> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/integrations/mdm/iru.md).

# Iru

<figure><img src="/files/ZvpTcTop2nXcxxTyTb5a" alt=""><figcaption></figcaption></figure>

### What you get

* **Live device inventory** — every Iru-managed Apple device appears in Siit with model, OS version, serial number, asset tag, and last check-in.
* **Ownership mapping** — Iru's assigned user populates the Siit Equipment owner automatically.
* **One-click actions from any request** — Lock, Wipe, and Open in Iru, directly from the request side panel.
* **Audit trail** — every action triggered from Siit is logged on the request timeline.

### What syncs from Iru

| Fields                                                     |
| ---------------------------------------------------------- |
| Device name, serial number, UDID, Iru device ID, asset tag |
| Model, model identifier, processor, memory, storage        |
| OS (macOS / iOS / iPadOS), OS version, build               |
| Assigned user (email), assignment date                     |
| Enrollment state, blueprint assignment, last check-in time |
| FileVault status, MDM profile installed, management state  |
| Office location (via equipment field mapping)              |

Devices are matched to Siit People using the assigned user's work email.

### Actions available

Available from the request side panel on any device:

* **Lock device** — sends a remote lock command via Iru.
* **Wipe device** — sends a remote wipe command via Iru (irreversible).
* **Open in Iru** — deep-links to the full device record in your Iru console.

> **Heads up** — Wipe is irreversible and immediate. Confirm the device, requester, and context carefully before running it.

### Before you connect

* You'll need an Iru admin account with permission to create an API token.
* Decide on the scope: Siit can sync all devices, or only devices matching specific blueprints or tags.
* Make sure your Iru users have a valid work email on their user record — this is how Siit matches devices to people.

{% hint style="info" %}
The steps below give you the full flow. For screenshots and the detailed walkthrough, see our Help Center guide: [Kandji integration setup](https://help.siit.io/kandji-integration).
{% endhint %}

### Connect Iru

1. In Iru, generate an API token:
   * Go to **Settings → Access → API Token** (in the Iru admin console).
   * Click **Add Token**, name it "Siit integration".
   * Grant the following permissions:
     * **Devices** — Read
     * **Users** — Read
     * **Blueprints** — Read (if you plan to scope by blueprint)
     * **Device Actions: Lock** — Write
     * **Device Actions: Erase** — Write
   * Copy the token — it's shown only once.
2. In Siit, go to **Settings → Integrations**.
3. Find **Iru** in the MDM section and click **Connect**.
4. Enter:
   * Your Iru subdomain (the `yourcompany` part of `yourcompany.api.kandji.io`)
   * The API token
5. Click **Authorize**. Siit verifies the connection and runs an initial device import.
6. Review the imported devices and click **Finish setup**.

> **Tip** — Start with read-only permissions to validate the sync, then add the Lock / Erase action permissions before enabling those actions for agents.

### After the connection

* **Check your Equipment inventory** — go to **Resources → Equipment** and confirm the device count matches your active Iru inventory.
* **Scope the sync** — in **Settings → Integrations → Iru**, narrow the import to specific blueprints or tags if you only want part of the fleet in Siit.
* **Map device types** — confirm Iru computers are mapped to Siit's "Computer" type, iPhones and iPads to "Smartphone" / "Tablet".
* **Try an action** — open any request and run **Open in Iru** from the side panel to confirm the deep link works.

### Sync frequency

Iru device data refreshes automatically every few hours. Trigger an immediate refresh from **Settings → Integrations → Iru → Sync now**. Actions (Lock, Wipe) execute on demand, immediately.

### Common scenarios

* **Lost iPhone.** An employee reports a missing iPhone. The agent sees it in the request side panel (synced from Iru), locks it in one click, and confirms in the Iru console.
* **Offboarding.** An agent wipes a returned MacBook directly from the request, without leaving Siit.
* **Device inventory lookups.** Support agents see the OS version and model for a device during triage, speeding up troubleshooting decisions.

### Troubleshooting

**"Invalid token" on connect.** The token has been revoked or the permissions are missing. Generate a new token in Iru with the required permissions.

**Devices missing from Siit.** Check blueprint / tag scoping in **Settings → Integrations → Iru**, and confirm devices are enrolled and checking in.

**Owner field is empty.** The device has no assigned user in Iru, or the user's email doesn't match a Siit person. Assign a user in Iru and confirm the email is a match.

**Lock / Wipe fails.** The API token is missing the corresponding action permission. Regenerate with Lock and Erase write permissions.

**Open in Iru returns 403.** The admin opening the link doesn't have access to that device in Iru. Check their Iru role.

**Recent action not showing.** MDM commands take a minute to reach offline devices. Check the Iru console for the command's status.