You are the IT administrator in a company with a Microsoft 365 subscription. You have a bring-your-own-device (BYOD) policy, and users have personal iOS mobile devices. You want to enable your users to use the Sharepoint app to access company data, but you must require a PIN to open it work context. What should you create?

Answer options:

A.An App registration in Azure Active Directory
B.An App configuration policy in Microsoft Endpoint Manager
C.A device compliance policy in Microsoft Endpoint Manager
D.An app protection policy in Microsoft Endpoint Manager

Correct Answer: D 
You should create an app protection policy in Microsoft Endpoint Manager. 
Even though your devices are not managed in mobile device management (MDM), you can still protect your company data on the app level by creating an app protection policy. 
In Microsoft Endpoint Manager admin center, navigate to Apps and select App protection policy. 

Option A is incorrect. App registrations are about authenticating and authorizing workflows in Azure.
Option B is incorrect. App configuration policy lets you assign configuration settings when users run the app. 
Option C is incorrect. Device compliance policy are about stating compliancy rules that devices must meet. 
Reference: 
To know more about application protection policy, please refer to the link below: 

https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy