# Passcode Policy > Configure the Passcode policy on Apple devices with Applivery. Set minimum length, complexity, expiration, failed attempts and auto-lock, with the exact limits Apple enforces. Source: https://docs.applivery.com/en/device-management/apple/apple-policies/passcode/ • Last updated: 2026-08-08 **Key topics:** Apple passcode requirements, Passcode expiration and history, Failed attempts and data erasure, User Enrollment limitations, Applivery, Apple, iOS, macOS --- **TL;DR:** Set passcode requirements on Apple Devices from Policies > Add configuration > Passcode. No supervision needed. Watch the failed-attempts setting: on iOS it erases the Device. The passcode is the single control that everything else on an Apple Device depends on. Data Protection encrypts the Device's storage, but that encryption is only meaningful if there's a passcode protecting it — without one, the data is effectively unprotected no matter what else you configure. You can verify both conditions on a Device in [Security Info](https://docs.applivery.com/en/device-management/apple/security-info/). The **Passcode** configuration is where you define what that passcode has to look like: how long, how complex, how often it changes, and what happens when someone gets it wrong too many times. ## Prerequisites - The Apple Device is enrolled in Applivery. - The Policy is correctly assigned to the target Device(s). :::info **Supervision is not required.** Apple lists this payload as `Requires supervision: N/A`, so it applies to [supervised](https://docs.applivery.com/en/device-management/apple/supervision/) and unsupervised Devices alike. ::: ## Configuration Once in the [**Applivery Dashboard**](https://dashboard.applivery.io), go to any of your **Policies** 1. From the left side menu, select **\+ Add configuration** and choose **Passcode** 2. ![passcode](https://docs.applivery.com/int/_r2/media/09ac0a4e-3ad8-478f-9f15-3474973eec71/8fa3efe6-caa7-4975-8881-4e68801a5837.png) ## What you can set ### Requiring a passcode **Force PIN** is the setting that makes a passcode mandatory. It's **off by default**, which is worth pausing on: without it, none of the other settings force the user to have a passcode at all — they only describe what the passcode must look like _if_ the user sets one. If you take one thing from this article, take this: turn Force PIN on first, then configure the rest. ### Length and complexity

Setting	What it does	Range
Minimum length	Minimum overall length of the passcode.	0–16 · default `0`
Allow simple	When off, blocks repeated characters and sequences such as `1111`, `123` or `CBA`.	Default: allowed
Require alphanumeric	Requires letters, not just digits.	Default: off
Minimum complex characters	Minimum number of characters that are neither letters nor digits — `&`, `%`, `$`, `#`.	0–4 · default `0`

Two details that trip people up: - **Minimum length maxes out at 16.** If a security requirement asks for more, it isn't achievable through this payload. - **Minimum length and minimum complex characters are independent.** Requiring 2 complex characters doesn't imply any total length — set both. For the common requirement of _"a 6-digit PIN that isn't trivial"_: Minimum length `6` + Allow simple **off**, leaving Require alphanumeric off. ### Rotation and reuse

Setting	What it does	Range
Maximum PIN age in days	Days the passcode can stay unchanged. When the limit is reached, the system forces a change before unlocking.	1–730
PIN history	The new passcode must be different from the last N used.	1–50

For a 12-month rotation, set 365. Pair it with PIN history, or users will alternate between two passcodes indefinitely. ### Idle locking

Setting	What it does	Range
Auto-Lock	Maximum idle minutes before the Device locks and asks for the passcode.	0–15 (macOS: up to 60)
Maximum grace period	Minutes during which the Device can be unlocked again without re-entering the passcode.	Default `0` — no grace period

:::warning **Auto-Lock is expressed in whole minutes.** There's no sub-minute granularity, so a requirement like _"lock after 90 seconds"_ isn't representable — you have to choose 1 minute (stricter) or 2 (looser). Setting the value also removes the **Never** option from the user's Settings. ::: Auto-Lock is a **ceiling**, not a fixed value: the user can pick a shorter time, but never a longer one. It's covered in more depth in [Auto-Lock](https://docs.applivery.com/en/device-management/apple/apple-policies/auto-lock/). ### Failed attempts

Setting	What it does	Range
Maximum failed attempts	Failed passcode entries allowed before the Device erases or locks.	2–11 · default `11`

:::warning **On iOS, iPadOS, visionOS and watchOS, exceeding this limit securely erases all data and settings from the Device.** It doesn't lock it — it wipes it. Only macOS locks instead. This is not a setting to tighten casually. A low value on a Device used by someone who mistypes their PIN a few times means real data loss, and there's no undo. ::: After six failed attempts, the Device imposes an increasing time delay between entries. That means values of 6 or lower behave differently from higher ones: there's no delay before the erase or lock; it happens as soon as the limit is passed. ### macOS-only settings

Setting	What it does
Change at next auth	Forces a password reset the next time the user authenticates. In a device profile, it affects all users, and admin authentications may fail until the admin password is also reset.
Minutes until failed login reset	Minutes before the login resets after the maximum failed attempts. Requires the failed-attempts limit to be set.
Custom regex	A regular expression the password must match, plus a localized description of the rule. macOS 14+.

:::warning Use **Custom regex** only when the standard settings genuinely can't express your requirement. A mistake produces either an unsatisfiable passcode policy or a description that doesn't match what's actually enforced, and the user is the one who discovers it, at the worst moment. The expression uses ICU syntax and is limited to 2048 characters. ::: ## What the Passcode configuration cannot do Three things are commonly asked for, and none of them live here: - **Requiring biometrics.** Apple has no key that forces a user to enrol Face ID or Touch ID. You can restrict biometrics, never mandate them. The verifiable control is the passcode itself. - **Setting a specific passcode.** The configuration defines _minimums_. Users choose their own passcode and can change it to any other compliant one. - **Blocking passcode changes.** That's a **Restrictions** setting, and unlike the Passcode payload, it **does require a supervised Device**. ## Personal Devices (User Enrollment) On BYOD Devices enrolled through User Enrollment, Apple accepts the payload but **ignores most of its settings**. Instead, its presence forces a fixed set of rules:

Setting	What Apple applies
Force PIN	Always on
Minimum length	Always 6
Allow simple	Always off
Auto-Lock	Value ignored — only the Never option disappears from Settings
Minimum complex characters	Ignored

Everything else — expiration, history, failed attempts — **is not applied**. If your requirement includes passcode rotation or a specific auto-lock time, User Enrollment can't satisfy it, and you need Device Enrollment or [Automated Device Enrollment](https://docs.applivery.com/en/device-management/apple/enrollment/dep/). This is the single most common source of _"I configured it, and nothing happened"_ on Apple Devices. Before troubleshooting the Policy, check how the Device was enrolled.