I read the documentation and found:WHEN YOU CREATE AN APP WITH DIRECT ENTITLEMENT, retail collections are not hidden at this time. for enterprise customers, will be important to hide content (even collections) if not entitled.So before the user login id it shouldn't see anything that is protected, ...