Android app directory · Identity and security
Microsoft Defender for Endpoint on Android reads a set of configuration keys that control what it scans, what it reports and how users onboard. Microsoft's documentation presents them for Intune, either as a managed devices policy or as a managed apps policy. The keys are plain restriction names, so this page lists them as such. Check how your EMM sends integer restrictions before you roll them out. Some keys appear only in the managed apps article, so test them on a device before you send them another way.
Nomidcom.microsoft.scmx Common setups
Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.
Keep web and network protection running but stop domain and app names from being included in threat reports.
{
"antiphishing": 1,
"DefenderNetworkProtectionEnable": 1,
"DefenderExcludeURLInReport": 1,
"DefenderExcludeAppInReport": 1
}Let staff skip the VPN and accessibility prompts at first launch, hide the sign-out button and tag the devices by site. Web protection stays off or partly active until people grant those permissions in the app.
{
"DefenderOptionalVPN": 1,
"DefenderOptionalAccessibility": 1,
"DisableSignOut": 1,
"DefenderDeviceTag": "warehouse-north"
}Turn on open Wi-Fi and certificate detection with notifications, and scan documents and archives as well as apps.
{
"DefenderNetworkProtectionEnable": 1,
"DefenderOpenNetworkDetection": 2,
"DefenderCertificateDetection": 2,
"EnableNonAPKFileScan": 1
}Managed configuration
Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.
| Key | Type | What it does | Example |
|---|---|---|---|
| Web protection | |||
antiphishing | Choice: 1 on, 0 off | Turns anti-phishing protection on or off. Microsoft documents it in the managed apps policy. | 1 |
vpn | Choice: 1 on, 0 off | Controls the local loopback VPN that web protection uses. Set it to 0 with antiphishing on to keep phishing checks without the VPN. | 1 |
| Network protection | |||
DefenderNetworkProtectionEnable | Choice: 1 on, 0 off | Turns network protection on or off. The other network protection keys only take effect when this one is on. | 1 |
DefenderOpenNetworkDetection | Choice: 0 off, 1 audit, 2 on | Controls detection of open Wi-Fi networks. In audit mode events go to the device timeline and the person is not notified. | 2 |
DefenderCertificateDetection | Choice: 0 off, 1 audit, 2 on | Controls detection of malicious certificates, with the same audit and on behavior as open network detection. | 2 |
DefenderAllowlistedCACertificates | Certificate thumbprints | Lists the private root certificate authorities your company trusts so Defender does not flag them as rogue. Use SHA-1 thumbprints separated by commas. | 503006091d97d4f5ae39f7cbe7927d7d652d3431 |
| Privacy and scanning | |||
DefenderExcludeURLInReport | Choice: 1 hide, 0 include | Keeps the domain name and website details out of phishing reports sent to your security team. | 1 |
DefenderExcludeAppInReport | Choice: 1 hide, 0 include | Keeps app names and package details out of malware reports. | 1 |
EnableNonAPKFileScan | Choice: 1 on, 0 off | Also scans documents, archives and scripts, not only apps. Defender stays inside the work profile when there is one. Microsoft labels it as preview in the managed devices article. | 1 |
| Onboarding and tagging | |||
DefenderOptionalVPN | Choice: 1 optional, 0 required | Lets people finish onboarding without granting the VPN permission. They can grant it later. | 1 |
DefenderOptionalAccessibility | Choice: 1 optional, 0 required | Lets people finish onboarding without granting the accessibility permission. | 1 |
DisableSignOut | Choice: 1 hide button, 0 show | Hides the sign-out button so users cannot switch Defender off by signing out. Microsoft says hiding it is already the default on personally owned work profiles, fully managed devices and corporate-owned devices with a work profile. | 1 |
DefenderDeviceTag | Text tag | Attaches a tag to the device that appears in the Defender portal's inventory, handy for grouping sites or teams. Tags can take up to 18 hours to show. People must open the Defender app before the tag can sync. | warehouse-north |
Permissions
Runtime permissions people are prompted for. A Nomid policy can grant, deny or leave each one to the person using the device.
| Permission | Android name | Why it asks | Common choice |
|---|---|---|---|
| Location | android.permission.ACCESS_FINE_LOCATION | Needed to detect threats on open or suspicious Wi-Fi networks. Microsoft recommends the all-the-time option for full protection. | Grant |
| Background location | android.permission.ACCESS_BACKGROUND_LOCATION | Lets network protection keep checking Wi-Fi while the app is closed. Without it Defender still checks certificates but not open networks. | Grant |
Permissions change between app versions. Checked in Configure Microsoft Defender for Endpoint on Android.
Deploy with Nomid
Find it on Google Play from the policy’s apps list and choose how it is installed.
In the policy, set the app’s managed configuration with the keys and values from this page.
Devices in the policy receive Microsoft Defender and its configuration on their next sync.
Questions
com.microsoft.scmx. It is the Defender for Endpoint app that appears in Google Play as Microsoft Defender.
Microsoft only documents the Intune route, as managed devices or managed apps policies, and says Intune app protection can also cover devices enrolled with another EMM. Mobile threat defense reporting and conditional access rely on a Defender and Intune connection. Microsoft does not document sending these keys from another EMM's managed configuration, so test them on a device first.
The managed apps article gives the raw key names. The managed devices article shows friendly labels in Intune's designer, and only names a few raw keys. This page uses the raw names throughout.
No. Microsoft says Defender respects Android profile boundaries and cannot reach files in the personal profile.
Add the app to a Nomid policy, set its configuration and choose its permissions.
