I strongly suggest you hiding the sign-in prompt to put user credentials when accessing to the private site URL on a mobile device. With the same scenario on PC, no credential prompt will be shown but redirected to the no-access page instead. It would be great if the page only says “access required” and no credential prompt shown because I don’t want people to know what service we are using.