Requirements for the password used to unlock a device.
JSON representation |
---|
{ "passwordMinimumLength": integer, "passwordMinimumLetters": integer, "passwordMinimumLowerCase": integer, "passwordMinimumNonLetter": integer, "passwordMinimumNumeric": integer, "passwordMinimumSymbols": integer, "passwordMinimumUpperCase": integer, "passwordQuality": enum ( |
Fields | |
---|---|
passwordMinimumLength |
The minimum allowed password length. A value of 0 means there is no restriction. Only enforced when |
passwordMinimumLetters |
Minimum number of letters required in the password. Only enforced when |
passwordMinimumLowerCase |
Minimum number of lower case letters required in the password. Only enforced when |
passwordMinimumNonLetter |
Minimum number of non-letter characters (numerical digits or symbols) required in the password. Only enforced when |
passwordMinimumNumeric |
Minimum number of numerical digits required in the password. Only enforced when |
passwordMinimumSymbols |
Minimum number of symbols required in the password. Only enforced when |
passwordMinimumUpperCase |
Minimum number of upper case letters required in the password. Only enforced when |
passwordQuality |
The required password quality. |
passwordHistoryLength |
The length of the password history. After setting this field, the user won't be able to enter a new password that is the same as any password in the history. A value of 0 means there is no restriction. |
maximumFailedPasswordsForWipe |
Number of incorrect device-unlock passwords that can be entered before a device is wiped. A value of 0 means there is no restriction. |
passwordExpirationTimeout |
Password expiration timeout. A duration in seconds with up to nine fractional digits, ending with ' |
passwordScope |
The scope that the password requirement applies to. |
requirePasswordUnlock |
The length of time after a device or work profile is unlocked using a strong form of authentication (password, PIN, pattern) that it can be unlocked using any other authentication method (e.g. fingerprint, trust agents, face). After the specified time period elapses, only strong forms of authentication can be used to unlock the device or work profile. |
unifiedLockSettings |
Controls whether a unified lock is allowed for the device and the work profile, on devices running Android 9 and above with a work profile. This can be set only if |
PasswordQuality
Password quality requirements.
Note:
- Complexity-based requirements are
COMPLEXITY_LOW
,COMPLEXITY_MEDIUM
andCOMPLEXITY_HIGH
. - An instance of
is said to be device-scoped if it hasPasswordRequirements
set topasswordScope
.SCOPE_DEVICE
- Complexity-based requirements can only be specified in a device-scoped instance of
.PasswordRequirements
- If
has a device-scoped element withpasswordPolicies
set to a complexity-based value, then it must also have another device-scoped element withpasswordQuality
set to a non-complexity-based value. In this case, only the complexity-based value applies to personally owned work profile devices on Android 12 and above, and only the non-complexity-based value applies on all other devices.passwordQuality
- A non-complexity-based device-scoped requirement applied on personally owned work profile devices on Android 12 and above will be treated as the next strictest complexity-based requirement for application. This may lead to a slight discrepancy between the requested requirements and the applied requirements.
- See
for which password requirements are actually taking effect on the device.appliedPasswordPolicies
Enums | |
---|---|
PASSWORD_QUALITY_UNSPECIFIED |
There are no password requirements. |
BIOMETRIC_WEAK |
The device must be secured with a low-security biometric recognition technology, at minimum. This includes technologies that can recognize the identity of an individual that are roughly equivalent to a 3-digit PIN (false detection is less than 1 in 1,000). This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
SOMETHING |
A password is required, but there are no restrictions on what the password must contain. This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
NUMERIC |
The password must contain numeric characters. This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
NUMERIC_COMPLEX |
The password must contain numeric characters with no repeating (4444) or ordered (1234, 4321, 2468) sequences. This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
ALPHABETIC |
The password must contain alphabetic (or symbol) characters. This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
ALPHANUMERIC |
The password must contain both numeric and alphabetic (or symbol) characters. This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
COMPLEX |
The password must meet the minimum requirements specified in This, when applied on personally owned work profile devices on Android 12 device-scoped, will be treated as |
COMPLEXITY_LOW |
Define the low password complexity band as:
This sets the minimum complexity band which the password must meet. Enforcement varies among different Android versions, management modes and password scopes. See |
COMPLEXITY_MEDIUM |
Define the medium password complexity band as:
This sets the minimum complexity band which the password must meet. Enforcement varies among different Android versions, management modes and password scopes. See |
COMPLEXITY_HIGH |
Define the high password complexity band as: On Android 12 and above:
This sets the minimum complexity band which the password must meet. Enforcement varies among different Android versions, management modes and password scopes. See |
RequirePasswordUnlock
The length of time after a device or work profile is unlocked using a strong form of authentication (password, PIN, pattern) that it can be unlocked using any other authentication method (e.g. fingerprint, trust agents, face). After the specified time period elapses, only strong forms of authentication can be used to unlock the device or work profile.
Enums | |
---|---|
REQUIRE_PASSWORD_UNLOCK_UNSPECIFIED |
Unspecified. Defaults to USE_DEFAULT_DEVICE_TIMEOUT. |
USE_DEFAULT_DEVICE_TIMEOUT |
The timeout period is set to the device’s default. |
REQUIRE_EVERY_DAY |
The timeout period is set to 24 hours. |
UnifiedLockSettings
Controls whether a unified lock is allowed for the device and the work profile, on devices running Android 9 and above with a work profile. This has no effect on other devices.
Enums | |
---|---|
UNIFIED_LOCK_SETTINGS_UNSPECIFIED |
Unspecified. Defaults to ALLOW_UNIFIED_WORK_AND_PERSONAL_LOCK . |
ALLOW_UNIFIED_WORK_AND_PERSONAL_LOCK |
A common lock for the device and the work profile is allowed. |
REQUIRE_SEPARATE_WORK_LOCK |
A separate lock for the work profile is required. |