# An App protection policy for Android platform exists in Intune
Without app protection policies, corporate data accessed on Android devices is vulnerable to leakage through unmanaged or malicious apps.
Source: https://maester.dev/docs/tests/ZTA.24549
## Overview
Without app protection policies, corporate data accessed on Android devices is vulnerable to leakage through unmanaged or malicious apps. Users can unintentionally copy sensitive information into personal apps, store data insecurely, or bypass authentication controls. This risk is amplified on devices that aren't fully managed, where corporate and personal contexts coexist, increasing the likelihood of data exfiltration or unauthorized access.
Enforcing app protection policies ensures that corporate data is only accessible through trusted apps and remains protected even on personal or BYOD Android devices.
These policies enforce encryption, restrict data sharing, and require authentication, reducing the risk of data leakage and aligning with Zero Trust principles of data protection and Conditional Access.
## Remediation
Deploy Intune app protection policies that encrypt data, restrict sharing, and require authentication in approved Android apps:
- [Deploy Intune app protection policies](https://learn.microsoft.com/intune/app-management/protection/create-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-an-iosipados-or-android-app-protection-policy)
- [Review the Android app protection settings reference](https://learn.microsoft.com/intune/app-management/protection/ref-settings-android?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
For more information, see:
- [Learn about using app protection policies](https://learn.microsoft.com/intune/app-management/protection/overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | App protection |
| Area | Data protection |
| ATT&CK | [T1567.002](/docs/tests?mitre=T1567.002) Exfiltration to Cloud Storage, [T1115](/docs/tests?mitre=T1115) Clipboard Data |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.