109: Mobile Threat Defense (MTD Role Permissions & Auto-Launch)
Implementation Effort: Medium – Requires enabling the MTD connector in Intune, deploying the MTD app (Microsoft Defender for Endpoint or partner), and enabling MTD role toggles.
User Impact: Low – With Android auto-launch during setup and MTD role exemptions, protection activates automatically without manual user setup or accidental termination.
Overview
Mobile Threat Defense (MTD) solutions (such as Microsoft Defender for Endpoint or supported partners like Zimperium, Lookout, Check Point, Pradeo, Trustd Mobile, and iVerify Enterprise) integrate with Microsoft Intune to detect malware, phishing, network threats, OS vulnerabilities, and malicious certificates on iOS/iPadOS and Android devices, feeding real-time device risk signals into Intune Compliance and App Protection Policies.
Major 2026 enhancements eliminate common mobile MTD deployment gaps:
- Grant MTD Role Permissions on Android COBO & COPE (June 2026 / 2605): A new Grant MTD role permissions toggle on the Intune MTD connector page grants enhanced OS-level exemptions to your chosen MTD app on corporate-owned fully managed (COBO) and corporate-owned work profile (COPE) Android devices:
- Exempt from Suspension & Hibernation: The OS cannot suspend or hibernate the MTD app.
- Exempt from Power Restrictions: Can start foreground services from the background without battery optimization throttling.
- Protected from User Termination: End users cannot force-stop the app or clear its app data, preventing users from disabling endpoint protection.
- Automatically Launch Microsoft Defender for Endpoint During Android Setup (June/September 2026 / 2605 & 2609): When enabled on the Defender for Endpoint connector page, Intune automatically opens Defender during out-of-box enrollment on Android COBO and COPE devices so initial onboarding completes during device setup without relying on the user to open the app manually.
- Rooted Android Devices Blocked from Microsoft Tunnel (November 2025): The Defender client on Android automatically detects root status, elevates device risk to High, and immediately drops and blocks Microsoft Tunnel VPN connections.
- iOS Certificate Inventory Sync with Zimperium (February 2026 / 2601): Synchronizes installed certificate inventory from managed iOS/iPadOS devices to detect malicious root/identity certificates.