Defender for Endpoint on iOS and Android: Intune onboarding, VPN, MTD and sign-in errors

Symptoms to confirm

• On Android, the Microsoft Defender app stops at sign-in with Sign in failed: Unexpected error, try later or Sign in failed: Invalid license, contact administrator.
• In the Microsoft Intune admin center, Endpoint security › Defender for Endpoint shows Connection status: Unavailable, and compliance policies that use the Defender risk score never mark mobile devices compliant.
• An iOS device has the app but never shows up in the Defender portal's device inventory.
• A banking app, another VPN or a line-of-business app stops working while the Defender VPN is connected.

Likely causes

• The services aren't connected. The Intune connection is turned on in the Defender portal, then each platform has its own toggles in Intune: one for compliance evaluation and a separate one for app protection evaluation.
• No license. Microsoft gives the Android license error two causes: no license assigned to the user, or no qualifying subscription in the organization.
• The broker app. The device must be registered in Microsoft Entra ID through Microsoft Authenticator or the Company Portal, and the user signs in to Defender with the same account. An outdated Authenticator on Android causes the "unexpected error"; a clock set by hand can make tokens look expired.
• The VPN. On unsupervised iOS devices and on Android, web protection uses a local loopback VPN that doesn't send traffic off the device. iOS allows only one active device-wide VPN, and some apps refuse to run while any VPN is detected.

Checklist

1. 1

   Connect Defender for Endpoint to Intune

   In the Microsoft Defender portal, go to System › Settings › Endpoints › General › Advanced features, turn on Intune connection and select Save preferences. Back in the Intune admin center, Endpoint security › Defender for Endpoint should show Enabled; Microsoft says the status can take up to 15 minutes to update.

2. 2

   License the users and deploy the apps

   Assign a Defender for Endpoint license to every user of the app. For iOS, add Microsoft Defender: Security as an iOS store app (or volume-purchased app) and assign it as required.

3. 3

   Onboard iOS without user effort

   For unsupervised devices, create an iOS/iPadOS VPN template profile with these values:

   Setting	Value
   Connection type	Custom VPN
   Connection name / VPN server address	Microsoft Defender for Endpoint / 127.0.0.1
   Authentication method / Split tunneling	Username and password / Disable
   VPN identifier	com.microsoft.scmx
   Custom attribute	SilentOnboard = True (zero-touch), or AutoOnboard = True (VPN set up automatically, user opens the app); never both
   Type of automatic VPN	On-demand VPN, rule Establish VPN for All domains
   Block users from disabling automatic VPN	Yes, if users mustn't switch web protection off

4. 4

   Clear the sign-in errors

   • Unexpected error, try later (Android): update Microsoft Authenticator from Google Play and sign in again.
   • Invalid license, contact administrator (Android): assign the license, then sign in again.
   • iOS device never appears: confirm the device is registered in Entra ID, that the user signed in with the same account, and that Settings › General › Date & Time › Set Automatically is on.
   • Xiaomi devices: users must allow Display pop-up windows while running in the background, otherwise phishing pages aren't blocked, and might have to set Defender to Don't Optimize in the work profile's battery optimization screen.
5. 5

   Use the risk level in policy

   In an Android Enterprise or iOS/iPadOS compliance policy, expand Microsoft Defender for Endpoint and set Require the device to be at or under the machine risk score (Clear, Low, Medium or High). For unenrolled devices, use the app protection conditional launch setting Max allowed device threat level with Block access or Wipe data.

6. 6

   Resolve VPN conflicts

   When a user needs another VPN or an app that refuses to run behind one, they can pause the Defender VPN in Settings › General › VPN: select the i button for Defender and turn off Connect On Demand. Web protection stays off until they turn it back on in the app.

7. 7

   Collect logs

   On iOS, users select the profile icon, Help and Feedback, then Send Logs to Microsoft, and share the incident ID. On Android, it's Help & feedback › Send feedback with Include diagnostic data.

Verify

• Intune shows Connection status: Enabled, and the platform toggles are saved.
• The device appears in the Defender portal's device inventory. It can take a few hours, and iOS names follow the username_iPhone pattern, so search by the Microsoft Entra device ID if needed. Admins need read access to security data for the device's group; see Defender XDR unified RBAC.
• The device turns compliant in Devices › Compliance, and the risk level appears in the compliance reports.
• On iOS, the VPN icon shows while web protection is on, and a blocked malicious site produces a notification on the device and an alert in the portal.

Prevent it next time

• Use zero-touch onboarding for corporate iOS devices and block users from disabling the automatic VPN.
• Keep Authenticator and the Company Portal updated, and tell users what the VPN icon means before rollout.
• If Outlook mobile ignores the threat level, work through the app protection checklist.