Device policies

Settings → Apple → Device policies. Two tabs: Passcode and OS Updates.

Screen passcode

1. Click New passcode policy or Create policy.

2. Give it a name. The fields on the form stay in English:

   • Require a passcode — the device must have a screen passcode.
   • Require letters and numbers — it must contain both letters and numbers.
   • Reject simple sequences and repeated characters — block a passcode that is too simple.
   • Minimum length, Minimum special characters.
   • Maximum failed attempts — how many wrong entries are allowed. Past that number, the iPhone can erase its data under Apple’s rule. It does not only lock the screen.
   • Auto-lock after minutes, Maximum grace period minutes — how soon it locks itself, and how long it can be opened again without the passcode.
   • Maximum passcode age days, Passcode history — how long one passcode may be used, and how many old passcodes cannot be reused.

3. Save, then assign it to a group, a user group, or the whole organization on Defaults.

After you assign it, the device asks the user to set a passcode that matches the rule. Removing the policy does not clear a passcode already set. To clear the current passcode, use the Clear Passcode command on the commands page, on a device that has sent an unlock token.

Operating-system update

1. Open the OS Updates tab and create a new policy.

2. Choose the iOS / iPadOS platform. Choose a version in Target release. If Apple’s version list does not load, type the version number by hand.

3. Fill in Enforcement deadline — the deadline in the device’s local time. Assign it the same way as a passcode policy.

Common questions

How is this different from Compliance policies?

This page makes the device change state (set a passcode, update the OS). Compliance only scores pass or fail, and can lock or wipe if you add an action.

Can I create a passcode inside Configuration profiles?

No. The configuration-profile form has no passcode type. Use this page.

They travel to the device together