> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Parameters

> Set up Blueprint parameters in Iru Endpoint to enforce security and compliance policies. Configure user account, FileVault, and system settings.

<Callout icon="apple" color="#4f46e5" iconType="regular">This guide applies to Mac computers</Callout>

Enable Parameters in Blueprints to control system-level behaviors and user account management on Mac computers. Parameters are built-in options you toggle on or off; they work alongside Library Items and apply to all Mac computers in the Blueprint, so you can enforce the right security and management settings at scale. Windows and Android Blueprints use Library Items and Mobile Device Management (MDM) policies instead.

<Tip>
  Not enrolling Mac computers? Skip ahead to enrollment:

  <div style={{ display: 'flex', alignItems: 'center', flexWrap: 'wrap', gap: '0.5rem 0.75rem', marginTop: '0.35rem' }}>
    <span style={{ display: 'inline-flex', alignItems: 'center', gap: '0.25rem' }}><Icon icon="apple" size={14} style={{ flexShrink: 0, opacity: 0.9 }} /><a href="/en/endpoint/getting-started/enrollment/apple-enrollment">Apple Enrollment</a></span>
    <span style={{ display: 'inline-flex', alignItems: 'center', gap: '0.25rem' }}><Icon icon="microsoft" size={14} style={{ flexShrink: 0, opacity: 0.9 }} /><a href="/en/endpoint/getting-started/enrollment/windows-enrollment">Windows Enrollment</a></span>
    <span style={{ display: 'inline-flex', alignItems: 'center', gap: '0.25rem' }}><Icon icon="android" size={14} style={{ flexShrink: 0, opacity: 0.9 }} /><a href="/en/endpoint/getting-started/enrollment/android-enrollment">Android Enrollment</a></span>
  </div>
</Tip>

## Available Parameters

Iru Endpoint includes built-in Parameters for common device management tasks. Expand a category below to read more.

<AccordionGroup>
  <Accordion title="User Accounts & Authentication">
    * **[Create User Accounts](/en/endpoint/blueprints/parameters/create-user-accounts)**\
      Create Administrator or Standard user accounts if they do not already exist.
    * **[Demote User Accounts to Standard](/en/endpoint/blueprints/parameters/demote-user-accounts-to-standard)**\
      Demotes local accounts to Standard users. At least one administrator user account must be excluded from the demotion process.
    * **[Don't Allow the Guest User to Log In](/en/endpoint/blueprints/parameters/dont-allow-the-guest-user-to-log-in)**\
      The Guest account is considered a security vulnerability because it has no password associated with it. It is recommended the Guest account be disabled on all macOS systems unless there is a clearly demonstrated need.
  </Accordion>

  <Accordion title="Filesystem">
    * **[Setting umask for All Users](/en/endpoint/blueprints/parameters/setting-umask-for-all-users)**\
      Sets the umask value to 027.
    * **[Checking Library and System Folders for World-Writable Files](/en/endpoint/blueprints/parameters/checking-library-and-system-folders-for-world-writable-files)**\
      Verifies directories in /Library and /System aren't set to be world writable.
  </Accordion>

  <Accordion title="Auditing & Logging">
    * **[Monitor Encryption Status of Time Machine Volumes](/en/endpoint/blueprints/parameters/monitor-encryption-status-of-time-machine-volumes)**\
      Backup volumes should be encrypted like boot volumes, even when a portable drive holds only non-sensitive data or when encryption would make the drive harder to use with other systems.
    * **[Report User Accounts with FileVault Recovery Keys Escrowed to iCloud](/en/endpoint/blueprints/parameters/report-user-accounts-with-filevault-recovery-keys-escrowed-to-icloud)**\
      It is recommended that FileVault Recovery Keys are not stored in a user's personal iCloud account as there is a possibility that keys can be retrieved by an unknown party.
  </Accordion>

  <Accordion title="macOS Applications & Services">
    * **[Restart after X Number of Days of Continuous Uptime](/en/endpoint/blueprints/parameters/restart-after-x-number-of-days-of-continuous-uptime)**\
      Require devices to restart after a set number of days of uptime.
  </Accordion>

  <Accordion title="Security & Compliance (CIS)">
    The following Parameters align with CIS benchmark recommendations (e.g., macOS 15 and macOS 26) and are available in Blueprints created from or updated with the CIS Level 1 and Level 2 templates. You can enable them for any Blueprint from the Parameters editor.

    * **Audit Touch ID settings**
      Touch ID is integrated with macOS and allows fingerprint use for many common operations. All use of Touch ID requires the presence of a password and the use of that password after every reboot, or when more than 48 hours has elapsed since the device was last unlocked. Touch ID is not a password replacement. The use of Touch ID can, however, make the use of passwords more secure for authorized users with physical access to a Mac.
    * **Ensure users' accounts do not have a password hint**
      Password hints that are closely related to the user's password are a security vulnerability, especially in the social media age. Unauthorized users are more likely to guess a user's password if there is a password hint.
    * **Ensure logging is enabled for sudo**
      To properly monitor the use of the sudo command, log events for any use of sudo should be captured in the unified log.
    * **Show location icon in Control Center when system services request your location**
      When user applications access location an arrow is displayed next to the Control Center in the menu bar to give users an indication when their location is being accessed. By default system services like time zones, weather, travel times, geolocation, "Find my Mac," and advertising services do not indicate the location is accessed. Enabling the "Show location icon in the menu bar when System Services request your location" setting will show an arrow in the control center when a system service accesses the location.
    * **Ensure Apple Mobile File Integrity (AMFI) is enabled**
      AMFI uses launchd, code signatures, certificates, entitlements, and provisioning profiles to create a filtered entitlement dictionary for an app. AMFI is the macOS kernel module that enforces code-signing and library validation. If disabled, applications could be compromised with malicious code.
    * **Audit that Signed System Volume (SSV) is enabled**
      Running without Signed System Volume on a production system could run the risk of OS software that integrates directly with macOS being modified.
    * **Report Lockdown Mode status**
      Lockdown Mode was introduced as a security feature in 2022 and provides additional extreme security protection. Users and organizations that suspect some users are targets of advanced attacks must consider using this control. This parameter will report the status of Lockdown Mode.
    * **Ensure XProtect is running and up to date**
      XProtect is the macOS native signature-based antivirus technology. XProtect both finds and blocks the execution of known malware. No matter what other tools are being used, XProtect should have the latest signatures available.
  </Accordion>
</AccordionGroup>

You can see all available Parameters when enabling Parameters for a Blueprint.

## Enable Parameters in Blueprints

<Steps>
  <Step title="Navigate to Blueprint">
    Open your desired Blueprint in the Iru Endpoint Web App.
  </Step>

  <Step title="Access Parameters">
    Select **Parameters** at the top of the Assignment Map.
  </Step>

  <Step title="Click Edit Parameters or Add Parameters">
    Click **Edit Parameters** or **Add Parameters** (first-time setup).

    <Note>To bring in Parameters from another Blueprint instead, choose **Import from existing Blueprint**, select a Blueprint from the list (use **Search Blueprints** if needed), then click **Import Parameters**.</Note>
  </Step>

  <Step title="Filter by category">
    Use the left navigation to filter Parameters by category.
  </Step>

  <Step title="Search for Parameters">
    Type in the search field to find the Parameters you need. You can narrow results with the **Compliance framework** dropdown next to it.
  </Step>

  <Step title="Enable Parameters">
    Toggle the switch to enable desired Parameters.
  </Step>

  <Step title="Set Parameter values">
    For Parameters with configurable options, set the desired values.
  </Step>

  <Step title="Configure notifications">
    Optionally mute notifications using the bell icon where available.
  </Step>

  <Step title="Click Save or Save Parameters">
    Click **Save** to apply changes.
  </Step>
</Steps>

## Next Steps

After configuring Parameters:

<Steps>
  <Step title="Set up enrollment for each platform">
    Once Blueprints and Parameters are configured, set up enrollment to manage devices: [Apple Enrollment](/en/endpoint/getting-started/enrollment/apple-enrollment), [Windows Enrollment](/en/endpoint/getting-started/enrollment/windows-enrollment), or [Android Enrollment](/en/endpoint/getting-started/enrollment/android-enrollment).
  </Step>
</Steps>