diff --git a/src/appdb.js b/src/appdb.js
index 20b6ad77e..41fe7087f 100644
--- a/src/appdb.js
+++ b/src/appdb.js
@@ -435,12 +435,8 @@ function updateWithConstraints(id, app, constraints, callback) {
         });
     }
 
-    if ('location' in app) {
-        queries.push({ query: 'UPDATE subdomains SET subdomain = ? WHERE appId = ? AND type = ?', args: [ app.location, id, exports.SUBDOMAIN_TYPE_PRIMARY ]});
-    }
-
-    if ('domain' in app) {
-        queries.push({ query: 'UPDATE subdomains SET domain = ? WHERE appId = ? AND type = ?', args: [ app.domain, id, exports.SUBDOMAIN_TYPE_PRIMARY ]});
+    if ('location' in app && 'domain' in app) { // must be updated together as they are unique together
+        queries.push({ query: 'UPDATE subdomains SET subdomain = ?, domain = ? WHERE appId = ? AND type = ?', args: [ app.location, app.domain, id, exports.SUBDOMAIN_TYPE_PRIMARY ]});
     }
 
     if ('alternateDomains' in app) {
diff --git a/src/apps.js b/src/apps.js
index 65704f149..df23cf6e0 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -667,11 +667,13 @@ function configure(appId, data, user, auditSource, callback) {
         if (error) return callback(error);
 
         let domain, location, portBindings, values = { };
-        if ('location' in data) location = values.location = data.location.toLowerCase();
-        else location = app.location;
-
-        if ('domain' in data) domain = values.domain = data.domain.toLowerCase();
-        else domain = app.domain;
+        if ('location' in data && 'domain' in data) {
+            location = values.location = data.location.toLowerCase();
+            domain = values.domain = data.domain.toLowerCase();
+        } else {
+            location = app.location;
+            domain = app.domain;
+        }
 
         if ('accessRestriction' in data) {
             values.accessRestriction = data.accessRestriction;
diff --git a/src/routes/apps.js b/src/routes/apps.js
index 681106f55..e0134b833 100644
--- a/src/routes/apps.js
+++ b/src/routes/apps.js
@@ -175,6 +175,10 @@ function configureApp(req, res, next) {
 
     if ('location' in data && typeof data.location !== 'string') return next(new HttpError(400, 'location must be string'));
     if ('domain' in data && typeof data.domain !== 'string') return next(new HttpError(400, 'domain must be string'));
+    // domain, location must both be provided since they are unique together
+    if ('location' in data && !('domain' in data)) return next(new HttpError(400, 'domain must be provided'));
+    if (!('location' in data) && 'domain' in data) return next(new HttpError(400, 'location must be provided'));
+
     if ('portBindings' in data && typeof data.portBindings !== 'object') return next(new HttpError(400, 'portBindings must be an object'));
     if ('accessRestriction' in data && typeof data.accessRestriction !== 'object') return next(new HttpError(400, 'accessRestriction must be an object'));