How the app is used:
- What can users do in the Passle app?
The app supports most Passle functionality, including creating, approving, and viewing content, as well as sharing articles to social media and via email.
- What data does the app handle?
The app mirrors information our main platform handles, including user data, content views statistics, and all content created in Passle. It does not process any confidential information beyond generic user data.
Technical and app configuration details:
- Supported platforms: iOS/Android (App Store/Google Play links)
The Passle app is available on, iOS: https://apps.apple.com/gb/app/passle/id930439165 and Android: https://play.google.com/store/apps/details?id=passle.bookmarkletv4&hl=en_GB.
- Does the app support Intune App Protection Policies, either via the Intune App SDK or app wrapping?
No - the app requires an exemption to be added. See here for details: https://support.passle.net/hc/en-us/articles/31354814329500-The-Passle-app-in-managed-environments
- Are there any app configuration settings required for a managed deployment?
The only setup is an Intune App Protection Policy exemption so SSO and app-to-app handoffs work. See here for details: https://support.passle.net/hc/en-us/articles/31354814329500-The-Passle-app-in-managed-environments
- How is data stored or cached on the device, and how is it protected?
The session token is stored in the device's secure keychain (iOS Keychain / Android Keystore). The app supports biometric login. The last-used email address is held in standard app storage. Most content is displayed via in-app web views.
- Security documentation (SOC 2 report/security whitepaper)
No SOC 2 report. We are Cyber Essentials Plus certified, the application is penetration tested annually, and we are working towards ISO 27001. Our Information Security Policy and other supporting documentation are available on request.
Single sign-on (SSO) requirements):
- The app and SSO with Microsoft Entra ID
Yes. The app uses the client's existing Passle SAML SSO configuration. It opens the sign-in page in the device browser, the user authenticates with Entra ID, and the app receives a session token. No separate Entra app registration is needed.
- Which protocol does it use (SAML or OpenID Connect/OAuth), and what setup is needed on our side, such as an Entra ID enterprise app or app registration?
SAML 2.0. The mobile app uses the same Entra ID enterprise application and SSO configuration as the Passle web platform, so no additional setup is needed. SP- and IdP-initiated login are supported. Requests are signed with SHA-256, and the IdP signing algorithm is configurable (SHA-256 by default for Entra ID).
- Does the app work with Conditional Access and MFA?
Yes. Authentication happens in Entra ID via the browser, so Conditional Access and MFA policies apply as normal. The app does not use the Intune SDK, so app-based Conditional Access controls (such as “require app protection policy”) apply to the browser used for sign-in rather than to the Passle app itself.
- Does the app support brokered sign-in through Microsoft Authenticator (iOS) or Company Portal (Android)?
No. The app does not use the Microsoft Authentication Library (MSAL), so brokered sign-in is not supported. Sign-in is completed in the device browser against Entra ID, so Conditional Access and MFA still apply.
- How are user accounts created and removed, for example, SCIM provisioning or just-in-time creation at first sign-in?
Accounts are provisioned and deprovisioned via SCIM 2.0 from Entra ID. There is no just-in-time creation; users must have a Passle account (via SCIM or created by an admin) before signing in with SSO.