Phones now carry the same email, Teams chats and files as laptops, yet most businesses protect them with little more than a PIN. Mobile threat defense with Intune changes that. A mobile threat defense (MTD) app on each iPhone and Android device watches for phishing links, malicious apps, risky networks and jailbroken or rooted devices, then reports a threat level to Intune. Intune uses that signal to block or wipe corporate data before an attacker can use the phone as a way in.
This guide covers what mobile threat defense actually protects against, how the Intune connector works, how to use Microsoft Defender as your MTD app, and how to apply it to both company-owned and personal phones.
What threats on phones look like
Mobile attacks rarely look like the desktop malware people imagine. In the incidents I see, the common patterns are:
Phishing by text message and messaging apps. A fake delivery notice or a fake Microsoft sign-in page, opened on a small screen where the address bar is easy to miss.
Malicious or over-permissioned apps, mostly on Android, especially when users install from outside the Play Store.
Jailbroken or rooted devices, where the operating system’s own protections have been removed.
Risky networks such as rogue Wi-Fi hotspots.
Outdated operating systems with known, exploited vulnerabilities.
Intune compliance can catch some of these on its own, like minimum OS version and jailbreak detection. An MTD app adds real-time detection of phishing and malicious apps, which compliance settings cannot see.
How the Intune MTD integration works
The model is the same whichever MTD vendor you choose:
The MTD app runs on the phone and classifies threats as low, medium or high.
The MTD service sends a device threat level to Intune through a connector.
Intune uses that level in a compliance policy (enrolled devices) or an app protection policy (enrolled or not).
Conditional Access or app conditional launch blocks access, or wipes corporate data from protected apps, when the threat level is above what you allow.
Intune supports Microsoft Defender for Endpoint and a list of third-party MTD partners, including Lookout for Work, Zimperium, Check Point Harmony Mobile, Jamf, SentinelOne and others. If you already run Microsoft Defender on your Windows devices, using Defender on mobile keeps everything in one portal and one set of alerts, which is why it is my default recommendation.
Step 1: Turn on the connector
For Microsoft Defender:
In the Defender portal, confirm Microsoft Intune connection is on under Settings > Endpoints > Advanced features.
In the Intune admin center, go to Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint.
Turn on the toggles to connect Android and iOS/iPadOS devices for compliance evaluation, and the separate toggles for app protection policy evaluation if you plan to cover personal phones.
For a third-party vendor, use Tenant administration > Connectors and tokens > Mobile Threat Defense, add the connector for your vendor, and complete the setup in that vendor’s console. Without the connector, MTD settings in your policies have no effect.
Step 2: Deploy the Defender app
Deploy the Microsoft Defender app from Intune to the phones in scope:
iOS and iPadOS: deploy the app from the App Store as a required app for company devices. Defender uses a local VPN profile on iOS to provide web protection without routing your traffic elsewhere, so deploy the Defender VPN configuration profile from Intune to avoid user prompts.
Android Enterprise: approve Microsoft Defender in managed Google Play and deploy it to the work profile or fully managed device. On Android, Defender adds app scanning on top of web protection.
For Android corporate-owned devices (fully managed and corporate-owned work profile), the connector page offers a toggle that grants the MTD app extra role permissions, so Android cannot suspend it or let users force-stop it. Only one MTD partner can hold those permissions per tenant.
Step 3: Use the threat level in compliance
For enrolled phones, add the threat level to your iOS and Android compliance policies. You have two related settings:
Setting
Where
Values
Require the device to be at or under the machine risk score
Microsoft Defender for Endpoint section
Clear, Low, Medium, High
Require the device to be at or under the Device Threat Level
Device Health section (any MTD partner)
Secured, Low, Medium, High
Use the one that matches your MTD source. For most businesses I set Low, so a medium or high threat makes the phone noncompliant. Combine this with jailbreak and root blocking and a minimum OS version, and require a compliant device in Conditional Access.
Step 4: Protect personal phones with app protection
Many businesses do not enroll personal phones, and that is often the right call. You can still apply mobile threat defense to them through Intune app protection policies:
Create or edit an app protection policy for iOS and Android covering Outlook, Teams, OneDrive and the other Microsoft 365 apps.
Under Conditional launch, add Max allowed device threat level. Choose a level and an action: Block access or Wipe data.
If you have more than one MTD connector, set Primary MTD service so the app knows which one to trust.
Use Conditional Access to require an app protection policy for mobile access.
The Defender app must be installed and signed in for the protected apps to open. If a threat is found, only corporate data in the managed apps is blocked or wiped. Photos and personal apps are untouched, which is what makes this acceptable to staff on their own phones.
Rollout tips
Start in report-only. Set the threshold to High at first, so you can see detections without blocking anyone. Tighten after two weeks.
Tell users before the app appears. A security app suddenly asking for VPN or notification permissions causes tickets. A short note explaining what it does, and what it does not see, prevents most of them.
Check activation. A deployed but never-opened MTD app reports nothing. Track activation in the Defender portal device list.
Keep break-glass accounts excluded from Conditional Access policies that require compliant or protected devices.
Mobile threat defense sits on top of good mobile management. Our Intune for iOS and iPadOS and Intune for Android services cover enrollment, compliance and app protection, and our BYOD for Microsoft 365 approach shows how to protect personal phones without enrolling them.
Do I need a third-party mobile threat defense product if I have Defender?
Usually not. Microsoft Defender for Endpoint works as an MTD source for Intune on iOS and Android. Third-party partners are an option if you already use one or need a specific feature they offer.
Can mobile threat defense work on phones that are not enrolled in Intune?
Yes. Use the max allowed device threat level setting in an app protection policy. The MTD app reports the threat level, and Intune blocks or wipes corporate data in protected apps only.
Does the Defender app on iPhone see my personal browsing?
Defender uses a local VPN on iOS to check links against threat intelligence and block known malicious sites. It is designed for web protection, not for reporting your browsing history to your employer.
Not sure how exposed your staff’s phones are? Book a free Microsoft 365 security assessment and we will review your mobile compliance, app protection and threat defense setup.
Phones now carry the same email, Teams chats and files as laptops, yet most businesses protect them with little more than a PIN. Mobile threat defense with Intune changes that. A mobile threat defense (MTD) app on each iPhone and Android device watches for phishing links, malicious apps, risky networks and jailbroken or rooted devices, then reports a threat level to Intune. Intune uses that signal to block or wipe corporate data before an attacker can use the phone as a way in.
This guide covers what mobile threat defense actually protects against, how the Intune connector works, how to use Microsoft Defender as your MTD app, and how to apply it to both company-owned and personal phones.
What threats on phones look like
Mobile attacks rarely look like the desktop malware people imagine. In the incidents I see, the common patterns are:
Intune compliance can catch some of these on its own, like minimum OS version and jailbreak detection. An MTD app adds real-time detection of phishing and malicious apps, which compliance settings cannot see.
How the Intune MTD integration works
The model is the same whichever MTD vendor you choose:
Intune supports Microsoft Defender for Endpoint and a list of third-party MTD partners, including Lookout for Work, Zimperium, Check Point Harmony Mobile, Jamf, SentinelOne and others. If you already run Microsoft Defender on your Windows devices, using Defender on mobile keeps everything in one portal and one set of alerts, which is why it is my default recommendation.
Step 1: Turn on the connector
For Microsoft Defender:
Settings > Endpoints > Advanced features.Tenant administration > Connectors and tokens > Microsoft Defender for Endpoint.For a third-party vendor, use
Tenant administration > Connectors and tokens > Mobile Threat Defense, add the connector for your vendor, and complete the setup in that vendor’s console. Without the connector, MTD settings in your policies have no effect.Step 2: Deploy the Defender app
Deploy the Microsoft Defender app from Intune to the phones in scope:
For Android corporate-owned devices (fully managed and corporate-owned work profile), the connector page offers a toggle that grants the MTD app extra role permissions, so Android cannot suspend it or let users force-stop it. Only one MTD partner can hold those permissions per tenant.
Step 3: Use the threat level in compliance
For enrolled phones, add the threat level to your iOS and Android compliance policies. You have two related settings:
Use the one that matches your MTD source. For most businesses I set Low, so a medium or high threat makes the phone noncompliant. Combine this with jailbreak and root blocking and a minimum OS version, and require a compliant device in Conditional Access.
Step 4: Protect personal phones with app protection
Many businesses do not enroll personal phones, and that is often the right call. You can still apply mobile threat defense to them through Intune app protection policies:
The Defender app must be installed and signed in for the protected apps to open. If a threat is found, only corporate data in the managed apps is blocked or wiped. Photos and personal apps are untouched, which is what makes this acceptable to staff on their own phones.
Rollout tips
Mobile threat defense sits on top of good mobile management. Our Intune for iOS and iPadOS and Intune for Android services cover enrollment, compliance and app protection, and our BYOD for Microsoft 365 approach shows how to protect personal phones without enrolling them.
Microsoft’s guide to MTD app protection: Create Mobile Threat Defense app protection policy with Intune.
Frequently asked questions
Do I need a third-party mobile threat defense product if I have Defender?
Usually not. Microsoft Defender for Endpoint works as an MTD source for Intune on iOS and Android. Third-party partners are an option if you already use one or need a specific feature they offer.
Can mobile threat defense work on phones that are not enrolled in Intune?
Yes. Use the max allowed device threat level setting in an app protection policy. The MTD app reports the threat level, and Intune blocks or wipes corporate data in protected apps only.
Does the Defender app on iPhone see my personal browsing?
Defender uses a local VPN on iOS to check links against threat intelligence and block known malicious sites. It is designed for web protection, not for reporting your browsing history to your employer.
Not sure how exposed your staff’s phones are? Book a free Microsoft 365 security assessment and we will review your mobile compliance, app protection and threat defense setup.