Secure Iru (formerly Kandji) with cnspec

Scan your Iru (formerly Kandji) tenant to find security risks across your managed Apple fleet. cnspec evaluates the device inventory, FileVault status and recovery key escrow, OS versions, enrollment and MDM state, configuration blueprints, the custom library catalog of custom apps, profiles, and scripts, installed applications and configuration profiles, per-device compliance parameters, and the tenant directory of end users.

New to cnspec? Start with the quickstart.

Prerequisites

To scan an Iru tenant with cnspec, you must have:

• cnspec installed on your workstation
• An Iru tenant with administrator access to create an API token
• Your tenant subdomain. It is the first label of your API host, so a tenant served at https://lunalectric.api.kandji.io has the subdomain lunalectric.

Give cnspec access using an Iru API token

To scan your tenant, cnspec needs access through the Iru API. You create an API token in the Iru admin console, grant it read permissions for the data you want to scan, then provide the token and your subdomain when running cnspec commands.

1. In the Iru admin console, go to Settings in the left nav, open the API tab, and select Add Token.
2. Enter a name and description, then select Create.
3. Copy the token and select Next. Record the token now; it is shown only once. Also note your tenant subdomain (for example, lunalectric).
4. Select Configure to manage the token's permissions. Enable the Get operations for the data you want to scan, such as devices and device details, blueprints, the library, and users. To let cnspec read your full tenant, enable all Get operations. Select Save when you finish. The token's per-endpoint permissions determine which resources return data.

To test access, open a cnspec shell and verify the connection:

cnspec shell iru --subdomain lunalectric --token YOUR_API_TOKEN

cnspec> iru.devices.length
iru.devices.length: 42

You can also set environment variables to omit the flags:

export IRU_SUBDOMAIN='lunalectric'
export IRU_TOKEN='YOUR_API_TOKEN'
cnspec shell iru

Scan Iru

To scan your Iru tenant:

cnspec scan iru --subdomain lunalectric --token YOUR_API_TOKEN

Understand scan output

When a scan completes, cnspec prints a summary of all the checks it ran, grouped by policy. Each check shows a pass or fail result. For example:

✓ Pass:  Ensure FileVault is enabled on all devices
✕ Fail:  Ensure FileVault recovery keys are escrowed
✓ Pass:  Ensure all devices run a supported macOS version

At the end of the output, cnspec shows a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To output results in other formats such as JSON, JUnit, or SARIF, read Report Results.

Scan with a custom policy

You can write your own policies to evaluate Iru against your specific security and compliance requirements. Pass a policy bundle directly to cnspec:

cnspec scan iru --subdomain lunalectric --token YOUR_API_TOKEN \
  --policy-bundle ./my-iru-policy.mql.yaml

Explore your Iru environment

Run cnspec shell iru --subdomain lunalectric --token YOUR_API_TOKEN to open the interactive shell.

Query the device inventory

cnspec> iru.devices { name osVersion platform filevaultEnabled }
iru.devices: [
  0: {
    name: "Suki's MacBook Pro"
    osVersion: "26.3.1"
    platform: "Mac"
    filevaultEnabled: true
  }
  ...
]

Audit configuration blueprints

cnspec> iru.blueprints { name computersCount }
iru.blueprints: [
  0: {
    name: "Corporate Macs"
    computersCount: 128
  }
  ...
]

Review the custom library

cnspec> iru.libraryItems { name kind active }

List end users

cnspec> iru.users { name email department }

Example security checks

Ensure FileVault is enabled on all devices

cnspec> iru.devices.all( filevaultEnabled )

Ensure FileVault recovery keys are escrowed

cnspec> iru.devices.all( filevaultRecoveryKeyEscrowed )

Ensure the Iru agent is installed on all devices

cnspec> iru.devices.all( agentInstalled )

Find devices that have not checked in recently

cnspec> iru.devices.where( lastCheckIn < time.now - 30*time.day ) { name lastCheckIn }

Find custom scripts in the library

cnspec> iru.libraryItems.where( kind == "custom-script" ) { name active }

Ensure supervised devices only

cnspec> iru.devices.all( supervised )

Go further with Mondoo Platform

To continuously scan your Iru environment and track posture over time, register cnspec with Mondoo Platform.

Learn more

• To learn more about how the MQL query language works, read Write Effective MQL.

• To learn about all the Iru resources and properties you can query, read the Mondoo Iru Resource Pack Reference.