Key Takeaways
- Intune can prevent Android users from installing apps from unknown or untrusted sources.
- Restricting app installations helps reduce the risk of malware, unauthorized applications, and security threats.
- Users can be restricted to installing approved apps through the Managed Google Play Store.
- Admins can configure the App Installation from Unknown Sources setting through an Android device restriction policy.
- Organizations can deploy Line-of-Business (LOB) apps through Managed Google Play for internal business requirements.
- Intune allows IT admins to decide which applications can be installed on managed Android devices.
- Enforcing trusted app sources strengthens the organization’s overall endpoint security and data protection.
This post walks you through how to block Android App Installation from Unknown Sources using Intune. By creating a device profile within Intune, admins can enforce policies that prevent users from installing apps from sources other than the Managed Google Play Store. The Intune device restriction policy setting blocks app installation from unknown sources. This will prevent users from installing apps from sources other than the Managed Google Play Store.
Table of Content
Table of Contents
Block Android App Installation from Unknown Sources using Intune
This proactive approach significantly reduces the risk of malware or unauthorized software to installed in corporate devices, enhancing overall data protection. Once the policy is defined and applied to specific user groups, Intune ensures that only trusted apps from the Play Store can be installed.
Line of Business apps are the apps that are specific to an organization and are used for internal use. These apps are either developed internally or by Private Apps for your Organization. These apps are designed to meet the specific needs of each company, and they are not available publicly in the Google Play Store for use. Intune supports various types of Android apps for multiple types of enrolment, An IT admin can add these LOB apps to the managed Google Play Store and deploy them to enrolled users, For more details Deploy Private LOB Apps To Android Devices Using Intune.
Block Android App Installation from Unknown Sources using Intune
Blocking Android app installations from unknown sources using Intune is a crucial security measure for organizations. Let’s check the steps, to understand which policies can be applied to block or allow Android App Installation from Unknown Sources.
- Sign in to Microsoft Intune Admin Center https://intune.microsoft.com/
- Click on Devices > Android
You can check more details, you wanted to create device restriction policies from scratch, Enforcing Screen Lock For Android Devices In Intune
Modify an Existing Device Restriction Configuration Profile
In Intune, navigate to Configuration and select the existing Device Restriction configuration profile (HTMD Android device restriction policy) that you want to modify. Open the profile and choose Edit to update its settings, assignments, or other configurations based on your organization’s requirements.
Edit Configuration Settings in the Device Restriction Policy
In the HTMD Android Device Restriction Policy, select Edit next to Configuration settings to modify the existing policy settings. This allows administrators to review and update the configured restrictions based on the organization’s security and device management requirements.
Open System Security Settings
Under Configuration settings, expand the System security section to access the available Android security-related policy settings. This section allows administrators to configure security controls for managed Android Enterprise devices, including restrictions related to app installation and other system-level security options.
You can see the different categories of applied configuration in the configuration settings for Android Enterprise personally owned devices with a work profile (BYOD). The System security allows you to configure the policy to control the app scan and installation from unknown sources.
Here you can review the available restriction settings under System security. You can select and customize them as per our requirements. I will be toggling to Switch to Block for Allow installation from unknown sources where you will apply the policy.
| Settings | Description |
|---|---|
| Allow installation from unknown sources | Allow lets users turn on Unknown sources. This setting allows apps to install from unknown sources, including sources other than the Google Play Store. When set to Not configured (default), Intune doesn’t change or update this setting. By default, the OS might prevent users from turning on Unknown sources. |
Review and Save the Device Restriction Policy
After configuring the required settings, review the policy configuration to ensure all settings are correct. Once you have verified the configuration, select Review + save to save the changes and apply the updated policy.
Save the HTMD Android Device Restriction Policy
After configuring the settings, click Save to save the profile. A notification prompt will appear confirming that the profile “HTMD Android Device Restriction Policy” has been saved successfully.
Monitor the devices to ensure that the restriction is successfully enforced. Let’s test the devices to confirm that users are unable to install APKs from unknown sources on the mobile device.
- Intune Company Portal App For Windows 11 Android | Install And Uninstall
- How To Add Android Managed Google Play App In Intune
Once the configuration is applied to the device, Staging app progress will appear as soon as you attempt to install the app on the managed mobile device. The user cannot install the APKs. Here you can see the message appears “Action not allowed” You do not have permission to perform this action. Contact your organization’s IT administrator for more information.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, join the WhatsApp Community and the Whatsapp channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Jitesh, Microsoft MVP, has over six years of working experience in the IT Industry. He writes and shares his experiences related to Microsoft device management technologies and IT Infrastructure management. His primary focus is Windows 10/11 Deployment solution with Configuration Manager, Microsoft Deployment Toolkit (MDT), and Microsoft Intune.