Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Configure Microsoft Defender for Endpoint on Android - Microsoft Defender for Endpoint | Microsoft Learn

19 October 2026Doc update+52 / −19 lines

In brief

The page now lists supported Defender configuration areas, clarifies the onboarding and Managed Google Play prerequisites, and updates the Intune policy creation link and wording.

What Defender admins need to know

Use the clarified sequence when configuring Defender for Endpoint on Android: onboard devices, approve and sync the Defender app, then create the app configuration policy.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Configure Microsoft Defender for Endpoint on Android - Microsoft Defender for Endpoint | Microsoft Learn

Security administrators can use Microsoft Intune to configure risk-based Conditional Access, custom indicators, web and network protection, privacy controls, vulnerability assessment, file scanning, sign-out controls, and device tagsthe following features for Microsoft Defender for Endpoint on Android. Android:

  • Risk-based Conditional Access
  • Custom indicators
  • Web and network protection
  • Privacy controls
  • Vulnerability assessment
  • File scanning
  • Sign-out controls
  • Device tags

Before you configure these features, deploy and onboard Defender for Endpoint on the Android devices you manage.

Microsoft Intune is a separate product that isn't included with every Defender for Endpoint subscription. You need a subscription that includes Intune, or you can buy Intune as a standalone subscription or add-on. For more information, see Microsoft Intune licensing.

Create a Managed devices app configuration policy

The Defender settings in the following sections use an Android Enterprise Managed devices app configuration policy in Intune. You can add multiple Defender configuration keys to one policy when thepolicy. The keys must apply to the same profile type and assignments. Create separate policies when you need to target different profiles, users, or devices.

Before you create the policy, add and approve Defender: Antivirus from Managed Google Play, and then sync it to Intune. After the sync, the app appears in Intune as Microsoft Defender: Antivirus. For deployment instructions,more information, see Deploy Microsoft Defender for Endpoint on Android with Microsoft Intune.

For the complete procedure to create a Managed devices app configuration policy in Intune, see Create an app configuration policy (opens. This page opens in a new tab in the Intune documentation).documentation. When creating the policy, always start with these settings:

  • Basicstab: Configure the following settings:

    • Platform: Select Android Enterprise.

    • Profile type: Select one of the following values:

      • All Profile Types: Applies the policy to all supported enrollment types. You can't associate an Intune certificate profile with the app configuration policy.
      • Fully Managed, Dedicated, and Corporate-Owned Work Profile Only: Applies the policy to corporate-owned, personally enabled (COPE) and corporate-owned, business-only (COBO) devices.
      • Personally-Owned Work Profile Only: Applies the policy to bring-your-own-device (BYOD) work profiles.

    • Targeted app: Select Select app, select Microsoft Defender: Antivirus, and then select OK.

  • Settings tab: Select Use configuration designer for Configuration settings format, and then select Add.

    • In the flyout pane that opens, select the configuration keys specified in the applicable sections of this article, and then select OK.
    • Configure the value for each key, and then complete the assignments and create the policy as described in the Intune procedure.

Configure network protection

- **Value type**: Integer
- **Configuration values**:

    - `1`: Enable (default)
    - `0`: Disable

  • Enable Users to Trust Networks and Certificates: Allows or prevents users from trusting or removing trust from unsecured networks and malicious certificates in the app.

    • Value type: Integer

    • Configuration values:

      • 1: Enable
      • 0: Disable (default)

  • Automatic Remediation of Network Protection Alerts: Enables or disables remediation alerts when users take remediation actions. For example, a user switches to a safer Wi-Fi access point or deletes a suspicious certificate detected by Defender. This setting applies only to alerts and doesn't affect device timeline events. It doesn't apply to the detection of open Wi-Fi networks or self-signed certificates.

    • Value type: Integer

    • Configuration values:

      • 1: Enable (default)
      • 0: Disable

  • Manage Network Protection detection for Open Networks: Enables or disables open network detection.

    • Value type: Integer

    • Configuration values:

      • 2: Enable (default)
      • 1: Audit mode
      • 0: Disable

    • Value type: Integer

    • Configuration values:

      • 2: Enable
      • 1: Audit mode
      • 0: Disable (default)

Privacy controls let security administrators limit which threat details Defender for Endpoint sends from Android devices:

  • Malware reports: When privacy is enabled, Defender for Endpoint doesn't send the malicious app name or other app details in malware alert reports. For configuration instructions,more information, see Configure privacy for malware threat reports.
  • Phishing reports: When privacy is enabled, Defender for Endpoint doesn't send the domain name or unsafe website details in phishing alert reports. For configuration instructions,more information, see Configure privacy for phishing alert reports.
  • Vulnerability assessment of apps: By default, Defender for Endpoint sends the list of apps installed in the work profile for vulnerability assessment. Security administrators can enable privacy to prevent this app inventory from being sent. For configuration instructions,more information, see Configure app inventory privacy for an Android Enterprise work profile.
  • Network protection: When privacy is enabled, Defender for Endpoint doesn't send network details. For configuration instructions,more information, see Configure privacy alert reports.

Prerequisite: Install Company Portal version 5.0.6621.0 (June 2025) or later.

Security administrators can enable privacy controls for phishing and malware reports sent by Defender for Endpoint on Android. When Defender detects a corresponding threat, these controls prevent domain or app details from being sent in the alert.

Use the Managed devices app configuration policy procedure, and addprocedure. Add one or both of the following configuration keys:

  • Hide URLs in report:

    • Value type: Integer

    • Configuration values:

      • 1: Hide domain and website details in phishing alert reports.
      • 0: Include domain and website details in phishing alert reports (default).

  • Hide app details in report:

    • Value type: Integer

    • Configuration values:

      • 1: Hide app names and package information in malware alert reports.
      • 0: Include app names and package information in malware alert reports (default).

By default, Defender for Endpoint sends the list of apps in the work profile to Microsoft Defender Vulnerability Management for assessment. To prevent this app inventory from being sent for targeted users, use the Managed devices app configuration policy procedure with Personally-Owned Work Profile Only as the profile type. Add the following configuration key:

  • Enable TVM Privacy:

    • Value type: Integer

    • Configuration values:

      • 0: Send the work profile app inventory for vulnerability assessment (default).
      • 1: Don't send the work profile app inventory for vulnerability assessment.

To enable non-APK file scanning, use the Managed devices app configuration policy procedure, and add the following configuration key:

  • [Preview] Enable non-APK file scan in Microsoft Defender:

    • Value type: Integer

    • Configuration values:

      • 1: Enable non-APK file scanning.
      • 0: Disable non-APK file scanning (default).

The privacy control for phishing reports can disable the collection of domain names and website information in phishing threat reports. Use this setting to choose whether Defender for Endpoint collects the domain name when it detects and blocks a malicious or phishing website.

To turn on privacy for targeted users in the work profile, use the Managed devices app configuration policy procedure, and addprocedure. Add the following configuration key:

  • DefenderExcludeURLInReport:

    • Value type: Integer

    • Configuration values:

      • 1: Enable privacy.
      • 0: Disable privacy (default).

The privacy control for malware threat reports can disable the collection of app details, including name and package information, from malware threat reports. Use this setting to choose whether Defender for Endpoint collects the app name when it detects a malicious app.

To turn on privacy for targeted users in the work profile, use the Managed devices app configuration policy procedure, and addprocedure. Add the following configuration key:

  • DefenderExcludeAppInReport:

    • Value type: Integer

    • Configuration values:

      • 1: Enable privacy.
      • 0: Disable privacy (default).

Disable sign out

Defender for Endpoint supports deployment without the sign out button in the app. Hiding the button helps prevent users from tampering with the device. Use the Managed devices app configuration policy procedure, and addprocedure. Add the following configuration key:

  • Disable Sign Out:

    • Value type: Integer

    • Configuration values:

      • 1: Hide the sign out button. This value is the default for Android Enterprise personally owned work profiles, fully managed devices, and corporate-owned devices with a work profile.
      • 0: Show the sign out button.

Defender for Endpoint on Android supports bulk tagging of mobile devices during onboarding. Security administrators configure device tags through Intune app configuration policies and deploy them to users' devices. After users install and activate Defender, the client app sends the device tags to the Microsoft Defender portal. The tags appear with the devices in the device inventory.

To configure device tags, use the Managed devices app configuration policy procedure, and addprocedure. Add the following configuration key:

  • DefenderDeviceTag:

    • Value type: String

    • Configuration value:

      • To assign a new tag, enter a value for the device tag.
      • To edit an existing tag, change the value.
      • To delete an existing tag, remove the configuration key from the policy.