MT.1247 - Ensure Android app protection policy requires a minimum OS and app version.
Overview
Ensure at least one assigned Android app protection policy requires a minimum OS and app version.
On an unenrolled phone, the conditional launch rules of an app protection policy are the only lever the organization has over how old the platform underneath its data is allowed to be. There is no compliance evaluation, no update ring and no device inventory: either the policy refuses to open the app on an outdated Android or app version, or it does not.
Two versions matter:
- Min OS version (
minimumRequiredOsVersion) is the platform whose protections the whole app protection model rests on. - Min app version (
minimumRequiredAppVersion) is the app carrying the Intune App SDK that enforces the policy. An app old enough can predate the settings the policy relies on.
Android adds a third, Min Android security patch level (minimumRequiredPatchVersion), which is the more precise signal on a fleet where two phones on the same Android version can be a year apart in patches. This test reports it but does not require it, so that the requirement is the same on both platforms.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Apps > App protection policies.
- Select an existing Android policy, or select + Create policy and choose Android.
- Under Conditional launch > Device conditions, add Min OS version and set the oldest Android version you support, with the action Block access or Warn.
- Add Min Android security patch level and set a date you are prepared to enforce.
- Under Conditional launch > App conditions, add Min app version and set the oldest app version you support.
- On the Assignments tab, assign the policy to the user groups whose apps hold organization data.
- Select Next and then Create or Save.
Review these floors on a schedule. A minimum version set once and never raised stops being a control as the fleet moves on.
Related links
- Microsoft Learn - Android app protection policy settings
- Microsoft Learn - Data protection framework using app protection policies
- Microsoft Learn - Create and assign app protection policies
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1247 |
| Severity | Low |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1203 Exploitation for Client Execution, T1068 Exploitation for Privilege Escalation |
| Supports controls | nist-800-53-r5:SI-2, nist-800-53-r5:AC-19 |
| PowerShell test | Test-MtAndroidAppProtectionMinimumVersion |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1247.ps1 - Documentation:
tests/maester/intune/Test.MT.1247.md