メインコンテンツへスキップ

031: Mobile Threat Defense

Implementation Effort: High
User Impact: Medium

Overview​

Mobile threat defense integration extends Microsoft Intune by adding device-risk signals from Microsoft Defender for Endpoint or another supported partner. Those signals can then influence app protection behavior, device compliance, or access decisions depending on platform and management model.

In Zero Trust terms, this is continuous risk evaluation: a device that becomes risky should not keep the same access posture it had when it first signed in.

Implementation Guidance​

  1. Choose a supported threat-defense integration strategy. For most Microsoft-centric environments, Microsoft Defender for Endpoint is the default starting point.
  2. Decide whether the threat signal will be used for:
    • Intune compliance policy evaluation on enrolled devices
    • App protection Conditional Launch decisions on supported protected apps
    • Microsoft Entra Conditional Access through compliant-device requirements or risk-aware access patterns
  3. Align risk-level definitions with the security operations team. Do not turn on blocking without agreeing what medium or high device risk means operationally.
  4. Pilot the integration on representative Android and iOS/iPadOS devices.
  5. Validate end-to-end behavior by simulating a risky device state and confirming that the intended app protection or access response occurs.
  6. Create support runbooks that explain how users remediate risk conditions.
  7. Review partner documentation periodically because supported integrations and feature coverage can change.

Threat-defense integration only adds value when someone owns the response workflow. If alerts are generated but no one remediates them, the control is incomplete.

Reference​