caption: Configure behavior for online password mismatches
desc: |-
  Controls how <ph name="PRODUCT_OS_NAME">$2<ex>Google ChromeOS</ex></ph> handles a password mismatch detected during an online sign-in. This policy determines what happens when the user's password, authenticated via an online IdP (e.g., 3P IdP, Gaia), does not match the password used to encrypt their local data. This typically occurs after a user changes their password externally.

  Setting the policy to 0 (Standard password change flow) or not setting it initiates the standard password change flow. The user will be prompted to enter their old password to update their local data encryption, or they may use other local data recovery mechanisms if available.

  Setting the policy to 1 (Automatic local data wipe) bypasses the standard password change flow. Upon detecting the password mismatch, the user's local data will be automatically wiped. This allows the user to sign in seamlessly with their new password but results in the loss of all data stored locally within the user's profile (e.g., Downloads, settings not synced). This option is intended for environments where users primarily store data in the cloud or password is expected to be updated often.
device_only: true
example_value: 0
features:
  dynamic_refresh: true
items:
- caption: Standard password change flow
  name: Default
  value: 0
- caption: Automatic local data wipe
  name: AutoWipe
  value: 1
owners:
- isandrk@chromium.org
- ghostbusters@google.com
schema:
  enum:
  - 0
  - 1
  type: integer
default: null
supported_on:
- chrome_os:152-
tags: []
type: int-enum
