App Launcher & Sign-in Tiles

App Launcher & Sign-in Tiles

1. What it is

The app launcher is the one list of everything a person can open from OneMango: the OneMango apps they have, the shortcuts you add, and the other apps your company’s identity provider gives them. A sign-in tile opens another app — Workday, ADP, Salesforce, your EHR — already signed in, in a new tab, through your identity provider. This is what MangoApps Classic called the SSO widget.

The same list, filtered for each person, shows in:

• the App Launcher card on the Home dashboard, which lists each person’s other apps grouped by category (OneMango’s own apps are on the More apps card);
• the Quick Actions widget on the home dashboard (people choose their own tiles);
• the Apps page;
• the phone’s Apps grid and More menu;
• search and Ask AI’s navigation answers;
• a Sites page, through the Quick Links block set to each reader’s apps.

Enablement: built into the platform — no app to license. Admins and super admins manage it.

2. Where the tiles come from

Source	Who sees a tile	Set up at
OneMango apps	Everyone who can open that app	Automatic
Shortcuts you add	Everyone, or only certain job titles, locations or groups	Admin → Organization → Quick Action Shortcuts
Apps your identity provider assigns	Each person sees the apps assigned to them there	Admin → Integrations → Identity Providers
Apps OneMango signs people in to itself	Everyone, or only certain job titles, locations or groups	Admin → Integrations → Identity Providers → Manage apps

When two tiles point at the same address or share a name, people see one: your shortcut wins over the identity provider’s app.

3. Add a sign-in tile yourself

Use this for an app your identity provider doesn’t list, or when you want to choose exactly who sees it.

1. In your identity provider, copy the app’s sign-in link:
   • Okta: the app’s App Embed Link (Applications → the app → General).
   • Microsoft Entra ID: the app’s User access URL (Enterprise applications → the app → Properties).
   • OneLogin: https://<your-subdomain>.onelogin.com/launch/<app id>.
2. Go to Admin → Organization → Quick Action Shortcuts and click Add shortcut.
3. Paste the link as the Destination, and set Opens in to Sign in through your identity provider (new tab).
4. Leave App logo on Automatic: when the destination is a well-known app (Workday, ADP, UKG, Salesforce, ServiceNow and about 200 more), the tile shows its logo, and the choice names the app it matched. Pick another app, or No logo, to change it. For an app that isn’t listed, add a picture under Your own logo — a square picture works best. Without any logo, the tile shows the Icon.
5. Choose where it shows (Quick Actions widget, App launcher, Search and Ask AI), a Category for the launcher, and, if it is not for everyone, the job titles, locations or groups that should see it.
6. Save.

People who are already signed in to your identity provider go straight into the app. Anyone who isn’t signs in there first.

4. Show the apps your identity provider assigns

Connect the provider once and each person’s assigned apps appear on their own, with the provider’s logos.

• Okta or Microsoft Entra ID connected for user sync: open the connection under Admin → Integrations → Identity Providers and turn on App launcher in its capabilities.
• Okta, Microsoft Entra ID or OneLogin connected by SCIM provisioning: open the SCIM connection and fill in its App launcher card with the provider’s API credentials — read access to users and apps is enough, and the card says which permission each provider needs. Click Save and test, then switch on Show the apps … assigns each person. Provisioning is not affected.

Then choose the Launcher category the apps are filed under, and whether they show in the launcher, in search, or both. Each person’s list refreshes when they sign in and at least every 12 hours. With Okta’s event hook set up on the connection, a change to someone’s apps in Okta reaches OneMango straight away.

5. Put the tiles in front of people

• Home dashboard: the App Launcher card is on every Home dashboard. Each person sees all of their other apps there — your shortcuts set to show in the launcher, the apps OneMango signs them in to, and the apps your identity provider assigns them — with no limit and nothing for them to set up. Someone with no other app doesn’t see the card. Move or remove it in Admin → Dashboard Builder.
• Quick Actions: shows up to nine tiles for things people do often. Your shortcuts lead by default (up to four), and people can add any other tile from Customize, including the apps in the App Launcher.
• A Sites page: add a Quick Links block and set its links to come from each reader’s apps. Every reader sees their own tiles; people who aren’t signed in see nothing.
• Phone: the Apps grid and More menu show the same list, and the Quick Actions widget shows the same tiles as on desktop.

6. Troubleshooting

• A shortcut doesn’t show for someone. Check it is Visible, lists the surface you’re looking at, and that the person matches every targeting rule (job title and location and group). A shortcut that names a required app hides for anyone who can’t open that app.
• Identity-provider apps are missing. Check the connection is active, App launcher is on, and its credentials are filled in. The person must exist in the provider with the same email address, or be linked through the connection’s sync. On a SCIM connection to Microsoft Entra ID, a person is found by their Entra object ID when the provisioning mapping sends objectId as externalId, otherwise by their email as their Entra user principal name (UPN); someone with neither sees no tiles. Pausing a SCIM connection hides its tiles until it is enabled again. A newly assigned app can take up to 12 hours to appear unless the person signs in again.
• The tile shows an icon instead of the logo. The destination isn’t a well-known app (pick one under App logo, or add Your own logo), the logo was archived or removed from the Asset Library, or the picture failed to load.
• The tile opens the provider’s sign-in page. The person isn’t signed in to your identity provider in that browser. After they sign in, the app opens.

7. Let OneMango sign people in to an app itself

With no Okta, Microsoft Entra ID or OneLogin, OneMango can be the identity provider for an app that accepts SAML sign-in — Salesforce, Zendesk, Workday, Box and most business apps.

1. Go to Admin → Integrations → Identity Providers and click Manage apps under Apps people sign in to through OneMango.
2. Copy OneMango’s values from the top of that page into the app’s single sign-on (SAML) setup: the Metadata address (most apps read everything from it), or the entity ID, Sign-in URL and Signing certificate.
3. Click Add an app. Paste the app’s own SAML metadata, or type its entity ID and the address where it receives sign-ins (its ACS URL).
4. Choose how the app knows each person — Email address, Employee number, OneMango employee ID, or An ID only this app sees — and which facts it is told (name, job title and so on).
5. Choose who may sign in (everyone, or certain groups, job titles or sites), set Status to On, and save. Try it signs you in as yourself in a new tab.

People in the app’s audience see its tile wherever the launcher shows, and an app that sends people to OneMango to sign in gets them back signed in. Anyone else is refused with a message that says why. Someone without the fact the app identifies people by (many frontline people have no email address) is told what is missing instead of being signed in. Every sign-in, and every refusal, appears under Admin → SSO Logs.

Each organization signs with its own certificate, valid for five years; its fingerprint and expiry date are on the same page.

8. Open a page inside an app

A shortcut can sign people in to one of the apps OneMango signs them in to (section 7) and open a particular page there — a Salesforce report, a Zendesk view, a ServiceNow queue.

1. Go to Admin → Organization → Quick Action Shortcuts and click Add shortcut.
2. Under Sign people in to, choose the app.
3. Paste the page’s full address as the Destination. It must be on the app’s own site — for an app that receives sign-ins at acme.my.salesforce.com, any address on salesforce.com.
4. Choose where it shows and who sees it, and save.

The tile signs the person in and tells the app to open that page. It shows only to people who can sign in to the app, and the page always comes from the saved shortcut. Some apps ignore the page they are given and open their home page instead, so open the tile once after saving.

For an app you sign in to through Okta, Microsoft Entra ID or OneLogin, use the page’s address as an ordinary shortcut: the app sends the person to your identity provider and back to that page.