# iOS/iPadOS - Compliance Policy > Compliance policy for iOS/iPadOS devices Compliance policy for iOS/iPadOS devices ## Settings this baseline controls | Setting | What it does | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | Managed email profile required | Require a managed email profile. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Block jailbroken devices | Devices must not be jailbroken or rooted. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Mobile Threat Defense level | Required Mobile Threat Defense level. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Minimum iOS version | Minimum iOS version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Maximum iOS version | Maximum iOS version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Minimum iOS build version | Minimum iOS build version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Maximum iOS build version | Maximum iOS build version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Maximum machine risk score | Required Advanced Threat Protection level. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | **10 more settings** | Setting | What it does | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Passcode required | Require a passcode to unlock iOS devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Block simple passcodes | Block simple passcodes. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Minimum passcode length | Minimum passcode length. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Required passcode type | Type of characters in passcode. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Minimum character set count | Number of character sets required in the password. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Minutes until screen locks | Minutes of inactivity before the screen times out. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Minutes before passcode required | Minutes of inactivity before a passcode is required. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Days until passcode expires | Number of days before the passcode expires. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Previous passcodes remembered | Number of previous passcodes to prevent reuse. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | | Restricted apps | List of apps that are not allowed to be installed on the device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-ios) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to a tenant that enrols iPhones or iPads, so Intune can keep jailbroken or under-protected devices off your Conditional Access-protected resources. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or include it in a scheme you deploy to every tenant enrolling Apple mobile devices ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Passcode required** on, with **Required passcode type** set to `alphanumeric`, **Minimum passcode length** at `8`, and reuse blocked for the last `5` passcodes. That's a full device passcode, not the four-digit PIN Android gets. 3. Leave **Block jailbroken devices** and **Managed email profile required** on. The first rules out a compromised device outright; the second requires mail to be delivered through Intune's managed profile rather than the device's built-in Mail app. 4. Set **Minimum iOS version** to `15`, and leave **Maximum iOS version** and its build-version counterparts blank. This sets a floor, not a ceiling. 5. Save, and turn on **Auto-remediation** if you want Octiga to create or correct this policy in Intune the next time it detects a deviation, rather than fixing it by hand. > **Caution:** A device that already fails these settings — a passcode too short, or a profile missing the managed mail requirement — becomes noncompliant on its next check-in, and loses access to anything behind a Conditional Access device-compliance policy until the user brings it up to standard. > **Licence: Intune:** ## Check it worked This baseline shows **Passing** once the policy exists in Intune with these settings and an iOS or iPadOS device reports back as compliant. Check progress in the Microsoft Intune admin centre: **Devices → Manage devices → Compliance → Policies**, open the policy, and use its device status and per-setting status views. A user on a noncompliant device sees what needs fixing in the Company Portal app, and may be blocked from mail and other protected resources until they fix it. ## Standards this addresses ### CIS - **v8 4.1** — CIS Controls v8 Safeguard 4.1 - **v8 3.6** — CIS Controls v8 Safeguard 3.6 ### NIST - **PR.DS-1** — NIST CSF 2.0 PR.DS-1 - **SC-28** — NIST SP 800-53 SC-28 - **CM-6** — NIST SP 800-53 CM-6 ### ISO 27001 - **A.8.13** — ISO/IEC 27001:2022 Annex A.8.13 - **A.8.22** — ISO/IEC 27001:2022 Annex A.8.22 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)