---
title: "Update mobile app protection"
url: https://docs.gleap.ai/en/reference/rest-api/update-mobile-app-protection
method: PUT
path: "/sso/organisation/{organisationId}/mobile-app-protection"
api: "API Reference"
tag: "Mobile app protection"
operationId: "UpdateMobileAppProtection"
updatedAt: "2026-11-07T09:40:00.500Z"
language: en
---

# Update mobile app protection

`PUT https://api.gleap.io/v3/sso/organisation/{organisationId}/mobile-app-protection`

Turn mobile app protection on (with the Entra tenant ID and email domains) or off, and whether the dashboard in a browser needs "Continue with Microsoft" too.

## Authorization

- `Authorization` (header, required): `Bearer <token>`

## Request body (`application/json`, required)

- `mode` (enum<string>, required): Mobile app protection (Microsoft Intune): an organisation that turns it on lets its data reach the Gleap mobile app only through a session that came from a Microsoft sign-in in its own Entra tenant. That sign-in is where the organisation's Conditional Access ("Require app protection policy") runs, so a phone without the organisation's app protection never gets such a session. The dashboard in a browser is covered only with `requireOnWeb`: then a browser needs the same Microsoft session (the dashboard's "Continue with Microsoft" in the tenant), where the tenant's Conditional Access for Gleap's web app runs. Without it, browsers sign in through the organisation's SSO when it requires one. Decisions only, no I/O. One of: `off`, `intune`.
- `entraTenantId` (string): The organisation's Microsoft Entra tenant ID (required when mode is intune).
- `allowedDomains` (string[]): The organisation's email domains whose people sign in with Microsoft in the app.
- `requireOnWeb` (boolean): The dashboard in a browser needs "Continue with Microsoft" in the tenant too. Turning it on needs the admin signed in that way right now: proof the tenant is the organisation's.

## Example request

```bash
curl --request PUT \
  --url 'https://api.gleap.io/v3/sso/organisation/{organisationId}/mobile-app-protection' \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{
  "mode": "off"
}'
```

## Responses

### 200 (`application/json`)

Ok

- `mode` (enum<string>, required): Mobile app protection (Microsoft Intune): an organisation that turns it on lets its data reach the Gleap mobile app only through a session that came from a Microsoft sign-in in its own Entra tenant. That sign-in is where the organisation's Conditional Access ("Require app protection policy") runs, so a phone without the organisation's app protection never gets such a session. The dashboard in a browser is covered only with `requireOnWeb`: then a browser needs the same Microsoft session (the dashboard's "Continue with Microsoft" in the tenant), where the tenant's Conditional Access for Gleap's web app runs. Without it, browsers sign in through the organisation's SSO when it requires one. Decisions only, no I/O. One of: `off`, `intune`.
- `entraTenantId` (string | null, required)
- `allowedDomains` (string[], required)
- `suggestedTenantId` (string | null, required): Filled in from the organisation's SSO when it is a Microsoft Entra provider.
- `suggestedDomains` (string[], required)
- `requireSsoEnabled` (boolean, required): Whether the organisation's SSO is on with Require SSO: without it, people can still use Gleap in a phone's browser.
- `requireOnWeb` (boolean, required): Whether the dashboard in a browser needs "Continue with Microsoft" in the tenant too.
- `signedInWithMicrosoftInTenant` (boolean, required): Whether the admin's own session came from "Continue with Microsoft" in the saved tenant (needed to turn requireOnWeb on).
- `microsoftApps` (object | null, required): Gleap's Entra apps the organisation's admin approves (public client ids); null while not set up. `webClientId` is empty while the dashboard's Microsoft sign-in is not set up.
  - `webClientId` (string, required)
  - `androidClientId` (string, required)
  - `iosClientId` (string, required)
  - `apiClientId` (string, required)

```json
{
  "mode": "off",
  "entraTenantId": "string",
  "allowedDomains": [
    "string"
  ],
  "suggestedTenantId": "string",
  "suggestedDomains": [
    "string"
  ],
  "requireSsoEnabled": true,
  "requireOnWeb": true,
  "signedInWithMicrosoftInTenant": true,
  "microsoftApps": {
    "webClientId": "string",
    "androidClientId": "string",
    "iosClientId": "string",
    "apiClientId": "string"
  }
}
```