{"slug":"deploy-tailscale-with-iru","title":"Deploy Tailscale with Iru","tags":["tailscale"],"agent_summary":"Last validated: Dec 2, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Deploy Tailscale with Iru\r\n\r\nLast validated: Dec 2, 2025\r\n\r\nThis integrationis available for [the Standard, Premium, and Enterprise plans](https://tailscale.com/pricing).\r\n\r\nIru is formerly known as Kandji. Several references to Kandji may still be found in instructions, code examples, and user interfaces.\r\n\r\nYou can use the Iru mobile device management (MDM) solution to deploy Tailscale in your organization. You can use Iru to remotely install the Tailscale client, configure a number of [system policies](https://tailscale.com/docs/features/tailscale-system-policies), and deploy these policies across devices in your organization. Tailscale system policies with Iru are supported on macOS and iOS.\r\n\r\nIf you need help deploying Tailscale using Iru, or would like to suggest any feature enhancements, contact our [support](https://tailscale.com/contact/support#support-form) or [sales](https://tailscale.com/contact/sales) teams.\r\n\r\n## [Deploying Tailscale using Kandji Auto Apps](https://tailscale.com/docs/integrations/mdm/iru\\#deploying-tailscale-using-kandji-auto-apps)\r\n\r\nSee [Deploy Tailscale on macOS using MDM](https://tailscale.com/docs/integrations/mdm/mac) for general best practices and [Approve the Tailscale system extension automatically](https://tailscale.com/docs/integrations/mdm/mac#approve-the-tailscale-system-extension-automatically) to ensure the best end-user experience.\r\n\r\nThe [Auto Apps](https://www.iru.com/products/endpoint/endpoint-management) feature in Kandji lets you automatically install Tailscale on any Mac in your fleet. Optionally, Kandji can also keep track of new Tailscale versions and automatically install them based on rules you define. To get started, follow these steps:\r\n\r\n01. Login to your Kandji admin console at `.kandji.io`.\r\n\r\n02. Select the Library tab, and then add a new item by selecting the **Add Item** button.\r\n\r\n03. Scroll down the page to the **Auto Apps** section. Choose **Tailscale**, then **Add and Configure**, which will add Tailscale to your Kandji library.\r\n ![Choose Tailscale to add to your Kandji library.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-1.a2c45fab.png&w=1080&q=75)\r\n04. Choose one or more blueprints you want Tailscale to be added to. Blueprints are a set of library items and other configurations that can be deployed to a group of devices. For instance, to deploy Tailscale to all devices in your fleet, select the **All Blueprints** option. You can also add additional optional rules to restrict the assignment within the blueprint.\r\n ![Choose the blueprints you want Tailscale to be added to.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-2.398609ef.png&w=1080&q=75)\r\n05. Select an installation method. You can choose to install and continuously enforce the Tailscale installation on devices, or allow your users to install Tailscale on-demand from your Kandji Self Service app.\r\n\r\n06. In the **Enforcement** section, choose whether Kandji should automatically update the Tailscale client for you or not. Refer to [Managing Tailscale updates with Kandji](https://tailscale.com/docs/integrations/mdm/iru#managing-tailscale-updates-with-kandji) later in this topic for more information.\r\n ![Specify whether Kandji should automatically update the Tailscale client.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-3.bc51e13e.png&w=1080&q=75)\r\n07. Turn on the **Notifications** switch to enable notification permissions for the client automatically. This will allow Tailscale to notify your users when their device key is about to expire, if their internet connection is down, or if other actions are required.\r\n\r\n08. Tailscale runs as a menu bar app with no Dock icon, so you can safely uncheck the **Add to Dock during install** option.\r\n\r\n09. Choose **Save** to continue.\r\n\r\n10. The deployment of the Tailscale client will begin according to the options you selected. You can use the **Status** tab to track its status.\r\n ![View the status of the Tailscale deployment.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-4.53840c2b.png&w=1080&q=75)\r\n\r\n### [Managing Tailscale updates with Kandji](https://tailscale.com/docs/integrations/mdm/iru\\#managing-tailscale-updates-with-kandji)\r\n\r\nBy default, Tailscale will automatically update on its own by using the Sparkle framework built into the app. We provide several [system policies](https://tailscale.com/docs/features/tailscale-system-policies) to configure the auto-updater settings, including whether or not these settings are visible to end-users. If you prefer to use the built-in auto-updater in Tailscale, you should choose **Do not manage updates** when setting up Tailscale in the Kandji library.\r\n\r\nIf you prefer to centralize management of your app updates, you might want to have Kandji install updates for you. To enable this, choose either one of the **Automatically enforce new updates** or **Manually enforce a new version** options. Then, set up the following system policy values to ensure the Tailscale auto-updater won't run and won't be visible to users:\r\n\r\n- `SUAutomaticallyUpdate` = `false`\r\n- `SUEnableAutomaticChecks` = `false`\r\n- `ApplyUpdates` = `hide`\r\n\r\n## [Deploying Tailscale system policies using Kandji](https://tailscale.com/docs/integrations/mdm/iru\\#deploying-tailscale-system-policies-using-kandji)\r\n\r\nTailscale [system policies](https://tailscale.com/docs/features/tailscale-system-policies) let you customize the behavior of the Tailscale client on the devices in your fleet. You can force Tailscale to always be enabled, enforce the use of a given exit node, hide specific parts of the user interface, and so on. For more information about the available options, refer to the [system policies topic](https://tailscale.com/docs/features/tailscale-system-policies).\r\n\r\nTo get started deploying Tailscale system policies with Kandji, you'll first need to determine which policies you wish to impose on your devices. Once you know which system policies to impose and the value for each, you'll then need to create an Apple configuration profile (`.mobileconfig` file) to define them, and upload the profile to the Kandji admin console.\r\n\r\n1. Paste the contents of our [configuration profile template](https://tailscale.com/docs/integrations/mdm/mac#deploying-system-policies-in-a-configuration-profile), which provides preset values for the **ManagedByOrganizationName** and **IPAddressCopiedAlertSuppressed** policies into a new XML file called `Tailscale.mobileconfig`. This XML file with the `.mobileconfig` extension will become your configuration profile.\r\n\r\n2. Login to your Kandji admin console at `.kandji.io`.\r\n\r\n3. Select the Library tab, and then add a new item by selecting the **Add Item** button.\r\n\r\n4. Select the **Custom Profile** and then **Add and Configure**.\r\n![Add and configure a custom profile.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-5.ab01887d.png&w=1080&q=75)\r\n5. Assign a descriptive name to the profile. For instance, `Tailscale System Policies for macOS`.\r\n![Assign a name for the profile.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-6.20055dc9.png&w=1080&q=75)\r\n6. Upload the `.mobileconfig` file you previously created to the admin console.\r\n![Upload the .mobileconfig file.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-7.af0770ea.png&w=1080&q=75)\r\n7. Choose **Save**.\r\n\r\n8. The deployment of the system policies will begin according to the options you selected. You can use the **Status** tab to track its status.\r\n![View the status of the system policies deployment.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-8.2dcb67fd.png&w=1080&q=75)\r\n9. Restart the Tailscale client on your devices to ensure the policies are fully applied. If you deployed the **ManagedByOrganizationName** policy, you can quickly verify the success of the deployment by checking a **Managed by CompanyName** menu item in the Tailscale client.\r\n\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Deploy Tailscale with Iru

\n

Last validated: Dec 2, 2025

\n

This integrationis available for the Standard, Premium, and Enterprise plans.

\n

Iru is formerly known as Kandji. Several references to Kandji may still be found in instructions, code examples, and user interfaces.

\n

You can use the Iru mobile device management (MDM) solution to deploy Tailscale in your organization. You can use Iru to remotely install the Tailscale client, configure a number of system policies, and deploy these policies across devices in your organization. Tailscale system policies with Iru are supported on macOS and iOS.

\n

If you need help deploying Tailscale using Iru, or would like to suggest any feature enhancements, contact our support or sales teams.

\n

Deploying Tailscale using Kandji Auto Apps

\n

See Deploy Tailscale on macOS using MDM for general best practices and Approve the Tailscale system extension automatically to ensure the best end-user experience.

\n

The Auto Apps feature in Kandji lets you automatically install Tailscale on any Mac in your fleet. Optionally, Kandji can also keep track of new Tailscale versions and automatically install them based on rules you define. To get started, follow these steps:

\n
    \n
  1. \n

    Login to your Kandji admin console at <companyName>.kandji.io.

    \n
    2. \n
  2. \n

    Select the Library tab, and then add a new item by selecting the Add Item button.

    \n
    3. \n
  3. \n

    Scroll down the page to the Auto Apps section. Choose Tailscale, then Add and Configure, which will add Tailscale to your Kandji library.\r\n\"Choose

    \n
    4. \n
  4. \n

    Choose one or more blueprints you want Tailscale to be added to. Blueprints are a set of library items and other configurations that can be deployed to a group of devices. For instance, to deploy Tailscale to all devices in your fleet, select the All Blueprints option. You can also add additional optional rules to restrict the assignment within the blueprint.\r\n\"Choose

    \n
    5. \n
  5. \n

    Select an installation method. You can choose to install and continuously enforce the Tailscale installation on devices, or allow your users to install Tailscale on-demand from your Kandji Self Service app.

    \n
    6. \n
  6. \n

    In the Enforcement section, choose whether Kandji should automatically update the Tailscale client for you or not. Refer to Managing Tailscale updates with Kandji later in this topic for more information.\r\n\"Specify

    \n
    7. \n
  7. \n

    Turn on the Notifications switch to enable notification permissions for the client automatically. This will allow Tailscale to notify your users when their device key is about to expire, if their internet connection is down, or if other actions are required.

    \n
    8. \n
  8. \n

    Tailscale runs as a menu bar app with no Dock icon, so you can safely uncheck the Add to Dock during install option.

    \n
    9. \n
  9. \n

    Choose Save to continue.

    \n
    10. \n
  10. \n

    The deployment of the Tailscale client will begin according to the options you selected. You can use the Status tab to track its status.\r\n\"View

    \n
    11. \n
\n

Managing Tailscale updates with Kandji

\n

By default, Tailscale will automatically update on its own by using the Sparkle framework built into the app. We provide several system policies to configure the auto-updater settings, including whether or not these settings are visible to end-users. If you prefer to use the built-in auto-updater in Tailscale, you should choose Do not manage updates when setting up Tailscale in the Kandji library.

\n

If you prefer to centralize management of your app updates, you might want to have Kandji install updates for you. To enable this, choose either one of the Automatically enforce new updates or Manually enforce a new version options. Then, set up the following system policy values to ensure the Tailscale auto-updater won't run and won't be visible to users:

\n\n

Deploying Tailscale system policies using Kandji

\n

Tailscale system policies let you customize the behavior of the Tailscale client on the devices in your fleet. You can force Tailscale to always be enabled, enforce the use of a given exit node, hide specific parts of the user interface, and so on. For more information about the available options, refer to the system policies topic.

\n

To get started deploying Tailscale system policies with Kandji, you'll first need to determine which policies you wish to impose on your devices. Once you know which system policies to impose and the value for each, you'll then need to create an Apple configuration profile (.mobileconfig file) to define them, and upload the profile to the Kandji admin console.

\n
    \n
  1. \n

    Paste the contents of our configuration profile template, which provides preset values for the ManagedByOrganizationName and IPAddressCopiedAlertSuppressed policies into a new XML file called Tailscale.mobileconfig. This XML file with the .mobileconfig extension will become your configuration profile.

    \n
    2. \n
  2. \n

    Login to your Kandji admin console at <companyName>.kandji.io.

    \n
    3. \n
  3. \n

    Select the Library tab, and then add a new item by selecting the Add Item button.

    \n
    4. \n
  4. \n

    Select the Custom Profile and then Add and Configure.\r\n\"Add

    \n
    5. \n
  5. \n

    Assign a descriptive name to the profile. For instance, Tailscale System Policies for macOS.\r\n\"Assign

    \n
    6. \n
  6. \n

    Upload the .mobileconfig file you previously created to the admin console.\r\n\"Upload

    \n
    7. \n
  7. \n

    Choose Save.

    \n
    8. \n
  8. \n

    The deployment of the system policies will begin according to the options you selected. You can use the Status tab to track its status.\r\n\"View

    \n
    9. \n
  9. \n

    Restart the Tailscale client on your devices to ensure the policies are fully applied. If you deployed the ManagedByOrganizationName policy, you can quickly verify the success of the deployment by checking a Managed by CompanyName menu item in the Tailscale client.

    \n
    10. \n
\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}