Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configure Microsoft Defender for Endpoint on Android Using MAM - Microsoft Defender for Endpoint | Microsoft Learn

15 October 2026Doc update+38 / −28 lines

In brief

The page updates headings, links, portal navigation wording, and instructions for connecting Defender for Endpoint to Intune and creating Android app protection policies.

What Defender admins need to know

Administrators configuring Android MAM can use the revised portal links and navigation labels to follow the setup procedure.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure Microsoft Defender for Endpoint on Android usingUsing MAM - Microsoft Defender for Endpoint | Microsoft Learn

Microsoft Defender for Endpoint on Android supports Microsoft Intune mobile application management (MAM) on devices that are enrolled or aren't enrolled in Intune mobile device management (MDM). Organizations that use another enterprise mobility management solution can also use Intune MAM to protect organizational data in managed apps.

This article describes the administrator and end-user prerequisites, the Defender settings to use in Intune policies, and the end-user onboarding experience.

Microsoft Intune is the recommended tool for configuring and distributing Defender for Endpoint features to devices. However, Intune is a separate product that isn't part of Defender for Endpoint, and itEndpoint. It isn't included in all subscriptions. To use Intune, you need a subscription that includes it, or you can buy it separately as a standalone subscription or add-on. For more information, see Microsoft Intune licensing.

Defender for Endpoint on Android supports the following MAM configurations:

  • In Intune, the Endpoint Security Manager role or equivalent permissions to manage Mobile Threat Defense settings.
  • In Microsoft Entra ID, the Security Administrator role, or permission to manage security settings in Defender for Endpoint.

Connect Defender for Endpoint to Intune

For the complete connection procedure, see Connect Microsoft Defender for Endpoint to Intune.

Verify the following settings:

Create an app protection policy

App protection policies are rules that protect organizational data in managed apps. An app integrated with the Intune App SDK or wrapped by the Intune App Wrapping Tool can be managed by Intune. For supported public apps, see Microsoft Intune protected apps.

For the complete procedure to create and assign an Android app protection policy, see App protection policies overview (opens. This page opens in a new tab in the Intune documentation).documentation.

When you create the policy, configure these Defender-specific settings:

  • Policy type: OnIn the Microsoft Intune admin center, on the Apps | Protection page in the Microsoft Intune admin center at https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/AppsMenu/~/protection,page, select Create > Android.

  • Apps tab: Add at least one managed app. You can target apps on managed devices, unmanaged devices, or devices in any management state.

  • Conditional launch tab: In the Device conditions section, select Max allowed device threat leveland then configure the following settings for it:

    • Value: Select the maximum threat level your organization allows (allows: Secured, Low, Medium, or High).
    • Action: Select Block access or Wipe data.

Defender for Endpoint shares the device threat level with Intune. When users sign in to a targeted managed app, Intune evaluates the Defender device risk signal and applies the configured action.

The Defender settings in the remaining sections use an Intune Managed apps app configuration policy. You can add multiple Defender configuration keys to one policy when the keys apply to the same assignments. Create separate policies when you need different settings or assignments.

For the complete procedure, see Add an app configuration policy for managed apps (opens. This page opens in a new tab in the Intune documentation).documentation.

When you create the policy, use these specific settings:

  • Policy type: OnIn the Microsoft Intune admin center, on the Apps | Configuration page in the Microsoft Intune admin center at https://intune.microsoft.com/#view/Microsoft_Intune_Apps/ConfigPoliciesMenu/~/appConfigurationPolicies,page, select Create > Managed apps.

  • Basicstab: Configure the following settings:

    • Target policy to: Verify Selected apps is selected.
    • Public apps: Select + Select public apps, find and select Microsoft Defender Endpoint Android, and then select Select.

  • Settings tab: In the General configuration settingssection, do the following steps:

    • Add the names and values specified in the applicable sections of this article.
    • Add DefenderMAMConfigs with a value of 1 to every Managed apps policy that configures Defender for Endpoint. The exception is a policy that disables end-user onboarding, where the value is 0. Don't add this key to a Managed devices policy.

Web protection helps secure devices against web threats and phishing attacks. Anti-phishing and custom indicators for URLs and domains are supported. Web content filtering is currently not supported on mobile platforms.

Use the Managed apps app configuration policy procedure, and addprocedure. Add the following configuration keys in the General configuration settings section on the Settings tab:

  • Name: antiphishing
  • Value:

Network protection detects threats from rogue Wi-Fi networks and certificates. For an overview of the feature behavior, supported detection modes, privacy controls, and current event experience, see Configure network protection.

Use the Managed apps app configuration policy procedure, and addprocedure. Add the applicable configuration keys in the General configuration settings section on the Settings tab:

  • Name: DefenderNetworkProtectionEnable. Enables or disables network protection. The remaining network protection keys take effect only when this key is set to 1.
  • Value:

Privacy controls can prevent Defender for Endpoint from collecting domain information in phishing reports and app details in malware reports. Network information is controlled separately by DefenderNetworkProtectionPrivacy in Configure network protection.

Use the Managed apps app configuration policy procedure, and addprocedure. Add one or both of the following configuration keys in the General configuration settings section on the Settings tab:

  • Name: DefenderExcludeURLInReport
  • Value:

In addition to scanning Android application packages (APK files), Defender for Endpoint on Android can scan non-APK files, such as documents, compressed archives, and scripts. Defender for Endpoint respects Android profile boundaries and can't access files in the user's personal profile.

Use the Managed apps app configuration policy procedure, and addprocedure. Add the following configuration key in the General configuration settings section on the Settings tab:

  • Name: EnableNonAPKFileScan

  • Value:

    • 1: Enable non-APK file scanning.
    • 0: Disable non-APK file scanning (default).

Configure optional permissions

Use the Managed apps app configuration policy procedure, and addprocedure. Add one or both of the following configuration keys in the General configuration settings section on the Settings tab:

  • Name: DefenderOptionalVPN
  • Value:

Hiding the sign-out button helps prevent users from signing out of the Defender app so that Defender for Endpoint continues running.

Use the Managed apps app configuration policy procedure, and addprocedure. Add the following configuration key in the General configuration settings section on the Settings tab:

  • Name: DisableSignOut

  • Value:

    • 1: Hide the sign-out button.
    • 0: Show the sign-out button (default).

Defender for Endpoint on Android supports bulk tagging of mobile devices during onboarding. After users install and activate Defender, the client app sends the device tags to the Microsoft Defender portal. The tags appear with the devices in the device inventory.

Use the Managed apps app configuration policy procedure, and addprocedure. Add the following configuration key in the General configuration settings section on the Settings tab:

  • Name: DefenderDeviceTag

  • Value:

    • To assign a new tag, enter a string value for the device tag.
    • To edit an existing tag, change the value.
    • To delete an existing tag, remove the key from the policy.

Disable end-user onboarding

Defender for Endpoint on Android is enabled by default in MAM mode. To prevent users from downloading and setting up Defender on unenrolled devices, use the Managed apps app configuration policy procedure, andprocedure to add the following configuration key in the General configuration settings section on the Settings tab:

  • Name: DefenderMAMConfigs

  • Value:

    • 0: Disable end-user onboarding.
    • 1: Enable end-user onboarding (default).

\ No newline at end of file