2Fifteen Tech moved its identity provider to Iru in one week with no disruption

The challenge

2Fifteen Tech is an Apple Technical Partner and Google Workspace partner based in Salt Lake City that provides managed IT, cloud, and security for Mac-first businesses. Its customers range from manufacturing and financial services to AI startups, software companies, marketing agencies, and real estate, and what unites them is that they chose Apple and want IT support that treats Macs the way Apple intended. Robby Barnes, Senior Director of Technology, has spent seven years at the company building the practice around that idea.

That philosophy shapes the stack 2Fifteen Tech runs internally. Iru (then Kandji) has managed the team's Macs since the company started using MDM. Google Workspace handles productivity, Tailscale and Cloudflare handle zero trust network access, and Material Security covers email and identity security. This is the kind of stack you usually see in a high-growth tech company. As Barnes puts it, "it's not the typical MSP stack."

Identity was the one piece that didn't fit the pattern. For five or six years the team had run a larger, more established identity platform. It was powerful, and it helped the company meet its compliance needs, but Barnes compares it to a cloud infrastructure console: a giant toolbox that will let you build anything, with no guidance on how. Over the years the team had routed all of its access management through it, and in practice only a couple of people understood what was going on inside it well enough to add new connectors or troubleshoot.

Provisioning was a particular sore spot. SCIM, the standard that lets an identity provider automatically create and remove user accounts in downstream apps, was sold as a separate add-on for every connection, and configured in a different place from the single sign-on setup. As a result, the team was never able to get it working reliably for some of the apps it cared about.

The solution

Iru had already earned the team’s trust on the device side, so when it started building an identity product, Barnes kept an eye on it. He wasn’t in a hurry to move. He wanted to see how Iru would handle identity first, and whether it would be ready for a team that depends on single sign-on every day.

Once it was stable enough, he put a handful of apps in to see how they behaved. They worked smoothly, so the full move followed, in two stages.

First, Barnes pointed the existing identity provider at Iru for authentication. Nothing changed about where the apps lived or how the team started a sign-in. Whenever someone chose SSO, they were handed to Iru for the actual login and sent back signed in. That one step put passkey-based, passwordless sign-in in front of every app on day one, without touching a single app.

Then he recreated the apps in Iru one at a time. When an app was ready, he cut it over and let Iru handle it end to end. Barnes describes the same approach for a team starting from Google Workspace:

Testing freely with versioned configurations

Every single sign-on connection in Iru Identity starts as a draft version that the admin applies when ready, and any previous version can be restored in one step. Barnes expected it to be a nice-to-have. In practice it changed how he worked.

A typical case: the initial connection to an app would work, but user roles weren't coming through correctly. Barnes could apply the working baseline, iterate on the role mapping in a new version, and if that attempt broke something, drop back to the baseline and try again.

Provisioning that is part of the flow, not another SKU

The biggest practical difference was SCIM. In Iru Identity, provisioning is part of setting up an app, not a separate product or a per-connection add-on. If an app supports it, the admin turns it on.

Iru also supports OIDC connections alongside SAML, which Barnes called "another great thing" that had been difficult to do on the previous platform.

Passkeys and a native app the team actually likes

For end users, the change showed up as passkey-based sign-in and the Iru Access app on every Mac.

Barnes also found a detail in the Access app that he now uses constantly: right-click any app and open it once in a different browser, without changing the default.

Results

The whole migration took about a week, and the clearest sign it worked is that nobody said anything.

The results that matter to Barnes go beyond the cutover itself. SCIM provisioning now works for dozens of apps where it never had. The identity configuration is something the team can reason about and hand around, rather than a system only two people could safely touch. Device management and identity live on one platform, with the same vendor the team already trusted for its Mac computers.

For other teams weighing the same move, Barnes offers a few pieces of hard-won advice, most of it about being careful with the apps on the other end. Any time you switch an app from one identity provider to another, there’s a moment where the old sign-in path is gone and the new one hasn’t been tested yet, and some services treat whichever provider you configured as the only door.

So before moving each app, know its break-glass path, and for the ones that don’t have one, let the vendor’s support team know the switch is coming so there’s a thread to fall back on. Plan how you’ll test each piece. And don’t be shy about using AI to translate between providers: screenshots of the old setup and a question about what each field means saved him real time, even after years of doing this work.

Looking ahead

2Fifteen Tech is growing its team, and Barnes sees identity moving to the center of how the company thinks about security, both for itself and for the Mac-first businesses it supports.

As an MSP, Barnes sees the pattern in his customers too, most of whom run on Google Workspace. Google’s built-in identity covers a simple SAML connection and not much more. Its list of supported apps is short, group handling is restrictive, and conditional access is hard to set up and harder to keep working consistently.

“It doesn’t take very long to get outside of what Google is able to directly cover,” he says. The enterprise alternatives are more capable, but tend to put conditional access, federation, and even logging behind additional licenses. A platform that keeps those pieces together, and that an entire team can operate, is where he expects more of his customers to head.

About 2Fifteen Tech

2Fifteen Tech is an Apple Technical Partner and Google Workspace partner headquartered in Salt Lake City, Utah. The company provides managed and co-managed IT, cloud, networking, and security services for Mac-first businesses across industries including creative agencies, real estate, and technology startups.