044: SafetyNet/ Hardware Back Key

Implementation Effort: Medium
User Impact: Medium

Overview

On Android devices, protecting organizational data requires combining hardware-backed device integrity attestation (via the Google Play Integrity API) with in-app data containment settings that prevent sensitive content from leaking through system UI surfaces, screen capture, or unapproved app transitions.

Implementation Guidance

1. Configure Play Integrity verdict (which replaced the legacy SafetyNet Attestation API) in your Android app protection policy under Conditional launch.
2. Enable Screen capture and Google Assistant blocks in the Android app protection policy to prevent protected content from being exposed through system overlays, task switchers, or assistant surfaces.
3. Require Strong integrity (hardware-backed attestation and recent security patch state) for high-risk user populations accessing sensitive organizational data.
4. Test the setting with the protected apps your organization actually uses, especially Microsoft 365 mobile apps.
5. Document which populations need the stricter Android controls and why.
6. Pair the control with other Android app protection settings such as screen capture restrictions, approved keyboards, minimum OS version, and app-integrity checks.

Reference

• Android App Protection Policy Settings - Microsoft Intune — Details the available Intune app protection policy settings for Android devices.
• App Protection Policies Overview - Microsoft Intune — Provides an overview of Intune app protection policies for managed apps.