Turn Your Intranet Into an Employee App With SSO, MDM and Push

Why an app, when the intranet already works

Desk workers reach the intranet through the browser all day. Frontline staff – in stores, warehouses, care, field service or production – often do not. They have a phone, rarely a company laptop, and no habit of opening a bookmarked URL. An employee app gives them an icon on the home screen, a persistent login and push notifications for shift changes, safety notices or company news.

Most organizations do not need a new product for this. The intranet (SharePoint, a CMS, a custom portal or a staff web app) already holds the content and permissions. The work lies in four areas: authentication, network access, distribution and notifications.

Single sign-on with Entra ID or Okta

Employees should sign in with the same identity they use everywhere else. With Microsoft Entra ID, Okta or another OpenID Connect or SAML provider, the details matter:

• Use the system browser for the login step. Identity providers increasingly restrict sign-in inside embedded web views. Routing the login through the system authentication session (ASWebAuthenticationSession on iOS, Custom Tabs on Android) keeps existing SSO sessions, passkeys and MFA apps working.
• Check Conditional Access policies. Rules that require a compliant or managed device can block an app that the device management tool does not know about. Involve the identity team before the first test build.
• Plan session length. Frontline staff hate re-entering passwords. Align token lifetimes and refresh behavior with your security policy instead of relying on defaults.
• Shared devices are a special case. If several shift workers use one device, you need a clear sign-out flow or the shared-device modes your identity provider offers.

Reaching an intranet that is not on the internet

A wrapper app cannot load what the phone cannot reach. If the intranet sits behind the corporate firewall, choose one of three patterns: publish it through an identity-aware reverse proxy, use a per-app VPN pushed by your MDM, or move the employee-facing parts to a hosted service with SSO in front. The proxy route is usually the least friction for personal devices.

Private distribution and MDM rollout

With Microsoft Intune, Jamf, Workspace ONE or a similar tool, the app can be installed silently and receive managed configuration, for example the intranet URL per region. Note that Intune app protection policies for unmanaged devices require the app to integrate Microsoft's SDK – a plain wrapper does not get them automatically. Apple's in-house Enterprise Program is not a shortcut; eligibility is narrow and most companies should use custom apps instead.

Push notifications employees actually want

Push is often the main reason for the app. Keep it useful: segment by location, department or role, separate urgent safety alerts from news, and never put sensitive content in the notification text, because it appears on the lock screen. Let employees mute non-essential categories. In many countries the works council or employee representatives have a say in tools that could be used to monitor staff, so involve them early.

How jocapps can help

WebViewGold turns your existing intranet or staff portal into native iOS and Android apps with push notifications, offline handling and native APIs, without rebuilding the content layer. When the project needs custom SSO flows, integration with HR or ERP systems, or a long-term SLA, OnlineAppCreator – our ISO-certified B2B and B2G delivery team in Germany – takes over. appsubmitter.io handles signing and submission of custom and unlisted apps in your own developer accounts.

A sensible next step is a free 30-minute intro call via the meeting planner, where we look at your identity setup and device landscape together.