Disable the boot pin from being set. Due to the power on pin and the lock screen passwords are not sync'd (password rest in MDM will only change the screen lock). If the user does not change the power on pin or has forgets it, then the phone has to be cleared down and rebuilt.