Deploy apps to employees’ iPhones and iPads

The two halves of the journey

Getting an app onto a device takes two separate steps, and confusing them is the most common source of a stalled rollout. First you choose how the app gets into AppDeploy. Then it installs on the devices you enrol.

The two are largely independent. An app added from Apple Business (formerly Apple Business Manager) can be listed in your branded portal so people can find it, and iPhone and iPad apps install on enrolled company devices; the person may be asked to accept.

• Step one — bring the app in: Apple Business licences, an enterprise-signed IPA or, on Enterprise, a signed Android package.
• Step two — get it to the device: assign it, and it installs on an enrolled company iPhone or iPad.
• Enrolment is a one-time step for each device that receives apps.

Step one: three ways to add an app

Apple Business, Apps and Books. Connect your Apps and Books token and AppDeploy syncs the applications your organisation holds licences for. Suited to App Store apps you buy in volume, because Apple handles licence ownership and you can reclaim a licence when someone leaves. Installing them on enrolled devices is included on every plan with device management, Free included.

Enterprise-signed IPA upload. Upload an application signed with your own Apple Developer Enterprise certificate. Suited to software your organisation wrote and never publishes to the App Store. Available on every plan with device management: free for the first 5 devices, then the AppDeploy paid plan, and Enterprise. In-house apps install on enrolled company devices. AppDeploy reads the bundle identifier and version from the package rather than trusting what is typed into a form.

Signed Android package (Enterprise extra). On the Enterprise plan, upload a signed APK for delivery through the branded portal. AppDeploy does not manage Android devices; this is distribution only.

Step two: how the app reaches the device

The branded portal. The employee opens your organisation's portal, enters their work email if you require it, and finds the apps you list there.

Managed installation. An administrator assigns the app and it installs on enrolled devices; the person may be asked to accept. This requires the device to be enrolled first, within the workspace's device allowance (the first 5 devices are free). This is how private apps reach company iPhones and iPads.

• The portal lists your apps; managed installation puts them on enrolled devices.
• The devices AppDeploy manages count towards the free 5 and the per-device price, never portal users.

Real-world use cases

The simplest way to see how the pieces fit is to walk through the situations teams usually start from. Each of these is a complete setup, not a fragment - nothing else is required.

• A warehouse with 30 shared company iPads - enrol them once with the never-expiring QR code on a poster in the office, group them as 'Warehouse', assign the scanner app to the group. The app installs on each enrolled iPad, which may ask someone to accept it.
• A retailer buying 200 iPhones through Apple Business - zero-touch: devices are assigned to AppDeploy by serial number before they ship. Staff unbox, join Wi-Fi, and the device arrives enrolled, ready for its apps.
• Seasonal or contractor staff - one shared enrolment link that lives until you revoke it; email optional at enrolment. When the season ends, unassign the group and the apps are actively removed from managed devices.
• A school or agency with Apps and Books licences - sync Apple Business and licences appear with live counts, ready to assign to enrolled iPhones and iPads.

What it costs - and what you don't have to buy

The pricing follows from one design decision: distribution and device management are separate concerns, so you should only pay per device for the layer that actually touches devices.

Every figure below comes from AppDeploy's published price list, and AppDeploy prices exclude VAT. Up to 5 managed devices are free. Beyond 5, each device costs £10 a year (or £1 a month). The branded portal, your own app store with release controls, is Distribution at £219 a year (or £29 a month), flat, with or without managed devices. Enterprise is priced by agreement.

• Branded portal only, with no managed devices: £219 a year on Distribution, flat, with no per-device charge.
• Portal and device management on all 100 devices: 95 x £10 = £950 a year for the devices, because the first 5 are free, plus £219 a year for the portal on Distribution: £1,169 a year.
• The mix is per device: manage the 20 company-owned devices that need your apps - 15 x £10 = £150 a year, because the first 5 devices are free - and give all 100 people the portal on Distribution for £219 a year: £369 a year in total.

Enrolment: needed to install apps on a device

Enrolment is how a device becomes manageable. There are three routes, and the right one depends on who owns the device and how it was bought.

Personal invitation. An administrator issues a single-use link or QR code for one named employee. The employee opens it on their device, installs the profile, and the link is spent. Best for individuals and for replacing a lost device.

Shared enrolment link. One reusable link or QR code that any number of devices can use until it expires or is cancelled. Each device still receives its own enrolment record. Best for onboarding a group in a single session, such as handing out devices at an induction.

Zero-touch during setup. An organisation-owned device bought through Apple Business enrols itself while the employee is still in the setup screens, before anyone has touched the home screen. The device becomes supervised, which unlocks management actions the other routes cannot offer.

Choosing a path

If the device belongs to the employee, it needs enrolling before AppDeploy can install apps on it, so talk to us before enrolling a personal phone.

If the device belongs to the organisation and was bought through Apple Business, use zero-touch enrolment and assign its apps. It is the least work for everyone and produces the cleanest audit trail.

If the device belongs to the organisation but was bought through ordinary retail, Apple Business does not know about it yet. Add it with Apple Configurator (this erases the device), then enrol it zero-touch. A shared enrolment link works without erasing.

If you are evaluating AppDeploy, set up your branded portal first. Nothing needs to be connected to list your apps.

• Start with the portal: list your apps and share the address.
• Add AutoDeploy for the company devices that receive your apps; the person may be asked to accept each install.
• Add zero-touch (ADE) when devices are bought through Apple Business and you want them managed from the box.
• You can change your mind later: the same app can be assigned to more enrolled devices without re-uploading anything.

What has to be in place

The branded portal, your own branded app store, works from the first day of the 14-day trial, and afterwards with Distribution or Enterprise; Free and the AppDeploy device plan on their own do not include it. Nothing else needs connecting first, which is why it is the recommended starting point.

Apps and Books syncing requires an Apple Business account and its Apps and Books token.

Enterprise IPA upload requires device management (free for the first 5 devices, then the AppDeploy paid plan) or Enterprise, membership of the Apple Developer Enterprise Program and an application signed with that certificate.

Installing apps on devices requires an Apple push certificate for your organisation, an AutoDeploy device allowance and at least one enrolled device.

Zero-touch enrolment additionally requires that the devices were purchased through Apple Business or an authorised reseller linked to your account. Devices bought at retail cannot use it.