Exam MD-102 topic 1 question 5 discussion

pin and account credentials reset app pin NOT device pin

1. PIN and account credentials 2. Reset the app PIN 1. EXPLANATION (PIN and account credentials) Select Require to require the user to sign in with their work or school account instead of entering a PIN for app access. If you set this to Require, and PIN or biometric prompts are turned on, both corporate credentials and either the PIN or biometric prompts are shown. SOURCE: https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements 2. EXPLANATION (Reset the app PIN) It's an APP protection policy, meaning the settings CAN'T apply to the device layer/level. An app policy is only allowed to utilize services on a device, but can't change device configurations.

1. PIN Only 2. Reset the app PIN My understanding is that the requirement for account credentials is for initial access, not for rechecking after inactivity. but did not test it.

For all of you insisting it is PIN and Account Credentials for the first drop down menu, please allow me to explain why you may be mistaken. Nobody would use their product if we had to re-auth with our 2FA after every 30 min period of inactivity. The PIN alone is sufficient, why else would that be the only thing passed along over to FaceID or other biometric methods? Users in our environment are definitely not prompted to enter their "Work or school account" password when this occurs. FaceID/PIN alone lets you back in and resets the timer. I use corp teams on my MAM enrolled device and I can tell you if I was prompted for a password after using FaceID or entering the Teams PIN manually after 30 mins of inactivity, I would get very annoyed and would consider uninstalling the product altogether. PIN only is indeed the correct answer. For those of you thinking you are resetting the PIN for the app itself you may be correct on that particular point but as for where that is controlled from, well that is from the device level. From the Intune management portal, you can only "Reset passcode" at the device level which effectively resets the PIN. There is not even anything anywhere else that says "Reset PIN" or even "Reset App Pin" as one would expect it to. After all this is Microsoft we are talking about here. Resetting the device PIN is the same as "reset passcode" in the Intune management portal, see: https://learn.microsoft.com/en-us/mem/intune/remote-actions/device-passcode-reset Reset the device PIN is indeed the correct answer.

Credential and PIN (or Biometrics if configured) will be required when re-check is done. Work or school account credentials for access https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy-settings-ios#access-requirements And yes, just App PIN reset as device is not workplace joined/managed, only app protection policy.

For the second question I think Device Pin is correct: From Microsoft: Timeout (minutes of inactivity) Specify a time in minutes after which either a passcode or numeric (as configured) PIN will override the use of a fingerprint or face as method of access. This timeout value should be greater than the value specified under 'Recheck the access requirements after (minutes of inactivity)'. It's inactivity of the device not of an app

Answer: 1> Pin and login using account 2> App pin.

Pin and account Credentials is correct

PIN and account credentials reset the app PIN

PIN and account credentials reset the app PIN PIN for access: Require Work or scholl account credential for access: Require Max PIN attempts value 5 - action: Reset PIN

pin and account to me. the difference here is that this (Work or school account credentials for access) setting is enabled? "If required, work or school credentials must be used to access the policy-managed app. If PIN or biometric methods also required for access to the app, the work or school account credentials will be required on top of those prompts."

Pin and account credentials Reset APP pin (since it is a app protection policy)

I'm going with krzysztofbr's answer

this would reset the app pin not the device pin

How would iOS APP protection policy reset DEVICE PIN?