Grant enhanced security permissions to a Mobile Threat Defense app on Android

A new Mobile Threat Defense role category is available on the Mobile Threat Defense connector configuration page in the Microsoft Intune admin center. The Grant MTD role permissions to \<MTD partner name\> on enrolled Android COBO and COPE devices toggle lets you grant enhanced security permissions to one Mobile Threat Defense partner app, such as Microsoft Defender for Endpoint or a supported third-party partner, on enrolled Android Enterprise corporate-owned fully managed (COBO) and Android Enterprise corporate-owned work profile (COPE) devices.

When you turn on this toggle, the selected MTD app receives the following exemptions on targeted devices:

• Suspension — The app is prevented from being suspended.
• Hibernation — The app is prevented from entering hibernation.
• Power restrictions — The app is exempt from power-related restrictions such as app standby, and can start foreground services from the background.
• User controls — Users can't clear app data or force-stop the app.

These exemptions help the MTD app maintain continuous threat protection without interruption from system or user actions. Only one MTD partner can hold these permissions per tenant.

For Microsoft Defender for Endpoint, a second toggle is also available: Automatically launch Microsoft Defender for Endpoint during setup on Android COBO and COPE devices. When enabled, the Defender for Endpoint app automatically launches during device setup, allowing it to complete its initial configuration without requiring the user to manually open it.

For more information, see Mobile Threat Defense role.