Skip to main content

Apple policy: Passcode

The Passcode settings section controls device passcode requirements and related security rules (for example, minimum length and complexity).

Options

In the Apple Policy Editor, passcode options are configured using a mix of toggles and numeric fields. Many fields include tooltips that indicate supported OS versions and supervision requirements.

Passcode toggles

  • ChangeAtNextAuthChange at next authentication: force a passwordpasscode reset the next time the user authenticates.
  • RequireAlphanumericPasscodeRequire alphanumeric passcode: require at least one alphabetic character and one number.
  • RequireComplexPasscodeRequire complex passcode: require a “complex” passcode (no repeating/sequential patterns and at least one non-alphanumeric character).
  • RequirePasscodeRequire passcode: require a passcode without additional length/quality requirements. Note: setting other passcode keys implicitly requires a passcode.

Numeric fields

  • FailedAttemptsResetInMinutesFailed attempts reset (minutes): minutes before the failed-attempts counter resets (requires MaximumFailedAttempts)Maximum failed attempts).
  • MaximumFailedAttemptsMaximum failed attempts: failed attempts allowed before the device is erased/locked (range: 2–11).
  • MaximumGracePeriodInMinutesMaximum grace period (minutes): how long the device can be unlocked without requiring the passcode (0 = none).
  • MaximumInactivityInMinutesMaximum inactivity (minutes): idle time before the device locks (range: 0–15).
  • MaximumPasscodeAgeInDaysMaximum passcode age (days): max passcode age before a forced change (range: 0–730).
  • MinimumComplexCharactersMinimum complex characters: minimum number of “complex” characters (range: 0–4).
  • MinimumLengthMinimum length: minimum passcode length (range: 0–16).
  • PasscodeReuseLimitPasscode reuse limit: passcode history length to prevent reusing old passcodes (range: 1–50).