Enterprise Distribution and MDM
Store release, internal distribution, enterprise signing, and MDM automation.
Key takeaways
- Five distribution channels (stores, TestFlight/Play internal, internal distribution, MDM/EMM, and OTA) each map to a specific EAS Build, Submit, or Update flow.
- Expo Go is not generally distributed for SDK 56, so standardize QA on development builds and internal distribution builds.
- Store Apple API keys and Google service account JSON in EAS or CI secrets, and prefer organization service accounts over personal ones.
- MDM integration must validate managed config, certificate trust for pinning, update policy, data protection, and PII-free logging.
- Never run a binary rollout and an OTA rollout at the same time; watch EAS Observe and crash reports for 24 hours after release.
Distribution Channels
| Channel | Audience | Expo/EAS flow |
|---|---|---|
| App Store / Play Store | public users | EAS Build production + EAS Submit |
| TestFlight / Play internal testing | QA, beta customers | EAS Build preview or production candidate |
| Internal distribution | employees, limited testers | EAS Build with distribution: internal |
| MDM / EMM | managed enterprise devices | Apple Business Manager, Managed Google Play, MDM vendor |
| OTA | installed compatible binaries | EAS Update channel, branch, runtimeVersion |
Expo Go Policy
Official SDK 56 guidance says Expo Go is not generally distributed through the App Store and Google Play for SDK 56. Production teams should standardize on development builds and internal distribution builds for QA.
EAS Submit Baseline
{
"submit": {
"production": {
"ios": {
"appleId": "release@company.com",
"ascAppId": "1234567890"
},
"android": {
"track": "production"
}
}
}
}Prefer organization service accounts over personal accounts. Store Apple API keys and Google service account JSON in EAS secrets or CI secrets.
MDM Integration Points
| Area | Check |
|---|---|
| Managed configuration | validate tenant, region, and API base URL at startup |
| Certificate trust | define proxy and TLS inspection exceptions for pinning |
| App update policy | forced update, staged rollout, business-hour restrictions |
| Data protection | managed open-in, clipboard, backup, screenshot policy |
| Logging | remove PII and minimize device/user identifiers |
Store Review Risks
- SDK 56 minimum iOS is 16.4+. Reflect dropped-device support in user-facing docs.
- Revisit ATS exceptions and network behavior after the
expo/fetchglobal path. - Background task, location, notification, and Live Activity explanations must match real use.
- Widget and Live Activity deep links must behave safely before and after login.
- EAS Metadata can help automate Apple metadata, but beta workflows still need approval controls.
Runbook
- Build a store release candidate from
previewandproductionprofiles. - Validate OTA candidate on a preview channel with the same
runtimeVersion. - Confirm symbol, sourcemap, and mapping uploads.
- Share managed config samples and rollback instructions with MDM customers.
- Do not run binary rollout and OTA rollout at the same time.
- Watch EAS Observe and crash reporting for 24 hours after release.