How to Disable Self-Service Passcode Reset for Standard Users in Microsoft Intune

Hi,

We are using Microsoft Intune to manage Android corporate-owned devices. Currently, standard users can reset their own device passcode remotely. The problem is:

• Users reset the passcode themselves
• Then they get confused
• They call IT saying they cannot open their phone

We want to prevent users from doing self-service passcode reset. Only admin should be able to reset the device passcode. I already checked configuration profiles and compliance policies in Intune, but I cannot find any setting to disable this.

Has anyone successfully disabled this feature?

Thank you.