Enforce password policies for your devices
You can distribute policies in a configuration profile that users install. Passcode and password settings configured remotely with your mobile device management (MDM) solution can push policies directly to devices. That means policies can be enforced and updated with no user involvement.
Typical password policies
Policies pushed to devices can include requirements for:
An initial passcode or password on the device
An alphanumeric value
Minimum passcode length
Minimum number of complex characters
Maximum passcode age
Time before auto-lock
Passcode or password history (unable to use previous passwords)
Grace period for an iPhone and iPad lock
Maximum number of failed attempts before the user account is disabled
Delay (in minutes) after maximum number of failed attempts on a Mac
If you’re using a directory service such as Active Directory, a Mac can automatically use your domain password settings. If there are Active Directory and MDM policies, the more stringent policy is applied.
If Managed Apple Accounts are being used, passcode policies vary from those listed here. For more information, see one of the following:
Use Managed Apple Accounts in the Apple School Manager User Guide
Use Managed Apple Accounts in the Apple Business Manager User Guide
iPhone and iPad passcode options
If an iPhone or iPad is configured to access a Microsoft Exchange account, Exchange ActiveSync policies are pushed to the device wirelessly. The available set of policies varies depending on the version of Exchange ActiveSync and Exchange Server. If Exchange and MDM policies exist, the more stringent policy is applied.
By default, the user’s passcode can be defined as a six-digit personal identification number (PIN) on Face ID and Touch ID–capable devices or a four-digit PIN on all other devices. For devices with iOS and iPadOS, you can choose from an extensive set of passcode policies to meet your security needs.
When the passcode payload is installed on an iPhone or iPad, the user has 60 minutes to enter a passcode. After that, the payload forces the user to enter a passcode using the specified settings.
Note: Password policies aren’t supported with Shared iPad.