If you are familiar to devices and apps management, you probably know that iOS end-users usually have bad time trying to onboard an EMM solution. In particular when their organisation rolls out a BYOD policy. This framework necessarily implies that the Mobility or the IT department of the organisation creates and then pushes a configuration profile on the targeted device. When it is installed, this configuration profile grants the organisation a set of authorizations over the device settings (if you are running an MDM solution) or at least over the corporate apps – if you are running an MAM solution such as Appaloosa. By the way, here’s the by-the-book procedure to generate an MAM configuration profile.

Well, since March 25th 2019, Apple has made the process of installing this indispensable configuration profile a little tougher on iOS12.2+ devices. And we, at Appaloosa, are glad to present the adapted onboarding flow that follows up.


Why is it complicated to install a configuration profile?

From origins, here’s the thing that makes EMMs’ UX Designers or companies’ Mobility Managers wake up at night: once an end-user’s has requested the downloading of their company’s configuration profile, it takes no less than 8 clicks on multiple very disturbing and worrying screens to have this profile running on the device. Here is the irreductible flow:


(0) – request downloading

1 – confirm download request

2 – acknowledge the successful download

(2 bis) – is redirected from webview to profile installation settings screen

3 – install the profile


4 – tap their passcode

5 – confirm installation

6 – confirm installation again, against the most frightening message ever


7 – trust the source of the profile, against a little more frightening wording


8 – quit the process by clicking okay

(9) – redirection to onboarding finalization


What a UX nightmare!

And what’s about iOS12.2? Worse.


iOS 12.2 profile installation: a UX (security) hole

On iOS 12.2 devices, to get from step 2 to step 3, the OS doesn’t allow automatic redirections anymore (2 bis). Where EMMs used to bridge from onboarding web view, straight to the final profile installation screen (deeply hidden in the settings), end-users must now have faith in their digging skills. On their own, they have to find a path from the last EMM webscreen, through their settings, until they get to the downloaded profile and eventually install it.

Why do you do this to me?”, thinks the Mobility Manager…

At Apple they have their reasons for this extra step to install the profile: as it demands a spontaneous user action, it raises the security level against malicious configuration profiles that would be pushed by any criminal to get control over the device. If such hacks can be detected in business-related cases – remember recent Facebook spying activities ? -, they can also lead to worse cause, as with Exodus & Assistenza malsware, when users’ list of contacts, photos or real-time location data were stolen.

Aware of the mobility management issue that emerges with this update for organisations, Apple has not completely abandoned field forces. As you can see on screenshot below, they implemented a shortcut that leads directly from main settings screen to the downloaded profile. Thus, if iOS 12.2 end-users are aware of this tip, they avoid getting lost in meanders of settings.


New onboarding flow for Appaloosa end-users

No need for wordy teasing about this UX update: our goal is to guide end-users through the configuration profile installation, so that they eventually get their enterprise app store installed and set up.

  • Flow begins with the classic invitation email, that is automatically sent when end-user is added to the store. A click on this secured temporary link will bring them on our mobile web onboarding flow – mobile.appaloosa-store.com.
  • Already identified thanks to the link, they will follow a 2-steps procedure: installation of the professional profile, and installation of the corresponding private app store.

  • A reassuring screen  informs that the goal is to separate work apps from personal data.

  • Then comes the profile downloading, with the traditional pair of confirmation popups.

  • And this is the moment we do not want to lose them. So we draw their attention on a short guiding slideshow  that points the steps to achieve through settings.


  • For the last step  we opted for a dead-end screen: we ask them to go to their settings, and to come back after having finished the profile installation to go further. Notice that “Finalize” button is disabled until this is not done.



  • Once the user has followed the system funnel, they come back on Safari, and find the “Finalize” button enabled.
  • Click on this button leads to store installation, and available apps for this specific user. Our backstage move, here, is to wait 1 minute before pushing the profile and mandatory apps without end-users actions needed. So end-users may manually click to launch their private app store installation – it raises engagement and awareness around their private store. But if they do not because they switch tasks and forget to finalize, they will get it anyway.


With this new onboarding flow, we hope that Apple’s update on configuration profile installation will not impact our administrator’s adoption rate on iOS 12.2 devices.

Today this flow is available for iOS 12.2 end-users onboarding within iOS MAM featured native stores.

And good news: in the coming weeks, we aim at delivering the same UI quality standard to classic natives store and iOS webstore end-users.

Please, had you any feedback on this update or an iOS related mobility project, write at support@appaloosa-store.com, we are happy to help.