1

We've got Intune set up at work, and I'm trying to push a custom iOS app out to several iPod Touches we have. Intune is set up and working properly, but the app refuses to install because it's integrity cannot be verified. I believe this is because my app is not signed properly (?), but no matter what I do, I can't seem to get it to work.

Here's my set up, and what I've tried:

  • We've got Intune set up, and I've made an MDM profile called "iPod Enrolment Profile". When that profile is installed on an iPod, the iPod is added to a dynamic group called "iPod Touches", and that deploys the app.
  • I've got a (personal) Apple developer account. I've created a provisioning profile for App Store distribution (though I also tried Ad-Hoc distribution as well)
    • I've added that provisioning profile to Intune as well, though I think that's only for renewing the app, and not needed for the initial install?
  • In Xcode, I've set up automatic signing. If I have the iPod plugged in, Xcode tells me that the device isn't registered into my developer account. I'd rather not register it, because I want any future iPods or iPads or iPhones we buy to be enrollable without needing an Apple developer account. If I switch off automatic signing and make Xcode use the provisioning profile I created, "Signing (Debug)" uses my distribution signing certificate, but Signing (Release)" complains that it doesn't include my Apple Development signing certificate

And here's how I'm enrolling the iPods

  • I have Apple Configurator 2 installed
  • I created a profile that sets up wifi and certificates
  • I created a blueprint that does the following:
    • Prepares the iPod. Does NOT enrol to an MDM, does NOT add to Apple School Manager (we have an account for this, if that's relevant) or Apple Business Manager, is supervised, allows pairing with other computers
    • Installs the wifi profile I created in AC2
    • Installs the MDM profile I created in Intune.
  • I restore the iPod, then apply the blueprint.
  • AC2 complains that the steps can't complete because the iPod is not supervised, but when I check, the two profiles are installed.
  • I wait a few minutes, and the app starts to download, but then fails with the integrity verification error.

So I've got a few ideas of what is going on:

  • I'm building or signing my app incorrectly. or..
  • I need an Apple Enterprise Developer account in order to push this app in-house, because signing the app without an AED is meant either for specific devices (ad-hoc provisioning profile), development machines (development provisioning profile) or for distribution on the App store (app store provisioning profile) or..
  • I need to add the devices to Apple School Manager so they can be verified (?)

Am I getting close?

The tl;dr is: What do I need to do in order to build my app so that I can deploy it to an arbitrary number of supervised, MDM controlled iOS / iPadOS devices?

Improve this question

2 Answers 2

Reset to default
2

You cannot deploy to devices in this manner. You will want to enroll in the Apple Developer Enterprise program. This will allow you to sign your app for internal distribution and deploy it via MDM. Follow Apple's recommendations here.

In theory, you could also add each and every device to your provisioning profile for your own personal developer account for preliminary testing. It's not the right way to do it, there's limitations on the number of devices, and it's really not practical at scale.

Improve this answer
1
  • That confirms my suspicions. I'll email my boss and get the ball rolling on an enterprise account. Thank you!
    – Grayda
    Commented Jun 29, 2022 at 1:23
2

A few months on from this, I've got a few potential answers.

The first, as is mentioned in the answer by jksoegaard, is to get an Apple Developer Enterprise account. When you fill out the form in the Getting Started section of their website, they'll call you and quiz you about why you need the enterprise program. They are really quite hesitant to sign people up for that when there's alternatives. This method lets you install it however you want, whether that's by emailing it to someone, or pushing it out via InTune, or hosting it on your company's intranet for people to just tap on and install.

The second, is that if you're deploying to under 100 devices (which we are, at least initially), you can just add the devices you want to your developer account, then build the app using that provisioning profile. There's info on how to bulk add devices on the Apple site. All you need is an Apple Developer account. This means you'll probably need to physically handle the devices first, but it limits which devices can have the app and bypasses the Apple Store.

The third, which wasn't made known to me until I had a second half hour phone call with Apple asking me why I wanted the enterprise account, is that if you have Apple Business Manager or Apple School Manager and a developer account, you can publish apps privately. They've got info on their website. This is great because it works with InTune as long as the app is free.

And side note, if you're an educational institute (e.g. a school or university), you may be eligible for a free developer account, but have a chat to Apple first, as I don't know if that applies to everyone or everywhere.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .