This control sets the password rules and the idle time before the screen locks on managed devices. Use it to make sure every laptop and phone in the fleet needs a strong credential and locks itself when nobody is using it.

Feature/Functionality

Overview

The control covers two things: the Screenlock timeout, and the password (or passcode) requirements. The password options you see depend on the platform. On Windows you can also manage the sign-in PIN separately.

How to use

1. Go to MDM > Controls > Add new control and choose Password and screenlock.
2. Set the Screenlock timeout. This is how long a device can sit idle before it locks.
3. Set the password requirements. The options per platform are listed in the next section.
4. On Windows only, fill in PIN Settings if you want to manage the PIN (see below).
5. Choose where the control applies: all devices, specific device groups, or a custom target.

Password options by platform

macOS

• Password strength, plus Allow simple to decide whether simple passwords are accepted.
• Password renewal interval.
• Force password change at next login toggle.

Windows

• Password strength and Password renewal, both under Password Settings.

iOS / iPadOS

• Passcode strength.

Android

• Password strength and Password renewal.

PIN settings (Windows only)

1. Under PIN Settings, enter your Microsoft Entra tenant ID in Tenant ID. Without it, PIN management stays off.
2. Set PIN strength and PIN renewal.

If you leave PIN settings empty, the password policy also covers the PIN.

How it works on each platform

macOS. The rules are enforced through MDM. Nobody is forced to reset their password when the control first lands: strength and renewal rules kick in at the next password change.

macOS also applies some rules of its own on top of yours:

• No runs of the same character, such as sss or fff.
• No consecutive identical characters.
• Some keywords and easy-to-guess patterns are refused.

Supported on macOS 13 and later, except macOS Sonoma 14.0 to 14.2.

Because of how macOS behaves, the enforced screen lock value may not look greyed out in System Settings. An employee may seem able to pick another timeout, but the value set through MDM always wins.

While Mac login with Factorial IT is turned on, the macOS password settings follow the Factorial IT password rules and cannot be edited. Only Screenlock remains editable.

Windows. Password and screen lock settings are enforced as an MDM policy. The PIN needs your Microsoft Entra tenant ID and is handled apart from the account password.

• Password renewal does not force an immediate reset. It counts from the last time the password was changed.
• PIN renewal makes the employee update the PIN at the next login if it does not meet the rules.

iOS / iPadOS. Passcode strength and screen lock apply to supervised iPhones and iPads.

Android. Screen lock type, password strength and password renewal are enforced on enrolled Android devices.

Change or switch off the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement. It does not remove settings already applied on devices.

Troubleshooting and FAQ

Troubleshooting

• A new password is rejected.
  • Look for repeated characters, such as sss or aaa, or consecutive letters.
  • Avoid reserved words and easy-to-guess patterns.
  • Check that the password meets the length and complexity you configured.
• An employee changed the screen lock timeout on their Mac. The setting may not appear greyed out, but the MDM value still applies.
• The control does not apply to a Mac. Check the macOS version. macOS 13 and later is supported, except Sonoma 14.0 to 14.2.

FAQ

1. Do employees have to change their password as soon as the control is applied?
   Not on macOS, where the rules apply at the next password change. On Windows, length and complexity rules force a change at the next sign-in.
    
2. What happens to the Windows PIN if I leave PIN settings empty?
   The password policy applies to the PIN as well.
    
3. Does the control work on Linux?
   No. It supports macOS, Windows, iOS / iPadOS and Android.
    
4. If I disable the control, are the settings removed from devices?
   No. Enforcement stops, but settings already applied stay on the device.