038: Device Manufacturers

Implementation Effort: Low to Medium
User Impact: Low to Medium

Overview

Some Microsoft Intune app protection Conditional Launch scenarios allow administrators to restrict access based on Android device manufacturer. This can be useful for exceptional cases, such as limiting access to a specific rugged-device vendor or blocking unsupported consumer OEMs during a targeted deployment.

However, manufacturer-based controls are not a strong trust signal on their own. In a Zero Trust design, they should only supplement stronger checks such as OS version, device integrity, app version, and threat posture.

Implementation Guidance

1. Use manufacturer restrictions only when there is a clear business or supportability reason.
2. Prefer positive security signals over manufacturer allow-lists whenever possible.
3. If you must use the control, document the exact manufacturer values and test them against real devices.
4. Communicate carefully with users, because the failure mode can look arbitrary if they do not understand why a device brand is blocked.
5. Revalidate the rule after major Android OEM branding or platform changes.
6. Review whether a device enrollment or compliance requirement would better solve the underlying problem.

Manufacturer-based restrictions are most appropriate as a temporary or niche control, not as the foundation of mobile trust.

Reference

• Android App Protection Policy Settings - Microsoft Intune — Details the available Intune app protection policy settings for Android devices.
• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies for managed apps.