Skip to main content

Deploy AI DLP via Iru

This guide shows you how to deploy AI DLP to your managed Macs from Iru (formerly Kandji). You add a script Anzenna provides as a Custom Script Library Item, fill in two values at the top of it, and assign it to a Blueprint. Deploying AI DLP installs the Anzenna Update agent, which installs AI DLP and keeps it current automatically.

Prerequisites​

  • Iru admin access with permission to create Library Items

  • Target Macs assigned to an Iru Blueprint

  • Target devices reported to Anzenna by a connected MDM or EDR integration (see

    Devices must already be known to Anzenna

    )

  • Your Anzenna domain and its Client Token (see

    AI DLP Overview

    )

  • The install and uninstall scripts, provided by Anzenna support

Required Step

Before beginning deployment, contact Anzenna support to obtain the install and uninstall scripts. The scripts ship with their value fields blank; you fill them in inside the Iru console.

Overview​

Iru delivers AI DLP as a Custom Script Library Item. Custom Scripts take no parameters, so there is no parameter field to fill in — the two values you supply are the first two editable lines of the script itself:

DOMAIN=""
CLIENT_TOKEN=""

Filled in, those two lines look like this:

DOMAIN="replace-with-your-domain"
CLIENT_TOKEN="replace-with-your-client-token"

  • The script goes in the Audit Script field, with the Remediation Script left empty

  • Execution Frequency is Run once per device

  • It runs as root, which the install requires, and verifies the downloaded agent's Apple Developer ID signature before running it

A filled-in script is a credential

Paste the script into Iru first, then type your values into Iru's editor. Do not fill them in to a local copy of the file — a local copy holding your Client Token is how it ends up in a ticket, a chat message, or a commit. Filled in inside the console, the only copy lives where it belongs.

Step-by-Step Instructions​

1. Create the Custom Script Library Item​

  1. Log in to Iru and go to Library

  2. Click Add Library Item

  3. Choose Custom Script, then click Add & Configure

2. Configure the Library Item​

Work down the form:

  1. Name: something that says what it is, for example Anzenna AI DLP — install

  2. Blueprints: add the Blueprint covering the Macs that should receive AI DLP. Start with a test Blueprint rather than your whole fleet.

  3. Execution Frequency: select Run once per device

  4. Self Service: leave off. This is a fleet deployment, not an opt-in install.

If your console says "Install once per device"

Some Iru documentation uses the label Install once per device for this setting. They are the same option — pick whichever label your console shows.

3. Paste the script and fill in your values​

  1. In the Audit Script field, paste the entire install script Anzenna provided

  2. Leave the Remediation Script field empty

  3. In the pasted text, fill in the two values at the top:

VariableValue
DOMAINYour Anzenna domain
CLIENT_TOKEN

Your domain's Client Token —

find it in the portal

Why the script and not a configuration profile

Iru can pass values to a script through a Custom Profile, but a profile's values land in /Library/Managed Preferences, which is world-readable on every managed Mac. Keeping your Client Token in the script body means it stays in the Iru console instead of in a readable file on every endpoint.

4. Save and deploy​

  1. Leave Restart after successful execution unchecked — nothing here needs a reboot

  2. Leave Liftoff Settings at their defaults

  3. Click Save

Online Macs pick the item up at their next agent check-in, typically within about 15 minutes.

Who can see the Client Token

The token is a literal in the script body, so anyone with Iru console access can read it. That is expected — the Client Token is domain-shared, not a per-device key. Nothing persistent lands on the Mac except the agent's own root-only configuration.

What "Run once per device" actually means​

The name is misleading in a way worth understanding before you deploy. Iru re-runs the audit script at each check-in until the item passes for that device:

  • On success the script exits cleanly, the item reaches Pass, and it stops running. This is the intended path and behaves like a one-shot.

  • On failure the item shows Error and Iru re-runs it at every check-in (~15 minutes) until it passes.

Do not leave a failing item assigned

That retry is useful for a transient problem — a network blip resolves itself on the next check-in with no action from you. But a persistent failure re-downloads roughly 15 MB every 15 minutes indefinitely. A long-running Error on this item is not cosmetic: fix the cause or unassign the item.

This is still the right frequency — Run every 15 min and Run daily re-run even after a success, which is worse. A non-zero exit also raises an Iru alert, and the script's output is recorded on the device's status page.

Verifying Deployment​

Check the Library Item status in Iru​

  1. Open the Library Item and find a target device, or open the device's record and find the item

  2. A status of Pass means the script completed successfully

  3. The captured output on the device status page ends with anzenna-update(iru-install): install complete

Verify on the Mac​

The agent's own log is the authoritative record, and it does not require sudo:

tail -20 "/Library/Application Support/Anzenna/Update/logs/update.log"

A quick structural check, which does not need the log at all:

ls -la "/Library/Application Support/Anzenna/Update/"
launchctl print system/ai.anzenna.update | head -5

See

AI DLP Overview

for how to read the log's install and update lines.

Uninstalling​

Removing the install item from a Blueprint does not uninstall anything — Iru Custom Scripts have no uninstall hook. Removal is its own Library Item.

  1. Add a second Custom Script Library Item, following step 1

  2. Name it something like Anzenna AI DLP — uninstall

  3. Paste the uninstall script Anzenna provided into the Audit Script field. It holds no secret and needs no values filled in.

  4. Set Execution Frequency to Run once per device, assign it to the Blueprint covering the Macs you want AI DLP removed from, and save

The uninstall removes the agent, its scheduled job, and its configuration, and is idempotent — running it on a Mac that never had AI DLP is a clean no-op.

Troubleshooting​

"DOMAIN is empty" or "CLIENT_TOKEN is empty"​

  • The Library Item was saved without filling in the values at the top of the script

  • Edit the script body in the Library Item — there is no separate parameter field on Iru to look for

  • Both values are required; a partial install is refused rather than left half-configured

The same install keeps running at every check-in​

  • Most likely the item is failing: "Run once per device" re-runs until it passes, so an Error state retries every ~15 minutes

  • Read the captured output on the device status page to see why, and fix that

  • Otherwise check the frequency — Run every 15 min and Run daily re-run even after success

The item shows Error but the Mac looks correctly installed​

  • Read update.log on the Mac. If it reaches install: complete, the deployment itself worked.

  • A failure after that point is in the background update run, not the install — contact Anzenna support with the log

The portal refused the enrollment​

The log shows exit 40: the Client Token is wrong. Find it in the portal and re-check it, then contact Anzenna support if it persists.

The install succeeded but no findings appear​

  • Check that Anzenna knows the device. If no connected MDM or EDR integration reports its serial number, AI DLP installs but does not register — see

    Devices must already be known to Anzenna

    . Connect the integration; the device registers on its own once it is reported.

  • For Claude Code, check the version meets the

    minimum requirement

    . Older versions produce no findings and no error.

"validly signed but NOT by Anzenna"​

Stop and contact Anzenna support. The downloaded file is properly signed by someone other than Anzenna, and the script correctly refused to run it.

Need help? Contact

Anzenna Support

for assistance.