Full Disk Access is the most important permission in macOS for a backup tool, and also the one people feel most wary about granting. Both reactions are correct. This article explains exactly what you are giving macup when you turn it on, what you are not, and why the trade is the right one.
Step 1 — Why Full Disk Access matters
macOS sandboxes every app by default. An app without special permission can only see a small slice of your disk — roughly, its own container and anything you explicitly drag into it. That is a sensible default for most software. It is an unacceptable default for a backup tool.
Without Full Disk Access, macup cannot read:
- Your Mail database, including every message and attachment.
- Messages, including attachments and iCloud-synced history.
- Safari bookmarks, reading list, and extension state.
- Calendar and Reminders data.
- Other users’ home folders on the same Mac.
- Any file protected by Apple’s privacy-protected paths.
A backup that silently skips those is not a backup. It is a file-copier with a nice icon. Full Disk Access is what turns macup into an actual backup.
Step 2 — Grant it
Open System Settings > Privacy & Security > Full Disk Access. Find macup in the list. Toggle it on. macOS will ask for your admin password the first time. When you relaunch macup, the new permission takes effect immediately.
If macup is not in the list yet — which happens on some brand-new installs — click the + button, navigate to Applications, and select macup.app manually. You only have to do this once per Mac.
If you use a separate login for work
Full Disk Access is granted per user, not per Mac. If you have more than one login on the same machine and you want macup to back up both, each login needs to grant Full Disk Access independently. macup will prompt you on first launch under each login.
Step 3 — Verify
Open macup and go to Preferences > Permissions. The Full Disk Access row shows:
- A green checkmark and “Granted” if everything is wired correctly.
- A red dot and “Not granted” if macOS is still blocking macup.
- An amber dot if the permission was granted but macup has not yet relaunched since.
If you see red or amber after following Step 2, quit macup fully from the menu bar and reopen it. This is the single most common support ticket we get, and the answer is almost always a relaunch.
Step 4 — What Full Disk Access does NOT give macup
This matters, so we are going to spell it out.
- It does not grant access to other users’ encrypted logins while they are logged out. FileVault keys are held by the logged-in user’s session. Nothing macup or any other app can do changes that.
- It does not grant network access beyond what any app has. macup talks to its destinations over TLS, same as every other app on your Mac. Full Disk Access is strictly a local-filesystem permission.
- It does not let macup read your passphrase, recovery code, or macOS Keychain items. Those are held in protected system stores that Full Disk Access does not unlock.
In short: macup sees what a user who is sitting at your Mac would see, after you have typed your password. Nothing more.
Step 5 — Revoking Full Disk Access
If you ever want to turn the permission off, the same System Settings > Privacy & Security > Full Disk Access pane is where you do it. Toggle macup off.
From that moment, macup will refuse to take new backups and surface an amber banner in the app explaining why. Existing snapshots remain intact and fully restorable — revoking the permission only blocks future reads, not past ones. Grant it again at any time to resume.
For enterprise fleets
If you manage Macs with MDM, Full Disk Access can be pre-granted with a Privacy Preferences Policy Control (PPPC) profile. Users never see the prompt. The enterprise deployment guide on our site covers the exact payload and the team-identifier values you will need — that article ships with Phase 7.