ProfilePasswordPolicy

Represents a profile’s password policies. Profile password policies override org-wide password policies for that profile’s users. Use ProfilePasswordPolicy to retrieve password policies for a given profile. This type extends the Metadata metadata type and inherits its fullName field.

File Suffix and Directory Location

ProfilePasswordPolicy components have the suffix .profilePasswordPolicy and are stored in the profilePasswordPolicies folder.

Version

ProfilePasswordPolicy components are available in API version 40.0 and later.

Fields

Field Name	Field Type	Description
forgotPasswordRedirect	boolean	If `true`, reset password links in forgot password emails don’t immediately expire the first time they’re clicked. Instead, the links stay active until a user confirms the password reset request on an interstitial page. The default value is `false`. This field is available in API version 43.0 and later.
lockoutInterval	int	Required. The duration of the login lockout, in minutes. If users are locked out, they must wait until the lockout period expires. Valid values: `0`, `15`, `30`, `60`.
maxLoginAttempts	int	Required. The number of times a user can enter a wrong password before getting locked out. Valid values: `0`, `3`, `5`, `10`.
minimumPasswordLength	int	Required. Minimum number of characters required for a password. Valid values: `5`–`50`.
minimumPasswordLifetime	boolean	If `true`, a user cannot change a password more than once in a 24-hour period.
obscure	boolean	If `true`, answers to security questions are hidden as the user types.
passwordComplexity	int	Required. Level of complexity required for the character types in a user’s password. If `0`, the password can contain any type of character. If `1`, the password must contain at least one alphabetic character and 1 number. If `2`, the password must contain at least one alphabetic character, one number, and one of the following special characters: ! # $ % - _ = + < >. If `3`, the password must contain at least one number, one uppercase letter, and one lowercase letter. If `4`, the password must contain at least one number, one uppercase letter, one lowercase letter, and one of the following special characters: ! # $ % - _ = + < >.
passwordExpiration	int	Required. Number of days until user passwords expire and must be changed. Valid values: `0`—If set to `0`, the password never expires. `30` `60` `90` `180` `365`
passwordHistory	int	Required. Number of previous passwords to save. Saving passwords is required to ensure that users reset their password to a new, unique password. This value must be set before a password reset succeeds. If `0`, passwordExpiration must be set to `0`.
passwordQuestion	int	Required. If set to `1`, the answer to the password hint cannot contain the password itself. If `0`, the answer has no restrictions.
profile	string	Required. Name of the user profile.

Declarative Metadata Sample Definition

The following is an example of a ProfilePasswordPolicy component.

1<?xml version="1.0" encoding="UTF-8"?>
2<ProfilePasswordPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
3    <forgotPasswordRedirect>true</forgotPasswordRedirect>    
4    <lockoutInterval>30</lockoutInterval>
5    <maxLoginAttempts>0</maxLoginAttempts>
6    <minimumPasswordLength>7</minimumPasswordLength>
7    <minimumPasswordLifetime>false</minimumPasswordLifetime>
8    <obscure>false</obscure>
9    <passwordComplexity>1</passwordComplexity>
10    <passwordExpiration>0</passwordExpiration>
11    <passwordHistory>0</passwordHistory>
12    <passwordQuestion>1</passwordQuestion>
13    <profile>platformportal</profile>
14</ProfilePasswordPolicy>

Wildcard Support in the Manifest File

This metadata type supports the wildcard character * (asterisk) in the package.xml manifest file. For information about using the manifest file, see Deploying and Retrieving Metadata with the Zip File.

Metadata API Developer Guide