Skip to main content

​
Prerequisites

  • Iru/Kandji admin access
  • Enrollment key from Runlayer
  • At least one Blueprint configured with enrolled devices
  • The signed Runlayer CLI macOS package (Custom App) ready to assign
Enrollment keys allow devices to automatically register with Runlayer and obtain API credentials.Enrollment Keys List
1

Navigate to Enrollment Keys

Go to Settings in the Runlayer dashboard and select the Enrollment Keys tab
2

Create a New Key

Click + Create Enrollment KeyCreate Enrollment Key
3

Configure the Key

  • Name (required): Enter a descriptive name (e.g., “Production MDM”)
  • Description (optional): Add context about the key’s purpose
4

Copy the Key

Copy the generated key (starts with rl_enroll_) and store it securelyEnrollment Key Created
Enrollment keys are shown only once. Store them securely and treat them like passwords.

​
Deployment Steps

Deploy in this order so the Audit Script finds the packaged CLI and optional managed Username before it enrolls.
1

Custom App — Runlayer CLI package

Assign the signed Runlayer CLI .pkg to the Blueprint so /usr/local/bin/runlayer is present before the sync script runs.
2

Custom Profile — com.runlayer.cli

Upload com.runlayer.cli.mobileconfig (from the CLI packaging) with at least Host set to your tenant URL. Optionally set Username to an Iru global variable such as $EMAIL so enrollment uses the user’s email when the script’s ENROLLMENT_USERNAME field is left empty.
3

Generate the Script

Fill in your settings below to generate a deployment script.Iru/Kandji-specific configuration tips:
  • ENROLLMENT_USERNAME: Prefer the Custom Profile Username key (e.g. $EMAIL) when possible. Leave empty to use that managed value, then the console short name.
  • ENROLLMENT_DEVICE_NAME: Use an Iru/Kandji variable for the device name. Leave empty to use the computer name.
4

Custom Script — Audit Script, run daily

  1. Navigate to the Library section in Iru/Kandji
  2. Click Add New → Custom Script → Add & Configure
  3. Provide a Name (e.g. “Runlayer Config Sync”)
  4. Assign to your target Blueprint(s)
  5. Set Execution Frequency to Run daily (recommended)
  6. Paste the generated script into the Audit Script field
  7. Enable Self Service on a test Blueprint for manual runs while logged in
  8. Click Save
The script runs as root. At the login window it exits 0 (skipped) so daily check-ins stay green; when a user is logged in it drops uid with launchctl asuser + sudo -u before credentials enroll / setup sync.

​
Verification

  1. Self Service (or wait for the daily run) while a user is logged in.
  2. On the Mac: runlayer credentials check --skip-org-check → user: ok; secret in the login keychain (security find-generic-password -s runlayer-cli), not plaintext in ~/.runlayer/config.yaml.
  3. Client configs (e.g. ~/.cursor/mcp.json) owned by the user; synced MCPs visible in Cursor.
  4. Iru Status tab shows stdout/stderr per run. Device log: /var/log/runlayer/auto_provisioning.log.
  5. Loginwindow / no console user → Pass (exit 0), log says skipped.
  6. CLI package removed → Error (exit 3) with the missing path in the log.
Force an immediate check-in on a test Mac with sudo kandji checkin when that CLI is still available on your tenant.