'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Microsoft Defender Unsanctioned App Detection with Intune MAM on Android
Question details
The user needs to enforce Intune MAM policies based on Microsoft Defender unsanctioned app detections on Android devices.
- Product
- Microsoft Defender and Intune
- Device & OS
- Android
- Scenario
- Using Microsoft Defender unsanctioned app detection linked to Intune MAM to block corporate data access when a maximum device threat level is exceeded.
- Observed behavior
- The Android device does not become noncompliant after an unsanctioned app is detected, resulting in corporate data access remaining unblocked.
Verify that your Microsoft Defender for Endpoint is properly linked to your Microsoft Intune tenant and that your Mobile Application Management (MAM) protection policies are actively assigned to the target user groups.
Verify Android Enterprise Work Profile Limitations
Check if the Android Enterprise work profile separation is preventing Defender from evaluating the unsanctioned app correctly.
When using Android Enterprise with a work profile, the operating system strictly separates personal apps and data from corporate data. Due to these privacy boundaries, Microsoft Defender for Endpoint installed in the work profile may not have the necessary visibility to scan or report on unsanctioned apps installed in the personal profile. As a result, the device threat level is not elevated, and Intune MAM policies are not triggered.
Log in to the Microsoft Intune admin center. Navigate to Apps > App protection policies, select your active Android policy, and review the 'Conditional launch' settings to ensure 'Max allowed device threat level' is configured.
Check the official Microsoft Learn documentation regarding 'Microsoft Defender for Endpoint on Android' to confirm the current support status for unsanctioned app detection on personal profiles within Android Enterprise deployments.
Consider if the targeted devices can be migrated to 'Fully Managed' or 'Corporate-Owned Personally Enabled (COPE)' modes, which grant Defender broader visibility over all installed applications compared to standard Bring Your Own Device (BYOD) work profiles.
Submit Feature Request to Microsoft Defender Team
If this capability is critical for your security compliance and unsupported in your environment, submit feedback directly to the product developers.
Need a Lightweight, Secure Office Suite for Mobile? Try WPS Office
Navigating complex mobile device management and security policies like Microsoft Defender and Intune MAM can be challenging. When it comes to mobile productivity, deploying a fast, lightweight, and highly compatible solution shouldn't be. WPS Office provides a free, seamless alternative to Microsoft Office, offering strong format compatibility, a familiar interface, and smooth migration for mobile workforces.
Frequently Asked Questions
Why doesn't Intune MAM block corporate data when an unsanctioned app is detected?
In environments utilizing Android Enterprise work profiles, strict privacy boundaries prevent corporate security apps from viewing the personal profile. If the unsanctioned app is installed on the personal side, Defender cannot detect it to elevate the device threat level, meaning the MAM policy is never triggered.
How do I configure Intune app protection to block access based on threat levels?
In the Microsoft Intune admin center, navigate to Apps > App protection policies. Select your policy, go to the 'Conditional launch' section, and under 'Device conditions', set the 'Max allowed device threat level' to your required threshold (e.g., Low, Medium, or High).
Can Microsoft Defender block unsanctioned apps on fully managed Android devices?
Yes. On fully managed corporate devices, Microsoft Defender for Endpoint has visibility and control over all applications installed on the device. In this scenario, unsanctioned app policies can correctly assess the threat level and block access if configured.
