Built for people who hold the keys to the tenant.
An admin app on a phone has to be safer than the portals, not just easier. Here’s how EnkiAdmin handles your sign-ins, your data and your organization’s permissions.
No servers in between
EnkiAdmin calls Microsoft’s and Google’s official APIs straight from your device. EnkiCube runs no servers for the app, so your users, mail and devices never pass through us, and there’s no EnkiAdmin account to create or breach.
Sign-in the way Microsoft and Google intend
You sign in on Microsoft’s or Google’s own page, in Apple’s secure sign-in window, using the standard OAuth flow with PKCE. The app never sees your password and contains no client secrets. Your organization’s MFA and Conditional Access policies apply as usual.
Sign-ins stay on this device
Sign-in tokens are stored in the iOS Keychain and marked for this device only, so they aren’t copied to iCloud or to a new phone. Signing out of a tenant removes them.
App Lock is always on
The first time you open the app, you set an App Lock passcode of at least 12 characters with letters and numbers, and can add Face ID. The app locks when you leave it and after a period with nobody using it, which you can change. Sensitive changes, such as resetting a password or MFA or deleting a user, ask for Face ID again.
Only the permissions you need, when you need them
EnkiAdmin asks for read permissions when you sign in, and for permission to make changes only the first time you use a feature that needs it. Microsoft and Google show their own consent screen each time. The app can never do more than your own admin role allows.
No tracking
No ads, no analytics and no third-party SDKs. EnkiAdmin’s App Store privacy label is “Data Not Collected”.
Short-lived local data
Dashboard and report data is cached on the device to keep the app quick and expires after 24 hours. Deleting the app removes everything it stored.
Diagnostics you control
The debug log is off by default. If you turn it on to report a problem, it masks email addresses, tokens and IDs, and it only leaves your device if you choose to share it.
Staying in control
Review or remove access at any time.
Microsoft 365
See and remove EnkiAdmin’s permissions in the Entra admin center under Enterprise applications › EnkiAdmin. A Global Administrator can also restrict who may use it.
Google Workspace
Manage EnkiAdmin’s access in the Admin console under Security › Access and data control › API controls, where you can trust, limit or block the app.
Found a security issue? Email support@enkicube.com with “Security” in the subject. Full details on what the app handles are in the Privacy Policy.
Be first to know when it launches.
EnkiAdmin is coming soon to the App Store. Send us a note and we’ll tell you the day it’s available.
Questions? support@enkicube.com