Iru

Deploy Stable 0.3.46 (build 1144) with a System Channel Custom Profile and an audit-and-enforce Mac Custom App. Iru was formerly Kandji.

Prepare the pilot

Have administrator access, an enrolled Mac running macOS 14 or later, and the vendor management agent where required. Download the Stable 0.3.46 (1144) Guardian Disabled PKG and complete the required configuration before upload. The completed Silmaril-Managed.mobileconfig has passed validation, and the package is the Stable PKG. Complete the shared profile preparation before creating Library Items.

Install the profile

Create a Custom Profile Library Item, upload Silmaril-Managed.mobileconfig, and choose System Channel. Keep the Mac on its existing base Blueprint. In that Blueprint’s Assignment Map, put the Silmaril profile behind a condition for a dedicated tag such as silmaril. Preserve baseline Library Items outside the condition. Update the existing Library Item when the profile identity already exists. Preserve supplied identifiers, UUIDs, and permission payloads. Keep the Mac Custom App unassigned for the initial pilot. In the profile’s Status and the device’s Activity, confirm InstallProfile completed before assigning the app.

Install the package

Create a Mac Custom App with Package Type Installer Package, upload the 0.3.46 (1144) PKG, choose Audit and enforce, leave restart disabled, and use the Guardian Disabled audit and console-user post-install scripts below. Exit 0 means a matching Guardian Disabled build at or above minimum build 1144 is installed. A nonzero audit result triggers enforcement. The minimum-build check accepts 1144 or newer and prevents downgrade. Assign it to the same Assignment Map condition as the profile, and only after that profile install is confirmed on those Macs. Audit exits 0 for bundle ID dev.silmaril.SilmarilMacOS, Guardian Disabled, and build 1144 or newer. The post-install script opens Silmaril for a signed-in console user above UID 500. With no signed-in user, it exits 0 and the profile opens Silmaril at the next login. A nonzero audit causes Iru enforcement to run. Keep restart disabled. Complete endpoint verification after the package installs.

Verify the pilot

Open Silmaril and verify its identity, managed connection, and fresh Protection activity. Resolve Restart required by fully quitting and reopening the affected agent, then starting a new session.

Expand the rollout

Once the Custom App is assigned behind the silmaril condition, hold app delivery for each later cohort before applying that tag.

Hold the app

In Assignment Map, select the Silmaril Mac Custom App. Expand Manual device exclusions, choose Add device, add each new Mac, and Save. Confirm the app is excluded using the map or device lookup. Leave the profile and baseline items assigned.

Deliver the profile

Add the silmaril tag to that cohort. Confirm InstallProfile completed on every Mac while the app remains excluded.

Release the app

Remove only those Macs from the Custom App exclusions with the X control and Save. Preserve exclusions for other devices. Verify the new cohort before expanding again.

Keep the same tag condition on the existing base Blueprint. A shared condition assigns the profile and app together, so repeat this hold for every cohort. Device exclusions control delivery. Use the removal workflow to uninstall an existing app.

Update or replace policy

Deploy the intended Guardian Disabled version and update the app/package metadata together. Replace the existing profile while preserving supplied identifiers, UUIDs, and permissions. Removing managed keys restores saved local preferences. Verify the updated pilot, then expand with the cohort hold above.

Uninstall

Pause every Silmaril Mac Custom App assignment for the target Macs. Preserve the base Blueprint and baseline Library Items. Run the shared MDM uninstall script as root with the affected user signed in. Retain the JSON receipt and exit code, then follow the shared result handling. Paste the script into the Audit Script field of a Custom Script Library Item. Keep Restart disabled and leave the remediation script empty. Inspect its output. Install once per device retries nonzero results. If an exit 2 receipt confirms app removal and Guardian absence with only permissions remaining, unassign the removal item and complete the permission follow-up. Keep the receipt, since the bundled helper is removed with the app. Remove only the Silmaril profile when policy should stop applying.

Guardian Disabled audit script

Exit 0 means bundle ID dev.silmaril.SilmarilMacOS, Guardian Disabled (SilmarilPrivilegedProtectionEnabled false), and CFBundleVersion greater than or equal to MIN_BUILD. MIN_BUILD is the numeric Stable build 1144. Any other result exits 1.

#!/bin/bash

APP="/Applications/Silmaril.app"
BIN="$APP/Contents/MacOS/Silmaril"
PLIST="$APP/Contents/Info.plist"
EXPECTED_BUNDLE_ID="dev.silmaril.SilmarilMacOS"
MIN_BUILD="1144"
EXPECTED_GUARDIAN_ENABLED="0"

case "$MIN_BUILD" in
  ''|*[!0-9]*) exit 1 ;;
esac

if [[ ! -x "$BIN" || ! -f "$PLIST" ]]; then
  exit 1
fi

bundle_id="$(/usr/libexec/PlistBuddy -c "Print :CFBundleIdentifier" "$PLIST" 2>/dev/null)" || exit 1
installed="$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$PLIST" 2>/dev/null)" || exit 1
guardian="$(/usr/libexec/PlistBuddy -c "Print :SilmarilPrivilegedProtectionEnabled" "$PLIST" 2>/dev/null)" || exit 1

case "$installed" in
  ''|*[!0-9]*) exit 1 ;;
esac

case "$guardian" in
  true) guardian_enabled=1 ;;
  false) guardian_enabled=0 ;;
  *) exit 1 ;;
esac

if [[ "$bundle_id" == "$EXPECTED_BUNDLE_ID" ]] &&
   [[ "$guardian_enabled" == "$EXPECTED_GUARDIAN_ENABLED" ]] &&
   (( 10#$installed >= 10#$MIN_BUILD )); then
  exit 0
fi

exit 1

Console-user post-install script

With no signed-in user, the script exits 0 and the profile opens Silmaril at the next login.

#!/bin/bash

APP="/Applications/Silmaril.app"
[[ -x "$APP/Contents/MacOS/Silmaril" ]] || exit 1

console_uid="$(/usr/bin/stat -f %u /dev/console)" || exit 1
case "$console_uid" in
  ''|*[!0-9]*) exit 1 ;;
esac

# With no signed-in user, the profile opens Silmaril at the next login.
[[ "$console_uid" -gt 500 ]] || exit 0

/bin/launchctl asuser "$console_uid" \
  /usr/bin/sudo -n -H -u "#$console_uid" \
  /usr/bin/open "$APP"

Start

Managed deployment

Configure

Maintain

Prepare the pilot

Install the profile

Install the package

Verify the pilot

Expand the rollout

Update or replace policy

Uninstall

Guardian Disabled audit script

Console-user post-install script

Vendor references

​Prepare the pilot

​Install the profile

​Install the package

​Verify the pilot

​Expand the rollout

​Update or replace policy

​Uninstall

​Guardian Disabled audit script

​Console-user post-install script

​Vendor references

Prepare the pilot

Install the profile

Install the package

Verify the pilot

Expand the rollout

Update or replace policy

Uninstall

Guardian Disabled audit script

Console-user post-install script

Vendor references