Enhanced Antimalware Protection in Microsoft Defender for Endpoint Android

Update: Enhanced antimalware protection for Android is now generally available. 

We are excited to share major updates to the Malware protection capabilities of Microsoft for Endpoint on Android. These new capabilities form a major component of your next-generation protection in Microsoft for Endpoint. This protection brings together , big-data analysis, in-depth threat research, and the Microsoft cloud infrastructure to protect Android devices (or endpoints) in your organization.

Today, we are thrilled to announce the general availability of this new, enhanced anti-malware engine capability!

What to expect with this enhancement:

  • Cloud Integration with support for metadata-based ML models, file classifications and reputation-based ML models, etc.
  • Better support for false positive and false negative prevention.
  • Reduced memory and CPU footprints.
  • Integrates seamlessly with Microsoft 365 portal across platforms.
  • Threat nomenclature: The change in threat / malware name will now be in accordance with the standard naming scheme followed across all platforms, including Windows. This is part of the effort for aligning our nomenclature across all platforms and having a single naming mechanism for consistency.

  Changes to Android Threat names as depicted in the security center portal will be as under:

…variant     —->     [Threat Type]:[Platform]/[Malware Family].[Variant]?![Suffixes]?


Old Syntax                                                     New Syntax

Android.Trojan.FakeInst.YB TrojanSpy:AndroidOS/Nyleaker.B

There are no changes to the user experience aside from the threat naming: 

  Screenshot showing a threat detection on the deviceScreenshot showing a threat detection on the device 

Microsoft 365 Defender portal example: 

Screenshot showing an alert in the portal with the new naming conventionScreenshot showing an alert in the portal with the new naming convention

Getting started with the preview: 

To get started, an IT Admin needs to use Microsoft Endpoint Manager (MEM) – Intune – to manage deployments from Managed Google Play's pre-production tracks for Android.


Use the recommended minimum version as 1.0.3825.0301. Sometime after GA announcement, APKs older than version 1.0.3825.0301 would stop getting Antimalware protection, so it's recommended to plan for an upgrade.

We welcome your feedback and look forward to hearing from you! You can submit feedback through the Microsoft Defender Security Center or through the Microsoft 365 security center.


This article was originally published by Microsoft's Defender for Endpoint Blog. You can find the original article here.