Private app

How it works

Google and Apple each offer a private lane, and each has rules.

On Android, Managed Google Play lets you publish a private app that appears only to your organization's managed devices. It goes through Google's automated review, usually in minutes rather than the days of a public listing, and it's the route Google recommends. The alternative is direct APK delivery by the MDM, which skips Play entirely and suits apps that must never leave your infrastructure. Since Android 14, sideloading is restricted on managed devices unless the policy allows it, and Google's 2025 developer verification rules apply even to apps installed outside Play, so the MDM-delivered route is now the serious option, not a workaround.

On iOS, the clean path is Custom Apps: the developer submits the app to App Store Connect and makes it available privately to your Apple Business Manager organization, which then assigns it like any other Apps and Books title. The older Apple Developer Enterprise Program, which signs IPA files for in-house distribution outside the store, still exists but Apple has restricted it since 2019 to organizations of 100 or more employees with a justified need, and certificates expire every year.

Either way, the MDM installs the app as a managed app, can push managed app configuration with it, and removes it on offboarding.

Why it matters for a fleet

Most companies past 200 employees have at least one app nobody outside should see: a warehouse picker, a field inspection form, an internal directory. Publishing it on a public store means a listing anyone can find, screenshots that show your workflow, and a review process tuned for consumer apps.

The private lane also changes release cadence. Internal apps ship monthly, sometimes weekly during a rollout. A distribution channel you control means the developer uploads version 4.1 on Tuesday and the field team has it Wednesday morning.

Two limits to keep in mind. Private apps on managed Google Play are still hosted by Google, which some sectors won't accept. And an in-house iOS build with an expired enterprise certificate simply stops launching, so someone has to own the renewal date.

How Appaloosa handles it

Private apps are where Appaloosa started. You upload an APK or IPA to the console, keep every version, and assign builds per device group; Custom Apps from Apple Business Manager sync into the same catalog next to public apps from Managed Google Play and Apple VPP. Users install from the enterprise app store on their device, or receive required apps silently, and the app disappears with its data when the device leaves the fleet. Details on the Mobile Application Management page.