Password Policies

Establishing criteria for acceptable PPM product passwords before adding new users is crucial to ensure all passwords meet your organization's security standards, protecting sensitive information and maintaining system integrity.

When adding new users, PPM Administrator automatically sends them a temporary password via email. These users must change their password before logging in to PPM Administrator. The new password must adhere to the established password policies, and blank passwords are not allowed. This is only applicable to users with Basic Authentication and does not apply to Windows Authentication.

Note: If the Basic Authentication option is selected on the Users Authentication tab, PPM Administrator sends temporary passwords to users.

• When the system-level authentication mode is set to Basic, the user-level authentication option defaults to Basic Authentication and the Windows Authentication option is disabled.
• When the system-level authentication mode is set to Mixed, temporary passwords are still sent as long as the user-level authentication remains set to Basic Authentication.

Field	Description
Password Strength	Select one of the following options to specify the password requirements: Weak: This setting sets the Password Complexity field to Characters required and the Minimum Length field to 8 characters. This is the default option. Medium: This setting sets the Password Complexity field to Character & digit required and the Minimum Length field to 12 characters. For existing installs with PM Compass option selected, this will be used. Strong: This setting sets the Password Complexity field to Character, digit & special character required and the Minimum Length field to 16 characters. Custom: This setting allows users to set their own password complexity and minimum length. Note: This setting applies to PPM products that are compatible with PPM Administrator.
Password Complexity	This option controls the requirements for character and number combinations. This option is automatically set and disabled based on the defined password strength. It is enabled only for the Custom password strength. Select one of the following options: Character required — This setting requires passwords to contain only characters. Character & digit required — This setting requires passwords to contain both characters and numbers. Character, digit, & special character required — This setting requires passwords to contain characters, numbers, and special character. Note: This setting applies to PPM products that are compatible with PPM Administrator.
Minimum Length	Enter the minimum number of characters that users must enter for a password. The minimum length is 3. It is enabled only for the Custom password strength.
Expiration	Select the time period when a password expires: Never 30 days 90 days 6 months 1 year After a password expires, the user is locked out of the PPM application and must change the password to log in again. By default, it is set to Never. If the password has expired, a message displays informing the user. The PPM Administrator then displays the Change Password dialog box. After the user changes the password, the login dialog box displays. Note: This setting applies to PPM products that are compatible with PPM Administrator.
Max Retries before Lockout	Enter a numeric value for the number of invalid login attempts allowed before a user is disabled from using any PPM products. When a user’s account is disabled, the user loses access to the PPM products and any sessions (including API sessions) associated to the users. Each time that a login is successful, the counter clears and restarts at zero. After the PPM product locks out users, their password will not work until the administrator reinstates their login rights. Note: If the user's account is locked, the user cannot use temporary passwords to unlock it . A system administrator must unlock the account on their behalf. Users with Windows Authentication will never be locked out.