Citrix Endpoint Management

Passcode device policy (Technical Preview)

May 7, 2025

Contributed by:

C S

Note:

Features in the Technical Preview are available to use in non-production or limited production environments, and to give customers an opportunity to share feedback. Citrix does not accept support cases for features in technical preview but welcomes feedback for improving them. You can provide feedback on this feature by clicking Send us your feedback. Citrix might act on feedback based on its severity, criticality, and importance.

The Passcode device policy creates passcode requirements based on the standards of your organization. You can require a code on devices and can set formatting rules and other passcode rules, such as the grace period before device lock.

To add or configure this policy, go to Configure > Device Policies. For more information, see Device policies.

Prerequisites

CEM version is equal to or greater than 25.5.0.
The feature flag ios.mdm.declarative.management is activated. Contact your admin to enable this feature if needed.

iOS settings

Passcode device policy

Require passcode: Select this option to require a passcode and to display the configuration options for an iOS passcode device policy. If On, requires the user to set a passcode without any requirements about the length or quality of the passcode and the page expands to let you configure settings for passcode requirements and passcode security. The default is On.
Passcode requirements
- Require Alphanumeric Passcode: Select whether to require the passcode to consist of at least one alphabetic character and at least one number. The default is Off.
- Require Complex Passcode: Select whether to require a complex passcode. A complex passcode is one that doesn’t contain repeated characters or increasing or decreasing characters (such as 123 or CBA), and must contain at least one nonnumeric and nonalphabetic character. The default is Off.
- Minimum Passcode Length: Select the minimum number of characters a passcode can contain. The default is 6.
- Minimum Complex Characters: Select the minimum number of complex characters in the password. A complex character is a character other than a number or a letter, such as &, %, $, and #. The default is 0.
Passcode security
- Maximum Number of Failed Attempts: Select the number of failed passcode attempts that the system allows the user before iOS erases the device. If you don’t change this setting, after six failed attempts, the device imposes a time delay before the user can enter a passcode again. The time delay increases with each failed attempt. After the final failed attempt, the system securely erases all data and settings from the iOS device. The passcode time delay begins after the sixth attempt, so if this value is six or lower, the system has no time delay and triggers the erase or lock as soon as the user exceeds the limit. The default is 11.
- Maximum Grace Period: Select the maximum period during which the user can unlock the device without a passcode. A value of 0 means no grace period, and the device requires a passcode immediately. In the absence of this key, the user can select any period. The default is immediately.
- Automatic Device Lock: Select the maximum period during which the device can be idle before the system automatically locks it. When the device reaches this limit, the device locks and the user must enter the passcode to unlock it. In the absence of this key, the user can select any period. Set the value to None to disable the policy. The default is None.
- Maximum Passcode Age: Select the maximum number of days that the passcode can remain unchanged. After this number of days, the system forces the user to change the passcode before it unlocks the device. Valid values are 0–730. The default is 0, which means the passcode never expires.
- Passcode Reuse Limit: Select the number of historical passcode entries the system checks when validating a new passcode. The device refuses a new passcode if it matches a previously used passcode within the specified passcode history range. Valid values are 0–50. The default is 0, which means users can reuse passwords.

Note:

If the same setting is sent as an MDM profile and a declarative configuration to a device, the same rules apply as if the setting was delivered by multiple profiles. For example, if passcode policies are configured by a profile (via Passcode policy) and a configuration (via declarative Passcode policy), the policies are merged and the strictest settings are enforced.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Passcode device policy (Technical Preview)

May 7, 2025

Contributed by:

C S

May 7, 2025

Contributed by:

C S

Passcode device policy (Technical Preview)

Prerequisites

iOS settings

In this article