ProfilePasswordPolicy Metadata in SFDX

Architectural Overview#

In defense-in-depth cybersecurity architectures, treating all user accounts with the same security policies creates vulnerability. Privileged user accounts—such as System Administrators, Financial Controllers, and Security Auditors—represent high-value targets for credential stuffing and brute-force attacks.

The ProfilePasswordPolicy metadata type enables architects to enforce granular password security parameters on a per-profile basis. This allows stricter rules (e.g., 90-day expiration, 16-character minimums, lockout after 3 failed attempts) for administrative profiles, while business users follow baseline policies or SSO federations.

Deploying password policies as version-controlled metadata ensures enterprise compliance standards are immutably maintained across all corporate environments.

Directory and File Conventions#

In SFDX source format, ProfilePasswordPolicy metadata files reside in the profilePasswordPolicies/ directory:

Key Metadata Fields#

The XML schema of ProfilePasswordPolicy controls cryptographic and lockout thresholds:

Declarative XML and Package Manifest Examples#

Below is a production ProfilePasswordPolicy enforcing strict controls for an administrator profile:

<?xml version="1.0" encoding="UTF-8"?>
<ProfilePasswordPolicy xmlns="http://soap.sforce.com/2006/04/metadata">
    <lockoutInterval>60</lockoutInterval>
    <maxLoginAttempts>3</maxLoginAttempts>
    <minimumPasswordLength>16</minimumPasswordLength>
    <passwordComplexity>3</passwordComplexity>
    <passwordExpiration>90</passwordExpiration>
    <passwordHistory>12</passwordHistory>
    <profile>Admin</profile>
</ProfilePasswordPolicy>

Package Manifest (package.xml)#

<?xml version="1.0" encoding="UTF-8"?>
<Package xmlns="http://soap.sforce.com/2006/04/metadata">
    <types>
        <members>Admin_Password_Policy</members>
        <name>ProfilePasswordPolicy</name>
    </types>
    <version>68.0</version>
</Package>

CLI Retrieval and Deployment Commands#

Manage ProfilePasswordPolicy via the Salesforce CLI:

# Retrieve all profile password policies
sf project retrieve start --metadata ProfilePasswordPolicy

# Deploy a specific profile password policy
sf project deploy start --metadata "ProfilePasswordPolicy:Admin_Password_Policy"

# Validate deployment into sandbox
sf project deploy validate --metadata ProfilePasswordPolicy

Architect Best Practices and Gotchas#

• Integration Service Account Caution: Setting maxLoginAttempts: 3 and lockoutInterval: 0 on profiles used by automated ETL or API tools can cause sudden enterprise integration downtime if invalid tokens are sent during certificate rollouts.
• Target Profile Dependency: The referenced profile must exist in the target environment or be included in the same deployment manifest.
• SSO Compatibility: Users logging in via SAML 2.0 or OpenID Connect Single Sign-On (SSO) bypass Salesforce password complexity checks, as authentication is delegated to the identity provider.

Frequently asked questions

How does ProfilePasswordPolicy differ from organization password policies?

It overrides the default organization-wide password settings, allowing stricter rules for privileged administrator profiles.

Where are ProfilePasswordPolicy files stored in SFDX?

They reside in force-app/main/default/profilePasswordPolicies/ with the .profilePasswordPolicy-meta.xml file suffix.

What security standards recommend using profile-level password policies?

Standards such as NIST 800-63B, ISO 27001, and SOC 2 recommend tighter lockout thresholds and rotation schedules for privileged administrative accounts.

Can API and integration user profiles use ProfilePasswordPolicy?

Yes, but architects must configure lockout intervals cautiously to prevent automated integrations from getting locked out unexpectedly.