Password Policy

A password policy is a set of rules enforced by an MDM platform that defines the complexity, length, expiry, and history requirements for device passcodes. Password policies help ensure devices are protected against unauthorized physical access through strong authentication.

Common Requirements

Password policies typically include minimum length (e.g., 8 characters), complexity requirements (e.g., uppercase, lowercase, numbers, symbols), expiry intervals (e.g., password must change every 90 days), and history (e.g., cannot reuse last 5 passwords).

Enforcement

The MDM platform enforces password policies through the Device Policy Controller. When a user sets a password, the system checks it against policy requirements and refuses weak passwords. The device prevents users from disabling the lock screen if required by policy.

Biometric Options

Most password policies also allow biometric authentication (fingerprint, facial recognition) as an alternative to traditional passwords. Policies can specify whether biometrics alone are sufficient or require password fallback.

Auto-Lock Configuration

Password policies often include auto-lock settings that automatically lock the device after a period of inactivity (e.g., 5 minutes). This prevents unauthorized access if a device is left unattended.

Compliance Monitoring

The MDM platform monitors password compliance. If a user disables the password lock, the device is flagged as non-compliant and actions are triggered based on the policy configuration.

User Experience

Strong password requirements improve security but can negatively impact user experience. Organizations should balance security requirements with usability. Regular password expiry can be frustrating for users; some organizations use longer expiry intervals (180+ days).

Regulatory Requirements

Many regulations require minimum password requirements. HIPAA requires secure passwords for healthcare data access. PCI-DSS specifies password complexity requirements for payment card systems. Organizations should define policies meeting regulatory requirements.

Password Managers

Supporting password managers can help users manage complex passwords. Some password managers can autofill device lock screens, improving both security and usability.