Iru Integration Guide – Deel

Deel can connect to your Iru tenant so you can view and manage your devices from Deel IT with MDM powered by Iru. This article explains how to prepare Iru, connect it to Deel, and check that your data is syncing.

Before you begin

To set up the Iru integration, you'll need:

An active Iru contract with Deel that includes mobile device management (MDM): MDM, Bundle 1 or Bundle 2, managed or unmanaged
A Deel user with the Manage HR, ATS & SSO apps permission
An Iru user who can create API tokens and set their permissions
To know whether your Iru tenant is hosted in the US or the EU

Your organization can use one MDM provider on Deel at a time. If you currently use MDM powered by JumpCloud, contact your account team before you connect Iru.

Step 1: Prepare Iru

In this section, we'll guide you through getting the two values Deel needs from Iru: your API URL and an API token with the right permissions.

Find your API URL

Your API URL depends on the region where your Iru tenant is hosted:

Region	API URL format
US	yourtenant.api.kandji.io
EU	yourtenant.api.eu.kandji.io

Replace yourtenant with your Iru tenant name. Use the URL for your own region. A URL for the wrong region is the most common reason a connection fails. You can find more information about your API URL in the Iru API Documentation page.

Create an API token and set its permissions

Iru doesn't group permissions into scopes. Instead, you allow each API endpoint (each type of request Deel makes) one by one under the API token's Permissions tab in Iru. The endpoints you need depend on the Iru services you use on Deel. The tables below list the endpoints for MDM powered by Iru.

In Iru, create a new API token.
Open the token's Permissions tab.
Enable the endpoints required for each service (e.g. Deel MDM powered by Iru)
Enable every endpoint in the Required table below, depending on the service.
Enable the endpoints in the Device actions and Device secrets tables if you want to use those features from Deel.
Copy the API token and store it securely. You'll need it in Step 2.

MDM: required device data (14 endpoints)

Area	Method	Endpoint	Used for
Settings	GET	/api/v1/settings/licensing	Checking the connection
Devices	GET	/api/v1/devices	Device list
Devices	GET	/api/v1/devices/{device_id}	Device by ID
Devices	GET	/api/v1/devices/{device_id}/details	Device details
Devices	GET	/api/v1/devices/{device_id}/library-items	Library items on a device
Devices	GET	/api/v1/devices/{device_id}/commands	Command history
Blueprints	GET	/api/v1/blueprints	Blueprint list
Blueprints	GET	/api/v1/blueprints/{blueprint_id}	Blueprint by ID
Blueprints	GET	/api/v1/blueprints/{blueprint_id}/list-library-items	Blueprint library items
Library items	GET	/api/v1/library/library-items/{library_item_id}/status	Status per device
Library items	GET	/api/v1/library/library-items/{library_item_id}/activity	Library item activity
Prism	GET	/api/v1/prism/device_information	Device information
Prism	GET	/api/v1/prism/local_users	Local users
Prism	GET	/api/v1/prism/cellular	Cellular data

MDM: optional device actions (8 endpoints)

Note: enable these endpoints only if you want to send device actions from Deel.

Method	Endpoint	Action
POST	/api/v1/devices/{device_id}/action/lock	Lock device
POST	/api/v1/devices/{device_id}/action/restart	Restart device
POST	/api/v1/devices/{device_id}/action/shutdown	Shutdown
POST	/api/v1/devices/{device_id}/action/setname	Rename device
POST	/api/v1/devices/{device_id}/action/erase	Erase device
POST	/api/v1/devices/{device_id}/action/clearpasscode	Clear passcode
POST	/api/v1/devices/{device_id}/action/unlockaccount	Unlock account
DELETE	/api/v1/devices/{device_id}	Delete device

MDM: optional device secrets (4 endpoints)

Method	Endpoint	Secret
GET	/api/v1/devices/{device_id}/secrets/bypasscode	Activation Lock bypass code
GET	/api/v1/devices/{device_id}/secrets/filevaultkey	FileVault recovery key
GET	/api/v1/devices/{device_id}/secrets/unlockpin	Unlock PIN
GET	/api/v1/devices/{device_id}/secrets/recoverypassword	Recovery lock password

If you leave out an endpoint, the integration stays connected. Only the part of MDM that needs that endpoint shows a message telling you which permission to add. If more Iru services become available on Deel, you won't need a new API token: edit your existing token in Iru and add the endpoints for that service.

Step 2: Connect the integration

In this section, we'll guide you through connecting Deel to Iru.

To connect Iru:

In Deel, go to Apps & Integrations.
Search for and select Iru (Kandji).
Select Connect.
In the wizard, enter your API URL in the API URL field.
Paste your API token in the API token field.
Select Connect.

Deel checks your details with Iru. If they're valid, the integration page shows Iru as connected. If they aren't, you'll see an error explaining the likely cause and your entries are kept so you can correct them. See Troubleshooting below.

Step 3: Open MDM in Deel IT

Once Iru is connected, you can access MDM from the IT section of the navigation menu. Additionally, the Iru integration page in Apps & Integrations shows the Mobile Device Management plugin on the Plugins and settings tab.

If your organization has an active Iru MDM contract: The plugin is enabled. Select it to go to MDM in Deel IT
If your organization has no active Iru MDM contract: The plugin (and the MDM page) will show Speak to Sales. Select it to book a call with your account team. If you think you're seeing this by mistake, contact your Deel IT Customer Operations Manager or Deel Support.

Step 4: Check that data is syncing

Go to MDM in Deel IT and open the Device management tab. Your Iru devices should appear there. Deel refreshes data from Iru every 5 minutes, so changes made in Iru can take a few minutes to show in Deel.

To learn what you can do next, read How to Manage Devices in Deel With MDM Powered by Iru.

Additional settings

Add permissions to your API token

If MDM shows a message that your API token is missing a permission, you don't need to reconnect. Edit the existing API token in Iru, enable the endpoint named in the message, and then retry in Deel.

Disconnect the integration

You need the Manage HR, ATS & SSO apps permission to disconnect Iru. When you disconnect Iru or remove the integration, MDM in Deel IT returns to the connect screen and your Iru data is no longer shown in Deel. Your devices and settings in Iru aren't affected.

Troubleshooting

This section includes solutions to common issues.

The API token is invalid or revoked

Check that you copied the full token and that it hasn't been deleted or revoked in Iru. If needed, create a new token with the permissions in Step 1 and try again.

The API URL isn't recognized

This usually means the URL is for the wrong region. Check whether your Iru tenant is in the US or the EU, and use the matching URL format from Step 1.

The Iru tenant can't be reached

Deel couldn't reach your Iru tenant. Check the API URL for typos and try again in a few minutes. If the issue continues, contact Deel Support.

Part of MDM shows a missing permission message

Your API token is missing the endpoint that part of MDM needs. The message names the permission to add. Add it to the token in Iru, then retry. See Add permissions to your API token.

MDM shows the connect screen after Iru was connected

Your Iru connection is no longer valid, for example because the API token was revoked or the integration was removed. Reconnect Iru by following Step 2. If you were already on an MDM page, you'll see the connect screen the next time you refresh or move to another page.

Iru integration reference

This section describes what the integration supports and its limitations.

Supported regions

Supported operating systems

macOS
iOS and iPadOS
tvOS (Apple TV)
Android
Windows

Available device actions vary by operating system. See How to Manage Devices in Deel With MDM Powered by Iru.

FAQs

Do I need an Iru contract through Deel to connect Iru?

You can connect Iru without one, but MDM in Deel IT is only available with an active Iru contract that includes MDM. Without it, the Mobile Device Management plugin shows Speak to Sales.

Do Iru plans without MDM work with this integration?

No. Iru plans for identity and access management, endpoint detection and response, or vulnerability management alone don't include MDM in Deel.

Is my data stored in my region?

Your Iru tenant stays in its own region. Deel connects to it using the API URL for that region.

Can I use the same API token for other tools?

We recommend creating a dedicated API token for Deel so you can manage or revoke it without affecting other tools.

In this article