This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 24%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
If I am in the wrong sub, please let me know where else I should post - any help is appreciated!
We recently created an app protection policy to secure outlook and teams for users that wish to access those apps on their personal devices without fully enrolling their devices into our management. I do see that we can set access requirements to require app pin for access to the app, and we can then select to not require app pin when device pin is set. However, I am seeing that this only works for MDM enrolled devices as there is a note next to the setting that says this. Therefore, any iOS device that is MAM-WE and not in Intune, but has a phone lock passcode, is still prompted for an app pin.
My question is - Are there any other settings or policies we can set so that even unmanaged iOS devices don't need to put an app pin in if they have a device lock?
** Under conditional launch/device conditions for Android devices, we can set it to require device lock, so why can we not set the IOS policy to check an IOS for a device lock passcode before booting as well? **
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 61%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXM%3C/text%3E%3C/svg%3E)
@Madison544 Thanks for posting in our Q&A.
It is by design. Based on my understanding, iOS and Android are the same. In android article, it also describes that Select Not required to disable the app PIN when a device lock is detected on an enrolled device with Company Portal configured.
From your description, did you mean that you don't need to enter PIN to access protected app when this android device is not enrolled, and it has device lock PIN?
If there is anything update, feel free to let us know.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
I will try to break it down, so it makes more sense:
Our Android Policy Currently:
We have it set to require app pin
We also have it set to NOT require app pin if device pin is set
We also have it set under device conditions for the app startup to block any android device that does not have a device lock on it
Our Android Testing Shows us:
When we do not have a device lock on the android phone and try to open the app, it blocks us. Perfect - this is what we want
When we do have a device lock on the android phone and try to open the app, it asks for biometric or phone passcode or pin to sign in to the app itself - This is fine too, but we would like it to recognize that there is already a lock on the device and therefore, not ask for another authentication when opening the a
Our iOS Policy
We have it set to require app pin
We also have it set to NOT require app pin if device pin is set (only for enrolled devices, which ours are NOT enrolled with MDM, this is where the problem lies, I believe)
However, iOS does not have a device condition like android does to set for app startup to block any iOS device that does not have a device lock on it.
Our iOS testing shows us:
Whether we have a device lock on or not, it doesn't matter because it will always ask for a pin or biometric when opening the app. It seems it can check the phone for min OS and check if it is jailbroken and block it, but there is nothing to check if there is already a device lock on the ios device.
So my question is - is there any other way to get an unenrolled/unmanaged IOS device to check if there is a device lock on it before prompting an app pin again?
Sorry, I know I am not making much sense - but I am trying.
In the Android and the iOS article for the "require app pin when device lock is set", if we set that so it does not require an app pin if device lock is set, both state that this is only for devices enrolled by MDM. We are using these app protection policies only for users who are accessing it on their personal phones, so we do not want to enroll their devices into our management. So, my question is, for devices that are not enrolled and not managed - is there a way to only require an app pin if there is no device lock already in place? I am pretty sure we have it figured out with Android since we can just have the setting on to block anyone without a device lock, but there is no setting for that in the iOS policy - it is missing.
Essentially, we want users with a personal iPhone or Android to be required to have a lock on their device in order to access teams or outlook on their phone, but there does not seem to be a way to control that for a non-enrolled iOS device. Android does have a way, but not iOS. I apologize if I am making this more confusing!
@Madison544 Thanks for your update. You've articulated it very clearly and I understand what you mean.
I have checked the settings in intune portal. Yes, iOS app protection policy doesn't have this setting "Require device lock". Honestly, I didn't find any information about it. With Q&A limitation resources, it is suggested to create an online support ticket to get more help. Here is the support link:
https://video2.skills-academy.com/en-us/mem/get-support
Thanks for your understanding and hope everything goes well with you.