How Apps Reach a Device: Every AppDeploy Delivery Path | AppDeploy for Apple Business

The two halves of the journey

Getting an app onto a device is two separate decisions, and confusing them is the most common source of a stalled rollout. First you choose how the app gets into AppDeploy. Then you choose how it reaches the device.

The two are largely independent. An app added from Apple Business Manager can reach a device through the branded portal or through silent deployment. An enterprise-signed app you built yourself can do the same. Pick each half on its own merits.

• Step one — bring the app in: Apple Business Manager licences, an enterprise-signed IPA, redemption codes, or an Android package.
• Step two — get it to the device: self-service from the branded portal, or silent deployment to an enrolled device.
• Enrolment is a separate one-time step that only silent deployment requires.

Step one: four ways to add an app

Apple Business Manager, Apps and Books. Connect your Apps and Books token and AppDeploy syncs the applications your organisation holds licences for. Best for App Store apps you buy in volume, because Apple handles licence ownership and you can reclaim a licence when someone leaves.

Enterprise-signed IPA upload. Upload an application signed with your own Apple Developer Enterprise certificate. Best for software your organisation wrote and never publishes to the App Store. AppDeploy reads the bundle identifier and version from the package rather than trusting what is typed into a form.

Redemption-code spreadsheet. Upload the code spreadsheet Apple Business Manager exports. Each employee consumes one code. Useful where licences were bought as codes rather than managed distribution, though managed distribution is easier to administer.

Signed Android package. Upload a signed APK for Android delivery through the branded portal. Android device management is deliberately out of scope; this is distribution only.

Step two: how the app reaches the device

Self-service from the branded portal. The employee opens your organisation's portal, sees the applications they are entitled to, and taps install. iOS asks them to confirm. Nothing needs to be enrolled and no device management is involved, which makes this the fastest way to start and the right choice for personally-owned devices.

Silent deployment. An administrator assigns the app and it installs on an enrolled device with no prompt and no user action. This requires the device to be enrolled first and requires the AutoDeploy allowance. It is the right choice for organisation-owned fleets where you do not want to depend on someone tapping a button.

• Self-service: no enrolment, works on any device, employee confirms the install.
• Self-service has no device limit and no per-device charge - one Business plan covers 10 employees or 10,000.
• Silent: enrolment required, organisation-owned devices, no employee action at all.
• Silent deployment (AutoDeploy) is an optional add-on, never a requirement - its 5-device allowance applies only to silently managed devices, not to portal distribution.
• Both can serve the same app to different groups at the same time.

Real-world use cases

The simplest way to see how the pieces fit is to walk through the situations customers actually arrive with. Each of these is a complete setup, not a fragment - nothing else is required.

• A 40-person sales team with personal iPhones - upload your enterprise IPA or connect Apple Business Manager, share the branded portal address, done. No enrolment, no device management, no per-device fees: the whole team is covered by one Business plan. Employees install and update from a page carrying your logo.
• A warehouse with 30 shared company iPads - enrol them once with the never-expiring QR code on a poster in the office, group them as 'Warehouse', assign the scanner app to the group. Every iPad converges automatically, and a version bump re-converges them.
• A retailer buying 200 iPhones through Apple Business Manager - zero-touch: devices are assigned to AppDeploy by serial number before they ship. Staff unbox, join Wi-Fi, and the device arrives supervised with its apps installing silently. Nobody in IT touches a phone.
• Seasonal or contractor staff - one shared enrolment link that lives until you revoke it; email optional at enrolment. When the season ends, unassign the group and the apps are actively removed from managed devices.
• A school or agency with Apps & Books licences - sync Apple Business Manager, licences appear with live counts, and the portal hands out redemption codes with a full audit trail of who installed what, when, and where.

What it costs - and what you don't have to buy

The pricing follows from one design decision that most of this market gets backwards: distribution and device management are separate concerns, so you should only pay per device for the layer that actually touches devices.

Every figure below is the live price list: Business at £599 per year flat, AutoDeploy as an optional add-on with the first 5 devices included and £17.85 per device per year on annual pre-pay (26-100 devices). The comparison uses Jamf for Mobile's published $5.75 per device per month at £1 = $1.28.

• Portal-only, 100 employees: £599 total. Per-device MDM pricing for the same headcount is about £5,400 - roughly 9 times the cost, if self-service distribution is all you require.
• Portal + silent push on all 100 devices: £599 + 95 x £17.85 = about £2,295 - still roughly 57% less than per-device MDM, and you chose the management layer instead of having it bundled.
• The mix is per-device, not per-plan: run the portal for everyone and AutoDeploy only for the 20 company-owned devices where silence matters - £599 + 15 x £20.40 (the 6-25 device rate) = about £905 a year for a 100-person organisation.
• The honest caveat: per-device MDM suites do more than distribute apps. The point is not that they are overpriced - it is that you should not be forced to buy device management for every device that only needs an app.

Enrolment: only needed for silent deployment

Enrolment is how a device becomes manageable. There are three routes, and the right one depends on who owns the device and how it was bought.

Personal invitation. An administrator issues a single-use link or QR code for one named employee. The employee opens it on their device, installs the profile, and the link is spent. Best for individuals and for replacing a lost device.

Shared enrolment link. One reusable link or QR code that any number of devices can use until it expires or is cancelled. Each device still receives its own enrolment record. Best for onboarding a group in a single session, such as handing out devices at an induction.

Zero-touch during setup. An organisation-owned device bought through Apple Business Manager enrols itself while the employee is still in the setup screens, before anyone has touched the home screen. The device becomes supervised, which unlocks management actions the other routes cannot offer.

Choosing a path

If the device belongs to the employee, use the branded portal. Enrolment adds friction and gives you management powers over a personal device that you probably do not want.

If the device belongs to the organisation and was bought through Apple Business Manager, use zero-touch enrolment and silent deployment. It is the least work for everyone and produces the cleanest audit trail.

If the device belongs to the organisation but was bought through ordinary retail, use a shared enrolment link and silent deployment. Zero-touch is not available for devices Apple Business Manager does not know about.

If you are evaluating AppDeploy and want to see something working in the next ten minutes, use the branded portal. Nothing needs to be connected first.

• Start with the portal. It is the shortest path to value, needs nothing installed on devices, and costs nothing per device.
• Add AutoDeploy only for the devices where silent, hands-off installation genuinely matters - usually company-owned hardware.
• Add zero-touch (ADE) when devices are bought through Apple Business Manager and you want them managed from the box.
• You can change your mind later: the same app can move from portal delivery to silent deployment without re-uploading anything.

What has to be in place

The branded portal works as soon as your workspace exists. Nothing else is required, which is why it is the recommended starting point.

Apps and Books syncing requires an Apple Business Manager account and its Apps and Books token.

Enterprise IPA upload requires membership of the Apple Developer Enterprise Program and an application signed with that certificate.

Silent deployment requires an Apple push certificate for your organisation, at least one enrolled device, and an AutoDeploy device allowance.

Zero-touch enrolment additionally requires that the devices were purchased through Apple Business Manager or an authorised reseller linked to your account. Devices bought at retail cannot use it.