# How to Create and Distribute Enterprise iOS Apps using Apple Developer Enterprise Program
Developing an iOS application for the general public requires submission to the Apple App Store, a process governed by strict review guidelines. However, large organizations frequently build proprietary, internal-use-only applications—such as inventory management tools, custom CRM interfaces, or secure employee communication platforms.
Submitting these to the public App Store is neither practical nor secure. To solve this, Apple offers the **Apple Developer Enterprise Program (ADEP)**.
This program allows organizations to compile, digitally sign, and distribute custom iOS applications directly to their employees’ devices, bypassing the App Store entirely. This guide details the technical workflow for provisioning and distributing an enterprise iOS application.
## Important Note on ADEP Eligibility
Apple is highly restrictive regarding who qualifies for the Enterprise Program. It is designed exclusively for large organizations (typically 100+ employees) to distribute proprietary apps *only* to their own employees.
If you intend to distribute the app to external contractors, clients, or the general public, you must use the standard Apple Developer Program and utilize Custom App distribution via Apple Business Manager or TestFlight. ADEP misuse will result in immediate certificate revocation by Apple.
## Step 1: Generate an Enterprise Distribution Certificate
To install an app outside the App Store, iOS requires cryptographic proof that the app was created by a trusted entity (your organization). This trust is established using an Enterprise Distribution Certificate.
1. Log in to the **Apple Developer Member Center** using the Team Agent account for your Enterprise Program.
2. Navigate to **Certificates, Identifiers & Profiles**.
3. Under **Certificates**, click the **+** (plus) button.
4. Select **In-House and Ad Hoc** under the Software section.
5. You will be prompted to upload a Certificate Signing Request (CSR).
6. Open the **Keychain Access** app on your Mac.
7. From the menu bar, select **Keychain Access > Certificate Assistant > Request a Certificate from a Certificate Authority**.
8. Enter your email address and name. Select **Saved to disk** and save the `.certSigningRequest` file to your Mac.
9. Upload this CSR file to the Apple Developer portal.
10. Apple will generate your certificate (`.cer`). Download it and double-click it to install it into your Mac’s Keychain.
## Step 2: Register the App ID
Every iOS app requires a unique identifier.
1. In the Developer portal, navigate to **Identifiers**.
2. Click the **+** (plus) button and select **App IDs**.
3. Provide a description (e.g., `Corporate Inventory App`).
4. Define the **Bundle ID** (e.g., `com.yourcompany.inventory`). This must exactly match the Bundle Identifier defined in your Xcode project.
5. Select any necessary capabilities your app requires (e.g., Push Notifications, Location Services).
6. Register the App ID.
## Step 3: Create an In-House Provisioning Profile
The provisioning profile ties your App ID and your Distribution Certificate together, authorizing the app to run on iOS devices.
1. In the Developer portal, navigate to **Profiles**.
2. Click the **+** (plus) button.
3. Under the Distribution section, select **In House**. (Do not select Ad Hoc, as that requires you to manually register the UDID of every employee’s iPhone).
4. Select the App ID you created in Step 2.
5. Select the Enterprise Distribution Certificate you created in Step 1.
6. Give the profile a descriptive name (e.g., `Inventory App In-House Profile`) and generate it.
7. Download the `.mobileprovision` file and double-click it to install it into Xcode.
## Step 4: Archive and Export the App in Xcode
With the cryptographic components in place, you can now compile the app for distribution.
1. Open your project in **Xcode**.
2. In the project navigator, select your project root, then select your app Target.
3. Under the **Signing & Capabilities** tab, uncheck “Automatically manage signing”.
4. For the **Release** configuration, select the In-House Provisioning Profile you just downloaded. Xcode should automatically locate the associated Enterprise Certificate in your Keychain.
5. In the top device target menu, select **Any iOS Device (arm64)**.
6. From the top menu bar, select **Product > Archive**.
7. Xcode will compile the code. Once finished, the Organizer window will appear.
8. Select your archive and click **Distribute App**.
9. Select **Enterprise** as the distribution method.
10. Proceed through the wizard, ensuring your In-House profile is selected.
11. Xcode will generate an `.ipa` (iOS App Store Package) file. Save this to your Mac.
## Step 5: Distribution via Mobile Device Management (MDM)
While you can technically distribute an enterprise app via a secure internal web page (using an `itms-services://` manifest file), the modern and secure standard is to deploy the `.ipa` file using a Mobile Device Management (MDM) solution like Jamf, Workspace ONE, or Microsoft Intune.
Distributing via MDM offers critical advantages:
– **Silent Installation:** The app can be pushed to managed employee devices in the background without user interaction.
– **Data Security:** The MDM can prevent corporate app data from being copied to personal apps (Managed Open In).
– **Remote Wipe:** If an employee leaves the company, the MDM can instantly remove the enterprise app and all its local data from the device.
To deploy:
1. Log in to your MDM dashboard.
2. Navigate to the App Catalog or App Management section.
3. Select the option to add an **Internal** or **In-House** enterprise app.
4. Upload the `.ipa` file generated by Xcode.
5. Assign the app to the appropriate user groups or device profiles and initiate the push command.
### The “Untrusted Enterprise Developer” Prompt
If an employee manually installs the app (or if the device is not fully supervised by an MDM), iOS will block the app from launching upon the first tap, displaying an “Untrusted Enterprise Developer” warning.
This is a security feature to prevent malicious sideloading. To resolve it, the employee must:
1. Open the **Settings** app.
2. Navigate to **General > VPN & Device Management**.
3. Under the **Enterprise App** section, tap the name of your organization.
4. Tap **Trust “Your Organization Name”**.
The application will now launch successfully, providing your workforce with the custom tools they need.