You have used your work email on your phone for months without thinking about it. Then one morning it demands a PIN you may never have set, and will not let you in until you deal with it. Nothing is broken, and you have not been hacked.
If your organisation protects work data on phones — most now do, and it is a requirement of Cyber Essentials — there is a policy sitting between your work account and the Outlook app. That policy is allowed to insist on a PIN, or on Face ID or a fingerprint, before work email opens.
The policy also watches for changes to the biometrics on your phone. If you add a new fingerprint, re-register your face, or change the passcode, the phone reports that the security setup has changed. The policy cannot tell the difference between you adding a fingerprint and somebody else adding theirs, so it does the safe thing and asks you to confirm who you are.
That is the usual trigger. It also happens after a major iOS or Android update, after restoring a phone from backup, or after a long period without using the app.
What to do
- Set (or reset) the PIN it asks for. It applies only to work apps, not to unlocking your phone.
- If it will not accept anything, close Outlook completely and reopen it — not just switch away from it.
- Still stuck? Sign out of the work account in the app and sign back in. Your email is on the server; you are not going to lose anything.
- If none of that works, contact your IT provider. It is a two-minute fix at their end, and there is nothing to gain from spending twenty minutes on it yourself.
Real-world tip: Do not delete and reinstall the Outlook app as a first move. It usually leads to the same prompt plus a fresh sign-in, and on a managed phone it can trigger a compliance check that locks you out for longer.
Real-world tip: If you are about to change your Face ID or passcode — a new phone, a cracked screen, a new pair of glasses — expect this prompt afterwards. Knowing it is coming turns a worrying morning into a five-second task.
These policies exist to make sure that a lost phone does not become a data breach, and they are deliberately set to be as unobtrusive as we can make them while still meeting the Cyber Essentials standard. If your business has not yet put anything in place for phones, it is one of the cheaper security improvements available. Bongo IT can set it up across your organisation in a day.