# Ensure Android app protection policy encrypts organization data

Ensure at least one assigned Android app protection policy encrypts organization data.

Source: https://maester.dev/docs/tests/MT.1246

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/earbona23" title="Eduard Arbona · Original author"><img src="https://github.com/earbona23.png" alt="Eduard Arbona" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/earbona23">Eduard Arbona</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Intune · App protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1246
```

## Overview

Ensure at least one **assigned** Android app protection policy encrypts organization data.

App protection encryption puts the organization's data in the managed apps under a key the Intune App SDK controls, separately from whatever the user has done with the device. On an unenrolled Android phone the organization cannot verify how the device encrypts storage, and the fleet spans a decade of manufacturers and patch levels.

**Android exposes this as two settings that can contradict each other:**

- **Encrypt org data** (`encryptAppData`) requires the app data to be encrypted.
- `disableAppEncryptionIfDeviceEncryptionIsEnabled` waives that requirement whenever the device reports its own encryption as enabled.

A policy can therefore show encryption as required and encrypt nothing, because the waiver hands the guarantee back to the device the organization does not manage. This test reads both, and reports the contradictory combination as a note even when another policy passes.

Policies that are **not assigned** to any group are reported by this test but do not count towards a pass, because an app protection policy with no assignment is never applied to a user.

#### Remediation action

1. Navigate to the [Microsoft Intune admin center](https://intune.microsoft.com).
2. Go to **Apps** > **App protection policies**.
3. Select an existing **Android** policy, or select **+ Create policy** and choose **Android**.
4. Under **Data protection** > **Encryption**, set **Encrypt org data** to **Require**.
5. Leave the option that disables app encryption when the device is encrypted turned **off**, so the policy keeps its own key on unmanaged devices.
6. On the **Assignments** tab, assign the policy to the user groups whose apps hold organization data.
7. Select **Next** and then **Create** or **Save**.

#### Related links

- [Microsoft Learn - Android app protection policy settings](https://learn.microsoft.com/intune/app-management/protection/ref-settings-android)
- [Microsoft Learn - Data protection framework using app protection policies](https://learn.microsoft.com/intune/app-management/protection/data-protection-framework)
- [Microsoft Learn - App protection policies overview](https://learn.microsoft.com/intune/app-management/protection/overview)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1246 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Feature | App protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1005 Data from Local System |
| Supports controls | nist-800-53-r5:SC-28(1), nist-800-53-r5:AC-19 |
| PowerShell test | [Test-MtAndroidAppProtectionEncryption](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1246.ps1) |
| Services | Graph |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/maester/intune/Test.MT.1246.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1246.ps1)
- Documentation: [`tests/maester/intune/Test.MT.1246.md`](https://github.com/maester365/maester/blob/main/tests/maester/intune/Test.MT.1246.md)