Enforce passcode requirements on iOS devices using a configuration profile

Mobile devices used by an organization can store sensitive information that requires protection. One of the key security measures that the organizations can take to safeguard their devices and data is to use a passcode. However, enforcing passcode requirements across a fleet of iOS devices can be a challenge, especially for IT administrators who need to ensure that all devices meet specific security standards. This is where configuration profiles come into play. By leveraging a configuration profile, IT administrators can easily set passcode requirements and enforce them across all iOS devices within their network.

To deploy this profile to multiple devices, you can use Hexnode’s Deploy Custom Configuration feature.

Set up passcode requirements

Use the custom configuration profile to enforce the passcode requirements on the devices.

Configure the below keys in the configuration profile based on your preferences.

1. The <key>allowSimple</key> key allows the users to set a simple passcode that contains characters that are repeated or arranged in increasing or decreasing order. For example, 12345 or ABCDEF.
2. The <key>maxFailedAttempts</key> specifies the maximum number of unsuccessful attempts that a user can make to enter the correct passcode. If this limit is exceeded, the device will introduce a time delay before allowing another passcode entry. The length of the delay will progressively increase with each subsequent failed attempt. When this number is exceeded in iOS, the device is wiped.

The minimum value is 2 and the maximum value can be 11.

3. The <key>maxGracePeriod</key> specifies the maximum grace period, in minutes, to unlock a phone without the need to enter a passcode. The default value is 0, indicating that there is no grace period, and a passcode is required immediately.
4. The <key>maxInactivity</key> sets the upper limit on the number of minutes that a device can remain idle without being unlocked by the user before the system automatically locks it. When this time limit is reached, the device is locked and requires the user to enter the passcode. While this setting can be customized by the user, it cannot exceed the maximum value specified here.

The minimum value is 0 and the maximum value can be 15.

5. The <key>maxPINAgeInDays</key> determines the number of days for which the passcode can be used before it must be changed. Once this time period has elapsed, the user will be required to change the passcode before being able to unlock the device.

The minimum value is 0 and the maximum value can be 730.

6. The <key>minComplexChars</key> determines the minimum number of complex characters that are required to be included in a passcode. Complex characters are defined as characters that are not numbers or letters, such as *^$#. Note that for User Enrollments, this property is not applicable.

The minimum value is 0 and the maximum can be 4.

7. The <key>minLength</key> sets the minimum length required for a passcode.
   The minimum value is 0 and the maximum can be 16.
8. The <key>pinHistory</key> specifies the number of previous passcodes that a new passcode must not match. Assuming a value of 6 has been set, if a user changes their current passcode from “1234abc,” they will be unable to reuse it as their passcode for the next six attempts.

The minimum value is 1 and the maximum can be 50.

9. The <key>requireAlphanumeric</key> requires the use of alphabetic characters in the passcode, in addition to numeric characters.
10. If <key>forcePIN</key> key is set to true, it forces the user to set a PIN.