Skip to main content

​
Your own mobile app

With a dedicated deployment, your organization can get its own build of the Langdock mobile app for iOS and Android. The app carries your name, icon, and colors, and connects only to your deployment. If your deployment has several workspaces, they all share one app. Langdock builds the app, publishes it to the App Store and Google Play, and ships updates. The store listing shows Langdock GmbH as the developer in small print under your app name. Contact your account manager to get started.

​
Distribution options

You can publish the app on iOS, Android, or both. Langdock offers two ways to distribute it. The right one depends on whether your employees use personal devices for work.

​
Unlisted app

On iOS, the app doesn’t appear in App Store search. Only people with the link can find and install it. On Android, it’s a regular listing on Google Play. Everyone who installs the app still has to sign in to your deployment, so the link alone gives no access to your data. You can still push the app to managed devices. Find it in Apple Business Manager by its App Store link instead of its name, then assign it as Required in Intune or your MDM to install it automatically. For personal devices, share the store links through your internal channels so employees can install the app themselves. Learn more in Apple’s guide to unlisted app distribution and the Explore unlisted app distribution tech talk.

​
Custom app

The app is published privately to your organization, so only enrolled devices can install it. On iOS, it reaches devices through Apple Business Manager. On Android, it reaches them through Managed Google Play. For a custom app, Langdock needs:
  • The Organization ID of every Apple Business Manager organization that should get the app. An administrator finds it by selecting their name in the sidebar, then Preferences → Organization Information.
  • Your Managed Google Play organization ID, found under Admin Settings.
Learn more in Apple’s intro to content distribution and Google’s guide to private apps in Managed Google Play.
You can’t switch between an unlisted app and a custom app later. Changing the distribution method means publishing a new app and moving your users to it. See Apple’s notes on distribution methods.
Not sure which to pick? Choose an unlisted app. It works on managed and personal devices, and you can still push it to managed devices.

​
Store listing

Langdock creates the App Store and Google Play listings from these details:
  • App name: Usually your workspace name. With several workspaces, choose a name that fits all of them.
  • Subtitle: 2 to 6 words shown under the app name, at most 30 characters including spaces.
  • Description: 1 to 3 paragraphs for the store page.
  • App icon: At least 1024 × 1024 px, without text, following Apple’s icon templates. Your workspace icon works too.
  • Support URL: Any public page where people can contact your support.
  • Privacy policy URL: Any public privacy policy, such as your company’s general one.
  • Sign-in tagline: An optional short line on the app’s sign-in screen. It can match the subtitle.

​
Availability

By default, Langdock publishes the app in all 171 available countries, so employees abroad or with devices registered in another country can still install it. Langdock’s terms exclude Russia, Belarus, Syria, Myanmar, North Korea, Iran, and Cuba. You can also limit the app to specific regions, such as Europe and North America, or to a list of countries. Apps that mention ChatGPT or “GPT” in their name or store listing aren’t allowed in China. To publish in China, keep “GPT” out of the listing. Otherwise, leave China out.

​
Microsoft Intune

Intune is optional. Without it, the app uses the same sign-in as your web workspace, and only your users can access it. With Intune, Langdock builds the app with the Microsoft Intune App SDK, and your app protection policies apply on managed and personal devices. Policies can require a PIN or biometrics, restrict copy and paste, saving, and sharing to other apps, limit where files can be opened from, block screenshots, and wipe app data. Strict policies also change how the app feels. Depending on your settings, they can stop users from copying responses, attaching photos, or opening files from integrations. Intune also adds setup steps in Entra and Intune, so the launch takes a little longer.

​
Set up the app registration in Entra

Langdock sends you the app’s bundle ID, package name, Android signature hash, and the Application (client) ID the app is built with. In the Microsoft Entra admin center, open the app registration with that client ID. If you can’t add the permission below to it, create a dedicated app registration for the mobile app and send Langdock its client ID. The app only works after Langdock rebuilds it with the new ID. Add both redirect URIs under Authentication:
  1. Click Add Redirect URI, choose iOS / macOS, enter the bundle ID, and click Configure. Entra adds msauth.<bundle ID>://auth.
  2. Click Add Redirect URI again, choose Android, enter the package name and signature hash, and click Configure. Entra adds msauth://<package name>/<signature hash>.
Then add the Intune permission under API permissions:
  1. Click Add a permission and open APIs my organization uses.
  2. Search for Microsoft Mobile Application Management.
  3. Add the delegated permission DeviceManagementManagedApps.ReadWrite.
  4. Click Grant admin consent for your organization.
For details, see Microsoft’s guides to adding a redirect URI and granting admin consent.

​
Users from several Entra tenants

If all your users are in one Entra tenant, send Langdock your tenant ID with the client ID. The app can also accept users from several tenants. In that case:
  • Set the app registration’s supported account types to allow those tenants, and add them to your allowed tenants if you restrict them.
  • Grant admin consent for DeviceManagementManagedApps.ReadWrite in every tenant whose users sign in.
  • Add the app to the app protection policies of every tenant that runs its own Intune. Intune evaluates policies in each user’s home tenant.

​
Add the app to your app protection policies

In the Microsoft Intune admin center, add the app to your iOS/iPadOS policy:
  1. Go to Apps → Protection and open your iOS/iPadOS app protection policy.
  2. Open Properties and click Edit next to Apps.
  3. Set Target policy to to Selected apps.
  4. Click Select custom apps and add the bundle ID.
  5. Click Review + create, then Save.
Repeat these steps for your Android policy with the package name. Assign both policies to everyone who uses the app. Microsoft explains the full setup in create and deploy app protection policies.
Assign the app to a few admins first and test your policies before you roll it out to everyone.

​
What your users need

  • Every user needs an Intune license and an assigned app protection policy. Without them, the app blocks access.
  • Intune builds need iOS 17 or later. Android devices need the Intune Company Portal app.
  • If your users had the app before Intune was added, they sign in again after the update.
  • To skip the account picker on managed devices, push IntuneMAMUPN and IntuneMAMOID on iOS or com.microsoft.intune.mam.AllowedAccountUPNs on Android through an app configuration policy.