How can I review app permissions before installing an APK file?

Question

I recently downloaded an APK file from a trusted website, but I am not sure about the safest way to install it on my Android phone. What security checks should I perform before installation, and how can I verify that the APK file is safe to use?

Answer 1

Hi,If you downloaded this using a desktop, you could always scan it with Windows Security. If no threats are detected, a good next step is to upload the file to VirusTotal for a second opinion. VirusTotal checks the file against multiple antivirus engines, which can help identify anything suspicious. If the APK is flagged by several reputable security vendors, proceed with caution, as the file may have been tampered with or could contain malware.

Answer 2

I think Android shows two things before install the permissions in the manifest and the signing cert inside the apk you can open the file with a simple viewer and compare those with what the developer publishes and that is the safe way to check an apk.

Answer 3

Before installing an APK, several checks can reduce risk and help ensure the app is safe and its permissions are appropriate.

1. Prefer store-based and built-in protections

• Whenever possible, prefer apps from official stores (such as Google Play or Amazon Appstore) because they are scanned and monitored.
• On Android devices that are managed with Microsoft Intune, admins can require Google’s built-in app scanning (Play Protect / Verify Apps). End users should ensure this is enabled so the device can send security signals and scan apps:
  • Open Google Play Store.
  • Go to My apps & games.
  • Tap the result of the last app scan to open Play Protect.
  • Make sure Scan device for security threats is turned On.

2. Be cautious with “unknown sources” / “install unknown apps”

• Installing APKs from outside the official store increases risk. Only install from developers and sites that are genuinely trusted.
• On Android 8.x and higher, permission is per-app:
  • Open Settings > search for Special access.
  • Tap Special access > Install unknown apps.
  • Select the browser or file manager used to open the APK and enable Allow from this source only if the source is trusted.
• On Android 7.x and lower:
  • Open Settings > Security or Lock screen and security.
  • Turn on Unknown sources only when needed, then turn it off again after installation.

3. Use reputation and browser protections

• If the APK was downloaded via a browser such as Microsoft Edge, pay attention to any SmartScreen or similar warnings about the site or download. Reputation-based checks can flag known malicious or suspicious sites and files.
• If the browser or platform shows a warning that the file or its publisher is untrusted, reconsider installing it.

4. Check the site and file before installing

• Confirm the site is the official site for the app or developer, not a third-party mirror.
• Avoid APKs that have been repackaged or modified by unknown parties.
• If possible, compare the file’s checksum or signature with values published by the developer.

5. Review and control permissions at install and runtime

• During installation, review the permissions the app requests and consider whether they match the app’s purpose (for example, a simple game should not need access to SMS or phone calls).
• After installation, review and adjust permissions:
  • Open Android Settings > Apps > select the app > Permissions.
  • Deny any permissions that are not clearly needed for the app’s core functionality.

6. Keep security tools active

• Ensure a reputable mobile security solution such as Microsoft Defender (where available) is installed and allowed to:
  • Run in the background.
  • Access device storage to scan apps and files for threats.
  • Send notifications so it can alert about malicious behavior.
• Allow it to perform an initial and periodic scan after installing new apps.

7. General safe-download practices

• Use an antivirus or mobile security app to scan the APK file before installing.
• Only download files from sites that are trusted.
• If any warning appears during download or installation about the file being unsafe or corrupted, do not proceed.

If any step (browser reputation checks, Play Protect, or Defender) flags the APK as unsafe, the safest option is not to install it.

---

References:

• Testing Android Apps
• Frequently asked questions about MAM and app protection
• Installing Microsoft Defender
• Download files from the web
• App Installer Security Features