Overview
The Apple Password Policy sets password and passcode requirements on managed Macs, iPhones, and iPads. You can control:
Strength: minimum length, letters and numbers, special characters, and simple passcodes
Changes: how often users must change their password, and how many old passwords they can't reuse
Locking: when the device locks, and what happens after failed attempts
Password AutoFill and password requests from nearby devices
Important: Too many failed attempts wipes an iPhone or iPad. When a user goes over Maximum number of failed attempts, a Mac locks, but an iPhone or iPad is erased. Set this carefully on mobile devices.
Requirements
Item | Details |
Platforms | macOS 10.10, iOS 4, iPadOS 4, or later. Some settings need newer versions. See the settings tables. |
Device ownership | Company-owned Macs, iPhones, and iPads. BYOD is supported on Macs only. |
Supervision | Required on iPhone and iPad for Allow Password AutoFill and Allow Password Requests from Nearby Devices |
Settings reference
Passcode strength
Setting | What it does | Default | Range | Platforms |
Minimum passcode length | The shortest passcode allowed | 8 | 0–16 | Mac, iPhone, iPad |
Require Alphanumeric value | When on, passcodes must include letters, not only numbers | Off | — | Mac, iPhone, iPad |
Minimum number of complex characters | How many characters other than letters and numbers, such as | 0 | 0–4 | Mac, iPhone, iPad |
Allow Simple passcode | When off, passcodes can't use repeated or sequential characters, such as | On | — | Mac, iPhone, iPad |
Passcode changes
Setting | What it does | Default | Range | Platforms |
Maximum passcode age | How many days a passcode can stay the same. After that, users must change it before they can unlock the device. | Not set | 3–730 days | Mac, iPhone, iPad |
Passcode history | How many previous passcodes users can't reuse | Not set | 1–50 | Mac, iPhone, iPad |
Reset passcode at next login | When on, users must reset their password the next time they sign in. See the note below. | Off | — | macOS 10.13 or later |
Disallow user to change password | When on, users can't change their password | Off | — | macOS 10.10 or later |
Locking and failed attempts
Setting | What it does | Default | Range | Platforms |
Require passcode on device | When on, users must set a passcode | On | — | Mac, iPhone, iPad |
Maximum grace period for device lock | How many minutes after locking a device can be unlocked without a passcode. | 0 | 0 or more minutes | Mac, iPhone, iPad |
Maximum Auto-Lock | The longest a device can be idle before it locks. Users can choose a shorter time, but not a longer one. | Not set | 0–15 minutes | Mac, iPhone, iPad |
Maximum number of failed attempts | How many wrong passcodes are allowed. After 6, users must wait before trying again, longer each time. When the limit is reached, a Mac locks, and an iPhone or iPad is erased. | 11 | 2–11 | Mac, iPhone, iPad |
Delay after failed login attempts | How many minutes a Mac waits before letting the user try again, after Maximum number of failed attempts is reached | Not set | 0 or more minutes | macOS 10.10 or later |
AutoFill and nearby devices
Setting | What it does | Default | Platforms |
Allow Password AutoFill | When off, users can't fill in saved passwords from Keychain or other password managers, in Safari or apps, and strong password suggestions are turned off. AutoFill for contacts and credit cards still works. | On | macOS 10.14, iOS 12, iPadOS 12, or later. Supervised iPhones and iPads. |
Allow Password Requests from Nearby Devices | When off, users can't request passwords from nearby Apple devices | On | macOS 10.14, iOS 12, iPadOS 12, or later. Supervised iPhones and iPads. |
Neither setting is supported with User Enrollment.
Things to know
Reset passcode at next login affects every user
When Reset passcode at next login is on, every user on the Mac must reset their password at their next sign-in, including administrators. Until an administrator resets their password, administrator sign-ins, such as approving an installer, may fail.
Turn it on only when you mean to make everyone choose a new password, and turn it off again afterward.
Maximum Auto-Lock conflicts with the Apple Screen Saver Policy
On Macs, Maximum Auto-Lock and Maximum grace period for device lock are applied as screen saver settings. Because of how macOS works, Maximum Auto-Lock conflicts with the screen saver idle time in the Apple Screen Saver Policy. The policy that was assigned most recently takes effect.
If you use both, set the same idle time in each, or use only one of them to control idle locking.
Disallow user to change password
This setting works like Allow Passcode Modification in the Apple User Authorization Policy. Use one or the other, so the two policies don't conflict.
Password resets from Swif follow this policy
When you reset a user's password from Swif, Swif checks the new password against this policy first. Passwords that don't meet it are rejected before they're sent to the device. See How to Reset a Device Password.
Use with the Compliance Center
On Macs, this policy is how Swif checks the AUTH-1 (Strong Authentication) control in the Compliance Center. To pass it, set:
Setting | Required value |
Require passcode on device | On |
Minimum passcode length | 8 or more |
AUTH-1 counts toward SOC 2, ISO 27001, HIPAA, NIST 800-53, NIS 2, CIS, CMMC, and HITRUST.
Session lock (ACC-1) uses the Apple Screen Saver Policy. On Macs, the ACC-1 (Session Lock) control is checked through the Apple Screen Saver Policy, not this policy's Maximum Auto-Lock. To pass ACC-1, require a password after the screen saver starts, and set the idle time to 15 minutes or less in the Screen Saver Policy. Leave Maximum Auto-Lock unset, so the two policies don't conflict.
Before you start
Check your compliance requirements, such as minimum length, maximum age, and lockout rules. To pass Swif's AUTH-1 control, require a passcode, with a minimum length of 8 or more.
Decide on failed attempt limits for iPhones and iPads, since going over the limit erases them.
Check other policies that also control locking or password changes, such as the Apple Screen Saver Policy and the Apple User Authorization Policy.
Tell users before you deploy stricter rules. They may need to change their password at their next sign-in.
Choose a pilot group of devices.
Create the policy
In Swif, go to Device Management > Policies, then select Create new policy > Configure a Policy.
Select Apple Password Policy.
Enter a clear name, such as
Mac Password – CIS.Set the requirements you need.
Save the policy.
Assign it to a device group.
Example configurations
Example 1: Meet the AUTH-1 control
Setting | Value |
Require passcode on device | On |
Minimum passcode length | 8 |
The minimum settings that pass Swif's AUTH-1 (Strong Authentication) control. See Use with the Compliance Center below.
Example 2: Stronger passwords for company Macs
Setting | Value |
Require passcode on device | On |
Minimum passcode length | 12 |
Require Alphanumeric value | On |
Minimum number of complex characters | 1 |
Allow Simple passcode | Off |
Passcode history | 5 |
Maximum number of failed attempts | 5 |
Delay after failed login attempts | 15 |
Passes AUTH-1, and adds complexity, history, and lockout rules. Adjust the values to match your organization's requirements.
Example 3: Company iPhones and iPads
Setting | Value |
Require passcode on device | On |
Minimum passcode length | 6 |
Allow Simple passcode | Off |
Maximum Auto-Lock | 5 |
Maximum number of failed attempts | 10 |
A 6-digit passcode, locking after 5 minutes. The device is erased after 10 failed attempts.
Example 4: Turn off password AutoFill
Setting | Value |
Allow Password AutoFill | Off |
Allow Password Requests from Nearby Devices | Off |
Users can't fill in or share saved passwords. Use this when your organization requires a specific password manager.
Verify the policy
On a Mac:
Go to System Settings > General > Device Management, open the Swif profile, and check that it includes the passcode settings.
Try to change the password to one that breaks the policy, such as one that's too short. macOS should reject it.
On an iPhone or iPad:
Go to Settings > General > VPN & Device Management, and open the Swif profile.
Go to Settings > Face ID & Passcode (or Touch ID & Passcode). If the current passcode doesn't meet the policy, the device asks the user to change it.
In Swif, open the device, and confirm that the policy shows as applied.
Troubleshooting
AUTH-1 shows as failing in the Compliance Center
Check that Require passcode on device is on, and Minimum passcode length is 8 or more. Then check that the policy is assigned to the Mac, and shows as applied.
Users are asked to change their password right after the policy applies
This is expected if their current password doesn't meet the new requirements, or if Reset passcode at next login is on.
Administrator sign-ins fail on a Mac
Reset passcode at next login is on, and the administrator hasn't reset their password yet. Reset the administrator's password, then turn the setting off.
The Mac's idle lock time keeps changing
Maximum Auto-Lock conflicts with the Apple Screen Saver Policy, and the most recently assigned policy wins. Set the same idle time in both, or use only one.
Minimum passcode length isn't applied
Check whether a minimum password complexity setting is also applied to the device. It can override the minimum length. Clear it first, then set the minimum length.
An iPhone or iPad was erased
The user went over Maximum number of failed attempts. On iPhone and iPad, this erases the device. Consider a higher limit.
AutoFill isn't turned off on an iPhone or iPad
Allow Password AutoFill works only on supervised iPhones and iPads.