Mac Device Management (MDM) and Security Software Designed for the Future of Work

Yes, Kandji integrates with Apple Business Manager to enable streamlined management of iPhone and iPad.

An Identity Provider can do many things, but its primary function is to store and serve as the source of truth for managing your users’ identities (i.e. username and password) throughout their lifecycles. An IdP can also help provide users with authenticated access to company resources and Mac login credentials via Kandji Passport.

Kandji supports macOS Big Sur 11, macOS Monterey 12, macOS Ventura 13, and macOS Sonoma 14.

Kandji uses the most appropriate method for your operating system and includes a variety of technologies behind-the-scenes. Whether you upgrade to a major OS or update to a minor OS version, users will receive the same great experience.

Unified endpoint management (UEM) is a management solution designed to work with a wide range of devices, including Windows computers, Android devices, and Apple devices. UEM is challenging because the various platforms have different release cycles, provisioning systems, and deployment and management methods. UEM systems are architected in a way that serves all platforms but doesn't necessarily use the complete feature set that each provides. Conversely, MDM solutions focus on specific platforms. Kandji utilizes the MDM framework from Apple along with a macOS agent built on SWIFT, which goes beyond MDM’s capabilities to configure and update Apple devices.

Kandji can ensure that data stored on the device is encrypted for all Apple devices. If the device is lost or stolen, an attacker won't be able to access the data without the password (Mac) or passcode (iPhone or iPad). The data is automatically obliterated after a number of failed login attempts. You can disallow iCloud backups, so users can't restore backups that contain corporate data to personal devices. And for iOS and iPadOS devices, you can restrict corporate data to being used only by apps installed by Kandji.

Kandji includes a native macOS agent, written entirely in Swift, extending Apple's MDM framework capabilities. It communicates with Kandji to enforce new policy changes. It can even remediate many policy controls when a device is fully offline.

With Kandji, you can completely block the App Store and still install apps, including those licensed using Apps and Books in Apple Business Manager, those downloaded from Kandji's pre-built Auto Apps library, or your own custom apps. Many companies choose to allow the use of the App Store but restrict the ability to share corporate data with apps that were not deployed by MDM.

Yes, endpoint protection software and VPN clients can be deployed to Apple devices either through the App Store (if applicable) or by using a Custom App library item for Mac devices. Once deployed, the Kandji Agent works to ensure that these apps remain installed.

Kandji has a robust set of pre-built libray items for managing devices that automatically create the necessary configuration profiles, so you don't need to create them manually. You can also upload custom configuration profiles to deploy to your devices.

Settings enforced via configuration profiles are those provided by Apple as part of the MDM framework. Configuration profiles take care of most of the settings administrators choose to enforce. For any not included in the MDM framework, the Kandji Agent for Mac computers extends those capabilities and checks every 15 minutes that additional settings are enforced. Settings enforced by the Kandji Agent can even be remediated fully offline if they change.

Kandji supports managing all Apple operating systems, including macOS, iOS, iPadOS, and tvOS.

Yes, like Kandji, most MDM systems can manage tvOS.

Yes. In Apple Business Manager or Apple School Manager, configure the device to be required to enroll in Kandji. You can even configure Apple Business Manager or Apple School Manager to automatically require all new devices your organization purchases to be enrolled in Kandji. When a user turns on the new device and connects it to the internet, the Setup Assistant on the device will display the Remote Management screen. The user can't use the device until they continue with Setup Assistant and allow the device to enroll in Kandji automatically. You can optionally configure Kandji to require user authentication via credentials from your organization's identity provider (IdP) before the device is allowed to enroll.

Apple or an Apple Authorized Reseller can automatically add those devices to your Apple Business Manager instance when you purchase your devices. You can then automatically assign those devices to your MDM or manually assign them in the Apple Business Manager interface. When a user turns on the new device and connects it to the internet, a Remote Management screen prompts them to enroll in Kandji. The user must continue enrolling into Kandji before the device is usable.

Yes, Kandji supports users enrolling devices through a secure web portal. Apple Business Manager can streamline enrollment into Kandji, but it is not required. To add Mac computers to Apple Business Manager after purchase, use Apple Configurator for iPhone. Add iPhone, iPad, and Apple TV devices to Apple Business Manager using Apple Configurator 2. Apple requires that Mac systems and Apple devices added to Apple Business Manager after the time of purchase are erased and that they have not been provisioned.