For large organizations, distributing internal tools and beta builds via the public App Store or even TestFlight isn't always feasible. Enter the Apple Developer Enterprise Program.
This guide provides a comprehensive look at iOS Enterprise Certificate distribution in 2026, helping you understand how to securely distribute in-house apps to your employees without the strict review process of the App Store.
Are you a tester, not an administrator? If your iPhone has just refused to open an app it finished installing, you want the fix for the Untrusted Enterprise Developer error rather than this page. Everything below is written for whoever runs the distribution program.
What is iOS Enterprise Distribution?
iOS Enterprise Distribution allows companies to distribute proprietary "in-house" apps directly to their employees' devices. These apps effectively bypass the public App Store review process, giving you total control over release timing and device availability.
To use this, you must be enrolled in the Apple Developer Enterprise Program, which is separate from the standard Apple Developer Program. It costs $299 USD per year.
Key Benefits vs. Standard Developer Program
| Feature | Standard Program ($99/yr) | Enterprise Program ($299/yr) |
|---|---|---|
| Distribution Audience | Public (App Store), Limited Beta (TestFlight/Ad Hoc) | Internal Employees Only |
| Device Limit | 100/device type (Ad Hoc) | Unlimited (Internal Devices) |
| App Review | Required for App Store & External TestFlight | No App Review |
How to Create and Distribute an Enterprise App
1. Create an In-House Distribution Certificate
Log in to your Apple Enterprise Developer account. Go to Certificates, Identifiers & Profiles → Certificates and create a new "In-House and Ad Hoc" production certificate. This certificate is used to sign your apps.
Once the certificate is installed in your login keychain, confirm the Mac can see it before you build. List every code-signing identity with:
security find-identity -v -p codesigningThe in-house identity appears as iPhone Distribution: Your Company (TEAMID). If it is missing, the certificate or its private key never made it into the keychain. That private key is also why signing an IPA online is a bad idea: any service offering to sign for you is asking for the key that ships software as your company.
2. Register an App ID
Create an explicit App ID for your internal app (e.g., com.yourcompany.internal.tool). Avoid wildcards if you plan to use capabilities like Push Notifications.
3. Create a Provisioning Profile
Create a new Provisioning Profile specifically for "In-House" distribution and link it to your App ID and Distribution Certificate. To confirm which certificate and entitlements an existing profile carries, decode it on the command line:
security cms -D -i embedded.mobileprovisionThat prints the profile as a readable plist, including its ExpirationDate. If you would rather not touch the terminal, paste the profile into our provisioning profile decoder to read the same fields in the browser.
4. Archive and Export from Xcode
When archiving your app in Xcode, select Distribute App → Enterprise. Xcode will sign the app with your Enterprise certificate and profile.
5. Distribute via OTA (Over-The-Air)
Similar to Ad Hoc distribution, you can distribute Enterprise apps wirelessly. You'll need:
- The signed .ipa file
- A manifest.plist file
- An HTTPS-enabled web server (plain HTTP installs are blocked by iOS)
The manifest.plist points at three HTTPS URLs: the software-package (your .ipa), a display-image (57×57 PNG icon), and a full-size-image (512×512 PNG icon). Devices then start the install by opening a link in this exact form:
itms-services://?action=download-manifest&url=https://example.com/manifest.plistMiss the HTTPS requirement, the bundle-identifier, or the bundle-version in that plist and the tap silently fails with no error — the most common reason OTA links "do nothing." For the full walkthrough, see our guide on how to install IPA files over the air.
Or skip the manifest entirely: upload your IPA to BetaDrop and we generate the OTA install link and a QR code for your employees automatically — no manifest.plist to hand-write, no web server to configure.
The One-Time Device Approval
Enterprise-signed apps install on any device, but they do not run until someone on the device approves the signing certificate once, under Settings → General → VPN & Device Management. Plan for it: employees who are not expecting the step read it as a broken build and file a ticket.
Two things are worth knowing when you write the internal instructions. The device has to reach Apple to verify the certificate at that moment, so approvals fail on offline devices and on captive-portal Wi-Fi. And devices enrolled in your MDM skip the step entirely, because a managed installation trusts the certificate on the user's behalf — if you have MDM, pushing the app through it is strictly less support burden than sending a link. For the tester-facing walkthrough, including what to do when the approval option is missing, send people to our guide on the Untrusted Enterprise Developer error.
Important Considerations & Risks
Strict Eligibility
Apple has become much stricter about who qualifies for the Enterprise Program. You must be a legal entity with a D-U-N-S number and demonstrate a clear need for internal-only distribution.
Certificate Expiration
Your distribution certificate expires every 3 years, and provisioning profiles expire every 12 months. Warning: If your certificate expires or is revoked, the app will instantly stop working on all employee devices, and the only way back is to re-sign the IPA with a fresh certificate and redistribute.
Revocation Risks
If you are caught distributing Enterprise apps to the public (non-employees), Apple will revoke your certificate and potentially ban your account. This is a "death sentence" for your internal apps, as they will all stop launching immediately.
Host the Signed OTA Install on BetaDrop
Once Xcode has produced your Enterprise-signed .ipa, the only step between you and your employees is hosting. BetaDrop turns that signed build into an over-the-air install link and QR code the moment you upload the IPA — no manifest.plist, no HTTPS server to stand up, and your first upload needs no account. Employees open the link in Safari, install, then complete the one-time device approval.
If you'd rather stay in the terminal, the BetaDrop CLI ships the same flow: install it with npm i -g @betadrop/cli and push a build straight from your release script.
Summary
In-house distribution buys you release timing that nobody else controls, and charges for it in maintenance. The signing certificate and the provisioning profile inside each build both carry expiry dates, and either one lapsing stops the app launching on every device at once — as does a revocation, if distribution ever reaches past your own staff. Put both dates on a calendar with a name against them, because the failure mode is not a degraded app but no app at all.
Frequently Asked Questions
What is the Apple Developer Enterprise Program?
The Apple Developer Enterprise Program lets organizations distribute proprietary, in-house apps to their own employees without the App Store or App Review. It costs $299 per year and is separate from the standard $99-per-year Apple Developer Program.
Is there a device limit for iOS Enterprise distribution?
No. Unlike Ad Hoc distribution, which is capped at 100 devices per device type per membership year, Enterprise (in-house) distribution has no hard device limit, provided the devices are owned or controlled by your organization and used by employees.
Do iOS Enterprise certificates and apps expire?
Yes. An in-house distribution certificate is valid for 3 years, but the provisioning profile embedded in the app expires after 12 months. Once the profile expires, or if the certificate is revoked, the app stops launching on every device until you re-sign and redistribute it.
Can I sell or share Enterprise apps with other companies?
No. The Enterprise Program is strictly for internal use by your own employees. Distributing in-house apps to the public or to other companies violates Apple's terms and will get your certificate revoked.
Does every employee have to approve the certificate on their own device?
Yes, once per device. The approval is stored per device and per signing certificate, so each employee taps through it after their first install and never sees it again for later builds signed by the same certificate. Devices that receive the app through an MDM server skip the step entirely, because a managed installation trusts the certificate on the user's behalf.
Can I distribute an Enterprise IPA over-the-air without running my own server?
Yes. Over-the-air installs normally require an HTTPS-hosted manifest.plist plus an itms-services link, which you can build and host yourself. Alternatively, upload the signed .ipa to BetaDrop and it returns the OTA install link and a QR code, with no manifest.plist to hand-write, no web server to configure and no tester accounts.
