With mobile app protection, people from your company sign in to the Gleap app on iPhone and Android with their Microsoft account. Your Microsoft Intune app protection policies then apply to Gleap: copy-paste limits, an app PIN, blocked screenshots (Android), selective wipe and jailbreak checks. Your Conditional Access decides who gets in. Push notifications for your organisation carry no ticket text. It's part of the Enterprise plan, and only organisation administrators can set it up.
Only people whose email address is on one of the domains you list. They can only use the Gleap app through "Continue with Microsoft" in your tenant. Everyone else in the organisation, such as a consultant or Gleap support, keeps their own sign-in.
Open your profile menu (your avatar), choose Organizations, then SSO configuration, and scroll to Mobile app protection.
Enter your Tenant ID (Entra admin center → Overview) and your Email domains. If your organisation's SSO already uses Microsoft, both are filled in from it.
Under Approve the Gleap apps in your tenant, click Approve Gleap API first, then Approve iPhone app and Approve Android app. Each opens Microsoft's admin consent page. A Microsoft admin accepts each one once. The Gleap API is the one the app's sign-in is for. Without it, sign-in on the phone fails (see below).
Turn on Require Microsoft sign-in.
In Intune → Apps → App protection policies, create a policy for iOS and one for Android. Add Gleap as a custom app with the bundle ID / package name io.gleap.app, and assign the policies to the people who use Gleap.
In Entra → Conditional Access, create a policy whose target resource is Gleap Mobile API (or All resources), with the grant Require app protection policy on iOS and Android. Don't target the Gleap Mobile iOS or Android apps: Conditional Access checks the resource a sign-in is for, and the app only ever signs in for Gleap Mobile API.
Have people install Microsoft Authenticator (iPhone) or Company Portal (Android). Then they open the Gleap app, choose Continue with Microsoft and sign in. Intune applies your policy before any data shows.
The Setup in Microsoft Intune list on the same page repeats these steps.
On its own, protection covers the app. Someone could still open Gleap in a phone's browser with an email login code, outside your Intune policy. To close that, turn on Require it in the browser too. People with your domains then sign in to the dashboard with "Continue with Microsoft" as well. Email codes, passkeys, Google and GitHub are refused for them, and the login page tells them to use Microsoft.
To turn it on, sign in to Gleap with "Continue with Microsoft" in this tenant first. That proves the Microsoft sign-in works before anyone loses their other sign-ins. You can add a Conditional Access policy for the Gleap web app as well, for example to require a compliant device or MFA.
"Lacks a service principal" (AADSTS650052) in the Entra sign-in logs, after sign-in in the app: your tenant has no entry for Gleap Mobile API yet. Click Approve Gleap API. If Microsoft shows an error there, a Global Administrator can create it in PowerShell with the Microsoft Graph module:
Connect-MgGraph -Scopes "Application.ReadWrite.All"
New-MgServicePrincipal -AppId 9636f2e3-5326-4cb4-9349-960fcefecaa8Then click Approve iPhone app and Approve Android app again and accept, and sign in on the phone again.
The app says your organisation requires Microsoft sign-in: the person used email, Google or Apple. They sign out and use "Continue with Microsoft".
Sign-in works but the policy doesn't apply: check that the app protection policy includes io.gleap.app and is assigned to that person, and that the Conditional Access policy targets Gleap Mobile API.
"Require SSO" won't turn on: with "Require it in the browser too" on, that's expected (see above). Otherwise, Require SSO needs SSO enabled, at least one allowed email domain, and you signed in through your SSO login URL right now.