Enterprise iOS App Distribution for Companies — A Practical Playbook
If you're at a company that needs to put an iOS app onto employee phones — internal tools, custom workflows, beta builds of customer-facing apps — you have three real options. They're not equivalent, and the right choice depends on your company size, IT maturity, and the app's nature.
Option 1: Apple Business Manager + MDM (formal enterprise route)
Apple Business Manager is Apple's enrollment platform for companies. Combined with an MDM (Mobile Device Management) solution like Jamf, Microsoft Intune, or Kandji, it gives you full device control: push apps silently, enforce policies, remote wipe, automated enrollment.
Distribution mechanisms within ABM:
- Custom Apps — apps you've submitted to the App Store with restricted visibility to your organization only
- Unlisted apps — App Store apps accessible only via direct link
- Enterprise apps via MDM — your Enterprise-signed IPAs pushed silently via MDM
Cost: ABM is free; MDM is $4-$15/device/month depending on vendor.
Best for: companies with 100+ employees, dedicated IT, formal device fleet management.
Option 2: Enterprise certificate, OTA install (mid-size)
Get an Enterprise certificate from a signing service, sign your IPA, host the install link. Employees tap, install, trust developer, run. No MDM required.
- Pros: No MDM overhead, fast deployment, works on personal devices (BYOD)
- Cons: No central management, revoke risk if Apple flags the cert, employees can install on personal devices freely
Best for: teams under 50 people, BYOD environments, situations where MDM is overkill.
Option 3: Ad-Hoc distribution (small teams)
For under 100 devices that you can control individually, Ad-Hoc distribution avoids the Enterprise route entirely. Collect UDIDs from each employee, register them, sign IPAs, distribute.
- Pros: Lowest revoke risk (Ad-Hoc certs rarely revoked), no Enterprise Program needed
- Cons: 100-device cap, manual UDID collection, must re-add for any new device
See: Developer vs Enterprise for the full tradeoff analysis.
Decision matrix
| Company size | Recommended approach |
|---|---|
| 1-20 employees | Ad-Hoc distribution (cheapest, simplest) |
| 20-100 employees | Enterprise signing via OTA install |
| 100+ employees | Apple Business Manager + MDM + Enterprise signing |
The Enterprise certificate ownership question
If you go the Enterprise route, you have a choice: get your own Enterprise certificate, or use a signing service's certificate.
Your own:
- $299/year + D-U-N-S registration + 100-employee minimum + Apple manual approval
- 3-6 months application timeline (often rejected in 2026)
- You're fully responsible for revoke risk — if Apple kills your cert, you're stuck
Signing service's:
- $259 per sign
- Fresh cert with rotation
- If revoked, free re-sign
- You don't bear the program management overhead
For most mid-size companies, the signing service model wins on math alone.
BYOD vs corporate devices
Important distinction:
- Corporate devices: any path works. MDM is recommended for serious control.
- BYOD: MDM can be invasive (full device wipe capability). Many employees push back. Enterprise OTA install is the lighter-touch choice.
Compliance considerations
If your app handles regulated data (healthcare, finance), check whether your Enterprise distribution method satisfies HIPAA/SOC2/etc. Generally, MDM-managed distribution is easier to audit than free-form Enterprise signing. The signing service should be willing to sign a DPA (Data Processing Agreement).
If you're piloting
Start with Enterprise OTA install on 10-20 employees. If the app is mission-critical and the company grows past 50 users, layer in MDM. Don't start with MDM — it's expensive and time-consuming to roll out and often premature.