079: Mobile Threat Defense
Implementation Effort: Medium
User Impact: Medium
Overview
Mobile Threat Defense integration lets Microsoft Intune consume device risk signals from Microsoft Defender for Endpoint or supported partner solutions so compromised or high-risk mobile devices can be identified quickly. In a Zero Trust model, threat signals should not remain informational. They should feed compliance state and access decisions so devices with elevated risk are blocked, remediated, or limited before they can continue accessing corporate data.
Implementation Guidance
- Select the mobile threat provider you will standardize on. Many organizations use Microsoft Defender for Endpoint for a more integrated Microsoft signal path, while some use approved partner integrations for specific requirements.
- Enable the connector in Tenant administration > Connectors and tokens in the Microsoft Intune admin center, and confirm the provider-to-Intune trust and required licensing are in place.
- Deploy the mobile threat app to target devices and verify it can onboard, report health, and communicate risk back to Intune.
- Create or update compliance policies so device risk thresholds are meaningful. For example, treat medium or high risk as noncompliant if that aligns with your incident response model.
- Use Conditional Access to require a compliant device or otherwise block risky devices from accessing Exchange, SharePoint, Teams, and other business applications.
- Document the remediation path for users and help desk staff so a blocked device can be investigated and returned to service quickly.
Video Walkthrough
Reference
- Configure Microsoft Defender for Endpoint with Intune and onboard devices - Microsoft Intune — Shows how to enable the Intune and Defender for Endpoint service-to-service connection.
- Integrate Mobile Threat Defense with Microsoft Intune - Microsoft Intune — Explains how to enable Mobile Threat Defense connectors and partner integrations in Microsoft Intune.
- How to Require Device Compliance with Conditional Access - Microsoft Entra ID — Explains how Intune compliance policies work with Conditional Access to protect access to resources.