> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Managing Passwords with Passport
> Manage macOS local account passwords with Passport in Iru Endpoint. Understand password sync behavior, change workflows, and expiration handling with your IdP.
This guide applies to Mac computers
### About Managing Passwords with Passport
Passport password management refers to how Passport handles password synchronization between your Identity Provider and local Mac user accounts. This includes automatic password updates, secure storage, and password reset capabilities. For setup and Library Item configuration, see [Configure the Passport Library Item](/en/endpoint/library/passport/configure-the-passport-library-item).
### How It Works
Passport can securely store user credentials and automatically synchronize password changes between your Identity Provider (IdP) and the local Mac account. When users change their IdP password, Passport can detect this change and update the local Mac password accordingly, ensuring seamless authentication.
### Login, Diagnostics, and Network
At the Passport login window, always enter the user's full email address in the username field so the session uses your IdP instead of local authentication. For how the login window and visibility settings interact with Passport, see [Passport Compatibility](/en/endpoint/library/passport/passport-compatibility-with-macos-and-iru-endpoint-features#login-window).
If a user cannot sign in or password sync seems wrong, open Iru Endpoint Passport Diagnostics with **Command-Shift-K-L** on the Mac. The panel surfaces useful detail, including error messages returned from your IdP.
Passport must reach your IdP to validate credentials and sync passwords. When you customize the Passport login window, enable the network manager so users can join Wi-Fi if needed. The control respects AirPort security settings in macOS.
Passport shows a Wi-Fi icon at the upper-right of the login window; users can click it to join a password-protected network. Passport does not support captive portals, click-through acceptance pages, or enterprise 802.1X networks that require a separate username and password in that flow. To isolate network issues, try a mobile hotspot or wired Ethernet while testing at the Passport login window. For more on Wi-Fi at the login window, see [Passport Compatibility](/en/endpoint/library/passport/passport-compatibility-with-macos-and-iru-endpoint-features#network-wi-fi).
### Ensure Surname (familyName) in Your IdP
Passport requires a **familyName** value in IdP user attributes. Populate **Last name** or the equivalent surname field for every account that signs in with Passport, including service accounts you test with.
### Password Configuration
#### Recommended Password Sync Configuration
To give users the most independent experience and reduce password-related support requests, configure the following in the Passport Library Item.
1. Enable password syncing. In the Passport Library Item, set **Store user password** to **Securely store password** in the Access section so Passport can sync IdP and local passwords automatically. For more on how syncing works, see [Password Syncing with the identity provider](#password-syncing-with-the-identity-provider).
2. Set the password reset URL in the Login Window. In [Customize Login Window](/en/endpoint/library/passport/configure-the-passport-library-item#customize-login-window), configure **Include password reset URL** so users can reset their IdP password from the login window or the Iru Endpoint menu app without contacting support.
You can enable either setting on its own, but the experience is less seamless. With only password syncing, changes sync automatically but users cannot reset their password via the IdP URL. With only the password reset URL, users can reset their IdP password but their local Mac password will not sync.
#### Passport & Passcode Conflicts
It is highly recommended to remove the Passcode Library Item from any Blueprint containing Passport. Your IdP should handle password requirements; otherwise users may see the error below. [Learn more](/en/endpoint/library/passport/passport-compatibility-with-macos-and-iru-endpoint-features#passcode) in Passport Compatibility.
When the Passcode Profile is applying a password requirement that is higher than the requirements defined by the IdP, the following message is displayed to the user at the Passport Login Window:
**Message shown to the user**
The password you entered doesn't yet meet the passcode policy requirements for this Mac; please contact your IT administrator for help.
This Mac has a local passcode policy that applies to passwords that have been changed or created since the policy was put in place. This is common when the Mac passcode policy conflicts with the Identity Provider passcode policy. To resolve this issue, remove the Passcode Library Item from any Blueprints that also contain Passport.
### Password Experience
#### Recommended Order for Password Changes
For the best result, users should change or reset their password in this order:
1. Change their password with your organization's IdP.
2. If a [Passport Reset URL](/en/endpoint/library/passport/configure-the-passport-library-item#customize-login-window) is configured, users can reset their IdP password from the Iru Endpoint menu app or the Passport Login Window.
3. Let Passport sync the local Mac password to match (Passport will prompt the user or update it automatically).
#### Password Reset at the Iru Endpoint Menu App
Users can reset their IdP password from the Iru Endpoint menu by clicking the gear icon and choosing the **Reset Password...** option. They are sent to the Passport reset URL set in your Passport Library Item.
* **Requirement:** The **Reset Password...** option is shown only when the user is logged in with their full email address.
To walk users through the steps, share the [Reset password from the menu bar (while logged in)](/en/endpoint/library/passport/user-experience-with-passport#reset-password-from-the-menu-bar-while-logged-in) section from the User Experience with Passport article.
#### Password Reset at the Passport Login Window
If the password reset URL is configured in the Passport Library Item, Passport shows a reset link after a user enters an incorrect IdP password three times at the Passport (local) login window.
* **Requirement:** **Include password reset URL** must be enabled in [Customize Login Window](/en/endpoint/library/passport/configure-the-passport-library-item#customize-login-window).
To walk users through the steps, share the [Reset password at the login screen](/en/endpoint/library/passport/user-experience-with-passport#reset-password-at-the-login-screen) section from the User Experience with Passport article.
### Password Syncing with the Identity Provider
The **Store user password** setting in the Passport Library Item, in the [Access](/en/endpoint/library/passport/configure-the-passport-library-item#access) section, controls how Passport syncs IdP and local Mac passwords. The two options behave as follows.
#### Securely Store Password
Passport stores credentials and can automatically sync the local password with the IdP password.
* **Logged out:** If a user changes their IdP password and then signs in at the Passport login window, Passport updates the local password to match automatically.
* **Logged in:** If a user changes their IdP password while logged in, Passport prompts them within 5 minutes; the user enters only their IdP password and Passport updates the local password.
#### Do Not Store Password
Passport does not store the local password. The user must provide it whenever Passport syncs.
* **Logged out:** If a user changes their IdP password and then signs in at the Passport login window, Passport asks for their local password before updating it to match.
* **Logged in:** If a user changes their IdP password while logged in, Passport prompts within 5 minutes; the user must enter both their local password and their IdP password to update.
* **Login with new IdP password but old local password:** If the user signs in with their new IdP password and their local password does not match, Passport prompts for the old local password. With **Do not store password**, the user must enter both passwords.
#### Password Syncing with Okta
When using Okta with Passport, set **Refresh Token** in your Passport OIDC application as follows:
* **Refresh Token disabled (recommended):** Use this when **Store user password** is set to **Securely store password**. If Refresh Token is left enabled, Passport will not prompt users to update their password while they are logged into their Mac.
* **Refresh Token enabled:** Use this only when **Store user password** is set to **Do not store password**, to avoid users being repeatedly prompted for their credentials while logged in.
For setup and options, see [Passport Configuration with Okta](/en/endpoint/library/passport/okta/passport-configuration-with-okta). For issues, see [Passport Troubleshooting with Okta](/en/endpoint/library/passport/okta/passport-troubleshooting-with-okta).
### Password Changes in System Settings
If a user changes their password locally in System Settings, it will go out of sync with Passport. Passport will then prompt the user for their new local password to bring the local password back in sync, which sets the local password to match the IdP. Users should change their password with their IdP so that Passport can sync it with their Mac.
To prevent users from changing their password in System Settings, use a [Restrictions Library Item](/en/endpoint/library/library-items-profiles/configure-the-restrictions-library-item) and enable **Disallow passcode modification** in the [**Passcode & authentication**](/en/endpoint/library/library-items-profiles/configure-the-restrictions-library-item#passcode-and-biometric-settings) group. With this restriction applied, the option for users to change their password in System Settings will be inactive.
### Password Check Frequency
Passport checks the user's password every 5 minutes and every online login from the login window. These checks ensure that the local account password and the user's IdP password are the same. If they aren't, the user is prompted to provide their IdP password.
### Troubleshooting
**What you see:**
Users do not see a way to reset their IdP password from the Passport login window or the Iru Endpoint menu app.
**What to do:**
* Follow [Recommended password sync configuration](#recommended-password-sync-configuration): enable password syncing as needed and set **Include password reset URL** in [Customize Login Window](/en/endpoint/library/passport/configure-the-passport-library-item#customize-login-window).
* Remember that at the **FileVault login window** (before the disk unlocks), the menu app and Passport reset URL are not available. Use [Password reset at the FileVault login window](#password-reset-at-the-filevault-login-window) when the user is stuck there.
**What you see:**
The user needs to reset a password while only the FileVault pre-boot screen is shown (after power on or restart, before the normal login screen).
**What to do:**
* The startup disk is still encrypted and Iru Endpoint and Passport are not running there, so the password reset URL and menu app cannot be used. Unlock with the **FileVault recovery key** and reset the local password using the steps in [If FileVault 2 is Enabled](/en/endpoint/devices/device-actions/reset-a-macos-user-password#if-filevault-2-is-enabled) in [Reset a macOS user password](/en/endpoint/devices/device-actions/reset-a-macos-user-password).
* After the user reaches the Passport login window, they can align the IdP password using the reset URL if you configured it. See [Password Reset at the Passport Login Window](#password-reset-at-the-passport-login-window).