--- title: "Protect the Gleap mobile app with Microsoft Intune" description: "Require Microsoft sign-in in the Gleap iPhone and Android app so your Intune app protection policies and Conditional Access apply. Microsoft Entra ID, Enterprise plan." url: https://help.gleap.ai/hu/articles/16752009-protect-the-gleap-mobile-app-with-microsoft-intune collection: "Security and account access" updated: 2026-11-09 language: hu alternates: [en] --- # Protect the Gleap mobile app with Microsoft Intune Require Microsoft sign-in in the Gleap iPhone and Android app so your Intune app protection policies and Conditional Access apply. Microsoft Entra ID, Enterprise plan. With mobile app protection, people from your company sign in to the Gleap app on iPhone and Android with their Microsoft account. Your Microsoft Intune app protection policies then apply to Gleap: copy-paste limits, an app PIN, blocked screenshots (Android), selective wipe and jailbreak checks. Your Conditional Access decides who gets in. Push notifications for your organisation carry no ticket text. It's part of the Enterprise plan, and only organisation administrators can set it up. > **Info:** This needs Microsoft Entra ID (Azure AD) and Microsoft Intune. You'll need a Microsoft admin who can grant admin consent and create Intune and Conditional Access policies. ### Who it applies to Only people whose email address is on one of the domains you list. They can only use the Gleap app through "Continue with Microsoft" in your tenant. Everyone else in the organisation, such as a consultant or Gleap support, keeps their own sign-in. ### 1\. Turn it on in Gleap 1. Open your profile menu (your avatar), choose **Organizations**, then **SSO configuration**, and scroll to **Mobile app protection**. 2. Enter your **Tenant ID** (Entra admin center → Overview) and your **Email domains**. If your organisation's SSO already uses Microsoft, both are filled in from it. 3. Under **Approve the Gleap apps in your tenant**, click **Approve Gleap API** first, then **Approve iPhone app** and **Approve Android app**. Each opens Microsoft's admin consent page. A Microsoft admin accepts each one once. The Gleap API is the one the app's sign-in is for. Without it, sign-in on the phone fails (see below). 4. Turn on **Require Microsoft sign-in**. ### 2\. Set up Intune and Conditional Access 1. In Intune → Apps → App protection policies, create a policy for iOS and one for Android. Add Gleap as a custom app with the bundle ID / package name `io.gleap.app`, and assign the policies to the people who use Gleap. 2. In Entra → Conditional Access, create a policy whose target resource is **Gleap Mobile API** (or All resources), with the grant **Require app protection policy** on iOS and Android. Don't target the Gleap Mobile iOS or Android apps: Conditional Access checks the resource a sign-in is for, and the app only ever signs in for Gleap Mobile API. 3. Have people install Microsoft Authenticator (iPhone) or Company Portal (Android). Then they open the Gleap app, choose **Continue with Microsoft** and sign in. Intune applies your policy before any data shows. The **Setup in Microsoft Intune** list on the same page repeats these steps. ### 3\. Cover the browser too On its own, protection covers the app. Someone could still open Gleap in a phone's browser with an email login code, outside your Intune policy. To close that, turn on **Require it in the browser too**. People with your domains then sign in to the dashboard with "Continue with Microsoft" as well. Email codes, passkeys, Google and GitHub are refused for them, and the login page tells them to use Microsoft. To turn it on, sign in to Gleap with "Continue with Microsoft" in this tenant first. That proves the Microsoft sign-in works before anyone loses their other sign-ins. You can add a Conditional Access policy for the Gleap web app as well, for example to require a compliant device or MFA. > **Warning:** Use "Require it in the browser too" or Require SSO (under Access on the same page), never both. Together they would block every browser sign-in, so Gleap won't let you turn on the second one. If you use mobile app protection, "Require it in the browser too" is the one you want: it already keeps your people off email codes. ### When it doesn't work **"Lacks a service principal" (AADSTS650052)** in the Entra sign-in logs, after sign-in in the app: your tenant has no entry for Gleap Mobile API yet. Click **Approve Gleap API**. If Microsoft shows an error there, a Global Administrator can create it in PowerShell with the Microsoft Graph module: ```powershell Connect-MgGraph -Scopes "Application.ReadWrite.All" New-MgServicePrincipal -AppId 9636f2e3-5326-4cb4-9349-960fcefecaa8 ``` Then click **Approve iPhone app** and **Approve Android app** again and accept, and sign in on the phone again. **The app says your organisation requires Microsoft sign-in**: the person used email, Google or Apple. They sign out and use "Continue with Microsoft". **Sign-in works but the policy doesn't apply**: check that the app protection policy includes `io.gleap.app` and is assigned to that person, and that the Conditional Access policy targets Gleap Mobile API. **"Require SSO" won't turn on**: with "Require it in the browser too" on, that's expected (see above). Otherwise, Require SSO needs SSO enabled, at least one allowed email domain, and you signed in through your SSO login URL right now. ### Related - [Set up single sign-on](https://help.gleap.ai/en/articles/371-set-up-single-sign-on.md) - [Sign in to Gleap](https://help.gleap.ai/en/articles/370-sign-in-to-gleap.md)