>
    Strata Copilot
    Configure Lockdown Mode for Always On Connect Method on Android Endpoints Using Microsoft Intune
    Focus
    Download PDF
    Focus
    1. Home
    2. GlobalProtect
    3. GlobalProtect Administrator's Guide
    4. GlobalProtect Apps
    5. Deploy the GlobalProtect App on Mobile Devices
    6. Manage the GlobalProtect App Using Microsoft Intune
    7. Configure the GlobalProtect App on Android Endpoints Using Microsoft Intune
    8. Configure Lockdown Mode for Always On Connect Method on Android Endpoints Using Microsoft Intune
    Download PDF
    GlobalProtect

    Configure Lockdown Mode for Always On Connect Method on Android Endpoints Using Microsoft Intune

    Table of Contents

    Configure Lockdown Mode for Always On Connect Method on Android Endpoints Using Microsoft Intune

    Set up device restrictions for always-on.
    Where Can I Use This?What Do I Need?
    • NGFW (managed by Panorama or Strata Cloud Manager)
    • Prisma Access (managed by Panorama or Strata Cloud Manager)
    • GlobalProtect Gateway license or Prisma Access license with the Mobile User subscription
    For devices configured with always on connect method, you must enable lockdown, which forces the secure connection to always be on and connected in addition to disabling network access when the app is not connected.
    For a demonstration of how to configure lockdown mode, watch this video.

    1. On the Microsoft Intune admin center, navigate to DevicesAndroidConfiguration.
    2. Click CreateNew Policy.
    3. Set Platform to Android Enterprise and Profile type to Device restrictions and then click Create.
    4. Enter a name and description and click Next.
    5. Expand Connectivity and enable Always-on VPN (work profile-level).
    6. Set the VPN client to Palo Alto Networks GlobalProtect.
    7. Enable Lockdown mode if required.
      The Lockdown mode is similar to the Enforce GlobalProtect for Network Access feature and ensures that all network traffic from Android endpoints passes through the GlobalProtect app, thereby enforcing security policies and preventing unauthorized access. When enabled, it blocks all network traffic on the endpoint until a connection to the GlobalProtect gateway is established.
    8. Click Next.
    9. Assign the policy to included user groups and click Next.
    10. Review the settings and click Create.

    © 2026 Palo Alto Networks, Inc. All rights reserved.