diff --git a/it-and-security/lib/configuration-profiles/macos-passcode-settings.json b/it-and-security/lib/configuration-profiles/macos-passcode-settings.json
new file mode 100644
index 0000000000..e68b0a46c6
--- /dev/null
+++ b/it-and-security/lib/configuration-profiles/macos-passcode-settings.json
@@ -0,0 +1,12 @@
+{
+    "Type": "com.apple.configuration.passcode.settings",
+    "Identifier": "com.fleetdm.config.passcode.settings",
+    "Payload": {
+        "RequireComplexPasscode": true,
+        "MinimumLength": 10,
+        "MinimumComplexCharacters": 1,
+        "MaximumFailedAttempts": 11,
+        "MaximumGracePeriodInMinutes": 1,
+        "MaximumInactivityInMinutes": 15
+    }
+}
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index 0ad266f905..f586b2b5d7 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -38,6 +38,7 @@ controls:
       - path: ../lib/configuration-profiles/macos-password.mobileconfig
       - path: ../lib/configuration-profiles/macos-prevent-autologon.mobileconfig
       - path: ../lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig
+      - path: ../lib/configuration-profiles/macos-passcode-settings.json
   macos_setup:
     bootstrap_package: ""
     enable_end_user_authentication: true