Include Android system-service exemptions in app-protection transfer tests

Source facts

Microsoft documents built-in data-transfer exemptions for some Android applications and platform services. Its example permits managed apps to exchange data with Google Text-to-speech for reading displayed text aloud. Microsoft states that the exemption list can change. Microsoft Learn.

Applicability

Use this review when testing Android Intune app-protection data-transfer restrictions. Identify the actual app, service and transfer operation before interpreting an allowed exchange as a policy failure.

DSE recommendation

DSE recommends maintaining a transfer test matrix that includes relevant accessibility and platform-service workflows. Compare an observed exchange with the current documented exemption before escalating a defect or proposing a stronger restriction. Have the security and accessibility owners agree on the required user experience and remaining information-handling constraints.

Verification

On an approved representative Android device, test the managed app’s required service interaction and a separate transfer expected to be restricted. Record the policy, app and service versions with the observed behavior. Review the current exemption list when those components change, and keep any unexplained transfer distinct from a documented service exception.

Official references

Microsoft Learn: Android App Protection Policy Settings in Microsoft Intune. Source reviewed September 17, 2026.