Approved Keyboards (Android Only)
Implementation Effort: Low
User Impact: Medium
Overview
The Android Approved keyboards APP control limits which input methods may be used inside managed apps. This reduces the risk of sensitive work data being exposed to untrusted or unsanctioned keyboard apps that may log or transmit entered content.
Because Android devices often ship with OEM keyboards and users may install additional keyboards for accessibility or language support, the approved list should be deliberate, tested, and documented rather than guessed.
Implementation Guidance
- In the Intune admin center, open the relevant Android app protection policy and configure the Approved keyboards setting under the documented data protection controls.
- Add the package IDs for each approved keyboard. Common examples may include Microsoft SwiftKey and Gboard, but administrators should verify the exact package IDs and any OEM-specific variants used in their device estate before rollout.
- Test on the Android device families actually used in production. Samsung, Pixel, and other OEM devices can differ in default keyboard packaging and user prompts.
- Coordinate with accessibility and language-support requirements. If a needed keyboard is not approved, document the exception process and the risk review instead of asking users to improvise.
- Publish the support statement so help desks know which keyboards are sanctioned and what users should do if a managed app blocks input due to an unapproved keyboard.
Video Walkthrough
Reference
- Android App Protection Policy Settings - Microsoft Intune — Details Android app protection policy data protection, access requirements, and conditional launch settings.
- App Protection Policies Overview - Microsoft Intune — Explains Intune app protection policy capabilities, the data protection framework, access requirements, and conditional launch behaviors.
- Tutorial - Walkthrough the Microsoft Intune Admin Center - Microsoft Intune — Shows where to review app protection policy status and troubleshoot affected users in the Intune admin center.