> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/device/security/reset-mobile-device-pin.md). # Reset Mobile Device Pin Reset the passcode of this mobile device ### Description Triggers an Intune passcode reset for this mobile device. Intune supports this only for certain corporate-owned device types and rejects it for personal or unsupported devices. Optionally the reset is skipped when Microsoft Defender for Endpoint rates the device as medium or high risk. ### Only reset the passcode if the device is not at risk When *Only reset passcode if device is not at risk* (`skipIfAtRisk`) is enabled, the runbook checks the device's risk score in Microsoft Defender for Endpoint before the Intune device is looked up and the reset is triggered. The lookup uses the Entra device ID and is the same query the **Check Defender Status** runbook performs. The check is off by default. Possible outcomes: * **No elevated risk** (risk score `None`, `Informational` or `Low`): the passcode is reset as usual. * **Risk score `Medium` or `High`**: the runbook stops with a warning before anything is changed. A device with an elevated risk score may be involved in a security incident; resetting its passcode could grant access to the device or interfere with the investigation. Align with your security team first; to reset the passcode anyway, run the runbook with the option disabled. * **Device not found in Defender for Endpoint**: the risk score cannot be determined. The runbook notes this and proceeds with the reset. Mobile devices only appear in Defender for Endpoint when the Defender app is deployed and onboarded on them, so devices without Defender are not blocked by the check. * **Device found, but without a risk score** (e.g. freshly onboarded): the runbook notes this and proceeds as well. * **Defender query fails**: the runbook stops without resetting the passcode, so a temporary API problem never bypasses the protection. #### Enable the check by default To enforce the check for every request, preset the parameter and hide it, so it cannot be switched off from the portal. The json configuration for this is as follows: ```json "rjgit-device_security_reset-mobile-device-pin": { "parameters": { "skipIfAtRisk": { "Default": true, "Hide": true } } } ``` ### Location Device → Security → Reset Mobile Device Pin **Full Runbook name** rjgit-device\_security\_reset-mobile-device-pin ### Details | Property | Value | | ---------------- | ----------------------------------- | | Version | 1.1.0 | | Required modules | RealmJoin.RunbookHelper (>= 0.8.10) | | Schedulable | no | ### Permissions #### Application permissions * **Type**: Microsoft Graph * DeviceManagementManagedDevices.Read.All * *Looks up the Intune device to check its ownership type before the reset* * DeviceManagementManagedDevices.PrivilegedOperations.All * *Executes the privileged resetPasscode action on the device* * **Type**: WindowsDefenderATP * Machine.Read.All *(optional — feature: Defender risk check)* * *Reads the device's Defender risk score in the skipIfAtRisk preflight* ### Parameters #### DeviceId Entra ID device ID of the device the runbook acts on. Set by the portal from the selected device. | Property | Value | | ---------------- | -------------------------------------- | | Required | true | | Default Value | | | Type | String | | Hidden in portal | yes (preset via runbook customization) | #### skipIfAtRisk Skips the reset when Microsoft Defender for Endpoint rates the device as medium or high risk, so a reset cannot open a device that is under investigation. Devices unknown to Defender are not blocked. | Property | Value | | ------------------- | ---------------------------------------- | | Required | false | | Default Value | False | | Type | Boolean | | Portal display name | Only reset if the device is not at risk? | **Portal options** | Portal option | Value | | ----------------------------------------------------------- | ----- | | Only reset if the Defender risk score is not medium or high | true | | Reset regardless of the Defender risk score | false | [Back to Runbook Reference overview](/automation/runbooks/runbook-references.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.realmjoin.com/automation/runbooks/runbook-references/device/security/reset-mobile-device-pin.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.