Hi, We need to setup some android devices as shared device for front line workers but when I setup the device it works fine but after 20-30 minutes it force me to have an Pin but i'm not sure where this setting is coming from We have following requirements Shared Device is available to login by any domain user Who ever logs onto device must setup an session pin If device is not in use, device mush wipe any existing session I have followed these steps Corporate-owned dedicated devices - create new token "Corporate-owned dedicated device with Azure AD shared mode" Then create an dynamic group "(device.enrollmentProfileName -eq "Azure AD Shared Device mode")" Then assign "Microsoft Home page" app to above group Then Configure new Config Profile and assign to above group Then create new App Config policy and assign to above group Then create Compliance policies and assign to above group When I enrol new shared device it enrols it but after 10 minutes its asking for pin setup, I dont want to setup pin for shared device, i like to ask user who will logon to these device to setup an session pin How can I do this and where is the pin setting coming from

@lalajee, Thanks for the reply. After checking the policy settings applied to shared device, I didn't find one related to the PIn or password set. That's strange. If we unenroll the device, delete the records in both Intune and Azure AD, then enroll again, will we PIN requirement disappear?

It is system security policy in your compliance policy that is forcing the 6 digit pin. You will need to look into that.

Is the device checking in? The compliance shows multiple sources for policies. Sure the filter is populating the intended devices?

Intune Android Shared device Remove Pin

lalajee 1,811

Hi,

We need to setup some android devices as shared device for front line workers but when I setup the device it works fine but after 20-30 minutes it force me to have an Pin but i'm not sure where this setting is coming from

We have following requirements

Shared Device is available to login by any domain user
Who ever logs onto device must setup an session pin
If device is not in use, device mush wipe any existing session

I have followed these steps

Corporate-owned dedicated devices - create new token "Corporate-owned dedicated device with Azure AD shared mode"
Then create an dynamic group "(device.enrollmentProfileName -eq "Azure AD Shared Device mode")"
Then assign "Microsoft Home page" app to above group
Then Configure new Config Profile and assign to above group
Then create new App Config policy and assign to above group
Then create Compliance policies and assign to above group When I enrol new shared device it enrols it but after 10 minutes its asking for pin setup, I dont want to setup pin for shared device, i like to ask user who will logon to these device to setup an session pin

How can I do this and where is the pin setting coming from

Accepted answer

Crystal-MSFT 44,411 Reputation points Microsoft Vendor

2023-01-17T05:06:43.89+00:00

@lalajee, Thanks for the reply.

After checking the policy settings applied to shared device, I didn't find one related to the PIn or password set. That's strange. If we unenroll the device, delete the records in both Intune and Azure AD, then enroll again, will we PIN requirement disappear?
Please sign in to rate this answer.
lalajee 1,811 Reputation points

2023-01-17T10:42:54.5+00:00

Hi @Crystal-MSFT

If I delete the device from intune it wipes the device.

i have deleted the device from intune and azure ad, but still get same issue

Pin Requirement doesn't kicks in until i install microsoft home page app, if I remove MS home app I dont get message to set pin

Crystal-MSFT 44,411 Reputation points Microsoft Vendor

2023-01-18T02:16:20.6966667+00:00

@lalajee, Thanks for the reply. For the Microsoft home page app, did you mean the managed home screen app? Please help to double confirm.

lalajee 1,811 Reputation points

2023-01-18T08:48:38.98+00:00

Yes, managed home screen app

Crystal-MSFT 44,411 Reputation points Microsoft Vendor

2023-01-19T04:20:04.25+00:00

@lalajee, Thanks for the confirmation. I have configured the same configuration but I didn't get "Encrypt your device" and "set a screen lock" under the device policy.

Here, would you mind to go to the affected device, select Device compliance and Device configuration to see if there's still any other policy there. Meanwhile, please check if any policy under Endpoint security assigned to this affected device.

lalajee 1,811 Reputation points

2023-01-20T00:05:43.6233333+00:00

You can see Pin and stand policy is not applied to this phone

Crystal-MSFT 44,411 Reputation points Microsoft Vendor

2023-01-20T06:27:28.5566667+00:00

@lalajee, Thanks for the response. For the last profile, it seems I didn't see it before. Could you get the detailed setting of this policy to double check?

lalajee 1,811 Reputation points

2023-01-24T13:02:00.19+00:00

@Crystal-MSFT

Thank you for all your help

its working now, it was my compliance policy which was causing the issue

lalajee 1,811 Reputation points

2023-01-24T13:03:57.93+00:00

@Crystal-MSFT

Thank for your help

Its working now, it was the compliance policy which was causing issue

Crystal-MSFT 44,411 Reputation points Microsoft Vendor

2023-01-25T09:15:08.19+00:00

@lalajee, Thanks for the update. I am glad that it is working now. Congratulations! If there's anything else we can help in the future, feel free to post in our Q&A to discuss together.

Thanks for your time and have a nice day!
Sign in to comment

2 additional answers

Rahul Jindal [MVP] 9,276 Reputation points MVP

2023-01-13T22:41:45.5666667+00:00

It is system security policy in your compliance policy that is forcing the 6 digit pin. You will need to look into that.
Please sign in to rate this answer.
lalajee 1,811 Reputation points

2023-01-14T21:23:10.5066667+00:00

I have remove that but still its asking for set pin or device will be reset in 9 days

On Device under Device Config

I see error for "Required unlock frequency" but I haven't configure this setting.

lalajee 1,811 Reputation points

2023-01-14T21:28:21.9233333+00:00

Also I create an filter and apply to all Device setting on each profile

Filter

Apply on each config profile as
Sign in to comment
Rahul Jindal [MVP] 9,276 Reputation points MVP

2023-01-14T23:03:41.4533333+00:00

Is the device checking in? The compliance shows multiple sources for policies. Sure the filter is populating the intended devices?
Please sign in to rate this answer.
lalajee 1,811 Reputation points

2023-01-14T23:31:12.1766667+00:00

Device is checking in.

I have split the config policy into 3 policy

Default policy (this exclude share device mode)

Pass code policy (this exclude share device mode)

Update (this include share device mode)

Shared Device Policy (only applied to shared device)

lalajee 1,811 Reputation points

2023-01-14T23:32:50.81+00:00

If I remove MS Home Page App, the pin number doesn't show anymore

I think its my app policy which is forcing me to setup pin

Crystal-MSFT 44,411 Reputation points Microsoft Vendor

2023-01-16T06:28:53.0866667+00:00

@lalajee, Thanks for posting in Q&A.

Based on my testing, when I only assign the app configuration policy to the dedicated with kiosk mode device, the device is asked session PIN when I sign in AAD user account. Wait for almost 10 minutes, not getting any prompting to enter device PIN. Then i sign out the AAD user account and wait 10 minutes, still not getting any prompt to setting device PIN.

From your description, I find currently Update and shared device policy are applied to these shared devices. Could you get screen shots of these policy properties to know their configuration better?

lalajee 1,811 Reputation points

2023-01-16T14:34:41.8766667+00:00

Please see all of the policy

This policy is applied to all machine expect for Shared Device (using filters)

Policy 2

This policy is applied to all machine expect for Shared Device (using filters)

policy 3/4 This policy is applied to all machine

This is the policy which gets applied to shared device

lalajee 1,811 Reputation points

2023-01-16T16:57:38.2033333+00:00

This is what I see on phone
Sign in to comment

Share via

Intune Android Shared device Remove Pin

2 additional answers