How To Distribute Keytos Shield Network Profiles to Your Devices with Iru (formerly Kandji)

Learn how Keytos Shield works with Iru MDM (formerly Kandji) to issue SCEP certificates and push EAP-TLS Wi-Fi profiles, then choose the guide for your device platform.

Overview - How to Distribute Network Profiles to Your Iru Managed Devices

Iru (formerly Kandji) is a device management platform that lets you configure and manage your organization’s devices from a single console.

To connect your Iru managed devices to your Shield-protected network, you push a network profile with Iru. The profile includes the network settings, authentication method, and certificates each device needs to connect to and authenticate with your network. The overall process is the same across device platforms, but each platform has its own steps and settings in Iru.

How Does Distributing Network Profiles via Iru Work?

Pushing a network profile to an Iru managed device takes three pieces to set up trust, encryption, and authentication:

  1. Trusted certificate: Your Shield Root CA certificate is pushed to your devices so they trust your Shield RADIUS servers and the certificates Shield issues. Without it, devices can’t establish a secure connection to your network.
  2. SCEP certificate: Each device requests its own unique certificate from Keytos Shield using the Simple Certificate Enrollment Protocol (SCEP). Iru uses Shield’s static SCEP URL and password to request the certificate on the device’s behalf.
  3. Wi-Fi profile: The Wi-Fi profile tells the device which network to join, to authenticate with EAP-TLS using its SCEP certificate, and which RADIUS servers to trust.

Prerequisites for Distributing Keytos Shield Network Profiles with Iru

Before you begin, make sure you have completed the following:

  1. The Keytos Entra ID applications are registered in your tenant.
  2. You have signed up for a Keytos Shield Plan.
  3. You have existing access policies in Keytos Shield.
  4. You are a Subscription Owner or Network Administrator.
  5. You are an Iru Administrator.

How to Distribute Keytos Shield Network Profiles with Iru by Device Platform

Select the guide for the devices you manage with Iru:

  • Apple devices (macOS, iOS, iPadOS): Push your Shield Root CA and a Wi-Fi Library Item with a SCEP certificate to your Apple devices.
  • Windows devices: Push your Shield Root CA and a Wi-Fi Library Item with a SCEP certificate to your Windows devices.

How to Troubleshoot RADIUS Authentication for Keytos Shield

If your devices can’t connect to your network, refer to our troubleshooting guide.

🔎 Shield RADIUS Troubleshooting Guide