Android Enterprise - Compliance Policy

Compliance policy for android enterprise devices

Settings this baseline controls

Setting	What it does
Password required	Require a password to unlock Android devices. Learn more
Required password type	Type of characters in password (e.g., numeric, alphabetic, alphanumeric). Learn more
Minimum password length	Minimum password length. Learn more
Minutes before password required	Minutes of inactivity before a password is required. Learn more
Days until password expires	Number of days before the password expires. Learn more
Previous passwords remembered	Number of previous passwords to prevent reuse. Learn more
Storage encryption required	Require encryption on Android devices. Learn more
App runtime integrity required	Require the device to not have the Play Integrity API evaluation as a risk. Learn more

6 more settings

Setting	What it does
Minimum Android version	Minimum Android version. Learn more
Maximum Android version	Maximum Android version. Learn more
Minimum security patch level	Minimum Android security patch level. Learn more
Mobile Threat Defense level	Required Mobile Threat Defense level. Learn more
Maximum machine risk score	Required Advanced Threat Protection level. Learn more
Play Integrity check	Require the device to pass the Play Integrity basic integrity check. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

Add this to a tenant that enrols Android Enterprise devices, so Intune can tell healthy, encrypted devices apart from anything rooted, out of date or unsecured.

1. Add the baseline to the tenant directly (Adding a baseline), or bundle it into a scheme you deploy to every tenant that enrols Android devices (Deploying a scheme).

2. Leave Password required on, with Required password type set to numeric and Minimum password length at 4. The baseline asks for a PIN on Android rather than a full alphanumeric password.

3. Leave Storage encryption required and App runtime integrity required on. The second checks the device passes Android’s Play Integrity check, which rules out rooted and tampered devices much as a jailbreak check does on iOS.

4. Set Minimum Android version to 12, and leave Maximum Android version and Minimum security patch level blank. This sets a floor on the OS version, not a ceiling or a vendor patch date.

5. Save. Turn on Auto-remediation if you want Octiga to create or correct this policy in Intune itself the next time it detects a deviation, rather than waiting for you to fix it by hand.

Caution

A device already enrolled but not meeting these settings becomes noncompliant the next time it checks in. If a Conditional Access policy blocks noncompliant devices from your tenant’s resources, users on older or unencrypted Android devices can lose access until the device is brought up to standard.

Licence: Intune

Check it worked

This baseline shows Passing once the compliance policy exists in Intune with these settings and Android devices report back as compliant. To check progress, go to Devices → Manage devices → Compliance → Policies in the Microsoft Intune admin centre, open the policy, and use its device status and per-setting status views. A user on a noncompliant device sees a message in the Company Portal app listing what to fix, and may lose access to anything behind a Conditional Access device-compliance check until they do.

Standards this addresses

CISv8 4.1v8 3.6

NISTPR.DS-1SC-28CM-6

ISO 27001A.8.13A.8.22

GDPRArticle 32

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→