Access Defence 365 on your unmanaged/personal Android device

On this page

• Introduction
• What to know before enrolling
• Device Requirements
• Log in to Defence 365
• Get a Temporary Access Pass (TAP)
• Remove Device from Company Portal (only if already installed)
• Enroll in Intune through Company Portal
• Access Personal and Work Apps
• Set up Microsoft Authenticator app
• Enable passwordless sign-in
• Use passwordless sign-in

Introduction

This guide provides step-by-step instructions for accessing Defence 365 applications, such as Teams, SharePoint and Outlook on your unmanaged/personal Android device. To protect sensitive information, certain security measures are mandatory.

Important Note: If you choose not to enroll in these security features, you can continue to access Defence 365 via your DWAN managed device or SSC mobile device.

What to know before enrolling

• User Agreement: Before you begin, you must agree to the conditions in the Defence 365 user agreement for unmanaged/personal devices (Accessible only on the National Defence network).
• Unenrollment: You can unenroll your device from Intune at any point using Microsoft's instructions (You are now leaving the Government of Canada website).
• Visual Variations: These enrollment steps are for Android devices. The screenshots shown on your device may look slightly different from the ones in this document depending on the version of the device you’re using.

Device Requirements

Before you begin, make sure your Android device meets the following requirements:

1. Device: Unmanaged/personal devices only, no DWAN managed devices or SSC mobile devices.
2. Android OS Version: Android 11.0 or higher. Click on Setting App, scroll down, near the bottom, tap About phone. Android version.
3. PIN Setting: 4-digit passcode minimum. Simple PINs are blocked (i.e., 1234, 0000). If you don’t have a passcode or it doesn’t meet the requirements, you’ll be guided to change it during the enrollment.
4. Google Play Services: Google Play Services along with a Google Play Integrity Verdict is required. On your Android phone or tablet, open the Settings app > Apps & notifications > See all apps. Scroll down and tap Google Play Services.
5. Applications: Applications from unknown sources are blocked. Only applications from the Google Play store or known developers should be installed.
6. Rooted: Devices that have been rooted will not be able to enroll.
7. USB Debugging: Must be disabled/blocked to enroll.
8. Internet Access: A stable Wi-Fi or ethernet connection is required.
9. Device Limit: You can enroll up to 5 devices in D365. To check your current devices, visit the MyInfo Portal (Accessible only on the National Defence network) on DWAN, then on the Devices tile, select “Remove registered devices” to view and remove any devices as necessary.

Log in to Defence 365

To complete the steps in this guide, you need to be able to log in to D365. You can use either:

• Your ECN password with the Microsoft Authenticator app or phone call authentication
• A Temporary Access Pass (TAP)

If using your ECN password, you can skip to the Remove Company Portal Section.

Get a Temporary Access Pass (TAP)

To get a TAP, follow these steps on your DWAN managed device (e.g. DND/CAF-issued laptop):

1. Visit D365 MyInfo Self-Service Portal (Accessible only on the National Defence network)
2. Under “Temporary Access Pass”, click on “Generate temporary access pass”
3. Click “confirm” to proceed
4. Click the eye icon to reveal your TAP

If you don't have a DWAN device, contact your SMC (Accessible only on the National Defence network) to generate the TAP for you. If you encounter issues, please reach out to your manager.

Remove Device from Company Portal (only if already installed)

If you have not yet installed or configured the Intune Company Portal app, proceed to the Enroll in Intune through Company Portal section.

If you have already installed and configured the app on your mobile device, you must first remove the device from Company Portal (Microsoft.com) (You are now leaving the Government of Canada website) before continuing with the enrollment.

To remove the device from the Company Portal app, follow these steps:

1. On your mobile device open the Intune Company Portal app.
2. Tap the three lines in the top left corner of the screen.

3. Tap “Remove Company Portal”, and then “OK”.

Note: Intune device enrollment is limited to a single account per device. If your device is currently registered with Intune for another organization (such as your employer or school), it will not be possible to enroll it for use with D365.

Enroll in Intune through Company Portal

1. Open the Google Play Store and search for “Intune Company Portal”. Tap “Install” to install the Intune Company Portal App.
2. Open the Company Portal app and tap “SIGN IN”.
3. If prompted, tap “Allow” to allow notifications.
4. Enter your Defence 365 (ECN) email (firstname.lastname@ecn.forces.gc.ca) and tap “Next”.
5. Enter your ECN password or your Temporary Access Pass (TAP) and tap “Sign in”.

6. If prompted, read the Terms of Use, then select “Accept” if you agree.

7. Tap “Begin” to start the enrollment process. It will proceed to create an Android Enterprise Work Profile.
8. Review what information DND/CAF can and can’t see. Tap “Continue”.
9. Tap “Accept & continue”, and then “Next” to set up your work profile.
10. The Company Portal app will open, sign in and check for security requirements.
11. Tap “Continue” to activate your work profile.
12. Sign in and authenticate.
13. Once the work profile has been activated, tap “Continue” to update device settings. You may be prompted to confirm your device settings.
14. To confirm your enrollment, open the Company Portal app, select your Android device, and ensure the Device settings status indicates "In compliance".

Access Personal and Work Apps

After you enroll your Android device in Intune through the Company Portal app, your device will have both a Personal profile and a Work profile. Having two profiles ensures work-related data is secure and personal information remains private.

Work apps have a briefcase badge, while personal apps do not. Once the work profile is established, duplicate apps may appear on your device. For instance, there might be two Outlook applications. Use the version identified with the briefcase icon for work-related activities.

The work profile location depends on the device manufacturer and the Android version. See how the work profile is displayed on different Android devices, see examples on the Microsoft website.

See examples of the work profile on common Android devices (Microsoft.com) (You are now leaving the Government of Canada website).

Set up Microsoft Authenticator app

If you're already using Microsoft Authenticator for DND/CAF on the personal side of your Android device, you'll need to remove your DND/CAF account from the app before proceeding.

Follow these steps to set up Microsoft Authenticator:

1. Ensure your device is registered with Intune and a Work Profile has been created.
2. Access the Google Play Store from your Work Profile. The Work Profile Play Store app is marked with a briefcase icon.
3. Search for and install Microsoft Authenticator
4. Open Microsoft Authenticator
5. On the initial screens, tap “Accept” and “Continue”.
6. Tap “Add work or school account”

7. Sign-in using either:
   1. your ECN account and a TAP, or
   2. your ECN account and password plus phone call authentication method.
8. On the next screen tap “Continue”.
9. A pop up will ask if Authenticator can send you notifications, select “Allow”.
10. Your account should be added, tap “Done”.

Microsoft Authenticator has been successfully set up on your Android device.

Enable passwordless sign-in

Passwordless sign-in may be automatically turned on during the enrollment process. To confirm that you have enabled passwordless sign-in for your device, open the Microsoft Authenticator app and tap your Defence 365 (ECN) email address. You should see “Passwordless sign in requests”.

If you don’t see “Passwordless sign-in requests” follow the steps below to enable it.

1. Open the Microsoft Authenticator app on your Android device.
2. Tap your Defence 365 (ECN) email address (firstname.lastname@ecn.forces.gc.ca)
3. Tap “Set up passwordless sign-in requests”.
4. Tap “Continue”.
5. Enter your Defence 365 (ECN) password and tap “Sign in”.
6. Approve the sign-in request by entering the matching number on your Microsoft Authenticator app and tapping “Yes”.
7. Tap “Register” to complete the passwordless setup.
8. To confirm that you have enabled passwordless sign-in for your Android device, open the Microsoft Authenticator app and tap your ECN email address. You should see “Passwordless sign-in enabled” or “Passwordless sign-in requests”.

Use passwordless sign-in

1. The next time you are asked to sign-in to your Defence 365 account, do not enter your password. Instead select “Use an app instead”.

2. You will automatically be asked to approve your sign-in using the Authenticator app without having to enter your password. After this first sign-in, you will no longer be asked for your password.

Back to top