Iru (formerly Kandji)

This guide walks through deploying Dev Machine Guard across your macOS fleet using Iru (formerly Kandji). The deployment uses Iru's Custom Script library item to run the loader on a daily schedule, after a short pilot run at higher frequency.

Two separate schedules are involved:

• Iru execution frequency controls how often Iru launches the loader on the device. You set this per library item in Iru, in Step 3 below.
• Scan Schedule controls how often a launch performs a full scan. You set this once for the whole organization in the StepSecurity dashboard, under Settings. Between scans, agent launches check in and exit without scanning.

Changing how often devices are scanned is a StepSecurity dashboard change, not an Iru change. See Adjusting scan frequency below.

The loader script shown in the StepSecurity dashboard is rendered with your tenant's credentials already embedded and should work as-is. If you need to customize the script (alternative install directory, proxy, etc.), reach out to StepSecurity.

Prerequisites

• An Iru tenant with administrative access to Library and Blueprints.
• A Blueprint scoped to the devices you want to enroll in the pilot, and a second Blueprint covering your full fleet for rollout.
• The Dev Machine Guard loader script for your tenant, downloaded from the StepSecurity dashboard (Step 1 below).

Step 1. Copy the loader script

• Sign in to the StepSecurity dashboard.
• In the sidebar, go to Developer Machines → Installation Script.
• On the macOS tab, click the Copy button at the top right of the script editor. (You can alternatively click Download to save the script as a file.)

Step 2. Create a Custom Script in Iru

• In Iru, open Library from the left sidebar.
• Click Add Library Item.
• In the General category, select Custom Script and click Add and configure.

Step 3. Configure the script

• Give the script a descriptive name, for example StepSecurity Dev Machine Guard.
• Under Blueprints, select the Blueprint that targets your pilot devices.
• Under execution frequency, select Every 15 Minutes. You will change this to Run daily after pilot validation in Step 6.
• This setting controls how often Iru launches the loader, not how often the device is scanned. Full scan cadence comes from Scan Schedule in the StepSecurity dashboard, covered in Adjusting scan frequency.
• Leave Self Service disabled.

Step 4. Paste the loader script

• Scroll to the Audit Script section.
• Paste the loader script you copied in Step 1 into the editor.
• Leave the Remediation Script field empty.
• Click Save at the bottom right.

Step 5. Validate on the pilot group

The 15-minute frequency set in Step 3 means each pilot device will run the loader automatically within 15 minutes of receiving the Blueprint. No action is needed on the client devices.

After 15 to 30 minutes, confirm on each pilot device:

• The library item status in Iru shows the script ran successfully.
• The device appears in the StepSecurity dashboard under Developer Machines → Devices with recent telemetry.

Adjusting scan frequency

Once the fleet is rolled out, how often devices run a full scan is controlled from the StepSecurity dashboard, not from Iru.

In the dashboard, go to Developer Machines → Installation → Settings → Scan Schedule and set Full scan every (minutes). The default is a full scan every 4 hours. A human-readable equivalent appears beside the field, so 240 displays as 4 hours. Select Save schedule to apply.

The setting is organization-wide and applies to every device in your tenant. Agents pick up the change on their next check-in, so you do not need to redeploy the loader, regenerate the script, or edit the Custom Script library item in Iru.

To confirm what a specific device is using, open Developer Machines → Devices, select the device, and check Scan Frequency in the Device Information block.

Agents older than 1.15.0 ignore the scan schedule and scan on every launch. Upgrade to 1.15.0 or later for schedule changes to take effect on a device.

Temporary boost

To scan more aggressively for a limited period, for example during an incident, select Add temporary boost on the Scan Schedule panel, set Every (minutes) and an end time, then select Save schedule. The fleet reverts to the regular schedule automatically when the boost ends. To end a boost early, select Remove boost and then Save schedule.

Uninstalling

To stop Dev Machine Guard from running on enrolled devices, either:

• Remove the Custom Script library item from the Blueprint, or
• Remove the device from the Blueprint.

Iru will stop scheduling further loader runs immediately. Any locally installed Dev Machine Guard binary will remain on the device until cleaned up out-of-band; see Devices for guidance.

Troubleshooting

Symptom	Where to look
Iru reports the library item as failed	Iru → Library → the Custom Script item → run history and per-device logs
Iru shows the script as successful but no device data	Confirm the script pasted in Step 4 is the full loader, including the embedded configuration
Devices missing from the StepSecurity dashboard	Confirm the pilot Blueprint covers the expected devices in Iru
Devices scanning less often than expected	Check Scan Frequency on the device in Developer Machines → Devices, then Settings → Scan Schedule. Agents older than 1.15.0 ignore the schedule

For additional support, contact StepSecurity.