Require passwords for managed mobile devices

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Starter, Business Standard, and Business Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, Teaching and Learning Upgrade, Education Plus, and Endpoint Education Upgrade; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; G Suite Basic and G Suite Business; Cloud Identity Free and Cloud Identity Premium. Compare your edition

As an administrator, you can protect your organization's data by requiring users to set a screen lock or password on managed mobile devices. With advanced mobile management, you can set minimum password characteristics and require that users reset their password regularly.

Understand the user impact

• Users get a notification when their passwords don't comply with your requirements. Users have 24 hours to update their passwords. After that period, they can't access their work data until they set an acceptable password.

  Note: To enforce your password requirements immediately with no grace period, you can set up Context-Aware Access to block non-compliant devices. Devices must be under basic or advanced mobile management and the user must have a license that supports Context-Aware Access. Learn more

• If you use basic management and require a password, passwords aren't enforced for Android 5.1.1 Lollipop and earlier devices or Apple iOS 7 and earlier devices.

Set password requirements

Expand section  |  Collapse all

Basic option: Require a screen lock or password

Before you begin: To apply the setting for certain users, put their accounts in an organizational unit.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsUniversal.
3. Click GeneralPassword requirements.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Check the Require users to set a password box.
6. Select Basic.
7. (Optional) If you use basic mobile device management and want to require passwords on devices earlier than Android 6.0 Marshmallow, check the Require users of pre-Android 6.0 (Marshmallow) devices to set a password box.
8. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.

Advanced option: (Recommended) Require a strong password

Supported editions for this feature: Frontline Starter and Frontline Standard; Business Plus; Enterprise Standard and Enterprise Plus; Education Standard, Education Plus, and Endpoint Education Upgrade; Enterprise Essentials and Enterprise Essentials Plus; G Suite Basic and G Suite Business; Cloud Identity Premium. Compare your edition

Requires advanced mobile management

Before you begin: To apply the setting for certain users, put their accounts in an organizational unit.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsUniversal.
3. Click GeneralPassword requirements.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Check the Require users to set a password box.
6. Choose a password strength:

   • Basic—Any screen lock patterns are accepted.

   • Standard—Requires a PIN or password. Screen lock patterns are not accepted. A password can contain any characters in any order. 
     Note: Android 12 and above personal devices (BYOD) that apply password settings at the device level require a PIN or password. The PIN can’t have repeating (4444) or ordered (1234, 4321, 2468) sequences.

   • Strong—Requires at least one character, number, and symbol (or the custom strength settings you set for Android devices). Not supported on Windows Phone 7 and 7.5 devices.
     Note: Android 12 and above personal devices (BYOD) that apply password settings at the device level require a PIN or password. The PIN can’t have repeating (4444) or ordered (1234, 4321, 2468) sequences.

7. For Minimum characters, enter a minimum password length. Strong passwords should have 3 or more characters.
   Note: Minimum password length is not supported for Android 12 and above personal devices (BYOD) that apply password settings at  the device level. Standard password length must have at least 4 characters, and Strong must have at least 6 or 8 characters for the PIN. 
8. (Optional) To lock the device screen after it's inactive for some time, select a time from the Time until screen locks menu.

   This setting overrides mobile devices' default values. For iPhones, the default is 5 minutes. For iPads, the default is 15 minutes.

9. (Optional) To prompt users to reset their password regularly, check the Set a password lifespan box and enter the number of days. Supported on Android 3.0 Honeycomb and later devices.
10. (Optional) To prevent the reuse of expired passwords, check the Block expired passwords box and enter the number of previous passwords that can’t be used again. For example, enter 2 to block the user from reusing their last 2 device passwords. Supported on Android 3.0 and later devices.
11. (Optional—Use with caution) To automatically wipe a device when a user enters too many incorrect passwords, check the Wipe device after failed attempts box and enter a number. On iOS, the user gets one less failed attempt than on Android. For example:
    • On Android–If you enter 5, after the fifth failed attempt, the device is wiped and reset to its factory settings.
    • On iOS–If you enter 5, after the fourth failed attempt, the device is wiped and reset to its factory settings.
12. (Optional) If you selected Strong in step 7, you can override the one character, number, symbol, and biometric requirements for Android devices. Check the Apply custom strength settings for Android box and select the requirements. 
    Important: This setting is not supported for Android 12 and above personal devices (BYOD) that apply password settings at the device level. 
13. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.

Less secure option: (Not recommended) Turn off password requirements

Before you begin: To apply the setting for certain users, put their accounts in an organizational unit.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesMobile & endpointsSettingsUniversal.
3. Click GeneralPassword requirements.
4. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
5. Uncheck the Require users to set a password box.
6. Click Save. If you configured a child organizational unit, you might be able to Inherit or Override a parent organizational unit's settings.

Related topics

• Apply settings for Android mobile devices
• Apply settings for iOS devices
• Apply universal settings for mobile devices and endpoints
• Enforce and monitor password requirements for users

_{Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.}