Choose your distribution option
For a managed fleet, the recommended path is Intune: Apple Business Manager Custom App on iOS and Managed Google Play private app on Android. Ad Hoc and direct download remain possible but are limited to small, registered device sets.
Â
| Option | Platform | Audience | App review | Automatic updates | Device limit | Best for |
|---|---|---|---|---|---|---|
| Public store | iOS, Android | Anyone | Yes (Apple, Google) | Yes | None | Unmanaged / BYOD devices |
| Apple Unlisted App Distribution | iOS | Anyone with the link | Yes (Apple) | Yes | None | Unmanaged devices, no MDM |
| ABM Custom App + Intune | iOS | Your organization only | Yes (Apple) | Yes, via Intune | None | Managed iOS fleet (recommended) |
| Google Play private / Managed Google Play | Android | Your organization only | Light (Google) | Yes | None | Managed Android fleet (recommended) |
| Intune LOB auto-deploy | iOS, Android | Intune-enrolled devices | No | Yes, when Powell pushes a new package | iOS: Ad Hoc limit applies | Fast rollout without store review |
| Ad Hoc | iOS | Registered devices | No | No | 100 per device type per year | Pilots, testing, very small fleets |
| Direct download link | iOS (Ad Hoc), Android | Anyone with the link | No | No | iOS: Ad Hoc limit applies | Last resort |
Public store (App Store, Google Play)
Publishing publicly makes the app searchable by anyone. It suits organizations whose users install the app on personal devices without MDM.
- App Store: Apple often rejects apps that only work for one company's employees (guideline 4.2 / 3.2). If the app is not meant for the general public, prefer Unlisted App Distribution or an ABM Custom App instead. See Tips to deploy on Apple Store.
- Google Play: review is lighter and the risk of rejection is low. You can also restrict the listing to your organization (see Google Play private / Managed Google Play).
- Updates are delivered automatically by the store.
Apple Unlisted App Distribution
Unlisted apps are published on the App Store but hidden from search and charts: users install them only through a direct App Store link. This is the best iOS option when devices are not managed by an MDM.
- Publish the app in App Store Connect as for a public release (full App Review applies).
- Submit Apple's unlisted distribution request form for the app.
- Once Apple approves, share the unlisted App Store link with your users (email, intranet, QR code).
No device registration and no device limit. Updates arrive through the App Store like any public app. Anyone who has the link can install the app, so authentication inside the app remains your access control.
Apple Business Manager Custom App with Intune (recommended for iOS)
A Custom App is visible only to the organizations you choose in App Store Connect. It is assigned through Apple Business Manager (ABM) and pushed silently by Intune, with no device limit.
- In App Store Connect, set the app's distribution to Private and enter your organization's ABM Organization ID. The app goes through App Review.
- In ABM, open Apps and Books, find the Custom App and assign licenses to your Intune location token.
- In the Intune admin center, go to Tenant administration > Connectors and tokens > Apple VPP tokens and sync the token. The app appears under Apps > iOS/iPadOS as a store app.
- Assign it to a group as Required (silent install on supervised devices) or Available (installed from Company Portal).
New versions published in App Store Connect are updated through ABM and Intune automatically. Prerequisites: an ABM account for your organization and an Apple VPP (location) token connected to Intune.
Google Play private / Managed Google Play (recommended for Android)
A private app is published on Google Play but visible only to your organization's Managed Google Play. It works on every Android Enterprise enrollment type, including personally owned work profiles.
- Bind Managed Google Play to Intune: Tenant administration > Connectors and tokens > Managed Google Play.
- Publish the app as private, either from the Google Play Console (Advanced settings > Managed Google Play, add your organization ID) or directly from Intune (Apps > Android > Add > Managed Google Play app > Private apps, upload the .apk).
- Sync the app in Intune, then assign it as Required or Available.
Updates published to the private listing reach devices automatically through Google Play.
Intune LOB auto-deploy
Powell Manager can upload each new build straight to Intune as a line-of-business (LOB) app, with no store review. It uses one Entra ID app registration for both iOS and Android.
- Create an Entra ID app registration with the DeviceManagementApps.ReadWrite.All application permission and admin consent (see Create the Entra ID app registration for Intune deployment).
- In Powell Manager, enter the Client ID and Client Secret in Automatic Deployment > Intune, and the Tenant ID in Environments Configuration.
- Trigger a deployment. The package is created or updated under Apps in Intune.
- In Intune, assign the app to a group as Required or Available.
| Platform | Package | Supported devices | Limits |
|---|---|---|---|
| iOS/iPadOS | .ipa signed with an Ad Hoc profile | Intune-enrolled iPhone and iPad | Only devices whose UDID is in the profile can install; see Ad Hoc limits |
| Android | .apk | Android Enterprise fully managed and dedicated devices | Not supported on work profile (BYOD or COPE): use Managed Google Play |
Intune LOB apps do not update themselves from a store: each new version reaches devices when Powell Manager uploads it to Intune.
Ad Hoc limits
An Ad Hoc build installs only on devices registered in its provisioning profile, capped at 100 devices per device type per membership year. Use it for pilots and small fleets, not for a company-wide rollout.
| Constraint | What it means for you |
|---|---|
| 100 devices per device type (iPhone, iPad, ...) per membership year | Removing a device does not free its slot until the membership year renews; the list can then be reset. |
| UDID registration | Each device's UDID must be sent to Powell and added to the profile before the build is generated. An unregistered device cannot install the app, even through Intune. |
| New device = new build | Every added UDID requires regenerating the profile and the package, then redeploying it. |
| Profile expiry (12 months) | The provisioning profile and distribution certificate expire after one year. When they do, the app stops launching on every device until a re-signed build is installed. Plan the renewal before the expiry date. |
If you need more devices, or users without registered devices, move to an ABM Custom App (iOS) or Unlisted App Distribution.
Direct download link (last resort)
You host the package on an HTTPS site you control and share the link. Updates are never automatic: you must notify users and have them reinstall each version.
- iOS: requires an Ad Hoc build, so every Ad Hoc limit applies. Host the .ipa and a manifest.plist, and link to the manifest with the itms-services://?action=download-manifest&url=https://…/manifest.plist prefix, never to the .ipa itself. Serve .ipa as application/octet-stream and .plist as text/xml.
- Android: host the release .apk. Users must allow Install unknown apps for the browser or file app they download it with.
You are responsible for the authenticity of the package Powell Software generated for you.
Support scope
Powell Software supports the automatic deployment to Intune and Store public. Configuring your ABM, Managed Google Play, MDM or download site is your responsibility. We welcome feedback on deployments with MDM solutions other than Intune.
Sources
- Add an Android line-of-business app to Microsoft Intune
- App configuration policies for managed Android Enterprise devices
- Filters: supported platforms and app types in Intune
- Open question: Apple limits (Ad Hoc device cap, profile validity, Unlisted request steps) are stated from Apple's developer documentation without a fresh check; confirm on developer.apple.com before publishing.