MDM powered by Iru lets admins view and manage the devices in their Iru tenant without leaving Deel. You can check fleet health, see the status of the library items deployed to your devices, send remote commands, retrieve device secrets, and match devices to your asset tracker.
In this article
- Who can use MDM powered by Iru
- Overview tab
- Device management tab
- Device actions
- Device secrets
- Library tab
- Event log tab
- Asset tracker
- What you manage in Iru
- Frequently asked questions
Who can use MDM powered by Iru?
MDM powered by Iru is available to organizations that have both:
- An active Iru contract that includes Deel IT mobile device management (MDM)
- A connected Iru integration
The Iru plans that include MDM are MDM, Bundle 1 (MDM, identity and access management, and endpoint detection and response) and Bundle 2 (Bundle 1 plus vulnerability management). Iru plans without MDM do not unlock MDM in Deel.
If Iru is connected but your organization has no active Iru MDM contract, the Mobile Device Management plugin on the Iru integration page shows Speak to Sales. Select it to book a call with your account team.
Your organization can use one MDM provider on Deel at a time: JumpCloud or Iru.
Connecting Iru
To use MDM powered by Iru, you first need to connect your Iru tenant to Deel from Apps & Integrations. You’ll need your Iru API URL, which depends on whether your tenant is hosted in the US or the EU, and an Iru API token with the required permissions. For step-by-step instructions, read the Iru Integration Guide.
Permissions
MDM powered by Iru uses the following permissions:
| Permission | What it gives access to |
|---|---|
| MDM view | The MDM feature |
| MDM devices view | The Device management tab, device list and device side panel |
| MDM devices match sync | Syncing device matches with the asset tracker |
| MDM devices actions manage | All device actions and secrets, except Rename device |
| MDM devices rename | Rename device |
| MDM logs view | The Event log tab |
Overview tab
The Overview tab gives you a quick read on the health of your fleet.
Device counts
- Total devices: All devices in your connected Iru tenant
- New devices: Devices enrolled in the last 30 days, with the percentage change against the previous 30 days
- Offline devices: Devices that haven't checked in within the last hour
Select View all to go to the Device management tab.
Library item deployment status
A summary of the library items deployed to your devices. Statuses roll up into Success, Other and Failed, so you can spot deployment errors quickly.
Fleet distribution
A breakdown of your devices by operating system.
Device management tab
The Device management tab lists every device in your Iru tenant, with data highlights at the top. You can search and filter the list, see which asset each device is matched to, and open a device to see more.
To enroll new devices, select Add devices. This opens your Iru console in a new tab, where enrollment takes place.
Device side panel
Select a device to open its side panel. It has three tabs:
- Details: Device details and specifications
- Library items: The status of each library item on the device
- Activity: The command history for the device
In the Activity tab, you can search and filter commands by status, date and activity type. Filtering isn't available for Windows devices. For a completed command, select View logs to open the device in Iru.
Device actions
You can send remote commands to a device from two places:
- The three-dot menu on the device row in the Device management tab
- The Actions menu in the device side panel
Both places show the same actions. Only the actions available for that device are shown. To send device actions and retrieve device secrets, your Iru API token needs the device action and device secret endpoints listed in the Iru Integration Guide.
Actions by operating system
| Operating system | Available actions |
|---|---|
| macOS | Unlock account, Lock device, Restart device, Shutdown, Rename device, Erase device, Delete device |
| iOS and iPadOS | Clear passcode, Lock device, Restart device, Shutdown, Rename device, Erase device, Delete device |
| tvOS (Apple TV) | Restart device, Rename device, Erase device, Delete device |
| Android | Lock device, Erase device, Delete device |
| Windows | Erase device, Delete device |
How commands work
Every command is queued. A success message means Deel sent the command to Iru, not that the device has completed it. The device runs the command the next time it checks in. To confirm a command ran, check the Activity tab in the device side panel.
If the device hasn't checked in recently, you can still send the command. It runs the next time the device connects.
When actions are hidden
- The device isn't under MDM management: Only Rename device, Delete device and the device secrets are available
- The device already has a pending command: Only Delete device and the device secrets are available. Wait for the pending command to run before you send a new one
Confirmations
The confirmation step depends on how hard the action is to undo:
- Unlock account, Restart device and Rename device: Select Confirm
- Clear passcode, Lock device and Shutdown: Tick the confirmation checkbox, then select Confirm
- Erase device and Delete device: Type the device name, then select Confirm. These actions can't be undone
When you erase a Mac, an unlock PIN is created as soon as you send the command, even while the command is still pending. You can retrieve it straight away with Get unlock PIN in the Actions menu.
Device secrets
You can retrieve four device secrets from the Actions menu in the device side panel:
- Activation Lock bypass code
- FileVault recovery key
- Unlock PIN
- Recovery lock password
Retrieving a secret doesn't send anything to the device. The value opens in a window with a copy option.
Library tab
The Library tab shows your Iru blueprints and the library items deployed to your devices, with the status of each item per device. The Library tab is read-only. To create or change blueprints and library items, use your Iru console.
Event log tab
The Event log tab lists the requests Deel sent to Iru for your organization, most recent first. It shows events triggered from Deel only. Actions taken directly in your Iru console don't appear here.
For each event, you can see:
- Timestamp: When the request was made
- Status: Info, Success or Error
- Operation ID: The unique identifier of the request
- Description: The request and its result
- Actor: The email of the person who triggered it, or System if Deel triggered it
You can search events, filter by status and date range, and select Details to see the full event. If you contact Deel Support about an event, share its Operation ID.
Asset tracker
If you use Deel's hardware services, Deel automatically matches your Iru devices to your asset tracker by serial number. When an asset matches an Iru device:
- The asset shows as enrolled in the MDM enrollment column of the asset tracker
- The Device health and security tab on the asset details shows the status of the Iru library items on the device
- You can trigger device actions from the Device health and security tab
You can also see the matched asset for each device in the Device management tab.
What you manage in Iru
Some tasks stay in your Iru console:
- Enrolling devices
- Creating and editing blueprints and library items
- Any setting not shown in Deel
Frequently asked questions
How often is device data updated?
Deel refreshes data from Iru every 5 minutes, so a change made in Iru, such as a device's status, can take a few minutes to show in Deel.
I sent a command but the device hasn't changed. What should I do?
Commands are queued and run the next time the device checks in. Open the device side panel and check the Activity tab to see whether the command is still pending.
Why can't I see an action for a device?Actions are shown only when they're available for that device. An action can be hidden because of the device's operating system, because the device isn't under MDM management, because a command is already pending, or because you don't have the right permission.
Can I use MDM powered by JumpCloud and MDM powered by Iru at the same time?
No. Your organization can use one MDM provider on Deel at a time.
Why does MDM show the connect screen again?
Your Iru connection is no longer valid, for example because the API token was revoked or the integration was removed. Reconnect Iru by following the Iru Integration Guide.
Can I edit blueprints or library items from Deel?
No. The Library tab is read-only. Make changes in your Iru console.
I have an Iru bundle. Why do I only see MDM in Deel?
MDM powered by Iru covers device management. The other parts of your Iru bundle, such as identity and access management and endpoint detection and response, are available in your Iru console.
Does connecting Iru change anything on my devices?
No. Deel reads your device data from Iru. Nothing is sent to a device until an admin sends a device action from Deel.
Do actions taken in the Iru console show in Deel?
Device commands show in the Activity tab of the device side panel, wherever they were sent from. The Event log tab lists only requests sent from Deel.
Why isn't a device matched to an asset?
Deel matches devices to assets by serial number. Check that the asset exists in your asset tracker and that its serial number matches the device's serial number in Iru.
What should I do if a device is lost or stolen?
Use Lock device to lock it remotely, or Erase device to remove its data. Both run the next time the device connects. For iPhone and iPad, Lost Mode is also available in your Iru console.