How the app will be used:
- What will users do in the app, such as creating, approving, or viewing content?
Our app allows users to use most Passle functionality, including creating, approving, and viewing content, as well as sharing articles to social media and email.
- What data does the app handle? Does this include client or confidential information?
The app mirrors the information our platform handles. This includes user data, statistics on content views, and all content created in Passle. It does not process any confidential information beyond generic user data.
Technical and app configuration details:
- Supported platforms (iOS and/or Android) and App Store / Google Play links
The Passle app is available on both iOS: https://apps.apple.com/gb/app/passle/id930439165 and Android: https://play.google.com/store/apps/details?id=passle.bookmarkletv4&hl=en_GB.
- Whether the app supports Intune App Protection Policies, either through the Intune App SDK or app wrapping?
No - the app requires an exemption to be added. See here for details: https://support.passle.net/hc/en-us/articles/31354814329500-The-Passle-app-in-managed-environments
- Any app configuration settings needed for a managed deployment?
The only setup is an Intune App Protection Policy exemption so SSO and app-to-app handoffs work. See here for details: https://support.passle.net/hc/en-us/articles/31354814329500-The-Passle-app-in-managed-environments
- How is data stored or cached on the device, and how is it protected?
The session token is stored in the device's secure keychain (iOS Keychain / Android Keystore). The app supports biometric login. The last-used email address is held in standard app storage. Most content is displayed via in-app web views.
- Any security documentation you can share, such as a SOC 2 report or security whitepaper?
No SOC 2 report. We are Cyber Essentials Plus certified, the application is penetration tested annually, and we are working towards ISO 27001. Our Information Security Policy and other supporting documentation are available on request.
Single sign-on (SSO) requirements):
- Whether the mobile app supports SSO with Microsoft Entra ID, and whether it uses the same setup as the Passle web platform?
Yes. The app uses the client's existing Passle SAML SSO configuration. It opens the sign-in page in the device browser, the user authenticates with Entra ID, and the app receives a session token. No separate Entra app registration is needed.
- Which protocol does it use (SAML or OpenID Connect/OAuth), and what setup is needed on our side, such as an Entra ID enterprise app or app registration?
SAML 2.0. The mobile app uses the same Entra ID enterprise application and SSO configuration as the Passle web platform, so no additional setup is needed. SP- and IdP-initiated login are supported. Requests are signed with SHA-256, and the IdP signing algorithm is configurable (SHA-256 by default for Entra ID).
- Does the app work with our Conditional Access and MFA policies?
Yes. Authentication happens in Entra ID via the browser, so Conditional Access and MFA policies apply as normal. The app does not use the Intune SDK, so app-based Conditional Access controls (such as “require app protection policy”) apply to the browser used for sign-in rather than to the Passle app itself.
- Whether the app supports brokered sign-in through Microsoft Authenticator (iOS) or Company Portal (Android)?
No. The app does not use the Microsoft Authentication Library (MSAL), so brokered sign-in is not supported. Sign-in is completed in the device browser against Entra ID, so Conditional Access and MFA still apply.
- How are user accounts created and removed, for example, SCIM provisioning or just-in-time creation at first sign-in?
Accounts are provisioned and deprovisioned via SCIM 2.0 from Entra ID. There is no just-in-time creation; users must have a Passle account (via SCIM or created by an admin) before signing in with SSO.