> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Password Requirements

In order to comply with PCI security requirements, the following minimum password settings are required. Merchants can select to make the requirements stricter than those required by Vindicia, for their users. The following info will be added to the MAC guide for merchant input.

If using Vindicia IDP (ulm) as the Portal access Identity Provider, add the Merchant input in to the ticket based on [VIN-19073](https://support.corp.aws.vindicia.com/browse/VIN-19073) template.

| Name | Description | Required Value |
| - | - | - |
| **Minimum Password Length** | The number of characters required for a password | At least 8 |
| **Password Lifetime** | The length of time before user is required to change password. | Minimum 90 days**Note:** For Vindicia IDP, provide the value in seconds (7,776,000). |
| **Password Historical Check Count** | Number of last passwords that can't be reused for new password. When a user tries to change to a previously used password, system will check the last X passwords. | At least 5 |
| **Maximum Number of MFA Retries** | Maximum number of MFA verification attempts by user.After this number of retries, user is locked. | Maximum 5 |
| **Email Domain Blocklist** | Users will be unable to onboard with blocked email domains. If left blank, there are no blocked email domains. | |
| **Email Domain Allowlist** | Users will only be able to onboard with allowed email domains. If left blank, any email domain can be used with the exception of domains listed under Email Domain Blocklist. | |
| **Parent topic:**[Vindicia Portal Users and Authentication](../topics/subscribeRetainUserAuthentication) | | |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.