メインコンテンツへスキップ

041: Require device lock

Implementation Effort: Low to Medium
User Impact: Medium

Overview​

The Require device lock setting in Microsoft Intune app protection policies checks whether the Android device has a screen lock that meets the required strength before the protected app can be used. This helps ensure there is at least a device-level barrier if the phone is lost, shared, or left unattended.

For Zero Trust, this is a minimum local-device hygiene control that complements, but does not replace, app-level protections such as app PIN and selective wipe.

Implementation Guidance​

  1. Decide whether device lock should be a universal baseline for Android app protection users.
  2. Choose a password complexity level that matches business risk and user population. Avoid imposing high friction without a clear requirement.
  3. Combine this setting with app PIN or biometric-backed access when stronger protection is required.
  4. Test behavior across supported Android versions, because password-complexity behavior can vary by OS level.
  5. Publish a short end-user guide that explains how to set or change the device lock if access is blocked.
  6. Review the policy alongside device enrollment strategy; a stricter enrolled-device baseline may make some app-level device-lock requirements redundant.

This setting is most useful as a simple baseline in MAM-only scenarios where the organization cannot otherwise enforce a full device-configuration standard.

Reference​