# Android Enterprise - Compliance Policy > Compliance policy for android enterprise devices Compliance policy for android enterprise devices ## Settings this baseline controls | Setting | What it does | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Password required | Require a password to unlock Android devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Required password type | Type of characters in password (e.g., numeric, alphabetic, alphanumeric). [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Minimum password length | Minimum password length. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Minutes before password required | Minutes of inactivity before a password is required. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Days until password expires | Number of days before the password expires. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Previous passwords remembered | Number of previous passwords to prevent reuse. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Storage encryption required | Require encryption on Android devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | App runtime integrity required | Require the device to not have the Play Integrity API evaluation as a risk. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | **6 more settings** | Setting | What it does | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Minimum Android version | Minimum Android version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Maximum Android version | Maximum Android version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Minimum security patch level | Minimum Android security patch level. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Mobile Threat Defense level | Required Mobile Threat Defense level. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Maximum machine risk score | Required Advanced Threat Protection level. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | | Play Integrity check | Require the device to pass the Play Integrity basic integrity check. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-android) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to a tenant that enrols Android Enterprise devices, so Intune can tell healthy, encrypted devices apart from anything rooted, out of date or unsecured. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or bundle it into a scheme you deploy to every tenant that enrols Android devices ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Password required** on, with **Required password type** set to `numeric` and **Minimum password length** at `4`. The baseline asks for a PIN on Android rather than a full alphanumeric password. 3. Leave **Storage encryption required** and **App runtime integrity required** on. The second checks the device passes Android's Play Integrity check, which rules out rooted and tampered devices much as a jailbreak check does on iOS. 4. Set **Minimum Android version** to `12`, and leave **Maximum Android version** and **Minimum security patch level** blank. This sets a floor on the OS version, not a ceiling or a vendor patch date. 5. Save. Turn on **Auto-remediation** if you want Octiga to create or correct this policy in Intune itself the next time it detects a deviation, rather than waiting for you to fix it by hand. > **Caution:** A device already enrolled but not meeting these settings becomes noncompliant the next time it checks in. If a Conditional Access policy blocks noncompliant devices from your tenant's resources, users on older or unencrypted Android devices can lose access until the device is brought up to standard. > **Licence: Intune:** ## Check it worked This baseline shows **Passing** once the compliance policy exists in Intune with these settings and Android devices report back as compliant. To check progress, go to **Devices → Manage devices → Compliance → Policies** in the Microsoft Intune admin centre, open the policy, and use its device status and per-setting status views. A user on a noncompliant device sees a message in the Company Portal app listing what to fix, and may lose access to anything behind a Conditional Access device-compliance check until they do. ## Standards this addresses ### CIS - **v8 4.1** — CIS Controls v8 Safeguard 4.1 - **v8 3.6** — CIS Controls v8 Safeguard 3.6 ### NIST - **PR.DS-1** — NIST CSF 2.0 PR.DS-1 - **SC-28** — NIST SP 800-53 SC-28 - **CM-6** — NIST SP 800-53 CM-6 ### ISO 27001 - **A.8.13** — ISO/IEC 27001:2022 Annex A.8.13 - **A.8.22** — ISO/IEC 27001:2022 Annex A.8.22 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)