Skip to main content

024: 3rd Party Keyboard

Implementation Effort: Medium
User Impact: Medium

Overview​

Keyboard apps can capture typed content, clipboard content, and usage telemetry. In app protection scenarios, that creates a risk that sensitive work data entered into a protected app could be exposed through an untrusted keyboard. Microsoft Intune supports restricting which keyboards can be used with protected apps on supported platforms and app versions.

For Zero Trust, this is a data exfiltration control. The goal is not to manage every keyboard on the device; it is to ensure that protected apps only accept input methods that the organization has reviewed and approved.

image

Implementation Guidance​

  1. Configure the Approved keyboards setting in the Intune app protection policy for Android (previously referred to as third-party keyboard restrictions in older documentation).
  2. Inventory the mobile apps and platforms where keyboard restriction is supported in your environment.
  3. In the Microsoft Intune admin center, configure the app protection policy setting that requires approved keyboards.
  4. Allow only keyboards that meet your privacy, supportability, and language requirements. Document the package IDs used for Android if Intune requires explicit package-based approval.
  5. Test multilingual and accessibility use cases before enforcement, especially for users who require regional layouts or assistive input tools.
  6. Update user communications so affected users know which keyboard apps are allowed and what remediation message they will see.
  7. Revalidate the list after major app protection SDK updates or when Microsoft adds new default approved keyboards.

Avoid enabling this control without testing, because it can create avoidable friction for users who depend on a specific input method.

Reference​