For internal tools, the URL must be reachable from the phone (public https, or a VPN the phone is on), and should be https even internally — Android blocks plain http in apps by default. Keep the SSO domain inside the app, distribute the APK through your MDM or a private download page, and don't publish it on Google Play.
Can the phone reach it?
- Public behind login: simplest — works anywhere.
- Private network: works only on office Wi-Fi or with a VPN app connected. The app's offline screen will show otherwise; word it for your staff (“Connect to the company VPN”).
- Zero Trust access (Cloudflare Access, etc.): the access login runs in the WebView; test that session cookies persist.
http and IP addresses
Internal tools often run on http://10.0.0.5:8080. Android 9+ blocks cleartext http in apps unless the app opts in. Put a certificate on it (internal CA or a public certificate on an internal hostname). Self-signed certificates must be trusted properly — never build an app that ignores certificate errors.
SSO
Microsoft Entra and Okta logins usually work in WebViews; Google Workspace sign-in does not. Test with a real staff account, including MFA prompts and app approvals.
Distribution
Push the APK with your MDM (Intune, Workspace ONE, Google's Android Enterprise managed Play private apps) or host it on an internal page. Keep the signing key in your password manager — you'll need it for every update.
FAQ
Can I make an app for a local IP address?
For testing yes; for staff use, prefer an https hostname. Plain http is blocked by default in Android apps.
Do I need Google Play for an internal app?
No. Sideload the APK or distribute it through your MDM or managed Google Play private apps.