*Updated 4 November 2026 · Simon Mestdagh*

Kandji customers must upgrade their tenant to Iru by **1 December 2026**. Iru's own docs say: "As part of our transition to Iru, Kandji is deprecated. The deadline to upgrade is December 1, 2026." The upgrade takes a few minutes in Settings > Access. Devices, configurations and data stay. What changes for admins is sign-in: your tenant moves to `subdomain.iru.com`, Standard Authentication becomes a passkey, and SAML, Google and Microsoft SSO connections must be rebuilt with new values. API URLs on `api.kandji.io` and `io.kandji.*` identifiers keep working.

**TL;DR**

- The deadline is 1 December 2026. Start from Settings > Access > Start migration in the Kandji web app.
- Before you start, enable Standard Authentication, sign in with username and password, set up MFA.
- During the upgrade, rebuild each SSO connection (new ACS URL, redirect URL, SSO URL and Entity ID), register a passkey, invite other admins.
- After it, every admin is signed out. Sign in at `subdomain.iru.com`. End users do nothing; the enrollment portal moves to `subdomain.iru.com/enroll`.
- API calls to `api.kandji.io` keep working. Logic that matches the app names "Kandji Agent" or "Kandji Self Service" must change to the Iru names.

## What do you have to do before 1 December 2026?

Five steps, in this order. Each row cites Iru's [Upgrade to Iru](https://docs.iru.com/en/iru/platform-overview/upgrade-to-iru) page (read 4 November 2026).

| Step | Where | What to do | Risk if skipped |
|---|---|---|---|
| 1. Enable Standard Authentication | Kandji web app > Settings > Access > Authentication | Select the ellipsis next to Standard Authentication, then Enable | You can lock yourself out of the tenant if an SSO connection is wrong |
| 2. Sign in with username and password | Log out, then sign in without SSO or social login | Use the password route only | The migration mapping does not show Standard Authentication as Active |
| 3. Set up MFA | Prompted at sign-in | Scan the QR code with a TOTP app, save the recovery code | No fallback sign-in during the move |
| 4. Run the migration | Settings > Access > Start migration | Rebuild SAML, Google and Microsoft connections with new values, register a passkey, invite other admins, Complete migration | Old SSO settings cannot be reused |
| 5. Re-authenticate and test | `subdomain.iru.com` | Sign in with the passkey, then test each other sign-in method | Admins stay signed out |

If you use Active Directory Certificate Services, one more step: uninstall the legacy AD CS Connector on the Windows Server, install the updated Connector from your Iru tenant, and approve its registration.

## What changes in sign-in and SSO?

Three things change. First, the tenant domain moves from `subdomain.kandji.io` to `subdomain.iru.com`; the old URL shows a "Your tenant has been migrated to Iru" screen with a link. Second, Standard Authentication (username, password, MFA) is converted to a passkey. Third, every SAML, Google and Microsoft connection is replaced by a new one. Iru's doc says "Some configuration details have changed, so you cannot reuse how you configured the connection in Kandji." Either create a new app in your identity provider or update the ACS URLs, Redirect URLs, SSO URLs and Entity IDs.

On a Mac, if the expected passkey does not show up, Iru's doc points to System Settings > Privacy & Security > Passkeys Access for Web Browsers. Turn it on for your browser, then restart the browser.

## What stays the same?

Iru's [brand update page](https://docs.iru.com/en/iru/platform-overview/iru-brand-update) (branding change dated 8 April 2026) lists what did not change:

| Item | Status after the upgrade |
|---|---|
| Managed devices, configurations, data | Stay with you |
| API base URL `subdomain.api.kandji.io/api/v1` | Keeps working; `subdomain.api.iru.com/api/v1` also works on migrated tenants |
| Unified Logging subsystems `io.kandji.*` | Unchanged; `log show` predicates still use them |
| Some bundle identifiers `io.kandji.*` | Unchanged |
| Some launchd labels and plist names | Still Kandji-prefixed |
| Self Service deep links `kandji-self-service://` | Keep working; new links use `iru-self-service://` |
| End users | No action needed |

## Which scripts, profiles and integrations need a look?

Anything that matches on a **display name** needs an edit. Anything that matches on an **internal identifier** or the API host usually does not. Iru's guidance: "If your logic uses user-facing names, update it to Iru names. If your logic uses internal identifiers, verify whether Kandji-prefixed values still apply before changing automation."

Find every reference first:

```bash
# All Kandji references in your scripts repo, with line numbers
grep -rni "kandji" /path/to/scripts

# Only display-name matches, the ones most likely to break
grep -rnE "Kandji (Agent|Self Service)" /path/to/scripts

# Old enrollment and web app URLs in docs, runbooks and onboarding mails
grep -rnE "[a-z0-9-]+\.kandji\.io/(enroll)?" /path/to/docs

# API hosts (these keep working, list them for later cleanup)
grep -rn "api\.kandji\.io\|api\.eu\.kandji\.io" /path/to/scripts
```

On a test Mac, check what the device reports today:

```bash
ls /Applications | grep -i -E "kandji|iru"
launchctl list | grep -i kandji
log show --last 1h --predicate 'subsystem BEGINSWITH "io.kandji"' | head
```

Typical places a name match hides: Extension Attribute-style inventory scripts, Munki or Installomator wrappers, Privacy Preferences (PPPC) profiles that target an app path, onboarding docs that tell new hires to open "Kandji Self Service", and helpdesk macros with `kandji.io/enroll` links.

## Do pricing or packaging change?

Iru's [pricing page](https://www.iru.com/pricing) (read 4 November 2026) does not list prices. It says pricing "is based on the solutions your organization needs, as well as the number of users and devices", contracts are annual and billed annually, and onboarding and migration support are free. Iru now sells six products: Workforce Identity, Endpoint Management, Endpoint Detection & Response, Vulnerability Management, Compliance Automation and Trust Center ([Iru newsroom, 22 October 2025](https://www.iru.com/newsroom/kandji-now-iru)). The upgrade page does not say your contract changes. Ask your account team in writing if you need certainty.

## What happens if you miss 1 December 2026?

Iru's docs give the deadline and call Kandji deprecated, but as of 4 November 2026 we could not find a published statement on what happens to tenants that have not upgraded by then. Do not assume a grace period. The safe reading: plan the upgrade in a quiet hour this month, with Standard Authentication on, and email support@iru.com if you get stuck.

## Frequently asked questions

### How long does the Kandji to Iru upgrade take?
Iru says a few minutes, depending on your identity provider and the number of SSO connections. Budget an hour so you can rebuild SSO and test each sign-in method.

### Do end users have to do anything?
No. They see a slightly updated sign-in during enrollment and a new enrollment URL, `subdomain.iru.com/enroll`.

### Will my API scripts break?
Not because of the host. `subdomain.api.kandji.io` keeps working and `subdomain.api.iru.com` is also accepted. Scripts that match on "Kandji Agent" or "Kandji Self Service" app names do need an update.

### Can I reuse my Okta or Google SSO app?
Not as is. Create a new app in the identity provider, or update its ACS URL, Redirect URL, SSO URL and Entity ID to Iru's new values.

### Is my Apple MDM setup affected?
Iru says devices, configurations and data stay, and Automated Device Enrollment, profiles and update automation continue. `io.kandji.*` bundle IDs and logging subsystems are unchanged.

## If you are reviewing your Mac setup anyway

Some teams use the upgrade as a moment to check what their MDM does not cover: SaaS accounts and access inside apps. Caspian works next to Iru: you keep Iru for the Macs and Caspian adds the apps, the accounts and who has access to what, including apps without SCIM. If you have no MDM, Caspian manages Macs directly. See every app and laptop for free; acting costs €10 per active user per month excl. VAT.

## What does Caspian read, and with which rights?

Seeing is read-only: Caspian reads apps, accounts and devices from the systems you connect, such as Google Workspace, Okta or your MDM. Changing anything (creating an account, removing access) needs write rights that you grant per app, and every change is logged. Caspian was pen-tested by Workstreet in August 2026.

[Start for free](https://getcaspian.io)

*Caspian is not affiliated with Iru. Kandji and Iru are trademarks of Iru, Inc., named here only to describe their products. Sources read 4 November 2026: docs.iru.com (Upgrade to Iru; Iru Brand Update), iru.com/pricing, iru.com/kandji-mdm, iru.com/newsroom/kandji-now-iru.*