Identity Manager can enforce password policies on incoming passwords from connected systems and on passwords set or changed through the User Application password self-service. If the new password does not comply, you can specify that Identity Manager not accept the password. This also means that passwords that don't comply with your policies are not distributed to other connected systems.
In addition, Identity Manager can enforce password policies on connected systems. If the password being published to the Identity Vault does not comply with rules in a policy, you can specify that Identity Manager not only does not accept the password for distribution, but actually resets the noncompliant password on the connected system by using the current Distribution password in the Identity Vault.
For example, you want to require passwords to include at least one numeric character. However, the connected system does not have the ability to enforce such a policy. You specify that Identity Manager resets passwords that flow from the connected system but do not comply with rules in the policy.