Kandji Agent vs MDM

What's the difference between the Kandji Agent and MDM? Which piece does what function?

What is the Kandji Agent?

In a nutshell, Kandji's proprietary macOS Agent extends the functionality of our platform beyond what the MDM framework can achieve by itself. The Kandji Agent is custom-built using Swift, a streamlined programming language specifically designed for Apple macOS. For more information about Kandji, you can read our platform overview.

What is the MDM Framework?

Using Apple's MDM framework in iOS, iPadOS, macOS, and tvOS, administrators can deploy and configure apps and settings, collect device information, and remotely lock or wipe devices. This can be done with corporate-owned as well as BYOD devices.

One advantage of using Apple's MDM framework is how quickly it can communicate with devices, which lets commands (such as to lock or erase devices) happen almost instantly. This is made possible by the Apple Push Notification System (APNS). Apple devices are constantly polling APNS for notifications to request managed devices to "Check-in" with their MDM server. Because of this constant polling, near-instant management of online devices can be achieved.

Which actions are performed by the Kandji Agent?

  • Custom Apps: Installation of DMG, PKG, and ZIP files. Running the audit, preinstall and postinstall scripts, and forcing restarts if the option is enabled.
  • Auto Apps: Profiles to whitelist Auto App features such as Notifications, KEXT, and PPPC are delivered via the MDM framework.
  • Scripts: All scripts are run as root by the Kandji Agent.
  • Parameters: Most Parameters go beyond the MDM Framework. For example, the Manage SSH config parameter requires the agent to write to the SSH config file.
  • Collection of additional computer details: The full application list, as well as other system details, can not always be pulled via the MDM framework. The Kandji agent helps pull these other details.
  • Native Application Blacklisting: The ability to blacklist applications and present the Kandji dialogue window is handled by the agent.

Which items does MDM handle?

  • Profile Installation: MDM Profiles are delivered via the MDM protocol.
  • MDM Commands: Commands such as those available to you in the Device Action Menu are sent via the MDM protocol.
  • Apps and Books installation (Formerly VPP): Apps acquired via Apple Business Manager and deployed via Kandji are installed by leveraging the MDM protocol.
  • Over-The-Air enrollment profiles: When end users navigate to the enrollment portal and download the enrollment profile, the communication between the device and Kandji to enroll the device is done via the MDM protocol.
  • Automated Device Enrollment (Formerly DEP): Automated Device Enrollment leverages the MDM protocol to enroll devices during setup assistant.
  • Kandji Agent installation: When a macOS device is enrolled into Kandji, one of the first commands initiated is the InstallEnterpriseApplicaiton command to install the Kandji Agent.