Corporate Mobile App Distribution via Enterprise Store
Imagine: a company has released an internal mobile app for 500 employees. Development is done, but how do you deliver it to all iOS and Android devices without publishing to the App Store and Google Play? Internal apps often contain sensitive data or violate monetization policies — public stores are out of the question. The solution is a corporate Enterprise Store, which we set up turnkey. Over 5 years, we have deployed more than 20 such stores for companies ranging from 100 to 10,000 employees, saving clients an average of 70% in support costs compared to manual distribution.
MDM-based vs. Hosted Enterprise Store
| Parameter | MDM-based | Hosted Enterprise Store |
|---|---|---|
| Device management | Requires MDM server (Jamf, Intune) | Not required, but desirable |
| Installation | Forced or on-demand via Self Service | User downloads manually |
| iOS | Requires configuration profile or ABM | Requires trust of Enterprise certificate |
| Android | Managed Google Play via EMM | Sideload APK (or Managed Play) |
| Updates | Automatic via MDM | Manual or via custom updater |
| Security | Full control over devices | Depends on BYOD policies |
| Deployment time | 5–10 days | 3–7 days |
MDM-based is chosen by companies with strict security requirements: for example, if remote wipe of lost devices is needed. Hosted Store is easier for BYOD but requires trust in the corporate certificate.
How to Bypass iOS Restrictions for Internal Distribution?
On iOS, installing IPA outside the App Store is possible through the Apple Developer Enterprise Program. A signed manifest manifest.plist is hosted on an HTTPS server, with a link like itms-services://?action=download-manifest&url=.... The user manually trusts the certificate in Settings — that's the bottleneck. It can be solved via MDM: the profile is installed automatically. Alternatives are TestFlight (up to 10,000 testers, 90-day lifetime) or Custom App through Apple Business Manager, but the latter requires MDM integration. TestFlight is convenient for pilot launches but not suitable for long-term distribution — builds expire after 90 days.
Comparison of iOS Distribution Methods
| Method | Audience | Requirements | Apple Review |
|---|---|---|---|
| Enterprise Program | Employees | Certificate, HTTPS server | No |
| TestFlight | Up to 10,000 | Apple ID, TestFlight app | Yes (beta) |
| Custom App (ABM) | Organization devices | MDM, ABM | No |
But remember: the Enterprise Program is the only option without Apple review, but requires certificate trust. TestFlight is for pilots, Custom App for fully managed devices.
Why Avoid Sideload on Android for Production?
Managed Google Play is the best choice for corporate Android devices. The app is published to a private track accessible only to devices connected via EMM. It does not require enabling installation from unknown sources. Sideload via APK is simpler but loses automatic updates and security: according to our data, the risk of malware infection increases 3 times compared to Managed Play. Also, support costs drop by 70% compared to manual APK updates.
How We Set Up an Enterprise Store: Step-by-Step Process
- Audit current infrastructure — assess MDM, devices, policies, platform mix.
- Choose model — MDM-based or hosted, iOS, Android, or cross-platform. We often recommend MDM-based for iOS and Managed Play for Android.
- Set up HTTPS server — host IPA/APK, generate
manifest.plist, ensure SSL certificate. - Integrate with MDM — if MDM-based: configuration profiles, installation and update policies.
- Configure auto-updates — for Android via Managed Play, for iOS via MDM or custom CDN with version checking.
- Testing and documentation — pilot on 10–20 devices, employee instructions, access revocation plan for terminations.
Example manifest.plist for iOS
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>items</key> <array> <dict> <key>assets</key> <array> <dict> <key>kind</key> <string>software-package</string> <key>url</key> <string>https://your-enterprise-store.example.com/app.ipa</string> </dict> </array> <key>metadata</key> <dict> <key>bundle-identifier</key> <string>com.example.app</string> <key>bundle-version</key> <string>1.0</string> <key>kind</key> <string>software</string> <key>title</key> <string>Your App</string> </dict> </dict> </array> </dict> </plist> Typical Implementation Mistakes
- Using an Enterprise certificate for apps intended for external users — Apple revokes the certificate and blocks all distribution.
- Lack of HTTPS on the server — iOS refuses to download IPA without encryption.
- Not configuring access revocation — a terminated employee retains the app with access to corporate data.
What's Included in Setup and Timeline
We deliver a turnkey Enterprise Store: from design to deployment. Timeline — from 3 to 10 working days depending on the number of platforms and MDM complexity. We assess your project in 1 day — simply contact us and get a consultation. We guarantee stable operation and help with integration into your existing IT infrastructure. Get a consultation on your project — assessment in 1 day.