Plan for Change: Google Play strong integrity definition update for Android 13 or above

As previously communicated, Google has updated the definition of "Strong Integrity" for devices running Android 13 or above, requiring hardware-backed security signals and recent security updates. For more information refer to the Android Developers Blog: Making the Play Integrity API faster, more resilient, and more private. Microsoft Intune will enforce this change by October 31, 2026. Until then we have adjusted app protection policy and compliance policy behavior to align with Google’s recommended backward compatibility guidance to minimize disruption as detailed in Improved verdicts in Android 13 and later devices | Google Play | Android Developers.

[How this will affect your organization:]

Our telemetry indicates that you have targeted users with app protection policies and/or compliance policies that are using devices running Android 13 or above without a security update in the past 12 months. After October 31, 2026, these devices will no longer meet the "Strong Integrity" standard.

User Impact: For users running devices on Android 13 or above after this change:

• Devices without the latest security updates may be downgraded from "Strong Integrity" to "Device Integrity" which could result in conditional launch blocks for affected devices.
• Devices without the latest security updates may see their devices become noncompliant in the Intune Company Portal app and could lose access to company resources based on your organization's Conditional Access policies.

Note: Devices running Android versions 12 or below are not affected by this change. 

[What you need to do to prepare:]

Review and update your policies as needed. Ensure users with devices running Android 13 or above are receiving timely security updates. You can use the app protection status report to monitor the date of the last Android Security Patch received by the device and notify users to update as needed. The following admin options are available to help warn or block users:

• For app protection policies configure the Min OS version and Min patch version conditional launch settings. For more details, review Android app protection policy settings in Microsoft Intune | Microsoft Learn
• For compliance policies configure the Minimum security patch level compliance setting. For more details, review: Device compliance settings for Android Enterprise in Intune