Updated 4 November 2026 · Simon Mestdagh

Kandji customers must upgrade their tenant to Iru by 1 December 2026. Iru's own docs say: "As part of our transition to Iru, Kandji is deprecated. The deadline to upgrade is December 1, 2026." The upgrade takes a few minutes in Settings > Access. Devices, configurations and data stay. What changes for admins is sign-in: your tenant moves to subdomain.iru.com, Standard Authentication becomes a passkey, and SAML, Google and Microsoft SSO connections must be rebuilt with new values. API URLs on api.kandji.io and io.kandji.* identifiers keep working.

TL;DR

• The deadline is 1 December 2026. Start from Settings > Access > Start migration in the Kandji web app.
• Before you start, enable Standard Authentication, sign in with username and password, set up MFA.
• During the upgrade, rebuild each SSO connection (new ACS URL, redirect URL, SSO URL and Entity ID), register a passkey, invite other admins.
• After it, every admin is signed out. Sign in at subdomain.iru.com. End users do nothing; the enrollment portal moves to subdomain.iru.com/enroll.
• API calls to api.kandji.io keep working. Logic that matches the app names "Kandji Agent" or "Kandji Self Service" must change to the Iru names.

What do you have to do before 1 December 2026?

Five steps, in this order. Each row cites Iru's Upgrade to Iru page (read 4 November 2026).

Step	Where	What to do	Risk if skipped
1. Enable Standard Authentication	Kandji web app > Settings > Access > Authentication	Select the ellipsis next to Standard Authentication, then Enable	You can lock yourself out of the tenant if an SSO connection is wrong
2. Sign in with username and password	Log out, then sign in without SSO or social login	Use the password route only	The migration mapping does not show Standard Authentication as Active
3. Set up MFA	Prompted at sign-in	Scan the QR code with a TOTP app, save the recovery code	No fallback sign-in during the move
4. Run the migration	Settings > Access > Start migration	Rebuild SAML, Google and Microsoft connections with new values, register a passkey, invite other admins, Complete migration	Old SSO settings cannot be reused
5. Re-authenticate and test	subdomain.iru.com	Sign in with the passkey, then test each other sign-in method	Admins stay signed out

If you use Active Directory Certificate Services, one more step: uninstall the legacy AD CS Connector on the Windows Server, install the updated Connector from your Iru tenant, and approve its registration.

What changes in sign-in and SSO?

Three things change. First, the tenant domain moves from subdomain.kandji.io to subdomain.iru.com; the old URL shows a "Your tenant has been migrated to Iru" screen with a link. Second, Standard Authentication (username, password, MFA) is converted to a passkey. Third, every SAML, Google and Microsoft connection is replaced by a new one. Iru's doc says "Some configuration details have changed, so you cannot reuse how you configured the connection in Kandji." Either create a new app in your identity provider or update the ACS URLs, Redirect URLs, SSO URLs and Entity IDs.

On a Mac, if the expected passkey does not show up, Iru's doc points to System Settings > Privacy & Security > Passkeys Access for Web Browsers. Turn it on for your browser, then restart the browser.

What stays the same?

Iru's brand update page (branding change dated 8 April 2026) lists what did not change:

Item	Status after the upgrade
Managed devices, configurations, data	Stay with you
API base URL subdomain.api.kandji.io/api/v1	Keeps working; subdomain.api.iru.com/api/v1 also works on migrated tenants
Unified Logging subsystems io.kandji.*	Unchanged; log show predicates still use them
Some bundle identifiers io.kandji.*	Unchanged
Some launchd labels and plist names	Still Kandji-prefixed
Self Service deep links kandji-self-service://	Keep working; new links use iru-self-service://
End users	No action needed

Which scripts, profiles and integrations need a look?

Anything that matches on a display name needs an edit. Anything that matches on an internal identifier or the API host usually does not. Iru's guidance: "If your logic uses user-facing names, update it to Iru names. If your logic uses internal identifiers, verify whether Kandji-prefixed values still apply before changing automation."

Find every reference first:

# All Kandji references in your scripts repo, with line numbers
grep -rni "kandji" /path/to/scripts

# Only display-name matches, the ones most likely to break
grep -rnE "Kandji (Agent|Self Service)" /path/to/scripts

# Old enrollment and web app URLs in docs, runbooks and onboarding mails
grep -rnE "[a-z0-9-]+\.kandji\.io/(enroll)?" /path/to/docs

# API hosts (these keep working, list them for later cleanup)
grep -rn "api\.kandji\.io\|api\.eu\.kandji\.io" /path/to/scripts

On a test Mac, check what the device reports today:

ls /Applications | grep -i -E "kandji|iru"
launchctl list | grep -i kandji
log show --last 1h --predicate 'subsystem BEGINSWITH "io.kandji"' | head

Typical places a name match hides: Extension Attribute-style inventory scripts, Munki or Installomator wrappers, Privacy Preferences (PPPC) profiles that target an app path, onboarding docs that tell new hires to open "Kandji Self Service", and helpdesk macros with kandji.io/enroll links.

Do pricing or packaging change?

Iru's pricing page (read 4 November 2026) does not list prices. It says pricing "is based on the solutions your organization needs, as well as the number of users and devices", contracts are annual and billed annually, and onboarding and migration support are free. Iru now sells six products: Workforce Identity, Endpoint Management, Endpoint Detection & Response, Vulnerability Management, Compliance Automation and Trust Center (Iru newsroom, 22 October 2025). The upgrade page does not say your contract changes. Ask your account team in writing if you need certainty.

What happens if you miss 1 December 2026?

Iru's docs give the deadline and call Kandji deprecated, but as of 4 November 2026 we could not find a published statement on what happens to tenants that have not upgraded by then. Do not assume a grace period. The safe reading: plan the upgrade in a quiet hour this month, with Standard Authentication on, and email support@iru.com if you get stuck.

Frequently asked questions

How long does the Kandji to Iru upgrade take?

Iru says a few minutes, depending on your identity provider and the number of SSO connections. Budget an hour so you can rebuild SSO and test each sign-in method.

Do end users have to do anything?

No. They see a slightly updated sign-in during enrollment and a new enrollment URL, subdomain.iru.com/enroll.

Will my API scripts break?

Not because of the host. subdomain.api.kandji.io keeps working and subdomain.api.iru.com is also accepted. Scripts that match on "Kandji Agent" or "Kandji Self Service" app names do need an update.

Can I reuse my Okta or Google SSO app?

Not as is. Create a new app in the identity provider, or update its ACS URL, Redirect URL, SSO URL and Entity ID to Iru's new values.

Is my Apple MDM setup affected?

Iru says devices, configurations and data stay, and Automated Device Enrollment, profiles and update automation continue. io.kandji.* bundle IDs and logging subsystems are unchanged.

If you are reviewing your Mac setup anyway

Some teams use the upgrade as a moment to check what their MDM does not cover: SaaS accounts and access inside apps. Caspian works next to Iru: you keep Iru for the Macs and Caspian adds the apps, the accounts and who has access to what, including apps without SCIM. If you have no MDM, Caspian manages Macs directly. See every app and laptop for free; acting costs €10 per active user per month excl. VAT.

What does Caspian read, and with which rights?

Seeing is read-only: Caspian reads apps, accounts and devices from the systems you connect, such as Google Workspace, Okta or your MDM. Changing anything (creating an account, removing access) needs write rights that you grant per app, and every change is logged. Caspian was pen-tested by Workstreet in August 2026.

Start for free

Caspian is not affiliated with Iru. Kandji and Iru are trademarks of Iru, Inc., named here only to describe their products. Sources read 4 November 2026: docs.iru.com (Upgrade to Iru; Iru Brand Update), iru.com/pricing, iru.com/kandji-mdm, iru.com/newsroom/kandji-now-iru.

← All resources