What's new in Microsoft Defender for Endpoint on Android
Applies to:
Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.
Aug-2024 (version: 1.0.6812.0101)
- Network Protection feature is enabled by default for all users
Network protection
Network protection on Microsoft Defender for Endpoint is now generally available. Network protection provides protection against rogue Wi-Fi related threats, rogue hardware like pineapple devices, and rogue certificates. It notifies the user if a related threat is detected. Users also see a guided experience to connect to secure networks and change networks when they're connected to an unsecure connection.
Important
This feature is now enabled by default for all users. As a result, users will be able to see a network protection card in the Defender for Endpoint app, along with App Protection and Web Protection. Users are also required to provide location permission to complete the set up. Admins can change the default value for network protection if they decide not to use it via the Intune App Configuration policies. There are also several admin controls to offer flexibility, including privacy controls to configure the data that's sent by Defender for Endpoint from Android devices. For more information, see network protection.
Device Tagging
Mobile Device Tagging is now generally available. This feature enables bulk tagging the mobile devices by allowing the admins to set up tags via Intune. Admin can configure the device tags through Intune via configuration policies and push them to user's devices. Once the user installs and activates Defender, the client app passes the device tags to the Security Portal. The Device tags appear against the devices in the Device Inventory.
This configuration is available for both the enrolled (MDM) devices and unenrolled (MAM) devices. For more information, see Device Tagging (MDM) and Device Tagging (MAM).
Microsoft Defender for Endpoint on Company-owned personally enabled devices
Defender for Endpoint is now generally available on AE COPE devices. Enterprises can onboard devices on COPE mode and push Defender for Endpoint to user's devices through the Microsoft Intune admin center. With this support, Android Enterprise COPE devices get the full capabilities of our offering on Android, including:
- Phishing and web protection.
- Malware scanning.
- Network protection (preview).
- Additional breach prevention through integration with Microsoft Intune and Conditional Access.
Read the announcement here.
Privacy Controls
Microsoft Defender for Endpoint on Android enables Privacy Controls for both the Admins and the End Users. This includes the controls for enrolled (MDM) and unenrolled (MAM) devices. Admins can configure the privacy in the alert report while End Users can configure the information shared to their organization. For more information, see privacy controls(MDM) and privacy controls (MAM).
Optional Permissions and Disable Web Protection
Microsoft Defender for Endpoint on Android enables Optional Permissions in the onboarding flow. Currently the permissions required by Defender for Endpoint are mandatory in the onboarding flow. With this feature, admin can deploy Defender for Endpoint on devices without enforcing the mandatory VPN and Accessibility permissions during onboarding. End Users can onboard the app without the mandatory permissions and can later review these permissions. This feature is currently present only for unenrolled devices (MAM). For more information, see optional permissions.
Microsoft Defender on Android enterprise BYOD personal profile
Microsoft Defender for Endpoint is now supported on Android Enterprise personal profile (BYOD only) with all the key features including malware scanning, protection from phishing links, network protection and vulnerability management. This support is coupled with privacy controls to ensure user privacy on personal profile. For more information, read the announcement and the deployment guide.
Microsoft Defender on Android app updates
Microsoft Defender is no longer supported for versions 1.0.3011.0302 or earlier. Users are requested to upgrade to latest versions to keep their devices secure.
To update, users can use the following steps:
On your work profile, go to Managed Play Store.
Tap on the profile icon on the top right corner and select Manage apps and device.
Locate Defender for Endpoint under updates available and select Update.
If you encounter any issues, submit in-app feedback.
Microsoft Defender for Endpoint is now Microsoft Defender in the Play store
Microsoft Defender for Endpoint is now available as Microsoft Defender in the play store. With this update, the app is available as preview for Consumers in the US region. Based on how you log into the app with your work or personal account, you have access to features for Microsoft Defender for Endpoint or for Microsoft Defender for individuals. For more information, see this blog.
Vulnerability Management
On January 25, 2022, we announced the general availability of Vulnerability management on Android and iOS. For more information, see the techcommunity post here.
Upcoming permission changes for Microsoft Defender for Endpoint running Android 11 or later (Nov 2021)
Release Build: 1.0.3501.0301
Release month: Nov 2021
Microsoft Defender for Endpoint has released this update required by Google to upgrade to Android API 30. This change prompts users seeking access to new storage permission, for devices running Android 11 or later. Users need to accept this new storage permission once they update Defender app with the release build 1.0.3501.0301 or later. This update ensures that Defender for Endpoint's app security feature to function without any disruption. For more information, review the following sections.
How will this affect your organization: These changes take effect if you're using Microsoft Defender for Endpoint on devices running Android 11 or later and updated Defender for Endpoint to release build 1.0.3501.0301 or later.
Note
The new storage permissions cannot be configured by admin to auto approve through Microsoft Intune. User will need to take action to provide access to this permission.
User experience: Users receive a notification indicating a missing permission for app security. If the user denies this permission, app security functionality is turned off on the device. If user doesn't accept or deny permission, they continue to receive the prompt when unlocking their device or opening the app, until it's approved.
Note
If your organization is previewing the tamper protection feature and if the new storage permissions are not granted by the user within 7 days of updating to the latest version, the user might lose access to corporate resources.
What you need to do to prepare:
Notify your users and helpdesk (as applicable) that users will need to accept the new permissions when prompted after they have updated Defender for Endpoint to build 1.0.3501.0301 or later version. To accept the permissions, users should:
Tap on the Defender for Endpoint in-app notification or open the Defender for Endpoint app. Users see a screen that lists the permissions needed. A green check mark is missing next to the Storage permission.
Tap Begin.
Tap the toggle for Allow access to manage all files.
The device is now protected.
Note
This permission allows Microsoft Defender for Endpoint to access storage on user's device, which helps detect and remove malicious and unwanted apps. Microsoft Defender for Endpoint accesses/scans Android app package file (.apk) only. On devices with a Work Profile, Defender for Endpoint only scans work-related files.
Tip
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.