KBY Technologies Logo
KBY Recommended Tools

Independent decision guide

Jamf vs Kandji (now Iru) for managing Macs

Jamf Pro and Kandji, now Iru Endpoint Management, compared for managing Macs at work: pricing model, Apple platform coverage, compliance benchmarks, security add-ons, scripting and hosting, with a clear verdict.

Checked against vendor documentation on 8 November 202620 vendor sources listedNo paid placement

KBY decision summary

The short answer

Choose Jamf Pro for large or complex Apple estates that need deep scripting, extension attributes, on-premises hosting or the widest Apple platform coverage. Choose Iru (formerly Kandji) for a faster, more opinionated setup with Blueprints, Library Items and Auto Apps, and for mixed fleets: Iru now also manages Windows and Android. Iru's documentation says Kandji is deprecated and existing customers must upgrade to the Iru platform by 1 December 2026, so plan that migration whichever way you go.

At a glance

Jamf vs Kandji (Iru): side by side

FeatureJamf ProIru (formerly Kandji)
PricingJamf for Mac (Jamf Pro, Connect and Protect) $12.50 per Mac per month; Jamf for Mobile $5.75 per mobile device per month. Billed annually, 25-device minimum, Jamf Cloud only. Jamf Now from $4 per device per month for under 25 employees.Quote only, based on the products bought and the number of users and devices. Annual contracts, billed annually.
Free trial14 days14 days
PlatformsmacOS, iOS, iPadOS, tvOS, visionOS and watchOS. The Jamf for Mobile bundle also lists Android.macOS, iOS, iPadOS, tvOS and visionOS, plus Windows 11 and Android
Automated Device EnrollmentYes, through PreStage enrollmentsYes
New macOS releasesSame-day support (vendor claim)Day-zero support (vendor claim)
Configuration modelPolicies, scripts, Smart Groups and extension attributes; declarative Blueprints in Jamf CloudBlueprints and Assignment Maps of Library Items: profiles, custom scripts and apps. Configuration as code through GitHub and an open-source CLI.
Compliance benchmarksCompliance Benchmarks built on the macOS Security Compliance Project: CIS Level 1 and 2, NIST 800-53 and 800-171, DISA STIG, CMMC and more. Jamf Cloud only.CIS Level 1 and 2 Blueprint templates
Endpoint securityJamf Protect (EDR), sold separately or in bundlesIru EDR and Iru Vulnerability Management, separate licences on the same agent
App catalogue and patchingJamf App Catalog and App Installers (about 700 titles), included with Jamf Pro Cloud; patch policiesAuto Apps catalogue (550+ apps)
Identity and Mac loginJamf Connect; Platform SSO with Microsoft Entra ID and OktaPassport (Entra ID, Okta, Google Workspace, OneLogin); Platform SSO with Entra ID and Okta
APIClassic API, Jamf Pro API and a platform API gateway; Terraform providersEnterprise API
HostingJamf Cloud or on-premises on Windows or Linux. Blueprints, Compliance Benchmarks and the Jamf for Mac and Mobile bundles are cloud-only.Cloud only, with US and EU regions

From each vendor's own pages on 8 November 2026. Prices and plans change; confirm them with the vendor before you buy.

Verdict

Which should you choose?

Choose Jamf Pro if:

  • You manage a large or complex Apple estate and rely on scripts, extension attributes and Smart Groups.
  • You must host on-premises, or need watchOS.
  • You want compliance benchmarks built on the NIST macOS Security Compliance Project.
  • Your team already has Jamf skills and integrations.

Choose Iru (formerly Kandji) if:

  • You want a fast, template-driven setup with less scripting.
  • You manage Windows or Android alongside Macs and want one console.
  • You want EDR and vulnerability management on the same agent.
  • You are a Kandji customer: the move to Iru is required anyway, so compare it with Jamf now.

Selection framework

What to test before choosing

01

Enrollment and setup

Test Automated Device Enrollment, the setup experience and account creation for a new Mac end to end.

02

Configuration depth

List the scripts, profiles and inventory data you rely on today and confirm how each is done in both products.

03

Compliance

Map your security baseline (CIS or NIST) to the built-in benchmarks and check how drift is reported and remediated.

04

Patching

Check that the apps you deploy are in the vendor catalogue and how quickly new versions reach devices.

05

Identity

Test Platform SSO or the vendor's login tool with your identity provider, including password changes and offline login.

06

Total cost

Compare a written three-year quote with the same device count and add-ons, including security and identity products.

Shortlist

Products and trade-offs

Best fit

Jamf Pro

Large or complex Apple estates that need deep customisation, on-premises hosting or the widest Apple platform coverage.

Jamf Pro manages every Apple platform, with policies, scripts, Smart Groups and extension attributes, plus Compliance Benchmarks and an app catalogue. Security and identity come from Jamf Protect and Jamf Connect, sold separately or in bundles.

Visit official product site Add to Stack Ledger

Reasons to shortlist

  • Deepest scripting and inventory model
  • All Apple platforms, including watchOS
  • Cloud or on-premises hosting

What to verify

  • More to learn and maintain
  • Security and identity products cost extra outside bundles
  • Some newer features are cloud-only

Best fit

Iru (formerly Kandji)

Teams that want quick, template-driven Mac management, or one console for Mac, Windows and Android.

Iru Endpoint Management, formerly Kandji, uses Blueprints of Library Items with Auto Apps and CIS templates. EDR and vulnerability management are separate licences on the same agent. It is cloud only.

Visit official product site Add to Stack Ledger

Reasons to shortlist

  • Fast, template-driven setup
  • Windows and Android in the same console
  • EDR and vulnerability management on one agent

What to verify

  • Quote-only pricing
  • No on-premises option
  • Existing Kandji customers must plan the move to Iru

Proof of concept

Run these checks before rollout

  1. 01Enroll five test Macs through Automated Device Enrollment in each product.
  2. 02Rebuild your three most important configuration profiles and scripts in both.
  3. 03Apply your CIS or NIST baseline and compare the compliance reports.
  4. 04Patch your ten most-deployed apps and time how long updates take to land.
  5. 05Test Platform SSO with your identity provider, including a password change.
  6. 06Get written three-year quotes with the same device count and add-ons.

Frequently asked questions

Is Kandji now called Iru?

Yes. Kandji announced its new name, Iru, on 22 October 2025: Kandji Device Management is now Iru Endpoint Management, and Kandji EDR and Vulnerability Management became Iru EDR and Iru Vulnerability Management. Iru's documentation says Kandji is deprecated and the deadline to upgrade existing tenants to Iru is 1 December 2026; devices, configurations and data carry over, but SSO connections for admins must be set up again.

Is Jamf or Kandji cheaper?

Jamf lists Jamf for Mac, which bundles Jamf Pro, Jamf Connect and Jamf Protect, at $12.50 per Mac per month on annual billing with a 25-device minimum; it does not list a price for Jamf Pro alone. Iru is quote only. Ask both for a quote for the same device count, contract term and add-ons such as EDR and identity, and compare the three-year total.

Can Jamf Pro be hosted on-premises?

Yes. Jamf still publishes installation guides for Jamf Pro on Windows and Linux servers, but Blueprints, Compliance Benchmarks and the Jamf for Mac and Jamf for Mobile bundles need Jamf Cloud. Iru is cloud only.

Which is better for a small business?

Jamf's Mac and mobile bundles start at 25 devices, and Jamf Now, from $4 per device per month, is its simpler product for organisations with fewer than 25 employees. Iru does not publish a minimum; ask for a quote. Beyond that, the deciding question is usually how much scripting and customisation you need: Jamf Pro offers more, and Iru is quicker to set up.

Sources reviewed

The guide was checked against these vendor pages on 8 November 2026. Product behaviour and availability can change.

Go deeper on KBY

Continue comparing

Password managers for IT teams

A documentation-backed framework for shortlisting a team password manager, validating administration controls, and running a safe proof of concept.

Open guide

1Password vs Bitwarden

1Password Business and Bitwarden Teams and Enterprise compared for IT teams: price per user, SSO, SCIM provisioning, self-hosting, admin account recovery, audit logs and SIEM, with a clear verdict.

Open guide

Security keys for Microsoft 365 admins

A form-factor and rollout guide for selecting FIDO2 security keys for privileged Microsoft Entra and Microsoft 365 accounts.

Open guide

Intune vs Jamf

Microsoft Intune and Jamf Pro compared for managing Macs, iPhones and iPads at work: licensing and price, Apple platform coverage, Automated Device Enrollment, declarative device management, Platform SSO, scripting and inventory, app deployment and patching, compliance and Conditional Access, new macOS releases and hosting, with a clear verdict.

Open guide

Okta vs Entra ID

Okta Workforce Identity and Microsoft Entra ID compared for single sign-on and workforce identity: price per user, app catalogue, MFA and passwordless, lifecycle and SCIM provisioning, Conditional Access and Okta policies, hybrid Active Directory, device trust, identity threat protection and administration, with a clear verdict.

Open guide