Masking ArcGIS Instant App URL

ColeShelley98

I would really like to see ESRI incorporate masking or "hiding" the URL for Instant Apps. We have some external agents/clients that have a basic viewing account within our ArcGIS Enterprise Portal but by simply deleting the app ID and "/apps/instant/lookup" from the URL, they are able to get into our Portal and view our all our important data and layers. Ideally, keeping their basic viewer accounts will allow us to track their logins and activity.

s.schuette_ct

This sounds like you assign the default Viewer Role to the external viewers, which gives them viewing access to content shared within the organisation. Member roles—Portal for ArcGIS | Documentation for ArcGIS Enterprise
You should create a custom viewer role and remove the option to see content shared within the organisation, then assign this role to your external viewers.

Share your app in dedicated group(s) and add your external viewers to the group(s).
This way, viewers will only be able to see apps (and containing content) shared with them in a group they belong to.
If you use Hosted Feature Services, you may want to create Views to limit visibility of data.

(Note: Check your license agreement to see if your use case - sharing user types outside your organisation - is covered.)