Microsoft Defender antivirus arrives on Android

A few months ago, Microsoft promised to release a proprietary Microsoft Defender antivirus for mobile devices that are running the Android operating system. Now the company has released a free preview version of the application.

Microsoft Defender antivirus arrives on Android

Google’s mobile operating system contains a huge amount of threats, including malware, phishing apps, trojans, and more. Google removes hundreds or even thousands of applications every month. But, many of these dangerous apps end up in users’ devices.

Microsoft Defender ATP for Android should solve this problem. This application allows you to scan your phone for malware and detect phishing attempts. When Microsoft Defender ATP detects malware, it restricts access to critical applications such as email clients and online banking applications to prevent further damage. If there is a threat, Microsoft Defender ATP will warn you about it.

Microsoft Defender ATP is currently still in a preview phase for Microsoft 365 customers. For all others, the antivirus will become available in the coming months.

MS Defender Key Capabilities

Web protection

Phishing is one of the biggest threat vectors on mobile. The majority of attacks happening outside of emails such as via phishing sites, messaging apps, games, and other applications. Other potential threats come from apps that may make connections to unsafe domains, unknowingly to the user and security teams. Web protection capabilities in Microsoft Defender ATP for Android help to address these challenges with:

1. Anti-phishing: 
2. Blocking unsafe connections:
3. Custom indicators

Malware scanning

Enterprises deploying Android can leverage built-in protections in the Android platform to limit the installation of apps to trusted sources as well as tools like Google Play Protect to significantly reduce the threat surface of potentially harmful apps being installed on devices. Microsoft Defender ATP fortifies this by introducing additional visibility and controls to deliver further assurances on keeping devices free of threats to device security.

Microsoft Defender ATP for Android uses cloud protection powered by deep learning. In addition to heuristics to provide coverage for low-fidelity signals which are inconclusively handled by signatures, in addition to offering signature-based malware detection. This protection extends to both malicious apps and files on the device.

Scans are instantly performed detect malware and potentially unwanted applications (PUA). If a safe app is downloaded, the end-user will see a lightweight notification letting them know the app is clean.

Blocking access to sensitive data

Additional layers of protection against malicious access to sensitive corporate information are offered by integrating with Microsoft Endpoint Manager. It includes both Microsoft Intune and Configuration Manager. For example, a compromised device would be blocked from accessing Outlook email. When Microsoft Defender ATP for Android finds that a device has malicious apps installed, it will classify the device as “high risk” and will flag it in the Microsoft Defender Security Center. Microsoft Intune uses the device’s risk level in conjunction with pre-defined compliance polices to activate Conditional Access rules that block access to corporate assets from the high-risk device.

 Unified SecOps experience

The Microsoft Defender Security Center acts as the single pane of glass experience for security teams to get a centralized view of threats and activities. All the alerts for phishing and malware on Android devices are surfaced here. As part of the alert, analysts see the name of the threat, its severity, the alert process tree for the incident, and other additional context including file details and associated SHA information. Android device-related alerts also roll up into the incident where analysts can get a more holistic view of attacks associated with a device.