Removing MAM apps from iOS does not seem to remove all settings

%3CLINGO-SUB%20id%3D%22lingo-sub-985785%22%20slang%3D%22en-US%22%3ERemoving%20MAM%20apps%20from%20iOS%20does%20not%20seem%20to%20remove%20all%20settings%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-985785%22%20slang%3D%22en-US%22%3E%3CP%3EOk.%26nbsp%3B%20Hopefully%20I%20can%20explain%20this.%26nbsp%3B%20%26nbsp%3BWe%20are%20using%20MAM%20for%20our%20O365%20apps.%26nbsp%3B%20When%20we%20setup%20a%20fresh%20iOS%20device%2C%20we%20register%20it%20with%20Authenticator%20and%20the%20first%20time%20Outlook%20is%20setup%20we%20get%20prompted%20to%20create%20a%20PIN%20per%20our%20policy%20and%20all%20is%20good.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHowever%2C%20from%20that%20point%20on%2C%20I%20can%20wipe%20the%20MAM%20apps%20with%20Intune%20we%20can%20unregister%20the%20device%2C%20uninstall%20and%20reboot%2C%20and%20when%20we%20setup%20Outlook%20again%20(or%20any%20other%20MAM%20app)%20we%20never%20get%20prompted%20to%20create%20a%20PIN..%20It%20just%20automatically%20users%20the%20one%20that%20was%20setup%20the%20very%20first%20time.%26nbsp%3B%20%26nbsp%3BThe%20only%20way%2C%20it%20seems%2C%20to%20get%20a%20truly%20fresh%20device%20is%20to%20do%20a%20hard%20reset.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAnybody%20know%20where%20that%20secret%20location%20is%2C%20or%20how%20to%20clear%20it%20out%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-985785%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMobile%20Application%20Management%20(MAM)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-985795%22%20slang%3D%22en-US%22%3ERe%3A%20Removing%20MAM%20apps%20from%20iOS%20does%20not%20seem%20to%20remove%20all%20settings%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-985795%22%20slang%3D%22en-US%22%3EHave%20you%20tried%20removing%20the%20Authenticator%20app%3F%20That%20is%20the%20broker%20for%20MAM%20on%20iOS%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-985828%22%20slang%3D%22en-US%22%3ERe%3A%20Removing%20MAM%20apps%20from%20iOS%20does%20not%20seem%20to%20remove%20all%20settings%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-985828%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3BOh%20yeah.%26nbsp%3B%20Tried%20just%20uninstalling%20it.%26nbsp%3B%20Tried%20deleting%20my%20credentials%20from%20it%2C%20de-registering%20it%2C%20then%20uninstalling%20it.%26nbsp%3B%20It%20wouldn't%20bother%20me%20too%20much%2C%20but%20now%20that%20they%20released%20S%2FMIME%20for%20Outlook%20we're%20finding%20that%20once%20you%20install%20your%20personal%20S%2FMIME%20certs..%20they%20go%20somewhere%20on%20the%20iOS%20device%20and%20there%20is%20no%20way%20to%20remove%20them%2C%20sans%20a%20hard%20reset%20of%20the%20device.%26nbsp%3B%20%26nbsp%3BAnd%20once%20your%20personal%20cert%20is%20on%20there%2C%20you%20can't%20replace%20it%20because%20it%20simply%20says%20it%20already%20exists..%20so%20if%20somebody%20would%20put%20a%20bad%20cert%20on%20their%20device%2C%20we%20can't%20remove%20it.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMaybe%20that's%20unrelated%20to%20the%20other%20settings%2C%20but%20it's%20another%20thing%20that%20hangs%20around%20after%20everything%20is%20uninstalled%20from%20the%20device.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-987203%22%20slang%3D%22en-US%22%3ERe%3A%20Removing%20MAM%20apps%20from%20iOS%20does%20not%20seem%20to%20remove%20all%20settings%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-987203%22%20slang%3D%22en-US%22%3EDid%20you%20remove%20the%20management%20profile%20%2C%20your%20device%20is%20Corp%20or%20Byod%20%2C%20you%20push%20outlook%20mam%20through%20managed%20app%20or%20managed%20device%20.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-989145%22%20slang%3D%22en-US%22%3ERe%3A%20Removing%20MAM%20apps%20from%20iOS%20does%20not%20seem%20to%20remove%20all%20settings%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-989145%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F445780%22%20target%3D%22_blank%22%3E%40MSBSKB%3C%2FA%3E%26nbsp%3B%20we%20don't%20have%20a%20management%20profile.%26nbsp%3B%20We%20are%20doing%20MAM-WE.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Contributor

Ok.  Hopefully I can explain this.   We are using MAM for our O365 apps.  When we setup a fresh iOS device, we register it with Authenticator and the first time Outlook is setup we get prompted to create a PIN per our policy and all is good.

 

However, from that point on, I can wipe the MAM apps with Intune we can unregister the device, uninstall and reboot, and when we setup Outlook again (or any other MAM app) we never get prompted to create a PIN.. It just automatically users the one that was setup the very first time.   The only way, it seems, to get a truly fresh device is to do a hard reset.

 

Anybody know where that secret location is, or how to clear it out?

4 Replies
Highlighted
Have you tried removing the Authenticator app? That is the broker for MAM on iOS
Highlighted

@Thijs Lecomte Oh yeah.  Tried just uninstalling it.  Tried deleting my credentials from it, de-registering it, then uninstalling it.  It wouldn't bother me too much, but now that they released S/MIME for Outlook we're finding that once you install your personal S/MIME certs.. they go somewhere on the iOS device and there is no way to remove them, sans a hard reset of the device.   And once your personal cert is on there, you can't replace it because it simply says it already exists.. so if somebody would put a bad cert on their device, we can't remove it.

 

Maybe that's unrelated to the other settings, but it's another thing that hangs around after everything is uninstalled from the device.

Highlighted
Did you remove the management profile , your device is Corp or Byod , you push outlook mam through managed app or managed device .
Highlighted

@MSBSKB  we don't have a management profile.  We are doing MAM-WE.