Defender for Endpoint onboarding for Android using Intune
Picking up on my post from last week, where I covered the details on onboarding iOS devices on MDE using Intune, I wanted to follow it up with the onboarding process for Android devices along with details on some additional configuration that I had to put in place.
In this blog, I will cover the onboarding process for Android devices onto MDE using MDM (Company Portal for personally owned Work Profile) + MAM & MAM-WE policies.
System Requirements & Pre-requisites
1. Mobile phones running Android 6.0 and above are supported. Mobile phones running Android go, tablets, and other mobile devices running Android are not currently supported.
2. The device is either enrolled with the Intune Company Portal app or is registered with Azure Active Directory through Microsoft Authenticator with the same account.
3. Microsoft Defender for Endpoint & Intune licenses assigned to the end users.
Enable Microsoft Intune connection from Microsoft 365 Defender to share device information. (Skip if already configured)
1. On Microsoft 365 Defender Portal navigate to Settings > Endpoints > General > Advanced features > Microsoft Intune connection.
2. Toggle the Microsoft Intune setting to On.
3. Click Save preferences.
4. Head over to Microsoft Endpoint Manager admin center.
5. Select Tentant Administration > Connectors and Tokens > Microsoft Defender for Endpoint and toggle on compliance policy for Android and iOS.
This way the compliance policy will use data from these connectors for evaluation based on the device threat level.
Setup compliance policy in Intune with MDE risk level (Applies to Enrolled devices in Intune)
1. On Microsoft Endpoint Manager admin center navigate to Devices > Compliance Policy.
2. Click on Create policy and select Platform as Android Enterprise and Profile type as Peronally-owned Work Profile
3. Give a name and other details and click next.
4. Configure the setting as Low or as needed according to you security requirements. Note: Microsoft recommends using Low or Clear values to ensure maximum security.
Add MDE application from Managed Google Play Store in Intune
1. In Microsoft Endpoint manager admin center, go to Apps > Android Apps > Add and select Managed Google Play app
2. On your managed Google Play page, search for Microsoft Defender. Click on the Microsoft Defender for Endpoint app from the Apps search result.
3. Review the information on the page and then select Approve.
4. Review the permissions and then select Approve.
5. Select 'Keep approved when app requests new permissions.' and hit Approve then click in Sync.
6. After a successful sync, the application will be available for assignment.
7. Assign it as required.
App Configuration policy to Autogrant Android Permissions to the MDE app for enrolled devices.
App configuration policies will enable autogrant for some specific Android permissions for the MDE app. This way, the end user will not be required to accept these permissions.
1. In Microsoft Endpoint manager admin center, go to Apps > App configuration policies
2. Click on Add and select Managed Devices.
3. Provide a name and select platform as Android Enterprise.
4. In the Profile type, you can select the profile of your choice, or All profile types. In my case, I am selecting Personally-owned Work Profile only.
5. Under targeted app, select Microsoft Defender.
6. Add the following permissions.
7. Add the following Configuration keys.
Device Restriction policy for Auto Always On VPN configuration for enrolled devices.
Defender for Endpoint on Android would use a VPN in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device.
1. In Microsoft Endpoint manager admin center, go to Devices > Configuration Profiles > Create Profile.
2. Choose Platform as Android Enterprise..
3. Select Device restrictions under one of the following, based on your device enrollment type:
-Fully Managed, Dedicated, and Corporate-Owned Work Profile
-Personally owned Work Profile
I am selecting Personally owned Work Profile in my case.
4. Type a name for the profile and select Next.
5. Under Connectivity, provide the following values -
5. Assign to a group.
Setup App Protection Policies (APP) with Device Threat Level Conditional launch.
Microsoft Defender for Endpoint can be configured to send threat signals to be used in App Protection Policies (APP, also known as MAM) on Android. With this capability, you can use Microsoft Defender for Endpoint to protect access to corporate data from unenrolled devices as well.
While MAM protection is optional for Intune enrolled devices, it is generally a good practice to apply the App Protection Policies (APP) to add an additional layer of security on your Intune enrolled devices. One can set device launch control to ensure that access to the application on a managed device is only allowed, when MDE threat level has been evaluated. The same can be configured for MAM without enrollment or MAM-WE devices.
1. On Microsoft Endpoint Manager admin center navigate to Apps > App protection policies.
2. Click on Create policy and select Android.
3. Give a name and other details and click next.
4. You have the option to select all device types, although I recommend to create separate APP for managed devices and managed apps for Android devices. (You can refer to my previous blog for some best parctices.)
5. For target apps, you can select apps individually or select preset bundle for All Microsoft apps or just Microsoft core apps. I am selecting Core Apps in accordance with my requirements.
6. Select the rest of the settings until you reach Conditional Launch section as per your requirements or you can refer to my previous blog for some best practices.
7. Once you reach Conditional Launch, select the Device threat level as Low. Again, Microsoft doesn't recommend Medium or High values, but you can set them up if needed.
8. Assign as normal.
End User Experience
During Intune enrollment\Intune enrolled\MDM+MAM scenarios, if MDE is not installed, then the device will be evaluated as non-compliant and the user will see the following in Company Portal.
Since MDE was added as a protected application in App configuration, it cannot be removed.
On a MDM+MAM or MAM-WE device, the APP will kick in. In case of MAM-WE, once the corporate identity is established, Intune will require the user to register the device using Company Portal Application. If not installed, user will be asked to install it first in order for the MAM policies to apply. Lastly the user will be asked to install the MDE application.
For permissions, the experience is slightly different for MAM-WE. User will be required to accept some permissions. -
To test for the working of MDE, you can launch smartscreentestratings2.net.
MDE in Android also provides Application level protection.
At this stage you can head over to Microsoft 365 Defender Portal to check for Device inventory and alerts. The above test cases will create Informational alerts in Defender.
Conclusion
There you have it. I left out the use of Conditional Access policies for Android for the same reasons as cited in my previous blog involving onboarding process for iOS devices. Just to re-iterate, CA works well for devices that are already enrolled in Intune as it grants access using Device compliance state. However, the same cannot be achieved for MAM-WE devices even if you grant access using APP. This is because MDE access on mobile actually takes place using Defender for Mobile application which is currently not supported for APP. If you do configure this, then chances are that you will run into onboarding issues. I did test and ran into some issues on both iOS and Android.
I am testing other MDE policies and will be sharing a write up on it very soon. If you have any questions or concerns, then please feel free to connect with me at rjindal@outlook.ie or my Twitter handle @rahulj1906.
Cheers!
Comments
Post a Comment