Skip to main content
This guide applies to Mac computers
Enable Parameters in Blueprints to control system-level behaviors and user account management on Mac computers. Parameters are built-in options you toggle on or off; they work alongside Library Items and apply to all Mac computers in the Blueprint, so you can enforce the right security and management settings at scale. Windows and Android Blueprints use Library Items and Mobile Device Management (MDM) policies instead.
Not enrolling Mac computers? Skip ahead to enrollment:

​
Available Parameters

Iru Endpoint includes built-in Parameters for common device management tasks. Expand a category below to read more.
  • Create User Accounts
    Create Administrator or Standard user accounts if they do not already exist.
  • Demote User Accounts to Standard
    Demotes local accounts to Standard users. At least one administrator user account must be excluded from the demotion process.
  • Don’t Allow the Guest User to Log In
    The Guest account is considered a security vulnerability because it has no password associated with it. It is recommended the Guest account be disabled on all macOS systems unless there is a clearly demonstrated need.
The following Parameters align with CIS benchmark recommendations (e.g., macOS 15 and macOS 26) and are available in Blueprints created from or updated with the CIS Level 1 and Level 2 templates. You can enable them for any Blueprint from the Parameters editor.
  • Audit Touch ID settings Touch ID is integrated with macOS and allows fingerprint use for many common operations. All use of Touch ID requires the presence of a password and the use of that password after every reboot, or when more than 48 hours has elapsed since the device was last unlocked. Touch ID is not a password replacement. The use of Touch ID can, however, make the use of passwords more secure for authorized users with physical access to a Mac.
  • Ensure users’ accounts do not have a password hint Password hints that are closely related to the user’s password are a security vulnerability, especially in the social media age. Unauthorized users are more likely to guess a user’s password if there is a password hint.
  • Ensure logging is enabled for sudo In order to properly monitor the use of the sudo command, log events for any use of sudo should be captured in the unified log.
  • Show location icon in Control Center when system services request your location When user applications access location an arrow is displayed next to the Control Center in the menu bar to give users an indication when their location is being accessed. By default system services like time zones, weather, travel times, geolocation, “Find my Mac,” and advertising services do not indicate the location is accessed. Enabling the “Show location icon in the menu bar when System Services request your location” setting will show an arrow in the control center when a system service accesses the location.
  • Ensure Apple Mobile File Integrity (AMFI) is enabled AMFI uses launchd, code signatures, certificates, entitlements, and provisioning profiles to create a filtered entitlement dictionary for an app. AMFI is the macOS kernel module that enforces code-signing and library validation. If disabled, applications could be compromised with malicious code.
  • Audit that Signed System Volume (SSV) is enabled Running without Signed System Volume on a production system could run the risk of OS software that integrates directly with macOS being modified.
  • Report Lockdown Mode status Lockdown Mode was introduced as a security feature in 2022 and provides additional extreme security protection. Users and organizations that suspect some users are targets of advanced attacks must consider using this control. This parameter will report the status of Lockdown Mode.
  • Ensure XProtect is running and up to date XProtect is the macOS native signature-based antivirus technology. XProtect both finds and blocks the execution of known malware. No matter what other tools are being used, XProtect should have the latest signatures available.
You can see all available Parameters when enabling Parameters for a Blueprint.

​
Enable Parameters in Blueprints

1

Navigate to Blueprint

Open your desired Blueprint in the Iru Endpoint web app.
2

Access Parameters

Select Parameters at the top of the Assignment Map.
3

Click Edit Parameters or Add Parameters

Click Edit Parameters or Add Parameters (first-time setup).
To bring in Parameters from another Blueprint instead, choose Import from existing Blueprint, select a Blueprint from the list (use Search Blueprints if needed), then click Import Parameters.
4

Filter by category

Use the left navigation to filter Parameters by category.
5

Search for Parameters

Type in the search field to find the Parameters you need. You can narrow results with the Compliance framework dropdown next to it.
6

Enable Parameters

Toggle the switch to enable desired Parameters.
7

Set Parameter values

For Parameters with configurable options, set the desired values.
8

Configure notifications

Optionally mute notifications using the bell icon where available.
9

Click Save or Save Parameters

Click Save to apply changes.

​
Next Steps

After configuring Parameters:
1

Set up enrollment for each platform

Once Blueprints and Parameters are configured, set up enrollment to manage devices: Apple Enrollment, Windows Enrollment, or Android Enrollment.