Iru (formerly Kandji)
Proofroom reads Iru (formerly Kandji) through the Iru Endpoint Management API with an API token. Add it on Integrations → Catalogue → Iru (formerly Kandji) → Connect.
What each collector shows
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| Device inventory with encryption | snapshot | monthly | Every managed device with its user, platform, OS version, last check-in and disk encryption (FileVault from Prism for Macs, with a note when the recovery key is not escrowed; iPhones, iPads and Apple TVs show unknown because Iru reports no encryption for them). Devices not encrypted come first. | PCI DSS 12.5.1; SOC 2 CC6.1, CC6.7 |
| Operating system versions | snapshot | monthly | Each device’s OS version against your minimum for its platform, or, with no minimum, the newest version seen on that platform. Without a minimum the evidence shows drift, not patching: the headline says so and PCI DSS 6.3.3 is suggested only once you set minimums. | PCI DSS 6.3.3 (with minimums); SOC 2 CC7.1 |
| Devices not checking in | snapshot | monthly | Devices not seen for 30 days (or the number you set). Their encryption, updates and screen lock can no longer be confirmed. | PCI DSS 12.5.1; SOC 2 CC7.1 |
The connection also takes staleDays (30 by default) and, optionally, minimumOsVersions: one line per
platform, such as macOS 15.6, Windows 10.0.26100 or iOS 18.6. A configured minimum wins over one read from the
system. Without a minimum, a platform is compared with the newest version seen on any of its devices, which shows drift
but not whether a version is still supported.
Disk encryption is mapped to SOC 2 CC6.1 and CC6.7, not to PCI DSS 3.5.1: PCI DSS accepts disk-level encryption for stored card numbers only on removable media (3.5.1.2), so laptop encryption is not evidence for 3.5.1.
The device inventory also feeds the Endpoint coverage built-in (computers without endpoint protection, leavers’ devices), the Endpoints posture score, and a risk suggestion when devices in use are not encrypted (Admin → Risks → Raised automatically).
Iru documents no per-device screen-lock setting, so this connector has no screen-lock collector. Removed devices are left out. Proofroom never calls the FileVault key endpoint.
Create the API token
- In Iru, open Settings → Access (or the account menu → API tokens) and click Add Token. Name it “Proofroom” and copy the token; it is shown once.
- Click Configure on the token and allow only List Devices (Devices) and FileVault (Prism). Save.
- Note your tenant’s API address:
https://<subdomain>.api.kandji.io(US) orhttps://<subdomain>.api.eu.kandji.io(EU).
Connect
| Field | Value |
|---|---|
| Subdomain | acme for acme.api.kandji.io |
| Region | us or eu |
| API token | From step 1 |
staleDays, minimumOsVersions |
See above |
Test connection reads one device and one Prism FileVault row, naming the permission to tick for any that is refused.
Known limits
- UNVERIFIED: the exact names of the two permissions in the token’s grid.
- Iru allows 10,000 requests an hour per tenant; Proofroom reads 300 devices a request.