# Include Android system-service exemptions in app-protection transfer tests

> Why can an Android managed app exchange data with a system service under an app-protection policy?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-127-include-android-system-service-exemptions-in-app-protection-transfer-tests/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:53+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Why can an Android managed app exchange data with a system service under an app-protection policy?

## Potentially affected

Use this review when testing Android Intune app-protection data-transfer restrictions. Identify the actual app, service and transfer operation before interpreting an allowed exchange as a policy failure.

## DSE recommendation

DSE recommends maintaining a transfer test matrix that includes relevant accessibility and platform-service workflows.

## Article

## Source facts

Microsoft documents built-in data-transfer exemptions for some Android applications and platform services. Its example permits managed apps to exchange data with Google Text-to-speech for reading displayed text aloud. Microsoft states that the exemption list can change. [Microsoft Learn](https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-android).

## Applicability

Use this review when testing Android Intune app-protection data-transfer restrictions. Identify the actual app, service and transfer operation before interpreting an allowed exchange as a policy failure.

## DSE recommendation

DSE recommends maintaining a transfer test matrix that includes relevant accessibility and platform-service workflows. Compare an observed exchange with the current documented exemption before escalating a defect or proposing a stronger restriction. Have the security and accessibility owners agree on the required user experience and remaining information-handling constraints.

## Verification

On an approved representative Android device, test the managed app’s required service interaction and a separate transfer expected to be restricted. Record the policy, app and service versions with the observed behavior. Review the current exemption list when those components change, and keep any unexplained transfer distinct from a documented service exception.

## Official references

[Microsoft Learn: Android App Protection Policy Settings in Microsoft Intune](https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-android). Source reviewed September 17, 2026.

## Primary reference

- Name: Android App Protection Policy Settings - Microsoft Intune | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/intune/app-management/protection/ref-settings-android
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Include Android system-service exemptions in app-protection transfer tests,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-127-include-android-system-service-exemptions-in-app-protection-transfer-tests/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.