What is a provisioning profile?
A provisioning profile is a small file from Apple that says which apps a developer may sign, and where they may run. iOS checks it every time a build is installed and every time it opens.
It holds the team, the App ID (bundle ID), the entitlements the app may use, the signing certificates, an expiry date and, for test builds, the list of devices allowed to run it. Apple signs it, so it can’t be edited by hand.
Every Ad Hoc, Development and Enterprise build carries one, named embedded.mobileprovision. On a Mac, profiles end in .mobileprovision, or .provisionprofile for Mac apps. The viewer reads both.
The four types
The viewer tells them apart from what's inside the file. Only the first three can install from a link.
| Type | How to tell | Devices | Used for |
|---|---|---|---|
| Development | get-task-allow is true | Listed UDIDs | Running and debugging from Xcode |
| Ad Hoc | A device list, get-task-allow false | Listed UDIDs (up to 100 per device type a year) | Test builds shared with testers |
| Enterprise (In-House) | ProvisionsAllDevices is true | Any device | A company's internal apps for its own staff |
| App Store / TestFlight | No device list | None directly | Uploading to App Store Connect |
Where to find a provisioning profile
- Xcode 16 and later:
~/Library/Developer/Xcode/UserData/Provisioning Profiles. Each file is named after the profile’s UUID. - Xcode 15 and earlier:
~/Library/MobileDevice/Provisioning Profiles. Newer Xcode still reads this folder too. - In Finder: press Shift-Command-G, paste the folder path and press Return. Drop any file from there onto the viewer.
- Apple Developer: open Certificates, Identifiers & Profiles, then Profiles, choose one and click Download.
- Inside an .ipa: an .ipa is a zip. The profile is at
Payload/YourApp.app/embedded.mobileprovision. Rename the .ipa to .zip and open it, or drop it into the IPA inspector. - In Terminal:
security cms -D -i profile.mobileprovisionprints the same property list this page reads.
"Unable to Install" usually means the iPhone isn't in the profile
An Ad Hoc or Development build only installs on the iPhones listed in its profile. On any other iPhone, iOS shows Unable to Install or "This app cannot be installed because its integrity could not be verified", even with a working link.
So when a tester can’t install, check two things here: is their UDID in the device list, and has the profile expired? Paste their UDID above to find out. They can get it with the free UDID finder.
If the iPhone is missing, register it in Apple Developer, regenerate the profile, download it and export the build again. More causes are in why an app is unable to install.
Skip profiles with BuildFerry
Collecting UDIDs, regenerating profiles and exporting again is the slowest part of ad hoc testing. With BuildFerry, testers open one link and their iPhone is registered with your Apple account once you approve it. The build is re-signed in the cloud with a profile that includes them. Nobody copies a UDID and nobody rebuilds.
Have a build that is already signed? Share the .ipa for free and get an install link and QR code in seconds.
Send your first buildQuestions
Is my provisioning profile uploaded?
No. The file is read by JavaScript in your browser tab and never leaves your computer: nothing is sent to BuildFerry or anyone else. Closing the tab clears it.
How do I check if a UDID is in a provisioning profile?
Drop the profile above and paste the UDID into "Is this iPhone in this profile?". Upper or lower case and the hyphen don’t matter. On a Mac you can also run security cms -D -i on the file and search its ProvisionedDevices list.
Why does my iPhone say "Unable to Install"?
Most often the iPhone’s UDID isn’t in the build’s provisioning profile, or the profile has expired. Both show here. The fix is to register the iPhone, regenerate the profile and export the build again, or let BuildFerry re-sign it for you.
How long is a provisioning profile valid?
Usually up to a year from when it was made; the viewer shows the exact date. After that, builds signed with it no longer install or open until they are signed with a new profile.
Can I add a device to an existing profile?
Not to the file itself: Apple signs it. Register the device in Apple Developer, edit the profile to include it, download the new one and sign the build again. Xcode's automatic signing does the middle steps for development builds.
What is the difference between .mobileprovision and .mobileconfig?
A .mobileprovision is a provisioning profile that lets a developer’s app run. A .mobileconfig is a configuration profile that sets up an iPhone, for example Wi-Fi, email or the UDID finder. This viewer reads provisioning profiles only.