A provisioning profile is Apple's permission slip for an app. It says who may sign the app, which app it is, which devices it can run on, until when, and which entitlements it may use. Apple signs every profile, and the iPhone checks it before running the app.
There are four kinds for iPhone apps.
The four types
| Development | Ad hoc | App Store | Enterprise (in-house) | |
|---|---|---|---|---|
| For | Running your app while you build it | Test builds for specific people | The App Store and TestFlight | Apps for your own employees |
| Devices | Registered devices listed in the profile | Registered devices listed in the profile | None directly | Any device |
| Certificate | Development | Distribution | Distribution | Enterprise distribution |
| Xcode export | Debugging (debugging) | Release Testing (release-testing) | App Store Connect (app-store-connect) | Enterprise (enterprise) |
| Account | Paid membership | Paid membership | Paid membership | Apple Developer Enterprise Program |
The export names in brackets are the method values for xcodebuild -exportArchive. Before Xcode 15.3 they were development, ad-hoc and app-store.
Development
For running builds on your own devices from Xcode, with the debugger attached. Its entitlements include get-task-allow, which lets a debugger attach. On iOS 16 and later, apps signed this way need Developer Mode turned on.
Ad hoc
For testers outside the App Store. It works like the release app, but only on the devices listed in the profile, up to 100 per device family each membership year. A new tester means registering their iPhone and regenerating the profile. How ad hoc works.
App Store
For uploading to App Store Connect, which is also how builds reach TestFlight. It lists no devices, so an App Store build can't be installed directly on a test iPhone.
Enterprise
For apps a company distributes only to its own employees, through the Apple Developer Enterprise Program. It isn't meant for customers or the public.
How to tell which one you have
Decode the profile, as shown in this guide, or drop it on our profile viewer. Then:
- `ProvisionsAllDevices` is present: enterprise.
- No device list at all: App Store.
- A device list and `get-task-allow` set to true: development.
- A device list and `get-task-allow` false: ad hoc.
The certificate name is a clue too: current development certificates are called "Apple Development" and distribution certificates "Apple Distribution".
How long they last
Every profile has an ExpirationDate, usually no more than a year away. When it passes, apps signed with it stop opening and you need a new profile and a new signature. Revoking a certificate also makes its profiles invalid.
Which one to use
- Debugging on your own iPhone: development.
- A build for a client or a few testers today: ad hoc. BuildFerry registers each tester's iPhone and re-signs the build for you.
- A big beta or a public release: App Store, through TestFlight and then the App Store.
- Internal company apps on an Enterprise account: enterprise.
Questions
What is the difference between a development and an ad hoc profile?
Both list specific registered devices. A development profile uses a development certificate and allows a debugger to attach. An ad hoc profile uses a distribution certificate and behaves like the release app, which is what testers should get.
Can I install an App Store build on my iPhone for testing?
Not directly. App Store profiles list no devices. Upload the build to App Store Connect and install it with TestFlight, or export an ad hoc build instead.
Can I use an enterprise profile to share an app with customers?
No. Apple's Enterprise Program is for proprietary apps distributed to your own employees. Use TestFlight or ad hoc distribution for testers outside your company.
How do I know which type a .mobileprovision file is?
Decode it. ProvisionsAllDevices means enterprise. No device list means App Store. A device list with get-task-allow true is development, and with it false is ad hoc.