A couple of days ago Microsoft released an Microsoft Intune Information Bulletin. As from September Microsoft Intune will deploy the Azure Authenticator app as a required app to all users that are using an Android device.
In one of the next Intune releases an option to opt out will become available under the Mobile Device Management, Android node in the Intune admin console.
If you opt out, (not possible yet) Microsoft will later this year, when the Microsoft Intune Company Portal app for Android is updated improve enrollment and single sign-on for Intune and Office apps will no longer be supported with the result that conditional access users will be quarantined on Android devices. To avoid this, install Azure Authenticator on Android devices before the Company Portal update.
Read more info about the Microsoft Azure Authenticator app deployment here: http://aka.ms/sept2015
