> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Recovery Password Library Item

> Set up the Recovery Password Library Item in Iru Endpoint for managed Mac computers. Configure firmware recovery passwords and escrow recovery credentials.

<Callout icon="apple" color="#B84A7A" iconType="regular">This Library Item is available for Mac computers</Callout>

The Recovery Password Library Item allows you to configure and apply recovery passwords to Mac computers with Apple silicon and EFI firmware passwords to Intel-based Mac computers, all from within the same library item.

Iru Endpoint supports automatically generating per-device passwords with optional configurable time-based rotation, or you can set a manual static password. You can also provide existing known firmware passwords for Intel-based Mac computers to update them using Iru Endpoint automatically.

### Create a Recovery Password Library Item

To add this Library Item to your Iru Endpoint Library, follow the steps outlined in the [Library Overview](/en/endpoint/library/library-items-profiles/library-overview) article.

### Configure the Recovery Password Library Item

<Steps>
  <Step title="Name and Icon">
    **Name** your Library Item, and choose an **icon** if desired.
  </Step>

  <Step title="Select Blueprints">
    Select your desired [**Blueprints**](/en/endpoint/getting-started/blueprints-and-library/configuring-blueprints).
  </Step>

  <Step title="Choose Password Method">
    **Choose** whether to have Iru Endpoint automatically generate device-specific passwords or to specify a static password manually.
  </Step>

  <Step title="Configure Password Rotation">
    If you have Iru Endpoint automatically generate device-specific passwords, choose whether Iru Endpoint should automatically rotate the password and specify how often.
  </Step>

  <Step title="Enable Legacy Passwords">
    If you have firmware passwords already deployed to Intel-based Mac computers, enable the **Legacy Firmware passwords** option so Iru Endpoint can update them.
  </Step>

  <Step title="Add Legacy Password">
    Add a **Legacy password** already deployed to Intel-based Mac computers
  </Step>

  <Step title="Add Additional Passwords">
    Optionally add up to 19 more legacy passwords (20 total) for Iru Endpoint to use when updating them.
  </Step>
</Steps>

<Steps>
  <Step title="Save configuration">
    Click **Save**.
  </Step>
</Steps>

<Warning>
  Iru Endpoint cannot update existing deployed firmware passwords on Intel-based Mac computers unless the currently in-use password(s) are provided to Iru Endpoint in the Legacy Firmware passwords section.
</Warning>

### Device Experience

* **Mac computers with Apple silicon**: The recovery password is applied and no user interaction is required.
* **Intel-based Mac computers**: Users are prompted by the Iru Agent to restart within 30 minutes after a legacy firmware password is applied, whether for the first time or when being rotated. As with the [FileVault Library Item](/en/endpoint/library/deployment-guides/apple/configure-filevault), this counter can **not** be deferred.

### View Recovery Password for a Device

<Note>
  After the recovery password has been set, this option becomes available when the device's next daily check-in completes.
</Note>

<Steps>
  <Step title="Access Device Action Menu">
    Open the **Device Action Menu**.
  </Step>

  <Step title="View Recovery Lock password">
    Click **View Recovery Lock password**.
  </Step>
</Steps>

<Note>
  When removing the Recovery Password Library Item, the recovery password will still show on the device record, even though there won’t be a visible password. This will be removed from the device record at the next daily check-in.
</Note>

### Additional Considerations

#### Blueprint Changes

When you move a device between Blueprints, Iru Endpoint automatically updates the recovery password to match the new Blueprint's settings. For instance, if you move a device from a Blueprint with randomized passwords to one with a fixed password, the device will switch to the fixed password automatically.

#### Removing Recovery Passwords

If you remove the Recovery Password Library Item from a Blueprint or move a device to a Blueprint that doesn't have one, Iru Endpoint will attempt to remove the recovery password from the device.

#### Device Unenrollment

When you delete a device record (which unenrolls it from Iru), macOS automatically removes any applied recovery password. However, legacy firmware passwords remain on the device and must be removed manually.

#### Password Format

When using an automatically generated recovery password to unlock a device, enter it exactly as displayed—including all capital letters and hyphens.

#### Erase Device Commands on Intel Macs with T2 Chip

Intel-based Mac computers with the Apple T2 Security Chip have special behavior when receiving an Erase Device command. If a legacy firmware password is still present, the device will perform a complete erase and require macOS reinstallation instead of the standard Erase All Content and Settings (EACS).

To avoid this and preserve the EACS behavior, move the device to a Blueprint without a Recovery Password Library Item before sending the Erase Device command. This step isn't required for Mac computers with Apple silicon.