Skip to main content
Articles
15
min read
Five Iru (Kandji) alternatives compared on features, pricing, and limitations — plus the hardware operations layer every MDM misses.
Kandji rebranded to Iru in 2025, but the product does the same thing it always did: enroll Apple devices, push security policies, and patch macOS. It does those things well.
But the problem is what it doesn't do.
Your mobile device management service providers can tell you a device hasn't checked in for 30 days. It can't retrieve it. It can enroll a MacBook in five minutes. But can it get that MacBook to your new hire in Berlin before their start date? No. It can flag a laptop as non-compliant, but won't wipe, rebox, and ship it to the next person who needs it.
That's why companies like New Relic and Docebo pair their MDM with an IT logistics platform like Firstbase to handle the physical side of the device lifecycle.
If you're an IT manager or head of IT at a distributed company, typically 500+ employees, hiring across multiple countries, running a lean IT team evaluating Iru alternatives, this guide compares the top ones and the gap every MDM comparison ignores: what happens before enrollment and after a remote wipe.
| Platform | Best for | Hardware Ops? | Rating | Key limitation |
|---|---|---|---|---|
| Firstbase | Physical device lifecycle (procurement, shipping, retrieval, disposal) | Yes | 4.8 | Reporting customization is limited |
| Jamf Pro | Deep Apple-only fleet management | No | 4.7 | Add-on pricing stacks up fast |
| Mosyle | Budget-conscious Apple environments | No | 4.6 | Thin documentation; The client agent can lose the MDM connection |
| Addigy | Real-time device monitoring and live support | No | 4.5 | Apple-only; no Windows or Linux |
| JumpCloud | Mixed-OS fleets with identity-first security | No | 4.5 | Weaker patching than dedicated Apple MDMs |
| NinjaOne | Cross-OS endpoint and asset management | No | 4.7 | Remote desktop and reporting gaps |
Customers report getting 10-15 hours per week back after switching to Firstbase. Take a self-guided product tour to see how it works with your current stack.
Now that we've established what MDM software does (and where it stops), let's look at the tools worth considering.
Jamf is the longest-running Apple device management platform on the market, with over 20 years of history. It covers zero-touch deployment through Apple Business Manager, configuration profiles, patching, app management, and security across Mac, iPhone, iPad, Apple TV, and Apple Watch.
Its Blueprints feature (built on Apple's Declarative Device Management) bundles settings, app installs, and restrictions into reusable templates, while Smart Groups dynamically segment devices and users.
If your fleet is overwhelmingly Apple, Jamf is probably the deepest MDM option available. But it stops at the software layer. Jamf can enroll and lock a MacBook remotely; it can't ship one to Berlin or retrieve it when someone leaves.
Customer Rating:4.7/5
Mosyle started in K-12 (it was the first Apple MDM built specifically for schools back in 2016) and has since expanded into business and MSP markets, with over 24,000 organizations using its platform. Its uniform price bundling comes at a price point that undercuts most competitors, because of their direct-sales model with no channel middlemen.
For Apple-only environments where budget is a real constraint, Mosyle is worth a serious look. But like every MDM on this list, its visibility ends at the software layer. It can push policies and patches to a device; it has no opinion on how that device got to the destination in the first place.
Customer rating:4.6/5
Where most MDMs poll devices on a schedule and show you status data that's minutes or hours old, Addigy maintains live health metrics, instant remote screen share, direct terminal access from the browser, and alerts that fire the moment something drifts out of compliance.
It's built for Apple and covers Mac, iPhone, and iPad with zero-touch deployment, policy enforcement, patching, and endpoint hardening (the security suite is powered by SentinelOne).
Like the others on this list, though, Addigy's scope is the device after it's been unboxed. It doesn't touch procurement, shipping, storage, or retrieval.
Customer rating:4.5/5
JumpCloud is an identity-first platform that also includes device management, and that distinction matters. While Jamf, Mosyle, and Addigy start with the device and layer security on top, JumpCloud starts with the user identity and ties everything (device policies, access management, MFA, SSO) back to a single set of credentials.
It also handles automated onboarding and offboarding at the identity layer: provision a user in Google Workspace or your HRIS, and device enrollment, app access, and policy enforcement cascade automatically. Revoke that identity, and access dies everywhere at once.
The tradeoff is that JumpCloud's device management isn't as deep as a purpose-built Apple MDM. It won't match Jamf's macOS granularity or Mosyle's patching automation.
Customer rating:4.5/5
NinjaOne is a unified endpoint management solution that covers Windows, macOS, Linux, Android, iOS, and network devices from a single pane. Where Jamf and Mosyle offer deep Apple management, NinjaOne goes wide across everything an IT team touches. It bundles patch management, remote access, a service desk, SaaS, and endpoint protection.
There's also a full IT asset management module that tracks hardware lifecycle, warranties, and software licensing. NinjaOne can tell you exactly which devices are approaching end-of-warranty and which software licenses are going unused. But it can't ship a replacement laptop to your new hire or retrieve one from a departing employee across the border.
Customer rating:4.7/5
Every tool above does the same job well. Enrollment, policies, patching, and remote wipe.
The differences are real (Apple depth vs. cross-OS breadth, pricing models, compliance requirements), but they're within the same layer: software control over devices already in someone's hands.
None of them touch what happens before enrollment or after the remote wipe. And that's where the money actually bleeds.
Your MDM handles the software. Your HRIS triggers the hire. Your ITSM logs the ticket. But nobody in that stack is buying the laptop, shipping it across borders, getting it back when someone leaves, wiping it, and putting it back into inventory.
That's the operational layer none of these tools were built to solve.
Firstbase isn't an MDM. It's the physical infrastructure and logistics layer that sits underneath your MDM and makes it actually work at scale.
Where MDM software handles enrollment and policy enforcement, Firstbase handles everything that involves a physical device moving through space: procurement from 150+ global resellers and distribution partners, imaging, shipping, tracking, repair, retrieval, and certified disposal. It pairs with any MDM vendor (Jamf, Microsoft Intune, JumpCloud, the lot) and feeds asset data into a single dashboard so IT has visibility into lifecycle stages that MDMs simply don't cover.
It also integrates with HRIS platforms like Workday and BambooHR so that a new hire added to your HR system automatically triggers a device order; a termination automatically kicks off retrieval.
Here's what that looks like in practice:
Departing employees confirm their address in the platform, receive a return kit at home, and schedule a pickup without leaving their house. The full retrieval cycle from offboarding trigger to wiped device back in inventory takes under 30 days. The time previously spent coordinating with VARs, packing boxes, printing shipping labels, and chasing unresponsive ex-employees gets eliminated. Employees self-serve approved accessories without filing a request.
Firstbase is also one of roughly 200 Apple Authorized Resellers in the U.S., which means guaranteed Apple Business Manager enrollment, priority procurement, and direct Apple service backing.
Every device action is tracked in the Firstbase platform with full chain-of-custody documentation, serial number histories, and certificates of destruction. That audit trail satisfies SOC 2, HIPAA, and NIST 800-88 requirements without IT having to compile anything manually.
Does Firstbase replace my MDM, or does it work alongside it?
Firstbase works alongside your MDM. Keep using Jamf, Kandji, Intune, Mosyle, JumpCloud, or your current tool for enrollment, policies, app management, and remote wipe.
It handles the part MDM does not cover: procuring devices, storing inventory, shipping laptops to employees, managing returns, certified wiping, and redeploying hardware.
So your MDM controls the device once it is active. Firstbase manages how that device gets to the employee, is returned, and is reused.
Before you commit to a platform, run through these questions. Your answers will tell you whether you need a different MDM, a hardware operations partner, or both.
Here's a quick guide to choose:
Every alternative on this list solves the same problem Iru solves: securing and managing devices after they're powered on. Not every MDM handles what happens before the device reaches your employee or after it leaves their hands.
Firstbase operates in that gap as a single procurement source, global shipping engine, and retrieval system that feeds directly into the MDM stack you already run. It turns device operations from a reactive scramble into a line item that Finance can actually predict.
Companies using Firstbase have cut per-employee offboarding costs by $125 while maintaining retrieval turnaround times under 30 days. Book a demo to see how it works with your current MDM.
Automate procurement, deployment, retrieval across 150+ countries and save 5,000+ IT hours a year.
Book a Demo →
