Having secure devices plays a major role in meeting compliance requirements. We want to support as many Mobile Device Management solutions (MDMs) as possible, in addition to providing our agent. We have heard from many of you that you use Kandji for macOS. This article goes over how to sync & bring all of your compliance-related information from Kandji to Drata.

To use Kandji, you need to ensure that your devices have been enrolled with the app and you have configured blueprints. To learn more about Kandji Blueprints, please follow these instructions. We recommend using Level 1 from Kandji’s templates since it has all the required compliance components except for the screen saver. To add the screen saver, please follow these steps:

Click on the Kandji Level 1 blueprint:

Click on the 'Edit Library' button:

Turn on 'Screen Saver' toggle and save your changes:

If you prefer to use your own blueprints, make sure the following library items are configured. You must include the indicated keywords in the blueprint name:

In the next step, you will be setting up an API Token with the following permissions:

To set up an API Token, go to Settings > Access > API Token. There are three parts to this step:

In this API Token screen, you will see your Organization’s API URL, which is needed when connecting to Drata. In the example screenshot above, the raw URL provided by Kandji is dratanfr.api.kandji.io. However, Kandji requires additional syntax to make successful API calls. Using this example URL, the format you enter into the Drata connection drawer should be https://dratanfr.api.kandji.io/api/v1/. Note the following additions to the URL syntax:

Drata will show an error If the provided syntax is not correct.

Note: If you are an EU Kandji customer, your example API URL would be dratanfr.api.eu.kandji.io. That is, eu will come after api. and before .kandji in your specific URL. You must still make the two required syntax changes before entering your URL into the Drata connection drawer.

When you click on 'Add Token', you will see the screen below. Add a Name and Description for your token and click on 'Create.'

Copy your token and click on 'Next.' You will not be able to view this API token again.

Note: You will need this token along with the API URL when connecting to Drata so please make sure to copy the token and click on 'Next'.

In the next step, we are going to add the required access permission to your token.

Make sure that the following permissions are granted to the token you will be using.

Once you click 'Save', you will be able to verify the proper set up in the next screen.

Your Kandji account should be connected to a user directory. This feature can be accessed under Settings > Integrations > User Directory. It is important to use the same account as the identity provider (IdP) used in Drata (Google, Okta, Microsoft 365) to ensure users are synced between Kandji and Drata. If your Drata IdP is not available in Kandji, ensure the email addresses in your Kandji user directory match exactly to the ones in your Drata IdP.

Click 'Connections' from the menu.

Select Available Connections and Scroll Down to Kandji and click the 'Connect' button for the Kandji integration.

4. Enter the Kandji account details and click 'Save & Test Connection.'

Note: This is where you enter the API URL and API token created above in Step 2. For the API URL, ensure you enter the full URL format as shown in the example text below. It should have https:// prepended, and /api/v1/ appended.

Navigate to your name in the lower left, then select 'Settings'.

Select 'Automated via Kandji MDM' and switch off 'Automated via Drata Agent' to disable the Drata agent.

Note: If both remain on, and the Drata agent is installed on an employee computer, the Drata agent will take precedence; meaning, employee compliance checks will come from the agent.

Your Kandji setup is complete! Drata will fetch data from Kandji on a daily basis once Autopilot completes running.