Like its primary competitor, Jamf, IRU utilizes Apple Business Manager to achieve "Zero-Touch Deployment." You can ship a factory-sealed Mac to a new hire, and upon booting it up, IRU automatically installs Identity tools (like Okta), configures VPNs, and locks down the hard drive. However, what makes IRU unique is its underlying philosophy: declarative device management.
The Rebrand Context
You may still hear IT administrators refer to it as Kandji. The rebrand to IRU signals their transition from just "managing Macs" to providing a holistic, intelligent security layer that actively remediates threats in real-time, competing heavily in the endpoint security space.
Interactive: Auto-Remediation in Action
The defining feature of IRU is the "IRU Agent", a small piece of software running on the Mac. If a user tries to disable a security setting (like turning off their firewall), the agent instantly notices and fixes it without IT lifting a finger. Click the button below to see how a Blueprint remediates an unsecure device.
CIS Level 1 Blueprint Enforcement
Watch the IRU Agent autonomously secure a new hire's MacBook.
The Standout IT Features
IRU's rapid rise in market share is driven by its ability to save IT administrators hundreds of hours of mundane scripting.
1. One-Click Compliance Templates
If your company needs to achieve SOC2, HIPAA, or CIS compliance, securing employee laptops is a massive hurdle. In legacy tools, an IT engineer has to write complex bash scripts to enforce these rules. In IRU, administrators simply select a "Blueprint" from a dropdown menu, and over 150 security controls are instantly applied to the onboarding flow.
2. Continuous Auto-Remediation
As demonstrated in the interactive widget above, IRU doesn't just apply settings once during onboarding. The IRU agent runs constantly. If a developer temporarily disables a security setting to test local code and forgets to turn it back on, IRU automatically remediates the setting back to the company standard within minutes.
3. Auto Apps (Patch Management)
Keeping third-party software (like Zoom, Google Chrome, or Slack) updated is a nightmare. Vulnerabilities in outdated browsers are a leading cause of enterprise breaches. IRU's "Auto Apps" feature maintains a library of pre-packaged applications. When Zoom releases an update, IRU automatically pushes it to all employee laptops seamlessly, requiring zero packaging effort from IT.
The Objective Pros & Cons
IRU is a brilliant, agile tool, but organizations must determine if they require agility or absolute, hyper-granular control.
The Pros
- One-click compliance templates (CIS, NIST) drastically reduce implementation time.
- Continuous auto-remediation guarantees devices remain secure post-onboarding.
- Incredibly modern, user-friendly interface compared to legacy MDMs.
- 'Auto Apps' handles third-party software patching effortlessly.
The Cons
- Lacks the hyper-granular, custom scripting depth that massive enterprises rely on Jamf for.
- Strictly focused on Apple devices; managing Windows requires a separate tool (like Intune).
- Recent rebranding from Kandji to IRU may cause temporary internal alignment confusion.
Pricing & Top Alternatives
The Pricing Model: IRU operates on a per-device, per-month subscription model, billed annually. While exact pricing is quote-based, it generally positions itself competitively against Jamf's enterprise tiers. Because it bundles compliance, MDM, and patch management into one platform, the total cost of ownership (TCO) is often lower for mid-market teams.
The Legacy Alternative: Jamf Pro remains the behemoth. If you have thousands of Macs, dedicated IT engineers who love writing custom scripts, and highly complex legacy network requirements, Jamf is still the safest enterprise bet.
The Unified Alternative: If you are tired of buying an HRIS, an Identity Provider, *and* an MDM separately, Rippling offers a native Apple MDM integrated directly into its core HR database. This allows you to orchestrate the *entire* onboarding flow, from signing an offer to locking down the Mac, in one unified system. For a complete landscape overview, visit our Master Comparison Guide.
