MT.1229 - Ensure iOS compliance policy requires a strong device passcode.
Overview
Ensure at least one assigned iOS compliance policy requires a strong device passcode.
The passcode is what stands between someone holding the device and everything on it. On a managed iPhone that is corporate mail, Teams conversations, and the Microsoft Authenticator app, which is the second factor for the signed-in user. A phone with no passcode, or with a four digit simple passcode, hands all of that to whoever picks it up, and a stolen phone is the most ordinary way a mobile device is lost to someone else.
Four settings make up the control, and this check requires all four on the same policy, because a device is evaluated against each policy as a whole:
- Require a password to unlock mobile devices - without it, nothing below applies.
- Simple passcodes set to Block - a passcode of 1234 or 1111 is guessed, not broken.
- Minimum password length - six characters by default in this check.
- Maximum minutes of inactivity until screen locks - fifteen minutes by default. A passcode on a screen that never locks protects nothing.
An inactivity timeout that is not configured does not count as a pass. Treating a missing value as "no limit, so under the limit" would report the weakest possible configuration as compliant.
Both thresholds are parameters, so an organization that requires eight characters and a five minute lock can set MinimumPasscodeLength and MaximumInactivityMinutes in its Maester configuration.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an unassigned compliance policy is never evaluated against any device.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Devices > Manage devices > Compliance.
- Select an existing iOS/iPadOS policy, or select + Create policy with Platform set to iOS/iPadOS.
- Under Compliance settings > System Security > Password:
- Set Require a password to unlock mobile devices to Require.
- Set Simple passcodes to Block.
- Set Minimum password length to 6 or more.
- Set Maximum minutes of inactivity until screen locks to 15 or less.
- On the Assignments tab, assign the policy to your iOS device or user groups.
- Select Next and then Create or Save.
Tell users before the policy applies: devices that do not meet the requirement prompt for a new passcode, and users with a four digit passcode have to choose a longer one.
Related links
- Microsoft Intune admin center - Device compliance
- Microsoft Learn - iOS/iPadOS compliance settings in Intune
- Microsoft Learn - Levels of protection and configuration in Intune
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1229 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | Device compliance |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1110 Brute Force, T1111 Multi-Factor Authentication Interception |
| Supports controls | nist-800-53-r5:IA-5(1), nist-800-53-r5:AC-11 |
| PowerShell test | Test-MtIosPasscodePolicy |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1229.ps1 - Documentation:
tests/maester/intune/Test.MT.1229.md