---
title: "Get mobile app protection"
url: https://docs.gleap.ai/en/reference/rest-api/get-mobile-app-protection
method: GET
path: "/sso/organisation/{organisationId}/mobile-app-protection"
api: "API Reference"
tag: "Mobile app protection"
operationId: "GetMobileAppProtection"
updatedAt: "2026-11-07T09:40:00.500Z"
language: en
---

# Get mobile app protection

`GET https://api.gleap.io/v3/sso/organisation/{organisationId}/mobile-app-protection`

The organisation's mobile app protection (Microsoft Intune): whether the Gleap app reaches its data only through a Microsoft sign-in in its tenant.

## Authorization

- `Authorization` (header, required): `Bearer <token>`

## Example request

```bash
curl --request GET \
  --url 'https://api.gleap.io/v3/sso/organisation/{organisationId}/mobile-app-protection' \
  --header 'Authorization: Bearer <token>'
```

## Responses

### 200 (`application/json`)

Ok

- `mode` (enum<string>, required): Mobile app protection (Microsoft Intune): an organisation that turns it on lets its data reach the Gleap mobile app only through a session that came from a Microsoft sign-in in its own Entra tenant. That sign-in is where the organisation's Conditional Access ("Require app protection policy") runs, so a phone without the organisation's app protection never gets such a session. The dashboard in a browser is covered only with `requireOnWeb`: then a browser needs the same Microsoft session (the dashboard's "Continue with Microsoft" in the tenant), where the tenant's Conditional Access for Gleap's web app runs. Without it, browsers sign in through the organisation's SSO when it requires one. Decisions only, no I/O. One of: `off`, `intune`.
- `entraTenantId` (string | null, required)
- `allowedDomains` (string[], required)
- `suggestedTenantId` (string | null, required): Filled in from the organisation's SSO when it is a Microsoft Entra provider.
- `suggestedDomains` (string[], required)
- `requireSsoEnabled` (boolean, required): Whether the organisation's SSO is on with Require SSO: without it, people can still use Gleap in a phone's browser.
- `requireOnWeb` (boolean, required): Whether the dashboard in a browser needs "Continue with Microsoft" in the tenant too.
- `signedInWithMicrosoftInTenant` (boolean, required): Whether the admin's own session came from "Continue with Microsoft" in the saved tenant (needed to turn requireOnWeb on).
- `microsoftApps` (object | null, required): Gleap's Entra apps the organisation's admin approves (public client ids); null while not set up. `webClientId` is empty while the dashboard's Microsoft sign-in is not set up.
  - `webClientId` (string, required)
  - `androidClientId` (string, required)
  - `iosClientId` (string, required)
  - `apiClientId` (string, required)

```json
{
  "mode": "off",
  "entraTenantId": "string",
  "allowedDomains": [
    "string"
  ],
  "suggestedTenantId": "string",
  "suggestedDomains": [
    "string"
  ],
  "requireSsoEnabled": true,
  "requireOnWeb": true,
  "signedInWithMicrosoftInTenant": true,
  "microsoftApps": {
    "webClientId": "string",
    "androidClientId": "string",
    "iosClientId": "string",
    "apiClientId": "string"
  }
}
```