{"slug":"restrict-device-access-with-iru","title":"Restrict device access with Iru","tags":["tailscale","access-control","devices"],"agent_summary":"Last validated: Jan 28, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Restrict device access with Iru\r\n\r\nLast validated: Jan 28, 2026\r\n\r\nThis integrationis available for [the Standard, Premium, and Enterprise plans](https://tailscale.com/pricing).\r\n\r\nIru is formerly known as Kandji. Several references to Kandji may still be found in instructions, code examples, and user interfaces.\r\n\r\n[Iru](https://www.iru.com/) collects a series of signals from its agent installed on each device that can be used to determine the security posture of a device. Tailscale can fetch these signals from Iru and use them as device posture attributes in access rules, which can then be used by organizations to grant access to sensitive resources only to devices that have a high level of trust.\r\n\r\nYou can achieve this Tailscale's [device posture management](https://tailscale.com/docs/features/device-posture) features:\r\n\r\n- Kandji posture integration, which synchronizes signals from Kandji to device posture attributes in Tailscale.\r\n- [Device Identity Collection](https://tailscale.com/docs/features/access-control/device-management/how-to/manage-identity), which collects identifiers (for example, serial numbers), used to match devices in Tailscale to devices in Kandji.\r\n- [Posture conditions in access rules](https://tailscale.com/docs/features/device-posture#device-posture-conditions), which enables configuration of access restrictions based on device attributes.\r\n\r\nThis guide explains how to enable Device Identity collection for your Tailscale network (tailnet) and configure Kandji posture integration.\r\n\r\n## [What is Kandji posture integration?](https://tailscale.com/docs/integrations/iru\\#what-is-kandji-posture-integration)\r\n\r\nKandji posture integration lets you connect your Tailscale network to Kandji. The integration runs periodically and copies signals from Kandji to device posture attributes.\r\n\r\nWhen configured, it will periodically:\r\n\r\n- Fetch a list of devices recorded in your Kandji account, and their details.\r\n- Match Kandji devices with corresponding devices in your tailnet, based on the serial number associated with a device.\r\n- Write the data from each device into the following Tailscale device posture attributes:\r\n\r\n| **Attribute key** | **Description** | **Allowed values** |\r\n| --- | --- | --- |\r\n| `kandji:mdmEnabled` | whether the device is enrolled in Iru (Kandji) MDM | `true`, `false` |\r\n| `kandji:agentInstalled` | whether the Iru (Kandji) agent is present on the device | `true`, `false` |\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/iru\\#prerequisites)\r\n\r\nBefore you can set up the Kandji integration, make sure you have:\r\n\r\n- [Device Identity Collection](https://tailscale.com/docs/features/access-control/device-management/how-to/manage-identity) enabled, and devices in your tailnet are reporting identifiers.\r\n- A Kandji account for which you have permission to create an API token.\r\n\r\n## [Create Kandji API Token](https://tailscale.com/docs/integrations/iru\\#create-kandji-api-token)\r\n\r\nTo authenticate your Kandji account with Tailscale, you'll need to create a Kandji API Token.\r\nThe Kandji integration uses these to fetch a list of devices and their data from Kandji.\r\n\r\nTo create a Kandji API Token:\r\n\r\n1. In Kandji, in the left-hand panel, select **Settings**.\r\n\r\n2. From the top menu, select **Access** and select **Add Token**.\r\n\r\n3. Add a name for the API token and select **Create**.\r\n![The Kandji Add an API token dialog](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fkandji-add-token.21763b83.png&w=750&q=75)\r\n4. The **API Token** will be shown once, make sure to copy it for use later and select **Next**.\r\n\r\n5. In the new dialog, select **Configure** to configure the permissions for the API token.\r\n\r\n6. Under **Prism**, select **Device Information** (`/api/v1/prism/device_information`) and select **Save** in the right corner.\r\n\r\n7. Under **Access**, make note of your organization's API URL, for example `https://your-organization.api.kandji.io`.\r\n\r\n\r\n## [Configure Kandji posture integration](https://tailscale.com/docs/integrations/iru\\#configure-kandji-posture-integration)\r\n\r\nTo configure Tailscale to fetch data about devices from Kandji:\r\n\r\n1. Open the [Device management](https://login.tailscale.com/admin/settings/device-management) page of the Tailscale admin console.\r\n\r\n2. Under the **Device Posture Integrations** section, locate the Kandji integration, then select **Connect**.\r\n\r\n3. Enter your **Kandji API URL**, the URL you use to access the Kandji console.\r\n\r\n4. Enter your **API Token**.\r\n![The configuration screen for connecting to Kandji from the Tailscale admin console.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fconfigure-integration.c1346e9c.png&w=1080&q=75)\r\n5. Select **Connect to Kandji**.\r\n\r\n\r\n## [Review the integration status](https://tailscale.com/docs/integrations/iru\\#review-the-integration-status)\r\n\r\nNext, check to ensure the Kandji integration has run successfully.\r\n\r\n1. Go to the **Device Posture Integrations** section of the [Device management](https://login.tailscale.com/admin/settings/device-management) page.\r\n2. Locate the Kandji integration under the **Integrations** section.\r\n\r\nAfter the Kandji integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.\r\n\r\n![Integrations: Kandji: Last sync 4 minutes ago, 1 match between 2 Tailscale devices with identifies and 3 Kandji devices](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fintegration-status.3102473f.png&w=1200&q=75)\r\n\r\n## [Check node attributes](https://tailscale.com/docs/integrations/iru\\#check-node-attributes)\r\n\r\nAfter you set up the Kandji integration, you can confirm that Tailscale is writing the new node attributes for your Kandji devices from the Tailscale admin console.\r\n\r\n1. Open the [Machines](https://login.tailscale.com/admin/machines) page of the Tailscale admin console.\r\n2. Select a device to inspect.\r\n3. The node attributes for the device are in the **Machine Details** section. This should include the set of `kandji:` attributes listed previously.\r\n\r\n![View of the machine attributes in the Machines page.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fmachine-attributes.8a0e285c.png&w=640&q=75)\r\n\r\nYou can also check device attributes using the [Tailscale API](https://tailscale.com/api#tag/devices/GET/device/%7BdeviceId%7D/attributes).\r\n\r\n## [Adjust Tailscale access rules](https://tailscale.com/docs/integrations/iru\\#adjust-tailscale-access-rules)\r\n\r\nAfter you set up the Kandji posture integration, and your devices have device posture attributes that reflect their signals as reported by Kandji, you can use those device posture attributes as part of your posture rules.\r\n\r\nFor example, to only permit access to `tag:production` from devices that have an active Kandji agent, you can create a new posture and use it as part of a corresponding access rule:\r\n\r\n```json\r\n\"postures\": {\r\n \"posture:trusted\": [\\\r\n \"kandji:agentInstalled == true\",\\\r\n ],\r\n},\r\n\"grants\": [\\\r\n {\\\r\n \"src\": [\"autogroup:member\"],\\\r\n \"dst\": [\"tag:production\"],\\\r\n \"ip\": [\"*\"],\\\r\n \"srcPosture\": [\"posture:trusted\"]\\\r\n }\\\r\n]\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n## [Schedule](https://tailscale.com/docs/integrations/iru\\#schedule)\r\n\r\nFor each configured integration, Tailscale will aim to sync device posture\r\nattributes every 15 minutes, with a few exceptions:\r\n\r\n- Adding a new integration, or changing configuration of an existing one,\r\nwill trigger an out-of-schedule sync.\r\n- If an integration fails due to authentication error (usually caused by invalid\r\ncredentials), it will be paused for up to 24 hours.\r\n\r\n## [Audit log events](https://tailscale.com/docs/integrations/iru\\#audit-log-events)\r\n\r\nThe following [audit log events](https://tailscale.com/docs/features/logging/audit-logging#events) are added for device posture.\r\n\r\n| **Target** | **Action** | **Description** |\r\n| --- | --- | --- |\r\n| Integration | Create posture integration | A new posture integration was created |\r\n| Integration | Update posture integration | A posture integration was updated |\r\n| Integration | Removed posture integration | A posture integration was removed |\r\n| Node | Update node attribute | Device posture attributes for a node were changed |\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Restrict device access with Iru

\n

Last validated: Jan 28, 2026

\n

This integrationis available for the Standard, Premium, and Enterprise plans.

\n

Iru is formerly known as Kandji. Several references to Kandji may still be found in instructions, code examples, and user interfaces.

\n

Iru collects a series of signals from its agent installed on each device that can be used to determine the security posture of a device. Tailscale can fetch these signals from Iru and use them as device posture attributes in access rules, which can then be used by organizations to grant access to sensitive resources only to devices that have a high level of trust.

\n

You can achieve this Tailscale's device posture management features:

\n\n

This guide explains how to enable Device Identity collection for your Tailscale network (tailnet) and configure Kandji posture integration.

\n

What is Kandji posture integration?

\n

Kandji posture integration lets you connect your Tailscale network to Kandji. The integration runs periodically and copies signals from Kandji to device posture attributes.

\n

When configured, it will periodically:

\n\n

| Attribute key | Description | Allowed values |\r\n| --- | --- | --- |\r\n| kandji:mdmEnabled | whether the device is enrolled in Iru (Kandji) MDM | true, false |\r\n| kandji:agentInstalled | whether the Iru (Kandji) agent is present on the device | true, false |

\n

Prerequisites

\n

Before you can set up the Kandji integration, make sure you have:

\n\n

Create Kandji API Token

\n

To authenticate your Kandji account with Tailscale, you'll need to create a Kandji API Token.\r\nThe Kandji integration uses these to fetch a list of devices and their data from Kandji.

\n

To create a Kandji API Token:

\n
    \n
  1. \n

    In Kandji, in the left-hand panel, select Settings.

    \n
    2. \n
  2. \n

    From the top menu, select Access and select Add Token.

    \n
    3. \n
  3. \n

    Add a name for the API token and select Create.\r\n\"The

    \n
    4. \n
  4. \n

    The API Token will be shown once, make sure to copy it for use later and select Next.

    \n
    5. \n
  5. \n

    In the new dialog, select Configure to configure the permissions for the API token.

    \n
    6. \n
  6. \n

    Under Prism, select Device Information (/api/v1/prism/device_information) and select Save in the right corner.

    \n
    7. \n
  7. \n

    Under Access, make note of your organization's API URL, for example https://your-organization.api.kandji.io.

    \n
    8. \n
\n

Configure Kandji posture integration

\n

To configure Tailscale to fetch data about devices from Kandji:

\n
    \n
  1. \n

    Open the Device management page of the Tailscale admin console.

    \n
    2. \n
  2. \n

    Under the Device Posture Integrations section, locate the Kandji integration, then select Connect.

    \n
    3. \n
  3. \n

    Enter your Kandji API URL, the URL you use to access the Kandji console.

    \n
    4. \n
  4. \n

    Enter your API Token.\r\n\"The

    \n
    5. \n
  5. \n

    Select Connect to Kandji.

    \n
    6. \n
\n

Review the integration status

\n

Next, check to ensure the Kandji integration has run successfully.

\n
    \n
  1. Go to the Device Posture Integrations section of the Device management page.
    2. \n
  2. Locate the Kandji integration under the Integrations section.
    3. \n
\n

After the Kandji integration runs successfully, it shows the time of the most recent sync, the number of synced devices, and any errors that occurred while synchronizing.

\n

\"Integrations:

\n

Check node attributes

\n

After you set up the Kandji integration, you can confirm that Tailscale is writing the new node attributes for your Kandji devices from the Tailscale admin console.

\n
    \n
  1. Open the Machines page of the Tailscale admin console.
    2. \n
  2. Select a device to inspect.
    3. \n
  3. The node attributes for the device are in the Machine Details section. This should include the set of kandji: attributes listed previously.
    4. \n
\n

\"View

\n

You can also check device attributes using the Tailscale API.

\n

Adjust Tailscale access rules

\n

After you set up the Kandji posture integration, and your devices have device posture attributes that reflect their signals as reported by Kandji, you can use those device posture attributes as part of your posture rules.

\n

For example, to only permit access to tag:production from devices that have an active Kandji agent, you can create a new posture and use it as part of a corresponding access rule:

\n
\"postures\": {\r\n  \"posture:trusted\": [\\\r\n    \"kandji:agentInstalled == true\",\\\r\n  ],\r\n},\r\n\"grants\": [\\\r\n  {\\\r\n    \"src\": [\"autogroup:member\"],\\\r\n    \"dst\": [\"tag:production\"],\\\r\n    \"ip\": [\"*\"],\\\r\n    \"srcPosture\": [\"posture:trusted\"]\\\r\n  }\\\r\n]\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Schedule

\n

For each configured integration, Tailscale will aim to sync device posture\r\nattributes every 15 minutes, with a few exceptions:

\n\n

Audit log events

\n

The following audit log events are added for device posture.

\n

| Target | Action | Description |\r\n| --- | --- | --- |\r\n| Integration | Create posture integration | A new posture integration was created |\r\n| Integration | Update posture integration | A posture integration was updated |\r\n| Integration | Removed posture integration | A posture integration was removed |\r\n| Node | Update node attribute | Device posture attributes for a node were changed |

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}