For large organizations, distributing internal tools and beta builds via the public App Store or even TestFlight isn't always feasible. Enter the Apple Developer Enterprise Program.
This guide provides a comprehensive look at iOS Enterprise Certificate distribution in 2026, helping you understand how to securely distribute in-house apps to your employees without the strict review process of the App Store.
What is iOS Enterprise Distribution?
iOS Enterprise Distribution allows companies to distribute proprietary "in-house" apps directly to their employees' devices. These apps effectively bypass the public App Store review process, giving you total control over release timing and device availability.
To use this, you must be enrolled in the Apple Developer Enterprise Program, which is separate from the standard Apple Developer Program. It costs $299 USD per year.
Key Benefits vs. Standard Developer Program
| Feature | Standard Program ($99/yr) | Enterprise Program ($299/yr) |
|---|---|---|
| Distribution Audience | Public (App Store), Limited Beta (TestFlight/Ad Hoc) | Internal Employees Only |
| Device Limit | 100/device type (Ad Hoc) | Unlimited (Internal Devices) |
| App Review | Required for App Store & External TestFlight | No App Review |
How to Create and Distribute an Enterprise App
1. Create an In-House Distribution Certificate
Log in to your Apple Enterprise Developer account. Go to Certificates, Identifiers & Profiles → Certificates and create a new "In-House and Ad Hoc" production certificate. This certificate is used to sign your apps.
Once the certificate is installed in your login keychain, confirm the Mac can see it before you build. List every code-signing identity with:
security find-identity -v -p codesigningThe in-house identity appears as iPhone Distribution: Your Company (TEAMID). If it is missing, the certificate or its private key never made it into the keychain.
2. Register an App ID
Create an explicit App ID for your internal app (e.g., com.yourcompany.internal.tool). Avoid wildcards if you plan to use capabilities like Push Notifications.
3. Create a Provisioning Profile
Create a new Provisioning Profile specifically for "In-House" distribution and link it to your App ID and Distribution Certificate. To confirm which certificate and entitlements an existing profile carries, decode it on the command line:
security cms -D -i embedded.mobileprovisionThat prints the profile as a readable plist, including its ExpirationDate. If you would rather not touch the terminal, paste the profile into our provisioning profile decoder to read the same fields in the browser.
4. Archive and Export from Xcode
When archiving your app in Xcode, select Distribute App → Enterprise. Xcode will sign the app with your Enterprise certificate and profile.
5. Distribute via OTA (Over-The-Air)
Similar to Ad Hoc distribution, you can distribute Enterprise apps wirelessly. You'll need:
- The signed .ipa file
- A manifest.plist file
- An HTTPS-enabled web server (plain HTTP installs are blocked by iOS)
The manifest.plist points at three HTTPS URLs: the software-package (your .ipa), a display-image (57×57 PNG icon), and a full-size-image (512×512 PNG icon). Devices then start the install by opening a link in this exact form:
itms-services://?action=download-manifest&url=https://example.com/manifest.plistMiss the HTTPS requirement, the bundle-identifier, or the bundle-version in that plist and the tap silently fails with no error — the most common reason OTA links "do nothing." For the full walkthrough, see our guide on how to install IPA files over the air.
Or skip the manifest entirely: upload your IPA to BetaDrop and we generate the OTA install link and a QR code for your employees automatically — no manifest.plist to hand-write, no web server to configure. Builds up to 512 MB are accepted.
Trusting the Enterprise Developer
When an employee installs an Enterprise app for the first time, they will see an "Untrusted Enterprise Developer" error. This is a security feature.
To fix this, the user must:
- Open Settings on their iOS device.
- Go to General → VPN & Device Management (labelled Device Management or Profiles & Device Management on iOS 14 and earlier).
- Tap your company name under the Enterprise App heading.
- Tap Trust "Your Company Name", then confirm in the dialog.
The device must reach Apple once (over Wi-Fi or cellular) to verify the certificate the first time it is trusted, so an offline first launch can still fail. If the app already installed but refuses to open, our dedicated walkthrough for the Untrusted Enterprise Developer error covers the remaining edge cases.
Important Considerations & Risks
Strict Eligibility
Apple has become much stricter about who qualifies for the Enterprise Program. You must be a legal entity with a D-U-N-S number and demonstrate a clear need for internal-only distribution.
Certificate Expiration
Your distribution certificate expires every 3 years, and provisioning profiles expire every 12 months. Warning: If your certificate expires or is revoked, the app will instantly stop working on all employee devices.
Revocation Risks
If you are caught distributing Enterprise apps to the public (non-employees), Apple will revoke your certificate and potentially ban your account. This is a "death sentence" for your internal apps, as they will all stop launching immediately.
Host the Signed OTA Install on BetaDrop
Once Xcode has produced your Enterprise-signed .ipa, the only step between you and your employees is hosting. BetaDrop is a free service that turns that signed build into an over-the-air install link and QR code the moment you upload the IPA — no manifest.plist, no HTTPS server to stand up, and no TestFlight or App Review wait. Employees open the link in Safari, install, then complete the one-time device-trust step. Builds up to 512 MB are supported, and links are ephemeral, so stale internal builds don't linger.
If you'd rather stay in the terminal, the BetaDrop CLI ships the same flow: install it with npm i -g @betadrop/cli and push a build straight from your release script.
Summary
iOS Enterprise Distribution is a powerful tool for large organizations needing to deploy internal mobile solutions. By bypassing the App Store, you gain agility and control. However, with great power comes the responsibility of managing certificates and ensuring strict internal-only usage.
Ready to share your Enterprise build? Upload your iOS IPA to BetaDrop for instant, secure link generation.
Frequently Asked Questions
What is the Apple Developer Enterprise Program?
The Apple Developer Enterprise Program lets organizations distribute proprietary, in-house apps to their own employees without the App Store or App Review. It costs $299 per year and is separate from the standard $99-per-year Apple Developer Program.
Is there a device limit for iOS Enterprise distribution?
No. Unlike Ad Hoc distribution, which is capped at 100 devices per device type per membership year, Enterprise (in-house) distribution has no hard device limit, provided the devices are owned or controlled by your organization and used by employees.
Do iOS Enterprise certificates and apps expire?
Yes. An in-house distribution certificate is valid for 3 years, but the provisioning profile embedded in the app expires after 12 months. Once the profile expires, or if the certificate is revoked, the app stops launching on every device until you re-sign and redistribute it.
Can I sell or share Enterprise apps with other companies?
No. The Enterprise Program is strictly for internal use by your own employees. Distributing in-house apps to the public or to other companies violates Apple's terms and will get your certificate revoked.
How do employees trust an Enterprise app on their iPhone?
After installing, open Settings → General → VPN & Device Management, tap your company name under the Enterprise App heading, then tap Trust and confirm. Until the developer is trusted, the app shows an "Untrusted Enterprise Developer" error and will not open.
Can I distribute an Enterprise IPA over-the-air without running my own server?
Yes. Over-the-air installs normally require an HTTPS-hosted manifest.plist plus an itms-services link, which you can build yourself. Alternatively, upload the signed .ipa to BetaDrop to get an instant OTA install link and QR code — no manifest.plist, web server, or tester accounts required. BetaDrop accepts builds up to 512 MB.
