043: Require Play Integrity Verdict (formerly SafetyNet)

Implementation Effort: Low – Built-in conditional launch setting in Intune App Protection Policies for Android.

User Impact: Low – Transparent to users on unmodified devices; blocks or wipes corporate app data on compromised or tampered devices.

Overview

Google replaced the legacy SafetyNet Attestation API with the Google Play Integrity API. In Microsoft Intune App Protection Policies (APP) and Android Compliance Policies, the Play Integrity Verdict setting verifies the integrity of Android devices before allowing access to corporate data.

Important October 31, 2026 Enforcement Update

Google updated the definition of Strong Integrity (MEETS_STRONG_INTEGRITY) for devices running Android 13 and later, requiring both hardware-backed security signals and a security update within the past 12 months. Microsoft Intune enforces this updated definition starting October 31, 2026:

• Devices on Android 13+ without a security patch in the last 12 months are downgraded from Strong Integrity to Device Integrity (MEETS_DEVICE_INTEGRITY), which can trigger conditional launch blocks or mark devices noncompliant.
• Admins should pair Play Integrity checks with the Min OS version and Min patch version conditional launch settings (and Minimum security patch level in MDM compliance policies) to warn users before they are blocked.

Reference

• Android app protection policy settings – Conditional launch (Play Integrity)
• Device compliance settings for Android Enterprise in Intune