Intune Device Restrictions Not Enforcing Passcode on Android Devices: A Solution

Intune Device Restrictions Not Enforcing Passcode on Android Devices: Solution

In a scenario where you have a hundred devices reporting non-compliant status due to passcode issues, it indicates that device passcodes are either not set or need to be changed. This article focuses on how to enforce passcode policies on Android devices using Microsoft Intune.

Understanding the Issue

When managing a fleet of mobile devices, it's crucial to enforce security policies, such as requiring a passcode, to protect sensitive data. With Microsoft Intune, you can create and deploy device restrictions to ensure compliance. However, if devices are still reporting non-compliant statuses, it implies that the passcode policies are not being enforced on those devices.

Prerequisites

Before you start, ensure that you have the following:

• An active Microsoft Intune subscription
• Mobile devices running Android
• Access to the Microsoft Endpoint Manager admin center

Creating a Passcode Policy for Android Devices

First, create a passcode policy that will enforce the required settings on Android devices in your Intune environment. Follow these steps:

1. Sign in to the Microsoft Endpoint Manager admin center > Devices > Configuration profiles > Create profile
2. Select Platform: Android
3. Select Profile type: Templates
4. Choose Device restrictions

Configure the following settings:

5. Passcode: Select Required
6. Minimum passcode length: Configure the minimum length
7. Number of complex characters: Configure the number of complexity requirements
8. Password expiration (days): Set the number of days before a user must change the passcode
9. Password history: Define the number of previous passwords to prevent reuse
10. Allow simple passwords: Set to Block

After configuring the settings, Next > Next > Create to save the profile.

Assigning and Monitoring the Passcode Policy

Now, assign the passcode policy to the necessary devices. Follow these steps:

1. Sign in to the Microsoft Endpoint Manager admin center > Devices > Configuration profiles
2. Select your passcode policy
3. Assignments > Add group
4. Choose the Azure AD user or device group
5. Add > Review + Save

After assigning the policy, you can monitor device compliance. Check if the non-compliant devices have started reporting compliant statuses. This process can take a few minutes up to a couple of hours depending on the update and reporting intervals.

Troubleshooting Non-Compliant Devices

If Android devices still remain non-compliant, try the following:

1. Check the device's Device status to see if device compliance policies are being evaluated.
2. On the device, navigate to the Settings > Security > Screen lock to ensure the required passcode settings match the ones in the policy, and manually enforce them if necessary.
3. Ensure the Intune Company Portal app is installed and up-to-date on the device.

This article discussed the issue where Android devices reporting non-compliant statuses due to passcode policies. The solution provided steps on creating a passcode policy and assigning it to devices using Microsoft Intune. Additional troubleshooting information was given for cases where some devices still remain non-compliant. With these steps, you can enforce required passcode settings on Android devices in yourIntune environment.

References

• Microsoft documentation: https://docs.microsoft.com/intune/device-restrictions-android
• Microsoft documentation: https://docs.microsoft.com/mem/configmgr/compliance/compliance-policy-create
• Android Developers: https://developer.android.com/work/dpc/device-owner