Put it through Apple Business Manager, not the public App Store
The clean answer is to distribute the app as a private app through Apple Business Manager and assign it only to managed iPads in your MDM. That keeps it off the public App Store, stops staff from installing it on personal devices, and lets you revoke it when a device leaves the fleet.
That is what the industrial business in this story needed for its safety app on company iPads. The goal was simple, but the controls had to be real.
What the team was trying to avoid
They did not want a public listing. A public App Store app can be found, shared, and installed outside the company’s control, which is the wrong shape for an internal safety app on staff iPads.
They also did not want a login wall to be the only barrier. If the app is sitting on a personal iPad, a login screen is not distribution control. It is just a screen.
The useful distinction is this: private distribution controls who can get the app, while app login controls who can use the data once it is open. You usually need both.
What made it stay company-only
The app was shipped as a private app that only that company could get, and it appeared on the managed iPads’ home screens automatically. That only works if the iPads are enrolled properly and managed through an MDM, such as Jamf, Microsoft Intune or Kandji, with Apple Business Manager connected.
For company-owned iPads, that is straightforward. The device enrolment ties the hardware to your management stack, so the app can be assigned silently and removed centrally.
For BYOD iPads, the answer is different. You can still keep the app private, but you should not expect the same level of control. Personal devices can be managed more lightly, and if the business does not own the iPad, you cannot treat it like part of the fleet. If the app must never leave company control, keep it on supervised, company-owned devices only.
The setup that matters before you publish
- Apple Business Manager set up for the business
- An MDM with the iPads enrolled and assigned
- The app configured as a private app, not public
- Managed Apple IDs or a company login path if the app needs identity
- A plan for revocation when a device is lost or an employee leaves
That last point matters more than people think. If you cannot remove the app quickly, the distribution model is too loose for a safety workflow.
Key takeaway: private distribution is only private if the device fleet is managed, the app is assigned centrally, and access can be revoked without waiting for the user to cooperate.
What happens when someone leaves
If the app is assigned through MDM, you can remove it from the device or unassign it from the user as soon as the offboarding process starts. If the iPad is supervised, you can also wipe or lock it remotely, which is the right move for a lost device.
That is the practical difference between “installed somewhere” and “managed on company hardware”. For a fleet iPad, you want the second one. It gives you a clean off-ramp when the device changes hands.
If the app uses internal data, pair that with proper auth, not shared credentials. Use your identity provider, SSO where appropriate, and role-based access so the app can tell who is allowed to see what. If you need the app to talk to internal systems, put the API behind real authentication and device-aware access rules, not a hidden URL.
For the data side of the workflow, What Data to Edit Offline vs Lock Until Reconnect is worth reading if the app has to keep working when the iPad drops off the network.
What private distribution can break
Private app distribution is not a free pass. Some capabilities still depend on how the app is built and signed, not just how it is delivered.
A few things to check early:
- Does the app rely on public App Store discovery or ratings? Private apps do not.
- Does the app need any Apple review exceptions or a demo mode for App Review? If the app sits behind staff login, reviewers still need a way in.
- Does the app use push notifications, sign-in, or device management APIs that need careful entitlement setup? Test those against your MDM and identity stack before rollout.
If the app includes job photos, signatures or notes on iPads, the workflow needs to be designed around the device itself, not bolted on later. How to Handle iPad Job Photos, Signatures & Notes covers the bits that usually get missed.
What this means for your rollout in Australia
If you are rolling this out across Australia, the rule is the same whether the team is in Perth, Brisbane or the Sydney CBD: the app must live on managed hardware, not just behind a login screen. The private app model is what keeps a company-only app for iPads out of personal use and out of the public App Store.
If the app is becoming core to operations, treat the distribution model as part of the software design, not an admin afterthought. That is where Custom App Builds and Embedded IT Leadership earn their keep, because the app, the device policy and the identity setup need to be planned together.
Common questions
How do I stop staff from installing the app on their personal iPads or forwarding it to someone outside the company?
Do not publish it publicly. Put it in Apple Business Manager as a private app and assign it only to managed devices in your MDM. That gives you control over who can receive it and lets you remove it later.
Can the app still be kept private if we have a mix of company-owned and BYOD iPads?
Yes, but only the company-owned, managed devices should get the app if you need hard control. BYOD devices can be harder to govern, so keep the private app on supervised fleet iPads if access must stay tightly contained.
What happens when an employee leaves or a device gets lost?
If the app is managed properly, you can unassign it, remove it from the device, or wipe the iPad remotely. That is why the MDM and supervised enrolment matter, they give you a fast offboard path.
If we need the app to use company logins or internal data, what security setup is actually necessary?
Use real identity, not shared logins. Connect the app to your identity provider, add role-based access, and protect any internal APIs with proper authentication and device controls.
Make the distribution model part of the build
If you already know the app has to stay off personal devices, set that rule before development finishes. The self-serve check is simple: confirm the iPads are enrolled in an MDM, confirm Apple Business Manager is in place, and confirm you can revoke the app from a lost or departed user within minutes, not days.
If you want the faster path, our Custom App Builds work is built for this kind of setup, app, device policy and access control designed together. Book a call and we will map the cleanest way to keep the app on company iPads only.
