Reset the passcode on Windows devices using Intune

Article
10/30/2023

Important

On October 22, 2022, Microsoft Intune ended support for devices running Windows 8.1. Technical assistance and automatic updates on these devices aren't available.

If you currently use Windows 8.1, then move to Windows 10/11 devices. Microsoft Intune has built-in security and device features that manage Windows 10/11 client devices.

You can reset the passcode for Windows devices. The reset passcode feature uses the Microsoft Pin Reset Service to generate a new passcode for devices that run Windows 10 Mobile.

Supported platforms

Windows 10 Mobile running Creators Update and later (Microsoft Entra joined).

The following platforms are not supported:

Windows
iOS
macOS
Android

Authorize the PIN reset services

To reset the passcode on Windows devices, onboard the PIN reset service to your Intune tenant.

Go to Microsoft PIN Reset Service production, and sign in using the tenant administrator account.
After you have logged in, choose Accept to give consent for the PIN reset service to access your account.
Go to the Microsoft PIN Reset Client production, and sign in using the tenant administrator account.
After you have logged in, choose Accept to give consent for the PIN reset client to access your account.
In the Azure portal, verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the Enterprise applications (All applications) blade. Filter the Application status drop down to "Enabled", and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production are enabled in your tenant.

Note

After you have accepted the PIN reset service and client requests, you may get a You do not have permission to view this directory or page. message, or it may appear as if nothing happens. This behavior is normal. Be sure to confirm that the two PIN Reset applications are listed for your tenant.

Configure Windows devices to use PIN reset

To configure the PIN reset on the Windows devices you manage, use an Intune Windows 10 custom device policy. Configure the policy using the following Windows policy configuration service provider (CSP):

Use the device policy - ./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery

Replace tenant ID with your Microsoft Entra Directory ID, which is listed in the Properties of Microsoft Entra ID in the Azure portal.

Set the value for this CSP to True.

Tip

After you create the policy, you assign (or deploy) it to a group. The policy can be assigned to user groups or a device groups. If you assign it to a users group, then the group may include users who have other devices, such as iOS/iPadOS. Technically, the policy doesn't apply, but these devices are still included in the status details.