MT.1237 - Ensure Android compliance policy blocks devices managed with device administrator.
Overview
Ensure at least one assigned Android compliance policy blocks devices managed with device administrator.
Android device administrator is the legacy management mode. Google deprecated the APIs it is built on, newer Android releases ignore a growing share of them, and the hardening that Android Enterprise brings - a separate work profile, Play Integrity attestation, per-profile policy - does not exist there. A device administrator enrollment is therefore managed in name while the controls an administrator believes are applied quietly stop being enforced.
The Android compliance policy can mark such enrollments non-compliant, which is how an organization drives the migration to Android Enterprise instead of discovering, years later, that part of the fleet was never protected.
This is a modernization control, not a defence against a particular technique, so it declares no ATT&CK mapping and a low severity. Its cost falls on users rather than on administrators: a device that is blocked has to be re-enrolled, and it loses access to corporate resources until it is. Plan the migration before you turn the setting on.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an unassigned compliance policy is never evaluated against any device.
Scope limitation
A tenant with no device administrator compliance policy at all is reported as not applicable: the setting has nowhere to live, and having no such policy is the modern posture rather than a gap. MT.1054 covers whether devices with no compliance policy assigned are treated as non-compliant.
Android Enterprise policies are counted and reported but their settings are not read by this test.
Remediation action
- Find out what you have first: in the Microsoft Intune admin center, go to Devices > All devices and group by Managed by, or check Reports > Device management. Devices enrolled with device administrator have to be re-enrolled into Android Enterprise, which is user work.
- Set up Android Enterprise enrollment under Devices > Enrollment > Android if it is not configured, and move your groups over.
- Go to Devices > Manage devices > Compliance.
- Select the Android device administrator policy, or select + Create policy with Platform set to Android device administrator.
- Under Compliance settings > Device Health, set Devices managed with device administrator to Block.
- On the Assignments tab, assign the policy to your Android device or user groups.
- Configure Actions for noncompliance with a grace period and a notification, so users are told to re-enroll before they lose access.
Related links
- Microsoft Intune admin center - Device compliance
- Microsoft Learn - Android device administrator compliance settings in Intune
- Microsoft Learn - Android device enrollment guide for Intune
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1237 |
| Severity | Low |
| Suite | Maester |
| Product | Intune |
| Feature | Device compliance |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:AC-19, nist-800-53-r5:CM-6 |
| PowerShell test | Test-MtAndroidDeviceAdministratorBlocked |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1237.ps1 - Documentation:
tests/maester/intune/Test.MT.1237.md