Password policies

Company > Users > Roles > Password Policies

A password policy is a rule that applies restrictions to user passwords, based on the account's primary role. The policy is consulted when a password is created for an account, either by the user or an admin. And when the Check password at login is true, the password is validated every time the user signs in. If the password does not comply with the policy, the system prompts an error and displays the requirements when reprompting to enter the new password.

Policies only apply to companies using username and password authentication; they have no impact on single sign-on (SSO) authentication.

Every policy has these general characters:

How often (days) a password must be changed.
How many times an incorrect password can be entered before the account is blocked.
When the User can request an automatic password reset.
How many times a day a user may request an automatic reset request before the account is blocked.
The restrictions applied to password values, such as minimum size, and type of characters allowed in the password.

Note: A blocked account is one where the user may not sign-in to the application. Depending on the policy, the user might be allowed to request an automatic password reset and become unblocked. Otherwise, a blocked user must be manually unblocked by an Administrator using the User Account editor. For more information, see Users.

There is a default policy that applies to all accounts unless another policy overrides it. Additionally, Medallia Experience Cloud provides templates that are examples of custom policies, including:

(Template) Default is the old default policy to apply to all roles.
(Template) Recommended is the old policy Experience Cloud used to recommend.
Default Password Policy (available on newer installations only) is the current default policy. You can rename and change this policy, and any changes become the default for the company.

Important: Beginning with the e697, you will not be able to edit or delete this default password policy. To edit it, create a new policy manually and assign it to all roles. In this case, all users without an explicitly assigned policy will use the default policy and will be locked out and requested to change their password.

Tip: Medallia recommends avoiding the use of these custom templates as a security best practice. To deactivate these templates, ask your Medallia expert to file a request with Medallia Support.

Creating a password policy

Either create a new policy with no defined properties, or clone an existing policy or template.
- Click New to create a blank policy where all the properties are empty.
- Click Create a new Policy based on this one that is a clone of the selected policy.
Provide a Name.
Enter or change the policy properties.
Assign the Roles the policy applies too.
Click Save.

Immediately, all accounts whose primary role is one of the assigned Roles will use the policy.

Properties

Important: To enable new default property values better aligned with our security best practices, ask your Medallia expert to file a request with Medallia Support. These values are:

Minimum letters — 0
Minimum lowercase letters — 0
Minimum uppercase letters — 0
Minimum digits — 0
Minimum symbols — 0
Minimum length — 15
Password expiry reminder days — 14

Create a new Policy based on this one

Creates a clone of the selected policy. The new policy has the same name as the original, but includes cloned at the end of the name.

Name

Name to easily identify the policy when referenced in other places, such as the Password Policy option on the Roles screen.

Maximum Tries

Count of consecutive failed sign-in attempts before the account is blocked and the password is automatically reset. By default, the User may request an automatic password reset in which the system emails the User to create a new password. However, when Disallow Password Reset of Blocked Accounts is on the account must be manually unblocked by an administrator (on the Users screen).

Default: 3; old default: unlimited

Expiration Days

Count of days since a password was set or last reset before the User is forced to enter a new password during sign-in.

Default: 180; old default: unlimited

Maximum Resets Per Day

Count of acceptable password resets in a day, as requested from the Reset your password page. If the User exceeds this threshold, the account is blocked and must be manually unblocked by an administrator.

Default: 2; old default: unlimited

Disallow Password Reset of Blocked Accounts

Keeps users from requesting a password reset using the Reset your password page when the account is blocked.

Default: true; old default: false

Check password at login

When on, passwords are verified against the policy every time users sign in, in addition to when passwords are created.

Turns this on after changing the policy to ensure all accounts follow the new policy. When passwords do not meet the new criteria, users are forced to create a new password before signing in.

Default: true; old default: false

History Size

Count of most recent passwords the system remembers and prevents the User from choosing when defining a new password. For example, when the size is 2, and the last 3 passwords were "tree", "house" and "cat" respectively, the user cannot choose "house" or "cat" as a new password, but "tree" is permitted.

Default: 10; old default: unlimited

Minimum Length

Minimum count of characters in a password.

Default: 10; old default: 6

Disallow 3 or more sequential digits

Whether or not to allow three or more adjacent digits (numerals) in passwords. For example, these passwords have three consecutive digits: “abc012” and “qwe47893asd”.

Default: true; old default: false

Disallow 3 or more consecutive equal characters

Whether or not to allow three or more adjacent instances of the same character in passwords. For example, these passwords have three consecutive equal characters: “122234as”, “12b!!!a”, and “@AAAklj”.

Default: true; old default: false

Minimum Letters

Must have at least this number of alphabetical characters. Letters in alphabets other than occidental are also considered. This is case-insensitive: 'a' and 'A' are considered equal for the test.

Default: 1; old default: unlimited

Minimum Lowercase Letters

Must have at least this number of lower-case characters.

Default: 0; old default: 0

Minimum Uppercase Letters

Must have at least this number of upper-case characters.

Default: 1; old default: 0

Minimum Digits

Must have at least this number of digit (number) characters. Numbers in alphabets other than occidental are also considered.

Default: 1; old default: 0

Minimum Symbols

Must have at least this number of symbol characters: ones that are not alphabetic or numeral.

Default: 1; old default: 0

Minimum Non Alpha

Minimum count of non-alphabetic characters; can be numerals or symbols.

Default: 1; old default: 1

Roles

One or more Roles this policy applies to. Accounts with these primary roles are authenticated with this policy. This property overrides the Default template for these roles.

A Role may be assigned to only one policy.

Email alerts

Email alerts are notifications sent to users to alert them about issues related to their passwords. The emails use the templates defined by User Emails screen.

Send email when user changes password: Send an email notification when the user changes their password.
Send password expiry email reminder: Send email reminder to notify users their password is set to expire soon.
Password expiry reminder days: List of days, prior to the password expiration, on which to send reminder email(s). Enter a comma-separated list of non-zero integers, such as 14, 7, 3. Email reminders are sent on each day listed, where 1 is the day before the password expires. When the list is empty, no reminders are sent.
Note calculations are based on days as determined by the server. If, for example the password will expire some time on a Thursday, the email for a 1-day prior reminder is sent early Wednesday morning, as determined by the server's timezone.