MT.1249 - Ensure Android app protection policy acts on the device threat level.
Overview
Ensure at least one assigned Android app protection policy acts on the device threat level.
A device compliance policy can refuse a rooted Android phone, but it only evaluates a device the organization enrolled. On an unenrolled phone the equivalent signal reaches the organization through the app protection policy: a mobile threat defense partner such as Microsoft Defender reports a threat level for the device, and the policy decides what the managed app does about it.
Two values decide that together:
- Max allowed device threat level (
maximumAllowedDeviceThreatLevel) is the gate. Not configured means the signal is ignored. - Mobile threat defense remediation action (
mobileThreatDefenseRemediationAction) is what happens when the gate is crossed. Warn leaves the data available on a device the organization has been told is compromised.
A level of high accepts every threat the partner reports, so this test treats it as configured but not protective and reports it as a note.
On Android this complements the Play Integrity device attestation condition, which is checked separately. Attestation answers "is this device what it claims to be"; the threat level answers "has anything been found on it".
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Go to Apps > App protection policies.
- Select an existing Android policy, or select + Create policy and choose Android.
- Set up a mobile threat defense connector and turn on app protection policy evaluation for Android (see the related link).
- Under Conditional launch > Device conditions, add Max allowed device threat level with a value of Secured, Low or Medium and the action Block access or Wipe data.
- On the Assignments tab, assign the policy to the user groups whose apps hold organization data.
- Select Next and then Create or Save.
Without the connector the condition is configured and inert: nothing reports a threat level, so nothing is ever blocked. Verify the connector status in Tenant administration > Connectors and tokens.
Related links
- Microsoft Learn - Configure Microsoft Defender for Endpoint integration with Intune
- Microsoft Learn - Android app protection policy settings
- Microsoft Learn - App protection policies overview
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1249 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1068 Exploitation for Privilege Escalation, T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:SI-4, nist-800-53-r5:AC-19 |
| PowerShell test | Test-MtAndroidAppProtectionDeviceThreatLevel |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1249.ps1 - Documentation:
tests/maester/intune/Test.MT.1249.md