Kandji
Connect Kandji to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Kandji to collect mdm evidence with automated compliance tests, switched on per workspace.
| Category | MDM |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Kandji's guide | support.kandji.io |
Connect with an API token
-
In Kandji:
- Sign in to Kandji and go to Settings, then the Access tab.
- Click Add API Token, enter a Name and Description, and click Create.
- Use Copy Token to copy the token and store it safely. You will not be able to see the token details again.
- Click Configure to manage the token's API permissions (or Skip and change them later from the token's Permissions tab). Select only the device read permissions Safeguard needs and click Save.
Where to find the other values:
- Subdomain: After you create your first token, the Access tab shows your tenant-specific API URL.
- Region (optional): Not stated on the fetched page.
Kandji shows the secret only once, so copy it before you leave the page.
Kandji's public documentation does not cover every step.
Source: support.kandji.io, checked 2026-10-07.
The permissions Safeguard needs:
Device list,Device details,Device status. -
On Compliance › Connectors, open Kandji, click Connect, choose API token and fill in:
Field What to enter Subdomain Required. The part before .api.kandji.io in your address. API token Required. Stored encrypted and never shown again. Region (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Kandji and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC6.1, CC6.2, CC6.5, CC6.6, CC6.8, CC7.1 | 8 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.11, A.6.5, A.8.1, A.8.8, A.8.9, A.8.20, A.8.24 | 8 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(5), 164.310(d)(1), 164.312(a)(1), 164.312(e)(1) | 8 |
| PCI DSS | Automated tests | 1.5.1, 3.5.1, 6.3.3, 8.2.8, 12.5.1 | 7 |
| NIST CSF 2.0 | Automated tests | ID.AM-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.IR-01, PR.PS-02 | 8 |
These tests are switched on per workspace by the Safeguard team.
Related
- MDM connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks