Require Managed Home Screen authentication for protected app activities

What changed

If MHS requires sign-in or a session PIN, the app redirects the user to MHS before allowing access to protected content. Assign an Intune app protection policy to both the app and the signed-in user; no specific app protection policy setting is required.

Why it matters

Requiring Managed Home Screen authentication before protected app activity closes a bypass path on shared and dedicated Android devices.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Verify Android Enterprise dedicated-device and Entra shared-device prerequisites
• Test MHS sign-in or session PIN before protected app activity
• Confirm permitted call behavior and user guidance