Defender for Endpoint on iOS and Android: Intune onboarding, VPN, MTD and sign-in errors

On phones and tablets, Defender for Endpoint protects the device (web protection, jailbreak detection on iOS) and sends a device risk level to Intune for compliance and app protection policies. When onboarding stalls, the cause is usually the Intune connection, the license, the sign-in broker app or the VPN behind web protection. In this post I'll work through each, with the settings that must match and how to prove a device is reporting.

Symptoms#

• On Android, the Microsoft Defender app stops at sign-in with Sign in failed: Unexpected error, try later or Sign in failed: Invalid license, contact administrator.
• In the Microsoft Intune admin center, Endpoint security › Defender for Endpoint shows Connection status: Unavailable, and compliance policies that use the Defender risk score never mark mobile devices compliant.
• An iOS device has the app but never shows up in the Defender portal's device inventory.
• A banking app, another VPN or a line-of-business app stops working while the Defender VPN is connected.

Why it happens#

• The services aren't connected. The Intune connection is turned on in the Defender portal, then each platform has its own toggles in Intune: one for compliance evaluation and a separate one for app protection evaluation.
• No license. Microsoft gives the Android license error two causes: no license assigned to the user, or no qualifying subscription in the organization.
• The broker app. The device must be registered in Microsoft Entra ID through Microsoft Authenticator or the Company Portal, and the user signs in to Defender with the same account. An outdated Authenticator on Android causes the "unexpected error"; a clock set by hand can make tokens look expired.
• The VPN. On unsupervised iOS devices and on Android, web protection uses a local loopback VPN that doesn't send traffic off the device. iOS allows only one active device-wide VPN, and some apps refuse to run while any VPN is detected.

How to fix it#

1. Connect Defender for Endpoint to Intune#

In the Microsoft Defender portal, go to System › Settings › Endpoints › General › Advanced features, turn on Intune connection and select Save preferences. Back in the Intune admin center, Endpoint security › Defender for Endpoint should show Enabled; Microsoft says the status can take up to 15 minutes to update. On the same page, turn on Connect Android devices to Defender for Endpoint and Connect iOS/iPadOS devices to Defender for Endpoint under both Compliance policy evaluation and App protection policy evaluation (the second set matters for unenrolled devices that only have app protection), then select Save.

2. License the users and deploy the apps#

Assign a Defender for Endpoint license to every user of the app. For iOS, add Microsoft Defender: Security as an iOS store app (or volume-purchased app) and assign it as required. If enrollment uses the Company Portal, make sure users completed it; for just-in-time registration without the Company Portal, deploy Microsoft Authenticator as required, because it provides the SSO extension registration uses. For Android Enterprise, approve the Microsoft Defender app in managed Google Play and assign it as required.

3. Onboard iOS without user effort#

For unsupervised devices, create an iOS/iPadOS VPN template profile with these values:

Add EnableVPNToggleInApp = True only if users should be able to switch the VPN from inside the app. Zero-touch can take up to five minutes, and it isn't available for devices enrolled without user affinity or with User Enrollment. After a password change or an MFA prompt, the user might still have to sign in once.

For supervised devices, create a managed devices app configuration policy for the app with key issupervised, type String, value {{issupervised}}, and deploy Microsoft's ControlFilter (or zero-touch ControlFilter) .mobileconfig as a custom profile. That gives web protection without the local VPN, but the ControlFilter profile doesn't work alongside Always-On VPN.

4. Clear the sign-in errors#

• Unexpected error, try later (Android): update Microsoft Authenticator from Google Play and sign in again.
• Invalid license, contact administrator (Android): assign the license, then sign in again.
• iOS device never appears: confirm the device is registered in Entra ID, that the user signed in with the same account, and that Settings › General › Date & Time › Set Automatically is on.
• Xiaomi devices: users must allow Display pop-up windows while running in the background, otherwise phishing pages aren't blocked, and might have to set Defender to Don't Optimize in the work profile's battery optimization screen.

5. Use the risk level in policy#

In an Android Enterprise or iOS/iPadOS compliance policy, expand Microsoft Defender for Endpoint and set Require the device to be at or under the machine risk score (Clear, Low, Medium or High). For unenrolled devices, use the app protection conditional launch setting Max allowed device threat level with Block access or Wipe data. If devices stay noncompliant, work through the machine risk score checklist; third-party partners are covered in Intune MTD connectors.

6. Resolve VPN conflicts#

When a user needs another VPN or an app that refuses to run behind one, they can pause the Defender VPN in Settings › General › VPN: select the i button for Defender and turn off Connect On Demand. Web protection stays off until they turn it back on in the app. If you don't deploy the VPN at all, turn off web protection; the iOS app then reports only when opened, and a device not opened for seven days can be marked inactive.

7. Collect logs#

On iOS, users select the profile icon, Help and Feedback, then Send Logs to Microsoft, and share the incident ID. On Android, it's Help & feedback › Send feedback with Include diagnostic data.

Verify the fix#

• Intune shows Connection status: Enabled, and the platform toggles are saved.
• The device appears in the Defender portal's device inventory. It can take a few hours, and iOS names follow the username_iPhone pattern, so search by the Microsoft Entra device ID if needed. Admins need read access to security data for the device's group; see Defender XDR unified RBAC.
• The device turns compliant in Devices › Compliance, and the risk level appears in the compliance reports.
• On iOS, the VPN icon shows while web protection is on, and a blocked malicious site produces a notification on the device and an alert in the portal.

Prevent it next time#

• Use zero-touch onboarding for corporate iOS devices and block users from disabling the automatic VPN.
• Keep Authenticator and the Company Portal updated, and tell users what the VPN icon means before rollout.
• If Outlook mobile ignores the threat level, work through the app protection checklist.

References#

• Deploy Microsoft Defender for Endpoint on iOS with Microsoft Intune
• Troubleshooting issues on Microsoft Defender for Endpoint on Android
• Configure Microsoft Defender for Endpoint with Intune and onboard devices