Skip to main content

​
Platform compatibility

​
Set up the control

1

Go to MDM > Controls > Add new control

Select Password and screenlock.
2

Configure screen lock

Set the Screenlock timeout to define how long a device can be idle before locking.
3

Set password requirements

Configure password strength and renewal settings. Available options vary by platform:
  • Password strength and Allow simple (whether simple passwords are permitted)
  • Password renewal interval
  • Force password change at next login toggle
Enabling Force password change at next login is not recommended if admin accounts are managed by the Admin management control — it will also enforce a password change for those accounts.
4

Configure PIN settings (Windows only)

Under PIN Settings, enter your Microsoft Entra tenant ID in Tenant ID to enable PIN management. Then set PIN strength and PIN renewal.
If PIN settings are not configured, password policy applies to the PIN as well.
5

Select targeting

Choose which devices to apply the control to: all devices, specific device groups, or a custom target.

​
How it works

Password and screen lock rules are enforced via MDM. The policy does not require an immediate password reset when first applied — renewal and strength requirements take effect at the next password change cycle.
Due to a macOS behavior, the screen lock value enforced by Primo may not appear grayed out in System Settings. Even if employees appear to be able to select a different timeout, the MDM-enforced value always takes priority.
Implicit password requirements on macOS:
  • Cannot contain repeated sequences of the same character (e.g. sss, fff)
  • Cannot use consecutive identical characters
  • Certain keywords and easily guessable patterns are not allowed
Available on macOS 13 and later, except macOS Sonoma 14.0–14.2.
While Mac login with Primo is enabled, the macOS password settings follow the Primo password rules and are locked. Only Screenlock stays editable.

​
Modify or remove the control

Open the control from MDM > Controls to edit or disable it. Disabling stops enforcement but does not remove existing configurations from devices.

​
Troubleshooting

A new password is being rejected
  • Check for repeated characters (e.g. sss, aaa) or consecutive letters
  • Avoid reserved words or easily guessable patterns
  • Verify the password meets the configured length and complexity rules