iOS App Protection Policy: Access Requirements and PIN Reset

MD-102 By islever Editorial Last updated

Plan and implement app protection and app configuration policies

Short answer

Opening the app requires the PIN and account credentials, and the administrator can reset only the app PIN, not the device PIN.

Question

HOTSPOT
You have a Microsoft 365 subscription.
You use Microsoft Intune Suite to manage devices.
You have the iOS app protection policy shown in the following exhibit.
Exhibit: iOS App Protection Policy: Access Requirements and PIN Reset
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Exhibit: iOS App Protection Policy: Access Requirements and PIN Reset

Key Takeaways

The item tests whether you distinguish an app-level protection policy (app PIN, account credentials) from device management, where the trap is answering 'reset the device PIN.'

This MD-102 hotspot checks how an Intune iOS app protection policy's access requirement settings behave: when 'PIN and account credentials' is required, opening the app demands both the work or school account sign-in and the app PIN, and admins can reset only the app PIN — never the device PIN.

Common mistake: Selecting 'device PIN' for the reset statement, because app protection policies never touch the hardware PIN — the policy governs only the managed app, which is unmanaged-device friendly by design.

Expert Analysis

Why the Answer Is Correct

Because the iOS app protection policy's access requirement is set so that the work or school account credentials are required, opening the protected app triggers both a corporate credential check and the app PIN (or biometric) prompt. Since app protection policies target the app rather than the hardware, the only credential an administrator can clear from the Intune console is the app PIN. That matches the two drop-down selections: 'PIN and account credentials' for the access prompt, and 'reset the app PIN' for the remediation action.

Why Other Candidate Answers Are Wrong

A device PIN reset would require a device-management action (such as remote actions on a managed, Entra-registered device), and an unmanaged or personally owned iOS device under app protection is precisely what the policy is designed to protect without enrolling it. Choosing only the PIN, or only the account credentials, is wrong because the 'Require' setting forces both prompts during access checks. Likewise, selecting a device-level or Intune device-restart style action confuses app-level data protection with endpoint device management.

Community Comment Notes

Community consensus lines up with this verdict: krzysztofbr stresses "reset app pin NOT device pin", and letters1234 explains that "Credential and PIN (or Biometrics if configured) will be required when re-check is done." Rewound pushes back rhetorically with "How would iOS APP protection policy reset DEVICE PIN?" while NoursBear openly corrects an earlier misreading to "App PIN..." — all confirming that the reset scope is app-level only.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements

This link opens the official vendor documentation in a new tab.

Exam Strategy

On hotspot items, read each drop-down against the policy scope: anything about prompts under an access requirement points to credentials plus app PIN, while any 'reset' action under app protection can only ever be the app PIN. Never import device-management actions into an app-protection scenario.

Frequently Asked Questions

Why can't an admin reset the device PIN from an iOS app protection policy?

App protection policies manage the app, not the hardware. Resetting a device PIN requires device management on an enrolled, managed device.

What happens when work or school account credentials are required by an app protection policy?

The user must supply corporate account credentials plus the app PIN or biometric prompt before the protected app grants access.

More MD-102 FAQ →

Discussion 27 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 27

  1. krzysztofbr 👍 67
    pin and account credentials reset app pin NOT device pin
  2. Temptset 👍 20
    1. PIN and account credentials 2. Reset the app PIN 1. EXPLANATION (PIN and account credentials) Select Require to require the user to sign in with their work or school account instead of entering a PIN for app access. If you set this to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown. SOURCE: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements 2. EXPLANATION (Reset the app PIN) It's an APP protection policy, meaning the settings CAN'T apply to the device layer/level. An app policy is only allowed to utilize services on a device, but can't change device configurations.
  3. Rewound 👍 7
    How would iOS APP protection policy reset DEVICE PIN?
  4. NoursBear 👍 7
    sorry my bad, App PIN... I misread something
  5. MR_Eliot 👍 5
    Answer: 1> Pin and login using account 2> App pin.
Show 22 more comments
  1. letters1234 👍 4
    Credential and PIN (or Biometrics if configured) will be required when re-check is done. Work or school account credentials for access https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements And yes, just App PIN reset as device is not workplace joined/managed, only app protection policy.
  2. Suresh_2411 👍 4
    Pin and account credentials Reset APP pin (since it is a app protection policy)
  3. MR_Eliot 👍 4
    Because "Work or school account credentials for access" is set to true.
  4. ansilva 👍 3
    this would reset the app pin not the device pin
  5. Amir1909 👍 3
    PIN and account credentials reset the app PIN
  6. Grg433 👍 3
    yes , it should be 'rest app pin' no ?
  7. xXDaveOnFireXx 👍 2
    For all of you insisting it is PIN and Account Credentials for the first drop down menu, please allow me to explain why you may be mistaken. Nobody would use their product if we had to re-auth with our 2FA after every 30 min period of inactivity. The PIN alone is sufficient, why else would that be the only thing passed along over to FaceID or other biometric methods? Users in our environment are definitely not prompted to enter their "Work or school account" password when this occurs. FaceID/PIN alone lets you back in and resets the timer. I use corp teams on my MAM enrolled device and I can tell you if I was prompted for a password after using FaceID or entering the Teams PIN manually after 30 mins of inactivity, I would get very annoyed and would consider uninstalling the product altogether. PIN only is indeed the correct answer. For those of you thinking you are resetting the PIN for the app itself you may be correct on that particular point but as for where that is controlled from, well that is from the device level. From the Intune management portal, you can only "Reset passcode" at the device level which effectively resets the PIN. There is not even anything anywhere else that says "Reset PIN" or even "Reset App Pin" as one would expect it to. After all this is Microsoft we are talking about here. Resetting the device PIN is the same as "reset passcode" in the Intune management portal, see: https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-passcode-reset Reset the device PIN is indeed the correct answer.
  8. 35429bb 👍 2
    I asked copilot "IF i have a IOS app protection policy in intune with the parameter work or school account credential for access activated i have to provide my credentials when my device is blocked because inactivity" and the answer was "Yes — if you configure an iOS App Protection Policy in Intune with “Require work or school account credential for access” enabled, then when the app is blocked due to inactivity, the user must provide their work or school account credentials (not just the App PIN) to regain access."
  9. NoursBear 👍 2
    For the second question I think Device Pin is correct: From Microsoft: Timeout (minutes of inactivity) Specify a time in minutes after which either a passcode or numeric (as configured) PIN will override the use of a fingerprint or face as method of access. This timeout value should be greater than the value specified under 'Recheck the access requirements after (minutes of inactivity)'. It's inactivity of the device not of an app
  10. Futfuyfyjfj 👍 2
    If you set this to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown.
  11. redline13 👍 2
    Why pin and account credentials for the first one? Isn't only pin will be required?
  12. VirtualJP 👍 2
    I'm going with krzysztofbr's answer
  13. ThomasE 👍 1
    I would say PIN and account credentials. According to https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-android#access-requirements Work or school account credentials for access: Choose Require to require the user to sign in with their work or school account instead of entering a PIN for app access. When set to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown.
  14. Zelda78 👍 1
    pin and account to me. the difference here is that this (Work or school account credentials for access) setting is enabled? "If required, work or school credentials must be used to access the policy-managed app. If PIN or biometric methods also required for access to the app, the work or school account credentials will be required on top of those prompts."
  15. Victor3 👍 1
    Answer is "PIN only" and "reset the app PIN". Why? Because the "App PIN when device PIN is set" setting is set to "Require". App PIN is seperate from device PIN if this option is on.
  16. Digo 👍 1
    1. PIN Only 2. Reset the app PIN My understanding is that the requirement for account credentials is for initial access, not for rechecking after inactivity. but did not test it.
  17. Tonsku 👍 1
    PIN and account credentials reset the app PIN PIN for access: Require Work or scholl account credential for access: Require Max PIN attempts value 5 - action: Reset PIN
  18. Arahnofob 👍 1
    PIN ONLY, because PIN because it says "override biometric with PIN after timeout" reset the app PIN because this whole exhibit is an iOS app protection policy
  19. solitudewriter 👍 1
    This exact question was in my exam today -- I marked APP and Account Credentials and Reset App PIN only. Hope that helps.
  20. Rndadhdman 👍 1
    The question is asking about the App protection policy. So this is correct. Thank you.
  21. jazzmirza 👍 1
    1. PIN and account credentials 2. Reset the app PIN
  22. Mattia8 👍 1
    Pin and account Credentials is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide