> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Passcode Library Item

> Set up the Passcode Library Item in Iru Endpoint to enforce password and passcode requirements on Apple, Windows, and Android managed devices.

<Callout icon="list-check" color="#B84A7A" iconType="regular">This Library Item is available for Apple, Windows, and Android devices</Callout>

The **Passcode** Library Item in Iru Endpoint lets you define password and passcode requirements for managed devices. By enforcing these requirements, you can strengthen security, maintain compliance, and ensure consistent password hygiene across your fleet.

You can deploy Passcode profiles to **Apple**, **Windows**, and **Android** devices. Each platform includes both shared and platform-specific configuration options.

<Warning>
  When using Passport, you must remove the Passcode Library Item from any Blueprint containing Passport to avoid conflicts. Your IdP should handle password requirements. [Learn more](/en/endpoint/library/passport/passport-compatibility-with-macos-and-iru-endpoint-features#passcode).
</Warning>

## Platform Support Matrix

| Feature                                        | macOS | iOS | tvOS | visionOS | Windows | Android |
| ---------------------------------------------- | ----- | --- | ---- | -------- | ------- | ------- |
| Require Passcode                               | ✅     | ✅   | ✅    | ✅        | ✅       | ✅       |
| Disallow Simple Passcode                       | ✅     | ✅   | ✅    | ✅        | ✅       | ✅       |
| Require Alphanumeric Passcode                  | ✅     | ✅   | ✅    | ✅        | ✅       | ✅       |
| Minimum Passcode Length                        | ✅     | ✅   | ✅    | ✅        | ✅       | ✅       |
| Minimum Complex Characters                     | ✅     | ✅   | ✅    | ✅        | ❌       | ❌       |
| Max Passcode Age                               | ✅     | ✅   | ✅    | ✅        | ✅       | ✅       |
| Passcode History / Repetition                  | ✅     | ✅   | ✅    | ✅        | ✅       | ✅       |
| Require after Sleep / Screen Saver / Lock      | ✅     | ✅   | ✅    | ✅        | ✅       | ❌       |
| Start Screen Saver After Timer                 | ✅     | ❌   | ❌    | ❌        | ❌       | ❌       |
| Maximum failed attempts before account lockout | ✅     | ❌   | ❌    | ❌        | ✅       | ✅       |
| Account lockout duration                       | ✅     | ❌   | ❌    | ❌        | ✅       | ❌       |
| Force password reset                           | ✅     | ❌   | ❌    | ❌        | ❌       | ❌       |
| Maximum available Auto-Lock delay              | ❌     | ✅   | ✅    | ✅        | ❌       | ❌       |
| Maximum Failed Attempts before Erasing Device  | ❌     | ✅   | ✅    | ✅        | ❌       | ✅       |

## Create a Passcode Profile Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

<Steps>
  <Step title="Navigate to Library">
    Navigate to the **Library** and select **Add Library Item**.
  </Step>

  <Step title="Select Passcode">
    Search for and select **Passcode**.
  </Step>

  <Step title="Name the Library Item">
    Give the Library Item a **Name**.
  </Step>

  <Step title="Select Platforms">
    Select the platforms where the profile should be installed under **Install on**.
  </Step>

  <Step title="Assign to Blueprints">
    Assign it to one or more **Blueprints**.
  </Step>
</Steps>

## Shared Settings

These settings are available across platforms:

* **Require passcode**

  Requires a passcode on the device.

* **Disallow simple passcode**

  Prevents simple sequences (e.g., `123`, `CBA`) or repeating characters (e.g., `111`, `AAA`).

* **Minimum passcode length**

  Defines the minimum number of characters in the passcode.

<Note>
  On Windows, this applies to Windows Hello and traditional account passwords. For more on Windows Hello for Business, see [Microsoft's Windows Hello for Business overview](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/).
</Note>

* **Maximum passcode age**

  Number of days a passcode can remain unchanged before a new one is required.

* **Passcode history**

  Prevents reuse of previously used passcodes.

* **Maximum failed attempts before lockout or erasing device**

  The allowed number of failed passcode attempts before all data on the device will be erased, or on Mac, the account is locked.

<Note>
  **Windows**: Setting this key for Windows will result in a device erasure if the threshold is exceeded. Use Account lockout duration below instead to enforce lockouts without device erasure.

  **Non-Mac**: Non-Mac devices will immediately be erased after the number of failed passcode attempts is reached.
</Note>

## Platform-Specific Settings

<Tabs>
  <Tab title="Apple" icon="apple" iconType="brands">
    ### Apple-Specific Settings

    These settings apply only to Apple devices. Platform support is noted in parentheses.

    * **Require alphanumeric passcode** (All Apple platforms)

      Requires letters as well as numbers.

    * **Require passcode after screen lock** (All Apple platforms)

      Defines the time before a passcode is required after screen lock.

    * **Minimum complex characters** (All Apple platforms)

      Defines the number of required special characters such as `%`, `$`, or `#`.

    * **Start screen saver after** (macOS only)

      Defines the idle time before the screen saver starts.

    * **Account lockout duration** (macOS only)

      Determines how long an account remains locked after failed attempts.

    * **Force password reset** (macOS only)

      Prompts the user to reset their password at next login.

    * **Maximum available auto-lock delay** (iOS, iPadOS, tvOS, visionOS)

      Defines the maximum period of time available in the Auto-Lock setting.
  </Tab>

  <Tab title="Windows" icon="microsoft" iconType="brands">
    ### Windows-Specific Settings

    These settings apply only to Windows devices:

    * **Require alphanumeric passcode**

      Require the passcode to contain letters, and not just numbers.

          <Note>
            On Windows, this applies to Windows Hello and traditional account passwords, same as **Minimum passcode length** in Shared Settings. For more on Windows Hello for Business, see [Microsoft's Windows Hello for Business overview](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/).
          </Note>

    * **Configure max inactivity time**

      Sets the maximum number of idle minutes allowed before Windows forces the device to the PIN/password lock screen.

          <Note>
            A device reboot may be required before this setting takes effect.
          </Note>

    * **Account lockout threshold**

      This security setting determines the number of failed logon attempts that causes a user account to be locked out. A locked-out account can't be used until it's reset by an administrator or until the lockout duration for the account has expired.

    * **Prevent administrator lockout**

      Exempts the builtin administrator account from the account lockout policy.

    * **Minimum password length audit**

      Determines the minimum password length for which password length audit warning events are issued. Only enable and configure this setting when trying to determine the potential effect of increasing the minimum password length setting.

    * **Prevent enabling lock screen camera**

      Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen.
  </Tab>

  <Tab title="Android Device Passcode" icon="android" iconType="brands">
    ### Android Device Passcode Settings

    These settings apply to the device-level passcode on Android devices:

    * **Require alphanumeric passcode**

      Requires letters, numbers, and optionally complex characters.

    * **Passcode timeout**

      Defines how long a device can remain unlocked with strong authentication (e.g., fingerprint, face) before requiring the passcode again.

    * **Block on non-compliance**

      Blocks the entire device after the defined number of days. Setting this to `0` blocks immediately.

    * **Erase entire device**

      Erases the device after the defined number of days in non-compliance.

    <Note>
      **Android Considerations**: "Require alphanumeric passcode" is mutually exclusive with "Disallow simple passcode." The Android Management API does not support restricting repeating / ascending / descending characters with alphanumeric passcodes.
    </Note>
  </Tab>

  <Tab title="Android Work Profile Passcode" icon="android" iconType="brands">
    ### Android Work Profile Passcode Settings

    These settings apply specifically to the work profile passcode on Android company-owned work profile devices:

    * **Require alphanumeric passcode**

      Requires letters, numbers, and optionally complex characters for work profile access.

    * **Passcode timeout**

      Defines how long the work profile can remain unlocked with strong authentication before requiring the passcode again.

    * **Block on non-compliance**

      Blocks the work profile after the defined number of days. Setting this to `0` blocks immediately.

    * **Erase entire device**

      Erases the device after the defined number of days in non-compliance.

    <Note>
      **Work Profile Considerations**:

      * The work profile passcode requirements cannot be less strict than the device passcode requirements
      * If both Device Passcode and Work Profile Passcode are configured, Android applies the most restrictive block/erase setting
      * Users will be prompted for the work profile passcode when accessing work applications
    </Note>
  </Tab>
</Tabs>

## Important Considerations

### Max Passcode Age (macOS)

With auto-generated user accounts, such as Auto Admin accounts and accounts created with the `Create a User Account` parameter, the creation date defaults to `12/31/1969`. A passcode reset will be forced during the first login attempt if **Max Passcode Age** is enabled.

### Force Password Reset (macOS)

If you enable **Force Password Reset**, users will be prompted to change their password at their next login. This occurs regardless of whether the existing password meets current complexity requirements. The reset is enforced only once, but you can re-enable the option in the future if needed.

<Warning>
  Consider alerting users before deploying this option to avoid disruption.
</Warning>

### Enrolling Existing Devices

When adding new devices to Iru, users' passwords may never have changed. This could conflict with **Max Passcode Age**. Consider delaying deployment or providing advance notice to users.

## Creating Android Work Profile Passcode Policies

For Android company-owned work profile devices, you can configure a separate passcode policy specifically for the work profile. To create a work profile passcode policy:

<Steps>
  <Step title="Navigate to Library">
    Navigate to the **Library**
  </Step>

  <Step title="Add Library Item">
    Select **Add Library Item**
  </Step>

  <Step title="Select Android Work Profile Passcode">
    Search for and select **Android Work Profile Passcode**
  </Step>
</Steps>

The *Android Work Profile Passcode* Library Item applies passcode policies only to the work profile. Users will be prompted for this passcode when accessing work applications. To reset or set a new work profile passcode, see [Reset Android Work Profile Passcode](/en/endpoint/devices/device-actions/reset-android-work-profile-passcode).

<Note>
  **Deployment**: You can simultaneously deploy both the *Passcode* and the *Android Work Profile Passcode* Library Items to the same device, configuring separate policies for device and work profile access.
</Note>

## Best Practices

<Steps>
  <Step title="Plan your deployment">
    Test passcode policies on a small group of devices before rolling out to your entire fleet.
  </Step>

  <Step title="Communicate with users">
    Inform users about new passcode requirements and provide guidance on creating strong passwords.
  </Step>

  <Step title="Consider user experience">
    Balance security requirements with user convenience to avoid excessive lockouts.
  </Step>

  <Step title="Monitor compliance">
    Regularly check that devices are compliant with passcode policies.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Users locked out after policy deployment">
    **Possible causes:**

    * Existing passwords don't meet new complexity requirements
    * Max passcode age forcing immediate password changes
    * Account lockout threshold too low

    **Solutions:**

    * Provide advance notice before deploying new policies
    * Consider a grace period for password changes
    * Adjust lockout thresholds if appropriate
  </Accordion>

  <Accordion title="Passcode policies not applying">
    **Possible causes:**

    * Device not enrolled or agent not running
    * Policy not assigned to device's Blueprint
    * Platform-specific limitations

    **Solutions:**

    * Verify device enrollment and agent status
    * Check Blueprint assignments
    * Review platform-specific documentation
  </Accordion>

  <Accordion title="Android work profile issues">
    **Possible causes:**

    * Conflicting device and work profile policies
    * Work profile not properly configured
    * Device compliance issues

    **Solutions:**

    * Review both device and work profile passcode settings
    * Ensure work profile is properly set up
    * Check device compliance status
  </Accordion>
</AccordionGroup>

## Security Recommendations

<CardGroup cols={2}>
  <Card title="Strong Requirements" icon="shield">
    Implement strong passcode requirements while considering user experience and productivity.
  </Card>

  <Card title="Regular Updates" icon="refresh">
    Encourage regular password updates and provide tools to help users create strong passwords.
  </Card>

  <Card title="Monitoring" icon="eye">
    Monitor passcode compliance and failed attempt logs for security insights.
  </Card>

  <Card title="Education" icon="book">
    Provide user education on password security best practices and company policies.
  </Card>
</CardGroup>