iOS Provisioning Profile Explained — What's Inside and Why It Expires
Inside every signed IPA there's a file called embedded.mobileprovision — the provisioning profile. It's the most common point of failure in iOS signing and the most misunderstood. Here's exactly what it does.
What a provisioning profile is
A provisioning profile is a digitally-signed XML (plist) file issued by Apple. It pairs together:
- One or more certificates (who can sign apps with this profile)
- An App ID (which bundle identifier it covers)
- A list of device UDIDs (which devices can install — only for Development and Ad-Hoc profiles)
- The app's entitlements (push, iCloud, background modes, etc.)
- An expiry date
iOS reads this file when installing an app and uses it to decide: is this certificate trusted, is this app ID allowed, is this device permitted, and have any entitlements been granted that the app needs?
The four profile types
| Type | Devices | Expires | Use case |
|---|---|---|---|
| Development | Specific UDIDs | 1 year (cert: 7 days for free) | Personal testing |
| Ad-Hoc | Specific UDIDs (max 100) | 1 year | Beta testing |
| App Store | Any (via Store) | 1 year | App Store releases |
| Enterprise | Unlimited (any device) | 1 year (revocable) | In-house distribution |
Why profiles expire
Apple expires provisioning profiles deliberately to force periodic re-verification. A long-lived profile would be too risky if a certificate were leaked. So:
- Development profile: usually expires when the underlying cert does. With free Apple ID, that's every 7 days.
- Ad-Hoc / App Store / Enterprise: typically 1 year from issue, but can be cut short if Apple revokes the cert.
When a profile expires, every app signed with it stops launching. The fix is to re-sign with a fresh profile.
Reading a provisioning profile
You can inspect any .mobileprovision file from Terminal on macOS:
security cms -D -i embedded.mobileprovisionIt dumps the XML so you can see the certs, devices, app ID, entitlements, and expiry. Useful when debugging "this app won't install" issues.
Common provisioning errors
- "Provisioning profile doesn't include device" — your UDID isn't in the profile. Re-sign with the UDID added.
- "No matching provisioning profile found" — the bundle ID in the app doesn't match any profile.
- "Profile expired" — exactly what it sounds like. Re-sign.
More fixes in our guide: why your IPA isn't installing.
Enterprise is different
An Enterprise provisioning profile has no device list — it permits any iOS device. That's its whole value. It also has no app ID restriction (uses wildcard *), so a single Enterprise profile can sign any app you point it at.