XFA checks every device at sign-in without enrolling it in an MDM or taking control of it. It also covers Linux, which Iru does not manage, and contractor laptops nobody enrolled.
Iru (formerly Kandji) started as an Apple device management platform and now also manages Windows and Android. IT enrolls each device, then manages apps, settings, updates, and patches from one console.
Iru does not manage Linux, and it only sees the devices IT has enrolled.
| XFA | IruFormerly Kandji | |
|---|---|---|
| Security checks | ||
| OS version, disk encryption, and screen lock checks | Yes | Yes |
| Jailbreak and root detection | Yes | Yes |
| Browser kept up to date | Yes | Yes |
| Active antimalware verified | Yes | Yes |
| Covers the most common operating systems | Yes | NoLinux is not supported |
| BYOD | ||
| Works for company-owned devices | Yes | Yes |
| People install it themselves | Yes | No |
| Finds devices through SSO sign-ins, before anything is installed | Yes | NoIru only sees the company-owned devices it manages. Unmanaged devices stay unknown to the organization |
| Setup and admin | ||
| Admin dashboard | Yes | Yes |
| Self-serve setup, no IT rollout | Yes | No |
| Known vulnerabilities (CVEs) per device, from OS and browser versions | Yes | Yes |
| Warns users before they are blocked at sign-in | Yes | No |
| Ecosystem | ||
| Works with your identity provider (SSO) | Yes | Okta, Entra ID, and Iru Identity |
| No device management migration needed | Yes | No |
Iru details from Iru's documentation, checked October 2026. Sources: iru.com (opens in a new tab).
A contractor's laptop gets the same check at sign-in as a company Mac. The XFA app installs without admin rights, and nothing is enrolled.
XFA for personal and contractor devicesXFA checks security settings. It does not collect browsing history, personal files, or messages. Nothing changes without their OK.
macOS, Windows, Linux, iOS, and Android go through the same check at sign-in. Linux laptops and devices nobody enrolled need no second tool.
How XFA works“XFA has a user-friendly and straightforward process for onboarding people. Additionally, I value that it supports a bring-your-own-device policy, unlike many other tools out there, which are both costly and restrictive.”
Roel BuyzenChief Delivery Officer, BytefliesRead the Byteflies story
Yes. Iru keeps managing your Apple devices. XFA checks every device at sign-in, those Macs included, and covers the Linux and contractor devices Iru does not reach.
No. The XFA app checks security settings. It does not collect personal files, messages, or browsing history. Nothing changes without the person’s OK.
Only if you switch blocking on. In a policy you choose, per check, whether a failed check warns the person or blocks their sign-in. Either way, XFA tells them what to fix.
Nothing. XFA is free to start, with no cap on people. It runs four device checks at every sign-in from day one.
Compare plansDevice security used to mean a project. With XFA it means connecting your identity provider and picking your checks.
Starting with XFA