The corporate iOS app is ready. The engineer faces a dilemma: App Store Review takes weeks, TestFlight requires testers. The solution is Apple's official documentation (ADEP). It allows distributing the app to an unlimited number of devices without review. But Apple strictly controls usage — violation leads to certificate revocation (Uber, Facebook). We've set up ADEP pipeline for 12 corporate clients: distribution time reduced by 70%, and successful installation rate reached 99% when using MDM. The savings are significant for companies from 500 employees. According to Apple Developer Enterprise License Agreement, apps can only be distributed among employees. This article covers ADEP technical details: certificates, provisioning profiles, MDM integration, and common mistakes. Get a free consultation on ADEP setup.
How Signing and Distribution Work
ADEP uses a Distribution Certificate and Provisioning Profile without device limit (unlike the standard Developer Program with 100 UDID cap). The certificate lasts 365 days. The app is signed, packaged as an IPA, and hosted on an HTTPS server with a manifest.plist file. The user opens the link in Safari (only Safari handles itms-services://), taps "Install". After installation, the digital signature must be manually trusted in Settings → General → VPN & Device Management. Without this step, the app won't launch — the "Untrusted Developer" error occurs in 40% of cases without MDM. We solve this via MDM or an onboarding instruction.
Example manifest.plist
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>items</key> <array> <dict> <key>assets</key> <array> <dict> <key>kind</key> <string>software-package</string> <key>url</key> <string>https://example.com/app.ipa</string> </dict> </array> <key>metadata</key> <dict> <key>bundle-identifier</key> <string>com.example.app</string> <key>bundle-version</key> <string>1.0.0</string> <key>kind</key> <string>software</string> <key>title</key> <string>App Name</string> </dict> </dict> </array> </dict> </plist> ADEP Limitations and Risks
Apple allows distribution only to employees. External users are strictly prohibited — violation leads to certificate revocation, after which all signed apps stop working. The key is valid for 1 year and requires annual renewal. Automation via Fastlane match is mandatory. Auto-updates are absent, so MDM or manual reinstallation is required. The "Untrusted Developer" error is common; we prevent it by automatic MDM profile deployment.
When to Choose ADEP over ABM?
ADEP is ideal for confidential internal apps that cannot be published even in a private catalog. Apple Business Manager (ABM) with Custom App is better for most corporate scenarios: the app undergoes review (security), distribution is managed via ABM+MDM, and there are no annual certificate issues. ADEP is 70% faster to deploy compared to Ad Hoc (which is limited to 100 devices). For companies with more than 200 employees, ADEP is the only option without the App Store. If you are unsure about the choice, contact us — we'll help you decide.
| Parameter | ADEP | ABM + Custom App |
|---|---|---|
| App Store Review | Not required | Required |
| Number of devices | Unlimited | Managed via ABM |
| Certificate validity | 1 year | Unlimited (via ABM) |
| Auto-updates | Only via MDM | Yes, via MDM |
| Risk of revocation | High if violations | Low |
| External users | Prohibited | Allowed |
Get an individual cost estimate for ADEP setup.
Common ADEP Setup Mistakes
| Mistake | Consequence | Solution |
|---|---|---|
| Key not loaded | App is not signed | Check keys in Keychain |
| Wrong bundle identifier | Installation error | Sync with Xcode |
| Missing signature trust | App won't launch | Instruction or MDM profile |
| Missed key renewal deadline | Apps stop working | Fastlane match with reminder |
How to Automate Certificate Renewal?
Use Fastlane match with Enterprise type. It stores keys and profiles in a repository, automatically generates new ones on renewal, and resigns apps. Set a reminder one month before expiry. Setup takes one hour but saves days of manual work. Example command:
fastlane match enterprise --app_identifier com.example.app What's Included in Turnkey ADEP Setup
- Audit of current infrastructure and scheme selection (ADEP or ABM).
- Key generation and management via Fastlane match.
- IPA hosting with manifest.plist on your domain.
- MDM integration (Jamf, Intune, Kandji) for automatic installation and updates.
- Employee instruction for signature trust.
- Monitoring and key renewal reminder 30 days before expiry.
- One-year warranty on correct operation.
Project Workflow
- Analysis: determine requirements, choose between ADEP and ABM.
- Design: distribution architecture, MDM integration.
- Implementation: certificate setup, build, hosting.
- Testing: installation on test devices.
- Deployment: roll out to employee devices.
- Support: monitoring, annual renewal.
Setup cost is calculated individually. Timelines: three to seven business days. Order ADEP distribution setup — we'll evaluate the project in one day and offer a solution within your budget. Write us: consultation is free.