iOS App Protection Policy: Access Requirements and PIN Reset
Plan and implement app protection and app configuration policies
Answer
Opening the app requires the PIN and account credentials, and the administrator can reset only the app PIN, not the device PIN.
HOTSPOT
You have a Microsoft 365 subscription.
You use Microsoft Intune Suite to manage devices.
You have the iOS app protection policy shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Community Insight
The item tests whether you distinguish an app-level protection policy (app PIN, account credentials) from device management, where the trap is answering 'reset the device PIN.'
This MD-102 hotspot checks how an Intune iOS app protection policy's access requirement settings behave: when 'PIN and account credentials' is required, opening the app demands both the work or school account sign-in and the app PIN, and admins can reset only the app PIN — never the device PIN.
Selecting 'device PIN' for the reset statement, because app protection policies never touch the hardware PIN — the policy governs only the managed app, which is unmanaged-device friendly by design.
Community Discussion (28 comments)
ThomasE
👍 1
I would say PIN and account credentials. According to https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-android#access-requirements Work or school account credentials for access: Choose Require to require the user to sign in with their work or school account instead of entering a PIN for app access. When set to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown.
Victor3
👍 1
Answer is "PIN only" and "reset the app PIN". Why? Because the "App PIN when device PIN is set" setting is set to "Require". App PIN is seperate from device PIN if this option is on.
Arahnofob
👍 1
PIN ONLY, because PIN because it says "override biometric with PIN after timeout" reset the app PIN because this whole exhibit is an iOS app protection policy
solitudewriter
👍 1
This exact question was in my exam today -- I marked APP and Account Credentials and Reset App PIN only. Hope that helps.
jazzmirza
👍 1
1. PIN and account credentials 2. Reset the app PIN
35429bb
👍 2
I asked copilot "IF i have a IOS app protection policy in intune with the parameter work or school account credential for access activated i have to provide my credentials when my device is blocked because inactivity" and the answer was "Yes — if you configure an iOS App Protection Policy in Intune with “Require work or school account credential for access” enabled, then when the app is blocked due to inactivity, the user must provide their work or school account credentials (not just the App PIN) to regain access."
_Dinkan_
👍 2
1. PIN and account credentials 2. Reset the app PIN
Digo
👍 1
1. PIN Only 2. Reset the app PIN My understanding is that the requirement for account credentials is for initial access, not for rechecking after inactivity. but did not test it.
xXDaveOnFireXx
👍 2
For all of you insisting it is PIN and Account Credentials for the first drop down menu, please allow me to explain why you may be mistaken. Nobody would use their product if we had to re-auth with our 2FA after every 30 min period of inactivity. The PIN alone is sufficient, why else would that be the only thing passed along over to FaceID or other biometric methods? Users in our environment are definitely not prompted to enter their "Work or school account" password when this occurs. FaceID/PIN alone lets you back in and resets the timer. I use corp teams on my MAM enrolled device and I can tell you if I was prompted for a password after using FaceID or entering the Teams PIN manually after 30 mins of inactivity, I would get very annoyed and would consider uninstalling the product altogether. PIN only is indeed the correct answer. For those of you thinking you are resetting the PIN for the app itself you may be correct on that particular point but as for where that is controlled from, well that is from the device level. From the Intune management portal, you can only "Reset passcode" at the device level which effectively resets the PIN. There is not even anything anywhere else that says "Reset PIN" or even "Reset App Pin" as one would expect it to. After all this is Microsoft we are talking about here. Resetting the device PIN is the same as "reset passcode" in the Intune management portal, see: https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-passcode-reset Reset the device PIN is indeed the correct answer.
letters1234
👍 4
Credential and PIN (or Biometrics if configured) will be required when re-check is done. Work or school account credentials for access https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements And yes, just App PIN reset as device is not workplace joined/managed, only app protection policy.
Futfuyfyjfj
👍 2
If you set this to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown.
NoursBear
👍 2
For the second question I think Device Pin is correct: From Microsoft: Timeout (minutes of inactivity) Specify a time in minutes after which either a passcode or numeric (as configured) PIN will override the use of a fingerprint or face as method of access. This timeout value should be greater than the value specified under 'Recheck the access requirements after (minutes of inactivity)'. It's inactivity of the device not of an app
NoursBear
👍 7
sorry my bad, App PIN... I misread something
Temptset
👍 20
1. PIN and account credentials 2. Reset the app PIN 1. EXPLANATION (PIN and account credentials) Select Require to require the user to sign in with their work or school account instead of entering a PIN for app access. If you set this to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown. SOURCE: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements 2. EXPLANATION (Reset the app PIN) It's an APP protection policy, meaning the settings CAN'T apply to the device layer/level. An app policy is only allowed to utilize services on a device, but can't change device configurations.
Rndadhdman
👍 1
The question is asking about the App protection policy. So this is correct. Thank you.
MR_Eliot
👍 5
Answer: 1> Pin and login using account 2> App pin.
MR_Eliot
👍 4
Because "Work or school account credentials for access" is set to true.
Mattia8
👍 1
Pin and account Credentials is correct
Amir1909
👍 3
PIN and account credentials reset the app PIN
Tonsku
👍 1
PIN and account credentials reset the app PIN PIN for access: Require Work or scholl account credential for access: Require Max PIN attempts value 5 - action: Reset PIN
Zelda78
👍 1
pin and account to me. the difference here is that this (Work or school account credentials for access) setting is enabled? "If required, work or school credentials must be used to access the policy-managed app. If PIN or biometric methods also required for access to the app, the work or school account credentials will be required on top of those prompts."
Suresh_2411
👍 4
Pin and account credentials Reset APP pin (since it is a app protection policy)
VirtualJP
👍 2
I'm going with krzysztofbr's answer
krzysztofbr
👍 67
pin and account credentials reset app pin NOT device pin
redline13
👍 2
Why pin and account credentials for the first one? Isn't only pin will be required?
Grg433
👍 3
yes , it should be 'rest app pin' no ?
ansilva
👍 3
this would reset the app pin not the device pin
Rewound
👍 7
How would iOS APP protection policy reset DEVICE PIN?
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Because the iOS app protection policy's access requirement is set so that the work or school account credentials are required, opening the protected app triggers both a corporate credential check and the app PIN (or biometric) prompt. Since app protection policies target the app rather than the hardware, the only credential an administrator can clear from the Intune console is the app PIN. That matches the two drop-down selections: 'PIN and account credentials' for the access prompt, and 'reset the app PIN' for the remediation action.Why Other Candidate Answers Are Wrong
A device PIN reset would require a device-management action (such as remote actions on a managed, Entra-registered device), and an unmanaged or personally owned iOS device under app protection is precisely what the policy is designed to protect without enrolling it. Choosing only the PIN, or only the account credentials, is wrong because the 'Require' setting forces both prompts during access checks. Likewise, selecting a device-level or Intune device-restart style action confuses app-level data protection with endpoint device management.Community Comment Notes
Community consensus lines up with this verdict: krzysztofbr stresses "reset app pin NOT device pin", and letters1234 explains that "Credential and PIN (or Biometrics if configured) will be required when re-check is done." Rewound pushes back rhetorically with "How would iOS APP protection policy reset DEVICE PIN?" while NoursBear openly corrects an earlier misreading to "App PIN..." — all confirming that the reset scope is app-level only.Official Reference
Exam Strategy
On hotspot items, read each drop-down against the policy scope: anything about prompts under an access requirement points to credentials plus app PIN, while any 'reset' action under app protection can only ever be the app PIN. Never import device-management actions into an app-protection scenario.
Frequently Asked Questions
Why can't an admin reset the device PIN from an iOS app protection policy?
App protection policies manage the app, not the hardware. Resetting a device PIN requires device management on an enrolled, managed device.
What happens when work or school account credentials are required by an app protection policy?
The user must supply corporate account credentials plus the app PIN or biometric prompt before the protected app grants access.
Related Analysis
Practice All MD-102 Questions
Access 92 questions with complete answers and detailed explanations.
View Full MD-102 Practice Test →