Skip to main content

MDM_04: Mobile Threat Defense for iOS and Android MDM in Intune

Implementation Effort: Medium  IT teams must configure MTD connectors, deploy third-party or Microsoft Defender apps, and integrate threat signals into compliance and Conditional Access policies.

User Impact: Medium  Users may need to install and maintain a threat defense app on their mobile devices and respond to alerts or remediation steps.

Overview​

Mobile Threat Defense (MTD) in Microsoft Intune enhances mobile security by integrating with third-party MTD vendors or Microsoft Defender for Endpoint. It enables real-time threat detection and response for iOS and Android devices, helping protect corporate data from mobile-specific threats such as malicious apps, unsafe networks, and OS vulnerabilities.

Key Capabilities​

  • Threat Detection: MTD apps analyze device behavior, network activity, and app integrity to detect threats.
  • Risk-Based Compliance: Devices are evaluated against risk levels (low, medium, high) reported by the MTD app.
  • Conditional Access Enforcement: Devices exceeding the allowed risk level are blocked from accessing corporate resources like Exchange, SharePoint, or Teams.
  • Support for Unenrolled Devices: MTD can also protect BYOD scenarios using Intune App Protection Policies (MAM).

Integration Workflow​

  1. Deploy MTD App: Users install the MTD app (e.g., Microsoft Defender or a third-party partner).
  2. Connect MTD to Intune: Admins configure the MTD connector in the Intune admin center.
  3. Define Compliance Policies: Set risk level thresholds that determine device compliance.
  4. Enforce with Conditional Access: Block or limit access based on device risk status.

Example: A device connected to a suspicious Wi-Fi network is flagged as "High Risk" by the MTD app. Intune marks the device non-compliant and blocks access to Microsoft 365 until the issue is resolved 1.

Zero Trust Fit​

This supports the "Assume breach" principle by continuously evaluating device health and blocking access from compromised endpoints, even if they are enrolled and previously compliant.

Reference​