Mobile Application Distribution via Corporate Enterprise Store
Corporate Enterprise Store — internal app catalog accessible to organization employees. It's an alternative to public stores for internal software: employee opens corporate portal, sees app list, installs needed app. No public App Store, no personal Apple IDs for iOS, no Google Play policy dependency for Android.
Two Fundamentally Different Approaches
MDM-based distribution. Apps are pushed via MDM (Jamf, Intune, Workspace ONE) or requested by user via Self Service Portal. MDM agent already on device — app arrives as managed app without extra user action. Recommended for corporate devices (COPE, COBO).
Hosted Enterprise Store. Separate web portal or mobile app with catalog. User logs in, selects app, downloads. On iOS requires config profile or Apple Business Manager. On Android — permission for external sources or Managed Google Play. Common for BYOD when MDM isn't on device.
iOS: Technical Limitations and Workarounds
IPA installation outside App Store possible three ways: Apple Developer Enterprise Program (distribute signed IPA via HTTPS), TestFlight (up to 10,000 testers), Custom App in ABM.
Enterprise Program — only option without App Store Review for internal software. But since 2019 Apple strictly monitors: Enterprise Program certificate can't be used for apps intended for external users (non-employees). Violation results in certificate revocation and all apps signed with it stop working.
Signed IPA distributed via ITMS-Services link (itms-services://?action=download-manifest&url=...) with manifest.plist manifest. User must manually trust Enterprise certificate in device settings — UX problem solved by training or MDM.
Android: Managed Google Play vs sideload
For corporate Android devices Managed Google Play is best option. App published in closed corporate Play Store track, accessible only to devices connected to organization via EMM (Enterprise Mobility Management). Doesn't require external source permission. Works with Android Enterprise.
Sideload via APK file is simpler but requires INSTALL_UNKNOWN_APPS and creates security risks: no auto-updates, no Play Protect signature check. Acceptable for testing, undesirable for production.
What Enterprise Store Setup Includes
Choosing distribution model for specific needs (MDM-based vs hosted, iOS vs Android vs cross-platform). Setting up infrastructure: HTTPS server for IPA/APK hosting with manifest.plist, or MDM Self Service integration. Configuring auto-updates — user shouldn't manually track versions. Configuring access revocation on employee departure.
Implementation timeline — three to ten working days depending on infrastructure complexity and platform count.