Organization versus profile password policies
Key Takeaway
To give one group of users different password rules, set Password Policies on their profile. Profile Password Policies override the org-wide Password Policies for that profile's users, so users on other profiles keep their current rules.
Password Policies set how strong user passwords must be, how long passwords last, and what happens after too many failed logins. You set them once for the whole org, and you can also set them on individual profiles. When a profile has its own Password Policies, they replace the org-wide Password Policies for users of that profile. Knowing which level applies tells you where to make a change and which users the change reaches.
Org-wide Password Policies
You set the org-wide Password Policies in Setup, on the "Password Policies" page. The page covers settings such as password expiration, password history, minimum length, complexity, maximum invalid login attempts, and lockout period. You need the "Manage Password Policies" permission to set these policies.
A new org starts with default values for several of these settings. You can change the defaults in all editions except Personal Edition.
| Setting | Default in a new org |
|---|---|
| Minimum length | 8 characters |
| Complexity | Includes one alphabetic character and one number |
| Password history | Users can't reuse their last 3 passwords |
| Password expiration | 90 days |
| Lockout period | 15 minutes |
Some rules always apply to passwords:
- A password can't contain the user's username.
- A password can't match the user's first or last name.
- A password can't be too simple, for example "password".
The org-wide Password Policies page also lets you add a "Message" and a "Help link" for users who can't reset their own password. You can use them for details such as your help desk name. The message appears in the "We can't reset your password" email and on the "Answer Your Security Question" page. The message shows only for accounts that need an admin to reset the password.