You tapped an app your employer or a beta program sent you, and instead of opening, iOS put an alert on the screen:
Untrusted Enterprise Developer
“Your Company Ltd.” has not been trusted on this iPhone. Until this developer is trusted, their enterprise apps will not be available for use.
Nothing is corrupt and nothing downloaded wrong. The app installed fine — iOS just will not run code signed by a certificate you have never explicitly approved on this particular device. You approve it once in Settings and the app opens. The reason this feels like a dead end is that Apple deliberately removed the approval from the alert itself, so the only button in front of you dismisses the thing without fixing it.
The fix, in about thirty seconds
- Dismiss the alert. The button is labeled Cancel, Dismiss or OK depending on your iOS version. You cannot approve the developer from here, by design.
- Open Settings and tap General.
- Tap VPN & Device Management. Apple has renamed this screen several times; on iOS 14 and earlier it reads Device Management or Profiles & Device Management, and on some older releases simply Profiles. If none of those labels is there, scroll the General list for the entry whose name mentions profiles or device management — it sits near the bottom, above Legal & Regulatory.
- Tap the developer under the ENTERPRISE APP heading. It will be the organization’s name, something like “Your Company Ltd.” rather than the app’s name.
- Tap Trust “Your Company Ltd.” and confirm Trust in the sheet that slides up.
- Go back to the Home Screen and open the app. It launches normally now, and so will every future build the same organization signs with that certificate.
One thing that trips people up before they even start: the device has to be online. When you tap Trust, iOS calls out to Apple to check that the certificate has not been revoked, and on recent iOS versions the Trust option simply is not offered until that check can complete. Locked-down corporate Wi-Fi and hotel captive portals are the usual culprits. Switch to cellular data, tap Trust, and you can go back to the restricted network afterwards.
Why iOS asks you this at all
Every app that runs on an iPhone is code-signed. For App Store apps the signature chains back to Apple’s own review, so nobody asks you anything. But organizations often need to ship internal apps to their own staff without publishing them, and Apple sells the Apple Developer Enterprise Program for exactly that: an in-house certificate that signs apps which install outside the App Store entirely.
That is a large amount of power to hand to a certificate, so Apple splits the decision in two. Installing the app is allowed. Running it requires a human on the device to say, once, that they know who this organization is. The approval is stored per device and per certificate — it is not a property of the app — which is why one tap covers every current and future app the same signer ships, and why a brand-new phone asks all over again.
It is also why the approval lives in Settings rather than in the alert. If a malicious page could pop a dialog with a Trust button on it, the whole protection would be one careless tap wide. Making you leave the app, open Settings and find the profile yourself is the friction, and the friction is the point.
When the Untrusted Enterprise Developer prompt has no Trust option, or trusting does not stick
The profile is not listed at all
The ENTERPRISE APP section only materializes once the app has finished installing. If you opened Settings while the icon was still showing a progress ring, or you cancelled the install partway, there is nothing to approve yet. Go back to the Home Screen, let the download finish, then return to Settings.
The Trust option is greyed out or the confirmation fails
This is the certificate-verification check described above failing to reach Apple. Being fully offline does it; so does a firewall or a proxy that blocks Apple’s certificate-status endpoints, which is common on guest and corporate networks. Cellular data is the fastest way to rule it out.
The device is managed and the option is gone entirely
If your iPhone is supervised or enrolled in an MDM, whoever administers it can switch off the ability to trust enterprise developers as a policy. The profile appears, but there is no Trust control anywhere on the screen and nothing you do on the device will bring it back. That is intentional: on those fleets, apps are expected to arrive through the MDM, which trusts the certificate on your behalf. Ask IT to push the app rather than send you a link.
You trusted it and the app still will not launch
If the app opens for a split second and closes, the trust worked and something else is wrong — almost always a revoked enterprise certificate or a provisioning profile past its expiry. Apple revokes certificates when a company is caught distributing in-house apps outside its own staff, and in-house profiles expire on a twelve-month clock regardless. Neither is fixable on the device. The developer has to re-sign the build and issue a new install link.
You want to take the trust back
Deleting the app from the Home Screen does not revoke anything — the profile stays and future builds from that signer will run without asking again. Return to Settings → General → VPN & Device Management, tap the profile, and use the removal option there. Depending on the iOS version it is labeled Remove Profile or Delete App; both revoke the trust and take the associated apps with them.
Is it safe to tap Trust?
It depends entirely on who is asking, and the honest answer is that this prompt is one of the few places where you are the security control.
- Reasonable: an internal tool from your employer, installed from a link on the company intranet or sent by a colleague you can verify out of band. A beta build from a company whose program you signed up for.
- Not reasonable: a “free paid games” or “modded app” site, a link from an unexpected message, or anything where you cannot name the organization on the profile. Enterprise certificate abuse is a real and well-documented malware distribution route, and the trust tap is the only gate.
If you do not recognize the name under ENTERPRISE APP, do not approve it. There is no partial trust and no per-app scoping — you are approving the signer, and everything it signs.
Which iOS install error do you actually have?
Several different failures get described as “the untrusted developer thing”, and only one of them is fixed by the steps above.
| What you see | What it means | What actually fixes it |
|---|---|---|
| “Untrusted Enterprise Developer” | An in-house build signed with an enterprise certificate this device has not approved. | The Settings steps at the top of this page. |
| “Untrusted Developer” (no “Enterprise”) | A development-signed build, usually side-loaded from Xcode or a free Apple ID. | Same Settings screen, but the profile sits under DEVELOPER APP. On iOS 16 and later you also have to switch on Developer Mode under Settings → Privacy & Security. |
| “Unable to Install” / “could not be installed at this time” | Usually an Ad Hoc build whose provisioning profile does not list this device. | The developer has to add your device identifier and re-sign. Trusting a profile cannot help. |
| Icon stuck on “Loading…” or greyed out | The download itself failed, or the OTA manifest points at something unreachable. | Delete the placeholder icon and open a fresh install link. |
| Launches, then closes instantly — after trusting | Revoked certificate or expired provisioning profile. | Nothing device-side. The build has to be re-signed and redistributed. |
If you landed in the third row, you need the device identifier the profile is missing. A web page cannot read that off an iPhone on its own, so our UDID checker uses the mechanism Apple provides: open it in Safari or Chrome on the iPhone itself, tap through to download a temporary configuration profile, install and approve it when iOS shows the profile screen, and the device reports the identifier back to BetaDrop, which shows it on the result page for you to send to whoever built the app. For the mechanics behind the whole install flow, see how OTA IPA installs work, and for the certificate side, the iOS enterprise certificate distribution guide.
If you are the one shipping the build
Worth knowing which side of this you can control. The trust prompt is a property of the certificate, not of how you host the file — no hosting service can suppress it, and any that claims to is describing something else. If your testers are hitting it, it is because the build is enterprise-signed.
An Ad Hoc build avoids the prompt completely. Signed with a regular Apple Distribution certificate and a profile that names each device, it installs over the air and launches with no Settings detour at all. The trade is that you collect every tester’s device identifier before you build, and you are capped at 100 devices per device type per membership year, so you move the friction from your testers to yourself. For an internal fleet of a few hundred staff, enterprise signing plus a one-time trust step is usually the better deal; for a handful of external testers, Ad Hoc is.
Either way the hosting is identical: the signed .ipa served over HTTPS with an itms-services manifest pointing at it. That is the part BetaDrop’s IPA file hosting does — drop in the signed build and you get an install link and a QR code back, free, with no account needed to start and nothing for the tester to sign up for. It changes nothing about the trust prompt, because nothing can; it just removes the manifest and web-server boilerplate between your build and the person testing it.
Frequently Asked Questions
Why does my iPhone say Untrusted Enterprise Developer?
The app is signed with an Apple enterprise (in-house) certificate that this device has not been told to trust yet. iOS finishes installing the app but refuses to launch it until you approve that developer once, under Settings, General, VPN and Device Management. It does not mean the download was corrupt or the app is broken.
Where is VPN & Device Management on my iPhone?
Open Settings, tap General, and scroll down to VPN and Device Management. Apple has renamed that screen more than once, so on iOS 14 and earlier look for Device Management or Profiles and Device Management in the same place. The entry only exists once a configuration profile or an enterprise app is actually installed, which is why it can seem to be missing.
Can I approve the developer from a Mac or PC instead of on the iPhone?
No. The approval only exists on the iPhone itself, under Settings, General, VPN and Device Management. There is no desktop equivalent, so connecting the phone to a computer, syncing it, or reinstalling the app from there will not create it or tap it for you. The only route that skips the step is an installation pushed by an MDM server, which trusts the certificate on the user's behalf, and that has to be set up by whoever administers the device.
Does trusting an enterprise developer put my iPhone at risk?
It can, so only do it for a developer you were already expecting a build from, such as your employer or a beta program you signed up for. An enterprise certificate lets its owner run any app on your device without App Review, so a trust prompt that arrives out of nowhere from a website you do not recognize is exactly the attack this screen exists to stop.
Does trusting a developer let their apps read my photos or location?
No. Trusting the certificate only lets iOS launch the app. It does not hand anything over: photos, contacts, location, the camera and the microphone all still sit behind the normal iOS permission prompts, and the app runs in the same sandbox as anything installed from the App Store. What you are accepting is that this code never went through App Review, so the judgment you are making is about the organization behind it, not about your data being copied the moment you tap Trust.
Is trusting an enterprise developer the same as jailbreaking my iPhone?
No. Nothing here modifies iOS or switches off any of its protections. You are approving one signing certificate inside a mechanism Apple built and documents, the app stays sandboxed, and the approval can be withdrawn again from Settings. Jailbreaking is the opposite move: it disables the code-signing enforcement that makes this prompt exist in the first place.
In short
“Untrusted Enterprise Developer” is a consent screen wearing the costume of an error. iOS is asking you to confirm, once, that you know who signed this app, because it cannot check that for you the way it can for App Store downloads. Settings → General → VPN & Device Management, tap the organization, tap Trust — with the phone online. If the Trust option is not there, you are offline, the install has not finished, or someone else administers the device.
