iOS App Distribution via Apple Developer Enterprise Program
Apple Developer Enterprise Program (ADEP) enables iOS app distribution to company employees without App Store publishing or App Store Review. Program costs $299/year and requires organizational verification. Key point: this isn't alternate App Store path but exclusively internal corporate software tool.
How Signing and Distribution Works
ADEP issues Enterprise Distribution Certificate and allows creating Provisioning Profiles with unlimited devices (vs standard Developer Program's 100 UDID limit). App is signed with this certificate and distributed via HTTPS using ITMS-Services manifest.
Manifest manifest.plist contains IPA file link, app name, bundle-identifier, and bundle-version. User opens special page in Safari (only Safari handles itms-services:// URI on iOS), clicks "Install", iOS shows system confirmation dialog.
After installation — mandatory step: user must manually trust certificate via "Settings → General → VPN and Device Management". Without this step app doesn't run; user sees "Untrusted Developer" error. UX problem typically solved by onboarding training or automatically via MDM profile including Enterprise certificate trust.
Limitations That Can't Be Ignored
Employees only. Apple explicitly forbids using ADEP for apps intended for external users, clients, or public. Facebook, Uber got Enterprise certificates revoked for this. When certificate is revoked — all apps signed with it stop working on all devices immediately. Not "on next install" but right now.
Certificate lives one year. Distribution Certificate must be renewed yearly, and apps must be rebuilt and resigned with new certificate after update. Missing deadline has same consequences as revocation. Automating this via Fastlane match with Enterprise type is mandatory for production.
No auto-updates. Unlike App Store or TestFlight, ITMS-Services doesn't provide automatic updates. App updates only if user follows link again and installs new version, or if MDM force-reinstalls.
Automation via MDM
ADEP + MDM (Jamf Pro, Intune, Kandji) solves most UX problems. MDM can:
- Automatically install and update apps without user involvement
- Manage Enterprise certificate trust via config profile
- Control device list with app installed
- Revoke app on employee departure
Without MDM ADEP is complex operationally. With MDM — full enterprise distribution.
When ADEP vs ABM + Custom App
ADEP fits if: app can't be published even in closed corporate catalog (secret development, specific B2B software), or organization rejects App Store Review on principle.
Custom App via Apple Business Manager — better choice in most corporate scenarios: app passes review (security plus), distribution managed via ABM+MDM, no yearly certificate problem, no sudden revocation risk.
ADEP distribution setup from scratch — three to seven working days including Apple verification and infrastructure setup.