The SIGNL4 mobile app supports integration with Microsoft Intune App Protection Policies (APP), allowing organizations to apply supported application-level data protection and security requirements.

To support Microsoft Intune App Protection Policies, the SIGNL4 mobile app requires an additional Microsoft Graph API permission through Microsoft Entra ID. After Microsoft authentication, SIGNL4 registers the signed-in account with the Intune App SDK, which handles enrollment and retrieves applicable App Protection Policies. 
This article explains the required permission, how an administrator can grant consent, and what happens if your organization does not use Intune App Protection Policies.

Required Microsoft Graph permission

The following delegated Microsoft Graph API permission is requested by the SIGNL4 mobile app: DeviceManagementManagedApps.ReadWrite.

This permission allows the application to access supported Microsoft Intune managed-app information and operations on behalf of the signed-in user. It is delegated, rather than unrestricted application-only access.

Important: The permission includes write capabilities. It is not read-only, even if SIGNL4 primarily requests it to determine whether applicable protection policies exist. The permission does not itself create or assign an Intune policy.

Why does SIGNL4 request this permission?

When a user successfully signs in with an EntraID account, SIGNL4 registers the account with the Intune App SDK. The SDK then handles enrollment and retrieves any applicable App Protection Policies. Previously enrolled accounts can also receive policy updates through the SDK.

How to grant administrator consent

1. Sign in to https://entra.microsoft.com/ using an account authorized to grant administrator consent.
2. Navigate to Entra ID → Enterprise applications → All applications.
3. Search for SIGNL4 and open the correct Enterprise Application. If multiple applications appear, verify the application identity against your existing SIGNL4 SSO configuration.
4. Select Security → Permissions.
5. Review the Microsoft Graph permissions and locate DeviceManagementManagedApps.ReadWrite.
6. Select Grant admin consent for [your organization].
7. Review the full Microsoft consent dialog and confirm the request.
8. Verify that consent is recorded. Restart the SIGNL4 mobile app or sign in again if necessary to obtain a new token.

Note: Administrator consent may apply to other requested permissions. Review the complete consent dialog before approving.

What if our organization does not use Intune App Protection Policies?

If your organization does not use Intune App Protection Policies for SIGNL4, this permission is not needed for that integration. In principle, an Entra ID administrator can leave the permission unconsented.

However, not granting consent and being able to continue using the app without interruption are different questions. Because SIGNL4 checks for policies at startup, Entra ID may still show an administrator approval prompt. Whether SIGNL4 continues normally depends on how the specific mobile app version handles the denied or unavailable permission.

• There is no need to configure an Intune policy solely because SIGNL4 requests this permission.
• Standard Entra ID SSO uses its own permissions, documented separately.
• If approval prompts block startup or sign-in, contact SIGNL4 Support.

Important: Leaving the scope unconsented is a valid Entra ID security decision; uninterrupted SIGNL4 startup and sign-in in that configuration require version-specific confirmation.

Troubleshooting

Users see “Need admin approval” or “Approval required”

The application may have requested a permission that users cannot approve. If Intune integration is used, ask an Entra ID administrator to review and grant the scope. Otherwise contact SIGNL4 Support if the prompt prevents use.

The permission is not listed in the Enterprise Application

A requested permission may not appear until the application has initiated the relevant authorization flow.

Open the SIGNL4 mobile app and complete Microsoft Entra ID sign-in, then check the application's permissions again. If the permission is still not visible, contact SIGNL4 Support.

The permission has been approved, but no protection policy is applied

Granting Microsoft Graph permission does not automatically enable Intune management.

Verify that your Intune App Protection Policy is correctly configured, that the relevant users and application are targeted, and that the SIGNL4 mobile app version and platform support the intended integration.

Related articles

• SIGNL4 Entra ID SSO: https://support.signl4.com/hc/en-us/articles/30394654499741-Microsoft-EntraID-How-can-I-set-up-EntraID-SSO
• Microsoft admin consent: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent
• Microsoft user and admin consent: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/user-admin-consent-overview