> ## Documentation Index > Fetch the complete documentation index at: https://docs.langdock.com/llms.txt > Use this file to discover all available pages before exploring further. # Mobile App and Microsoft Intune > Get a branded mobile app for your dedicated deployment. Compare the distribution options, see what goes into the store listing, and set up Microsoft Intune app protection in Entra and Intune. ## Your own mobile app With a dedicated deployment, your organization can get its own build of the Langdock mobile app for iOS and Android. The app carries your name, icon, and colors, and connects only to your deployment. If your deployment has several workspaces, they all share one app. Langdock builds the app, publishes it to the App Store and Google Play, and ships updates. The store listing shows Langdock GmbH as the developer in small print under your app name. Contact your account manager to get started. ## Distribution options You can publish the app on iOS, Android, or both. Langdock offers two ways to distribute it. The right one depends on whether your employees use personal devices for work. | | Unlisted app | Custom app | | - | - | - | | Who can install it | Anyone with the link | Only devices your organization manages | | Personal devices | Yes | No | | iOS | Unlisted in the App Store | Private through Apple Business Manager | | Android | Public on Google Play | Private through Managed Google Play | | Push to managed devices | Yes | Yes | ### Unlisted app On iOS, the app doesn't appear in App Store search. Only people with the link can find and install it. On Android, it's a regular listing on Google Play. Everyone who installs the app still has to sign in to your deployment, so the link alone gives no access to your data. You can still push the app to managed devices. Find it in Apple Business Manager by its App Store link instead of its name, then assign it as **Required** in Intune or your MDM to install it automatically. For personal devices, share the store links through your internal channels so employees can install the app themselves. Learn more in Apple's guide to [unlisted app distribution](https://developer.apple.com/support/unlisted-app-distribution/) and the [Explore unlisted app distribution](https://developer.apple.com/videos/play/tech-talks/10892/) tech talk. ### Custom app The app is published privately to your organization, so only enrolled devices can install it. On iOS, it reaches devices through Apple Business Manager. On Android, it reaches them through Managed Google Play. For a custom app, Langdock needs: * The Organization ID of every Apple Business Manager organization that should get the app. An administrator finds it by selecting their name in the sidebar, then **Preferences** → **Organization Information**. * Your Managed Google Play organization ID, found under **Admin Settings**. Learn more in Apple's [intro to content distribution](https://support.apple.com/guide/deployment/intro-to-content-distribution-depe1553f932/web) and Google's guide to [private apps in Managed Google Play](https://support.google.com/googleplay/work/answer/6145139). > [!WARNING] > > You can't switch between an unlisted app and a custom app later. Changing the distribution method means publishing a new app and moving your users to it. See Apple's notes on [distribution methods](https://developer.apple.com/help/app-store-connect/manage-your-apps-availability/set-distribution-methods/). > [!TIP] > > Not sure which to pick? Choose an unlisted app. It works on managed and personal devices, and you can still push it to managed devices. ## Store listing Langdock creates the App Store and Google Play listings from these details: * **App name**: Usually your workspace name. With several workspaces, choose a name that fits all of them. * **Subtitle**: 2 to 6 words shown under the app name, at most 30 characters including spaces. * **Description**: 1 to 3 paragraphs for the store page. * **App icon**: At least 1024 × 1024 px, without text, following Apple's [icon templates](https://developer.apple.com/design/resources/). Your workspace icon works too. * **Support URL**: Any public page where people can contact your support. * **Privacy policy URL**: Any public privacy policy, such as your company's general one. * **Sign-in tagline**: An optional short line on the app's sign-in screen. It can match the subtitle. ### Availability By default, Langdock publishes the app in all 171 available countries, so employees abroad or with devices registered in another country can still install it. Langdock's terms exclude Russia, Belarus, Syria, Myanmar, North Korea, Iran, and Cuba. You can also limit the app to specific regions, such as Europe and North America, or to a list of countries. Apps that mention ChatGPT or "GPT" in their name or store listing aren't allowed in China. To publish in China, keep "GPT" out of the listing. Otherwise, leave China out. ## Microsoft Intune Intune is optional. Without it, the app uses the same sign-in as your web workspace, and only your users can access it. With Intune, Langdock builds the app with the Microsoft Intune App SDK, and your [app protection policies](https://learn.microsoft.com/en-us/intune/intune-service/apps/app-protection-policy) apply on managed and personal devices. Policies can require a PIN or biometrics, restrict copy and paste, saving, and sharing to other apps, limit where files can be opened from, block screenshots, and wipe app data. Strict policies also change how the app feels. Depending on your settings, they can stop users from copying responses, attaching photos, or opening files from integrations. Intune also adds setup steps in Entra and Intune, so the launch takes a little longer. ### Set up the app registration in Entra Langdock sends you the app's bundle ID, package name, Android signature hash, and the Application (client) ID the app is built with. In the Microsoft Entra admin center, open the app registration with that client ID. If you can't add the permission below to it, create a dedicated app registration for the mobile app and send Langdock its client ID. The app only works after Langdock rebuilds it with the new ID. Add both redirect URIs under **Authentication**: 1. Click **Add Redirect URI**, choose **iOS / macOS**, enter the bundle ID, and click **Configure**. Entra adds `msauth.://auth`. 2. Click **Add Redirect URI** again, choose **Android**, enter the package name and signature hash, and click **Configure**. Entra adds `msauth:///`. Then add the Intune permission under **API permissions**: 1. Click **Add a permission** and open **APIs my organization uses**. 2. Search for **Microsoft Mobile Application Management**. 3. Add the delegated permission `DeviceManagementManagedApps.ReadWrite`. 4. Click **Grant admin consent for your organization**. For details, see Microsoft's guides to [adding a redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-redirect-uri) and [granting admin consent](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent). ### Users from several Entra tenants If all your users are in one Entra tenant, send Langdock your tenant ID with the client ID. The app can also accept users from several tenants. In that case: * Set the app registration's [supported account types](https://learn.microsoft.com/en-us/entra/identity-platform/howto-modify-supported-accounts) to allow those tenants, and add them to your allowed tenants if you restrict them. * Grant admin consent for `DeviceManagementManagedApps.ReadWrite` in every tenant whose users sign in. * Add the app to the app protection policies of every tenant that runs its own Intune. Intune evaluates policies in each user's home tenant. ### Add the app to your app protection policies In the Microsoft Intune admin center, add the app to your iOS/iPadOS policy: 1. Go to **Apps** → **Protection** and open your iOS/iPadOS app protection policy. 2. Open **Properties** and click **Edit** next to **Apps**. 3. Set **Target policy to** to **Selected apps**. 4. Click **Select custom apps** and add the bundle ID. 5. Click **Review + create**, then **Save**. Repeat these steps for your Android policy with the package name. Assign both policies to everyone who uses the app. Microsoft explains the full setup in [create and deploy app protection policies](https://learn.microsoft.com/en-us/intune/intune-service/apps/app-protection-policies). > [!TIP] > > Assign the app to a few admins first and test your policies before you roll it out to everyone. ### What your users need * Every user needs an Intune license and an assigned app protection policy. Without them, the app blocks access. * Intune builds need iOS 17 or later. Android devices need the [Intune Company Portal](https://learn.microsoft.com/en-us/intune/intune-service/user-help/sign-in-to-the-company-portal) app. * If your users had the app before Intune was added, they sign in again after the update. * To skip the account picker on managed devices, push `IntuneMAMUPN` and `IntuneMAMOID` on iOS or `com.microsoft.intune.mam.AllowedAccountUPNs` on Android through an [app configuration policy](https://learn.microsoft.com/en-us/intune/intune-service/apps/app-configuration-policies-overview). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.