macOS ADE passcode policy not enforced during Create Local Account setupSolved

Hi @ren_ben!

macOS doesn’t have a way to pause Setup Assistant until all MDM policies are applied. Most profiles are processed after enrollment completes and the device checks in, so it’s normal for the passcode policy to still be pending when the user reaches the account creation screen.

Sometimes the device checks in quickly enough and the passcode profile gets applied before the user enters a password, which is when macOS shows the password requirements tooltip. But that timing can vary depending on network speed and how many commands are being processed.

What usually works better is keeping the ADE profile light:

1. Associate only the passcode policy, and any absolutely required network-related payloads, with the ADE enrollment profile.<.li>
2. Move heavier tasks, such as endpoint security app installation, FileVault configuration, Firewall settings, and OS update settings, to a separate policy.
3. Target that second policy to a dynamic device group for enrolled macOS devices.

That way, the passcode policy doesn’t have to compete with heavier tasks and has a better chance of being applied while Setup Assistant is still running.

The “Change password at next login” option can be used as a fallback, but it forces users to change their password even if they already chose one that meets the requirements. So, if you want to avoid that extra step, it’s better to leave it disabled and use the split-policy approach.

Best Regards,
Isabel Lora
Hexnode UEM

I tried enabling “Change password at next login”, but it made me reset the password even though I had already used a strong one that matched the policy. Is that normal? It seems like it would be annoying for users.

Yes, that’s expected @ren_ben. macOS treats it as a simple “must change password” flag and doesn’t check whether the current password already meets the policy.

Because of that, it’s usually only useful if you want everyone to change their password after enrollment. If you want to avoid unnecessary prompts, it’s better to leave that setting off. Once the passcode policy is applied, macOS will enforce it, and users with non-compliant passwords will be asked to update them later.

Best Regards,
Isabel Lora
Hexnode UEM