Microsoft Defender for Endpoint on Android - Intune Deployment.

Question

Hello,

I am currently investigating the deployment of Microsoft Defender for Endpoint on fully-managed corporate Android devices, deploying with Microsoft Intune. This is just a proof of concept for the business at this stage.

I am discovering various issues which would make this deployment a rubbish end-user experience, and also finding security flaws with the app itself. I 'm struggling to find any solutions to these issues and flaws, this is where I need some help here please.

Here are my rough notes on what steps need manual input on the Android devices when launching the Microsoft Defender app for the first time, obviously we would want this deployment to be completely zero-touch/silent...

1. Log in with domain account.
2. Accept Defender's terms.
3. Begin Android permissions bits...
4. Turn on All Files Access permission.
5. Accept VPN connection set up request [this is the only step I've found a possible zero-touch solution for online].
6. Turn on Appear On Top permission.
7. Agree to Accessibility services.
8. Accessibility > Installed Apps > Microsoft Defender > Turn this on > Then tap Allow.
9. Allow 'Stop optimising battery usage' for Defender.
10. Phone is then protected.

I can't imagine any users bothering with all these steps if we were to roll out the app to the business.

If there is no way of getting this app deployment fully zero-touch/silent, then my other idea was an Intune compliance policy that doesn't let you access any company resources at all unless the Defender app is fully running. But I can only find policies that just detect that the app is installed or not.

The security flaws with the app are the following...

1. The app can be Force Stopped from the Android > Apps page. This then leaves the phone completely unprotected unless the app is manually opened again. When reopening the app, you have to re-accept all the accessibility settings again.
2. Similarly, the app can have it's data cleared from the Android > Apps page. This stops the app running as well, and leaves the phone unprotected. Obviously once the data is cleared, you then have to accept the apps terms and a few other things when re-launching for first time.

Any ideas or opinions please? As it stands Microsoft Defender for Endpoint is no good for us on Android.

Thanks!

Answer 1

@AmazingPhone6248, Thanks for posting in Q&A.

Based as I know, we can deploy the app via Intune for Android devices. For Android Enterprise enrolled devices, we can configure app configuration policy and device configuration policy. You can configure them and see if we can get a better sign in experience. Here is a link with the detailed steps you can try:

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/android-intune?view=o365-worldwide

Meanwhile, for compliance policy setting of Android, I find a setting "Require the device to be at or under the machine risk score". it will check the score evaluated by Microsoft Defender for Endpoint. when exceed the score, it will get marked noncompliant. Maybe you can try this setting to see if the setting can work for these devices which are not running Defender.

https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android-for-work#microsoft-defender-for-endpoint

Hope it can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi, I'm having the same issue as reported above. Even when configuring the app configuration policy the app will still prompt the end user to approve and apply the permissions on the phone for the app to function properly.

Please see below the permissions and config applied from Intune.

@AmazingPhone6248 did you manage to find a solution?