Enterprise Distribution — what it is, iOS app distribution

What is Enterprise Distribution?

Enterprise Distribution is a method of distributing iOS applications available to Apple Developer Enterprise Program members ($299/year). The program is intended exclusively for internal corporate use and prohibits distributing applications outside the organization. The main advantage is the absence of device limits and the ability for direct installation without the App Store.

The Enterprise program was launched by Apple in 2009 for large organizations that need to distribute confidential business applications among employees. Apple Developer Enterprise Program includes the same development tools as the standard program ($99/year) but adds the ability to create In-House distributions and Enterprise Provisioning Profiles.

According to Apple (2025), Enterprise Distribution is used in 90% of Fortune 500 companies for at least one internal application. Typical scenarios include corporate messengers, time tracking systems, tools for field employees, and warehouse management applications.

How does corporate iOS distribution work?

Enterprise Distribution works via OTA (Over-The-Air) installation. The developer signs the application with a corporate certificate, uploads the IPA file and manifest file to a web server, after which employees install the application through Safari by following an internal link.

The process does not require using App Store Connect or going through Apple review. Installation is performed directly on the device via the iOS OTA mechanism: the user opens a link in Safari, the system downloads the manifest file, verifies the certificate, and offers to install the application. Device management can be handled through an MDM solution for mass distribution.

<!-- manifest.plist for OTA installation of Enterprise app -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>items</key>
    <array>
        <dict>
            <key>assets</key>
            <array>
                <dict>
                    <key>kind</key>
                    <string>software-package</string>
                    <key>url</key>
                    <string>https://example.com/app.ipa</string>
                </dict>
            </array>
            <key>metadata</key>
            <dict>
                <key>bundle-identifier</key>
                <string>com.company.app</string>
                <key>bundle-version</key>
                <string>1.0.0</string>
                <key>title</key>
                <string>Company App</string>
            </dict>
        </dict>
    </array>
</dict>
</plist>

For Enterprise Distribution, HTTPS is important — Apple requires that the manifest file and IPA file be served over a secure connection. The HTTPS certificate must be valid and trusted on users' devices. This is a mandatory condition, violation of which leads to an installation error.

Enterprise certificates and profiles

Enterprise Distribution requires two key components: an Enterprise Certificate and a Provisioning Profile for In-House distribution. The certificate is created in the Apple Developer Portal and is valid for one year, after which it requires renewal. Without a valid certificate, application installation is impossible.

A Provisioning Profile for Enterprise Distribution is created without binding to specific devices — this is the main difference from Development or Ad Hoc profiles. An In-House profile allows installing the application on any device that trusts the corporate certificate. Trust management is done through the Profile section in iOS settings or centrally via MDM.

Apple strictly controls the use of Enterprise certificates. If Apple detects that Enterprise Distribution is being used to distribute applications outside the organization, the certificate may be revoked without warning. In 2023, Apple revoked the certificates of several large companies that violated the program's terms.

Setting up Enterprise Distribution

Setup of Enterprise Distribution begins with registration in the Apple Developer Enterprise Program. The organization must provide a D-U-N-S number, which confirms the company's legal status. After registration approval, the administrator creates an Enterprise certificate and an In-House Provisioning Profile in the Apple Developer Portal.

1. Register in the Apple Developer Enterprise Program with the organization's D-U-N-S number
2. Create a Certificate Signing Request (CSR) via Keychain Access on macOS
3. Generate an Enterprise Distribution Certificate in the Apple Developer Portal
4. Create an In-House Provisioning Profile for the required Bundle ID
5. Sign the application with an Enterprise certificate via Xcode or Fastlane
6. Upload the IPA to an HTTPS server along with the manifest.plist file
7. Distribute the installation link among employees or via MDM

For signing automation, Fastlane is used — a tool that allows setting up a CI/CD pipeline for Enterprise Distribution. Fastlane automatically manages certificates, signs binary files, and publishes them to the server. This is especially useful for teams releasing frequent updates to internal applications.

Enterprise vs App Store and Ad Hoc

Enterprise Distribution differs from the App Store and Ad Hoc in key parameters: audience, limitations, and publishing process. The App Store requires review and is available to all users, Ad Hoc is limited to 100 devices, while Enterprise has no limitations but is prohibited for public use.

The choice between Enterprise and other methods depends on the organization's needs. If the application is intended for external users — only the App Store. For internal testing by small groups, Ad Hoc Distribution or TestFlight is suitable. For corporate applications used by the entire organization, Enterprise Distribution is the optimal solution with no device limits and no need for store publishing.

An important advantage of Enterprise Distribution is no moderation. The organization can release updates at any time without waiting for Apple review. This is critical for applications requiring quick security fixes or urgent business logic updates.