In this guide 6 sections
Publish it as a private app. On iPhone use Apple Business Manager custom apps, with TestFlight only for testing. On Android use a private app in managed Google Play. Push installs through an MDM tool, and tie access to the staff login so leavers lose it the same day.
Choose a channel for each platform
Apple gives you three realistic routes. A custom app in Apple Business Manager is the proper one for staff. TestFlight suits pilots, since builds expire and testers are capped. The enterprise developer programme is for large organisations with their own staff only, and Apple reviews its use.
Android is simpler. Publish a private app to managed Google Play, limited to your organisation’s account, and it appears only on enrolled phones. Both routes still need a signed build and a short review.
- iPhone: custom app in Apple Business Manager
- iPhone pilots: TestFlight invitations
- Android: private app in managed Google Play
- Both: an MDM tool to push the install
Enrol phones before the app arrives
An MDM tool such as Intune, Jamf or Workspace ONE decides who gets the app. Staff phones are enrolled once, either supervised company devices or a work profile on personal ones. The app is then assigned to a group, for example drivers or branch managers.
Decide early whether personal phones are allowed. Work profiles on Android and managed apps on iOS keep company data in a separate container. Staff keep their photos. You keep the ability to wipe only the app.
Why sideloading is the wrong shortcut
Mailing an APK or sharing a link looks free. It breaks quickly. Staff must switch off a protection setting on the phone to install it, nobody can see who has which build, and there is no clean way to remove it.
Sideloaded installs also skip the signing and scanning that stores perform. One forwarded file on a messaging group can put a modified copy on a phone that holds customer data.
- No record of who installed which version
- Phone security settings weakened for every user
- Forwarded files can be tampered with
- No remote removal when a phone is lost
Plan updates and the first-launch login
Store-based channels update through the same pipe as the first install. Set the MDM to push updates on Wi-Fi at night so a van crew is not downloading at a customer site. Keep each release backward compatible with the previous server version for a week.
Add a minimum version check inside the app. When a build is too old, the app shows an update screen and stops sending data. This fixes the stragglers that ignored a notification.
Revoke access the day someone leaves
Removing a person from the app group is not enough. Tokens already on the phone can keep working. Sign staff in through your directory with short-lived tokens, so disabling the account cuts the app off within minutes.
Write the leaver steps into the HR exit checklist: disable the directory account, remove the MDM assignment, wipe managed data and recover the device. Test it once with a dummy account before you need it.
Internal app rollout checklist
A checklist in four blocks: build and signing, store channel, device enrolment, and leaver handling. Rows hold the bundle identifier, certificate expiry, MDM group, minimum supported version, update window and the owner for each step, with a tick box and date beside them.
Open a blank worksheet to printQuestions owners ask
Can we use TestFlight as our permanent distribution method?
It is meant for testing. Builds expire and the tester count is limited, so staff would lose the app periodically. Use custom apps in Apple Business Manager for daily work.
Do staff need their own Apple ID or Google account?
With managed distribution, the install is assigned by the MDM. Staff may need a work identity, but not a personal store account paid for by themselves.
What happens if an employee uses a personal phone?
Use a work profile on Android or managed app settings on iPhone. The company can remove the app and its data without touching personal files.
How do we stop a former employee opening the app offline?
Keep any cached data small and encrypted, expire sessions after a short period and let the MDM wipe managed data when the device checks in.