# Extended Checks for Screen Lock and Antivirus - Iru (Kandji) & Microsoft Intune

### Overview

Sprinto’s enhanced integrations with supported MDMs (Mobile Device Management tools) now support automated monitoring of two additional compliance checks:

* **Screen lock** — Verifies that devices automatically lock after a defined period of inactivity.
* **Antivirus** — Detects the presence of recognised antivirus protection on staff devices.

This enhancement enables real-time compliance tracking and removes the need for manual evidence submissions.

This article explains how to configure your MDM (Iru (Kandji) or Microsoft Intune) so Sprinto can enforce these extended checks.

***

### Prerequisites

Before enabling extended checks, ensure that:

* You have **admin access** to your MDM account (Iru (Kandji) or Intune).
* You can create or edit **compliance policies** or **profiles** in your MDM.
* You can update API token permissions (Iru (Kandji)) or re-integrate the account (Intune).

***

### Configure in Iru (Kandji) (macOS)

#### Step 1 – Configure Screen Lock

Create or edit a **Passcode profile** with these settings:

* Require passcode — Enabled
* Require Passcode After Sleep or Screen Saver Begins — Immediately
* Start Screen Saver After — 15 minutes or less

Assign the Passcode profile to your **Blueprints**.

#### Step 2 – Update API Key Permissions

Ensure the API key used in Sprinto has the following **Device permissions** enabled:

* Device Library Items
* Application List

#### Antivirus Detection

Sprinto checks the installed applications list via Iru (Kandji) API. A device passes if any recognised antivirus is found (e.g., Microsoft Defender, CrowdStrike, Sophos, Bitdefender, SentinelOne, McAfee, Malwarebytes, etc.).

***

### Configure in Microsoft Intune (Windows & macOS)

#### Step 1 – Configure Antivirus Requirement (Windows only)

In your Intune **compliance policies**, set one of the following to **Require**:

* Encryption → Antivirus field
* Defender → Defender field

#### Step 2 – Configure Screen Lock Requirement

In Intune compliance policy:

* Navigate to **System security → Password**.
* Set **Maximum minutes of inactivity before password is required** to 15 minutes or less.
* Apply for both Windows and macOS devices.

#### Step 3 – Re-integrate Intune with Sprinto

After updating compliance policies:

* In Sprinto, go to **Settings → Integrations → Active Integrations**.
* Select **Microsoft Intune → Manage → Update Connection**.
* Re-connect to the same account so Sprinto updates the integration.

***

### How Sprinto Tracks Antivirus

* **Iru (Kandji)**: Reads installed apps via API, flags devices without recognised antivirus.
* **Intune**: Reads compliance status directly from your configured antivirus settings.

***

### Next Steps

Once configuration is complete:

* **New monitors** for Screen Lock and Antivirus appear under **Staff Devices** in Sprinto.
* Non-compliant devices are flagged automatically.
* **Remediation tasks** are created where required.
* Compliance status updates in real time based on Iru (Kandji) or Intune data.