メインコンテンツへスキップ

052: Require Threat Scan on apps

Implementation Effort: Low to Medium

User Impact: Low

Overview​

The Require threat scan on apps setting for Android app protection policies uses Google Play Protect signals to help determine whether a device is in a safer state before protected work data is accessed. In a Zero Trust design, this is a lightweight but useful control for personally owned Android devices where the organization wants application-level protection without requiring full device enrollment.

This control should be treated as one signal, not a complete mobile threat defense strategy.

Implementation Guidance​

  1. Use this setting only in an Android app protection policy scenario where the protected apps support Intune app protection.
  2. Decide whether your organization should warn or block access when Google Play Protect app scanning is off. A warning is easier for pilot phases; blocking is stronger for production.
  3. Scope the policy to users who access organizational data from personally owned Android devices or from MAM-only scenarios.
  4. Pair this setting with other Android app protection controls such as PIN/biometric access, controlled data transfer, and restrictions on saving organizational data to personal storage.
  5. Provide end-user instructions for turning Google Play Protect back on, because the most common failure case is simply that the device user disabled scanning.
  6. Review reporting for potentially harmful apps and failed access attempts so you can see whether this setting is producing real security value or unnecessary friction.

Reference​