CITT

    Scan results

    Intune Company Portal

    Android

    The Company Portal provides access to corporate apps and resources. Enroll to access resources, browse and install company apps, view and manage enrolled devices, view IT contact information, change work account passwords, and manage device enrollment. Requires Microsoft Intune subscription.

    CITT SCORE
    92
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Employees accessing work resources on personal devices

    What It Means For You

    Device usage and app activity is reported to the employer through Microsoft telemetry services. Microsoft collects diagnostic and usage data via ARIA Telemetry, and Firebase handles push notifications from the organization. The employer can enforce security policies on the device through this app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (4)

    Code Security

    4 total
    3 Medium
    1 Low

    Third-Party Services

    Microsoft MSAL, Microsoft MAM SDK, Microsoft PowerLift, Microsoft ARIA Telemetry, Firebase Messaging, Firebase Remote Config, Google Play Services, Samsung Knox SDK, YubiKit, OkHttp, BouncyCastle

    Security Strengths

    • ✓Certificate pinning implemented for Microsoft services
    • ✓Android KeyStore integration for credential protection
    • ✓File-level encryption for managed corporate data
    • ✓Comprehensive HTTPS enforcement
    • ✓Firebase Analytics disabled
    • ✓No advertising SDKs
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    enterprise
    mdm
    sensitive data
    authentication

    Package

    com.microsoft.windowsintune.companyportal

    Version

    5.0.6923.0

    Analysis Date

    Mar 27, 2026

    Classes Analyzed

    24,733

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 0 findings

    Network Security - 0 findings

    Code Safety - 0 findings

    Privacy - 0 findings

    Privacy Concerns

    What Data is Collected

    The app collects device information, app activity, and diagnostic data on behalf of the organization. This information supports mobile device management and is used to enforce the employer's security policies and troubleshoot device issues.

    Third-Party Data Sharing

    Diagnostic and usage data is shared with Microsoft ARIA Telemetry for service monitoring. Firebase Messaging and Firebase Remote Config receive data to deliver organizational notifications and configuration updates. Google Play Services and Samsung Knox SDK receive device-level signals to support security enforcement. YubiKit is present for hardware security key support, and OkHttp and BouncyCastle handle secure network communication on the device.

    Understanding the Scores

    • Security: 88/100
    • Privacy: 100/100
    • Data Security: 100/100
    • Network Security: 100/100
    • Code Safety: 82/100
    • Data Collection: 100/100
    • Data Sharing: 100/100
    • User Control: 100/100

    Positive Security Features

    • Network communications between the device and the organization's systems are handled with strong protective practices.
    • Data storage and handling practices meet high standards for enterprise mobile management.
    • Data collection and sharing practices are consistent with what an employer-managed app is expected to do, with no unexpected third-party advertising or behavioral profiling observed.

    Areas for Improvement

    • Code safety scored below the top tier, suggesting certain coding practices could be hardened in future releases to further reduce risk to user devices.
    • Diagnostic data collection is automatic and required by the device management function, meaning users cannot opt out while the app is active on the device.
    • The number of integrated third-party services adds complexity to the data flow between the device and external systems, which is worth being aware of for employees using a personal device.

    About This Analysis

    This scorecard is based on automated static analysis of the app's code and behavior patterns. Scores reflect security and privacy practices observed at the time of the scan and may change as the app is updated.

    App Details

    • Package: com.microsoft.windowsintune.companyportal
    • Version: 5.0.6923.0
    • Scan Date: March 27, 2026

    Right of Reply

    Developer not yet contacted