Apps and connection modes

Apps are the entries of the catalog your users see on Home. You manage them from Apps (/admin). Owners and admins can change apps; read-only admins can only view them.

Add an app

1. Open Apps and select New app.
2. Enter a Name. Frontdoor suggests a Slug (unique identifier) from the name until you edit the slug yourself.
3. Fill in the other fields you need:
   • Description and Extended description, shown in the app's details on Home.
   • Target URL, where the app lives.
   • Tags, used by the tag filter and by the Group by tag view on Home.
   • Sort order.
   • The icon (see App icons).
4. Choose a connection mode (see below).
5. Choose one or more groups to give them access right away.
6. Save.

If you select no group, the app is created without permissions and nobody sees it on Home. Apps without any group are flagged in Unassigned apps detected, with direct links to edit them.

Choose a connection mode

The mode decides how Frontdoor hands the user off to the app.

Mode	Value	How it works
External link	redirect-plain	Plain link to the app. No authentication is forwarded.
Internal link	internal-link	Plain link to a private IP address, for rare on-premises targets. Hostnames are not accepted.
Redirect SSO	redirect	Frontdoor forwards a short-lived token to the app's SSO endpoint, by GET query string or POST form (Method). The app verifies it with the shared secret or through Frontdoor's introspection endpoint.
Shared Cookie	shared-cookie	Frontdoor's httpOnly session cookie is scoped to a wildcard domain, so apps on subdomains such as *.contoso.com can read it.
Entra App	entra-app	Opens an app enrolled in Microsoft Entra through the Microsoft MyApps launcher. Enter the Entra Application ID, either as a GUID or as a full launcher.myapps.microsoft.com/... URL.

Every app opening is recorded in the access log, in all modes. For the developer side of Redirect SSO and Shared Cookie, see Authentication for satellite apps.

Owners can hide the Shared Cookie, Redirect SSO and Entra App buttons from the app editor in Customize. An app that already uses a hidden mode keeps it until you change it.

App icons

You can set an app's icon in three ways:

• an emoji or a short text in the icon field
• an image pasted from your computer or browser
• SVG markup pasted in Or paste SVG

Icons are limited to 1 MB (SVG 512 KB). PNG, JPEG and WebP images are shrunk in the browser to at most 256 px before upload. Pasted SVG is sanitized.

Frontdoor stores icons on disk and serves them with a long-lived cache. The icon URL changes when you save the app, so browsers fetch the new icon only after a change.

Media library

The media library (/admin/icons, linked from Customize with Open media library) lists every app icon and branding logo on disk. Identical files used by several apps appear as one card. You can filter by kind and by orphan status, copy an asset link or its SVG markup, and delete assets that nothing uses any more.

App icons larger than 200 KB are listed at the top. Use Optimize icons to shrink the PNG, JPEG and WebP ones to at most 256 px and save them on their apps.

Find apps

On the Apps page you can search the catalog, filter it by tag (Tag filter) and by connection type (Mode filter). A quick filter, with its count, shows the apps that have no tag yet.

Duplicate, deactivate or delete an app

• Duplicate opens a copy of the app in the editor. Nothing is saved until you save the copy, so edit only the fields you need.
• Deactivating an app hides it from the catalog and keeps its history.
• Delete removes the app together with its permissions and its access logs.

Restore the demo apps

A new installation starts with a set of example apps. Restore demo apps adds back the missing ones. Existing apps with the same slug are updated, not replaced.