Skip to main content
Connect Iru to Oleria to see who your Iru tenant manages devices for, and what administrators and API tokens change in it. Iru, formerly Kandji, is an Apple-first endpoint management platform. Oleria reads its users and its audit log through the Iru API using a read-only API token.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Iru tenant:
  • Accounts - every user that your user directory integrations (such as Okta, Microsoft Entra ID, Google Workspace, or SCIM) bring into Iru, with email, name, department, and job title. A user is shown as disabled when they are inactive or archived, for example after they’re removed from your directory.
  • Activity - the tenant audit log for the past year. That covers:
    • blueprint and library item changes;
    • access to sensitive device data, such as FileVault recovery keys;
    • device enrollment and removal;
    • user directory changes;
    • API token and administrator management.
    Oleria records who made each change but doesn’t import the changed values themselves.
Oleria refreshes this data on its regular sync schedule.
This integration covers your Iru users and audit log. It doesn’t read your devices, blueprints, or library items, so Oleria doesn’t populate Access Inventory or resource-level Access Graph data for Iru. The Iru API doesn’t list Iru administrators or API tokens, so they appear only as the actors in Activity.

​
Prerequisites

  • Access to the Access page in your Iru tenant, where API tokens are created.
  • Admin access on the Oleria platform to add a new integration.

​
Create an API token in Iru

1

Open API tokens

In the Iru web app, open the Account menu and select Access. Go to API Token.
2

Copy your API URL

Note the API URL shown on the page, for example accuhive.api.kandji.io. Tenants in the EU use an address ending in .api.eu.kandji.io.
3

Create the token

Add a token for Oleria and turn on read access for the following. The exact permission names in Iru can differ slightly:Oleria makes no changes in Iru, so it needs no other permissions. Copy the token and store it somewhere safe until you’ve connected Oleria.
All API tokens in an Iru tenant share a rate limit of 10,000 requests per hour. Oleria spaces its requests well below that limit.

​
Connect Iru to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Iru.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria checks that the token can read users and the audit log. Find the newly connected tenant on the Connected tab of your Oleria Integrations page.
If Authenticate fails, Oleria shows the reason:
  • Token rejected - check that you copied an Iru API token and that it hasn’t been revoked.
  • Missing permission - turn on the permission the message names (Users or Audit Log) for the token.
  • Not an Iru API URL - enter the API URL shown on the API Token page.
You can connect each Iru tenant to Oleria once, and you can’t move a connection to a different tenant. To keep the stored token when you edit the integration, leave the API Token field empty.

​
Update a connection made with SCIM

If you connected Iru to Oleria earlier through SCIM, that connection used a SCIM token, which can’t read the Iru API. After this update, its syncs fail with a message asking for an API token. To fix it:
  1. Create an API token with the Users and Audit Log permissions.
  2. In Oleria, edit the Iru integration and paste the new token into API Token. The API URL is kept.
  3. Select Update. The next sync uses the new token.
Groups from the SCIM directory are no longer imported. They’re copies of the groups in your identity provider, which Oleria discovers from the identity provider itself.

​
Verify the integration

Confirm the Iru tenant appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts and activity in your Oleria workspace.

​
Known limitations

  • Iru administrators and API tokens aren’t inventoried. The Iru API doesn’t list them; their changes appear in Activity.
  • No groups or roles. The Iru API has no group or role data.
  • No MFA, SSO or last sign-in data. Your users sign in through your identity provider, so Iru doesn’t report this.
  • No remediation actions. The Iru API’s only user change is deleting a user, which can’t be undone and is reversed by the next directory sync. Remove users in your identity provider instead; Iru follows it.
  • One year of activity. The Iru audit log keeps one year of events.

​
Contact us

For questions about this integration, contact us at support@oleria.com.