> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting umask for All Users

> Configure the default umask value for all users on managed Mac computers using this Blueprint parameter. Control default file and directory permissions.

<Callout icon="apple" color="#B84A7A" iconType="regular">This guide applies to Mac computers</Callout>

### What is umask?

The **umask** (user file-creation mode mask) is a command in Unix that sets default permissions for new files and directories. It essentially dictates which permission bits will not be set when a file or directory is created, thus controlling the default permissions. For more information about setting custom umask values in macOS, see this [Apple guide](https://support.apple.com/en-gb/101914).

### How It Works

When you create a file or directory, it starts with a default set of permissions. The umask value is subtracted from this default to determine the final permissions. For instance, the default permissions are typically 666 for files (read and write for everyone) and 777 for directories (read, write, and execute for everyone). The umask value is subtracted from these defaults to get the actual permissions.

Setting the umask to 027 is a common practice for enhancing security. Here’s a breakdown of what this means:

**0:** This digit is often ignored in the context of umask.

**2:** This digit affects group permissions, removing write permissions.

**7:** This digit affects "others" permissions, removing read, write, and execute permissions.

After the umask is applied the following numeric values for permissions will be set:

Files will have permissions 640 (666 - 027):

| **Owner**      | **Group** | **Others**     |
| -------------- | --------- | -------------- |
| read and write | read-only | no permissions |

Directories will have permissions 750 (777 - 027):

| **Owner**                | **Group**        | **Others**     |
| ------------------------ | ---------------- | -------------- |
| read, write, and execute | read and execute | no permissions |

### How to Set the umask to 027

A Parameter can be configured on a Blueprint (Assignment Map) to set the umask to 027 across all users on the Mac computers in your fleet.

<Warning>
  Enabling this Parameter will require a restart for each Mac it runs on if the umask value does not already match the value set. It may also cause unintended consequences for software installs, or in collaborative environments. Please test umask adjustments thoroughly before deploying to production computers.
</Warning>

### Configuring the Parameter

<Steps>
  <Step title="Access Parameters">
    Open your Blueprint, then click **Parameters**.
  </Step>

  <Step title="Edit Parameters">
    Select **Edit Parameters**. If this is the first Parameter you're adding, select **Add Parameters**.
  </Step>

  <Step title="Search for umask">
    In the search field, enter "**umask**".
  </Step>

  <Step title="Enable the Parameter">
    Locate the **Set umask for all users** Parameter, and enable it by toggling the switch.
  </Step>

  <Step title="Save Configuration">
    Click **Save**.
  </Step>
</Steps>