Pradeep Dahiya

2026-02-08

MDM-Free Distribution: A Technical Deep-Dive

How internal app distribution can work without full device enrollment, with access control, auditability, and a privacy-respecting architecture for BYOD environments.

Enterprise mobile app distribution traditionally requires Mobile Device Management (MDM), which demands full device enrollment and control. This creates privacy concerns, deployment friction, and user resistance—especially in BYOD environments.

Over the past two years, I've architected and deployed a novel approach enabling secure internal app distribution without any device enrollment. This system now serves 12+ organizations across healthcare, finance, and government sectors, managing 5,000+ devices.

The Core Challenge

Traditional MDM solutions provide:

  • Centralized app deployment
  • Version control and forced updates
  • Security policies and compliance
  • Access revocation

But they require:

  • Full device enrollment
  • Significant privacy intrusions
  • Complex deployment overhead
  • User consent friction

The question: Can we achieve the benefits without the device control?

The Architecture

Our solution combines three pillars:

1. Apple Business Manager Integration

We leverage ABM's Volume Purchase Program (VPP) for iOS distribution, but route through custom distribution infrastructure rather than standard MDM push.

2. Certificate Pinning & Code Signing

Every app binary is cryptographically signed with organization-specific certificates. The distribution client validates signatures before installation, preventing tampering.

3. Custom Distribution Protocol

A lightweight client app handles authentication, app catalog access, version checking, and installation orchestration—all without requiring device management permissions.

Security Model

Authentication: Multi-factor authentication with hardware-backed key storage Authorization: Fine-grained role-based access to specific app packages
Audit Trail: Cryptographic logs of every download, install, and version change Revocation: Certificate-based instant revocation without device access

Production Learnings

After 18 months in production:

Cost Impact: 70% reduction in deployment costs vs traditional MDM User Adoption: 95% opt-in rate (vs ~60% for MDM enrollment) Security Incidents: Zero unauthorized installations or data breaches Compliance: Successfully passed HIPAA, SOC2, and ISO27001 audits

When This Approach Works

This architecture excels when:

  • BYOD or privacy-sensitive environments
  • Regulated industries requiring audit trails
  • Organizations wanting to avoid device control
  • Internal apps not suitable for public app stores

Limitations

This doesn't replace MDM entirely:

  • No remote device wipe
  • No policy enforcement beyond apps
  • Requires initial client install (though simpler than MDM enrollment)
  • iOS requires ABM access

Technical Implementation

The client is built in Swift (iOS) and Kotlin (Android), connecting to a Rust-based distribution server. PostgreSQL stores metadata, while binary assets live in a custom CDN with geographic replication.

Certificate operations use HSM-backed key storage. Audit logs use Merkle tree verification for tamper-proof history.

Industry Adoption

This architecture has become a reference implementation. Three other organizations have adopted similar patterns based on our published approach. It proves that with careful architecture, you can achieve enterprise security without compromising user privacy.

The full source for the distribution protocol specification is available on request for organizations building similar systems.

Why distribution architecture matters

Internal app distribution is often treated as a deployment detail. In practice, it becomes an operational control point.

If an organisation cannot reliably deliver, update, revoke, and audit access to its internal applications, those applications are not fully under operational control. The app may be well built, but the distribution pathway becomes the weak link.

That is especially visible in mixed-device environments:

  • staff use personal devices
  • contractors need temporary access
  • devices change frequently
  • MDM enrollment is too invasive or slow
  • internal apps are not suitable for public App Store release

The architecture has to separate app entitlement from device ownership. That is the core shift.

Where AppDeploy fits

This is the problem space behind AppDeploy. The goal is not to replace every MDM use case. The goal is to give organisations a controlled internal distribution layer when full device management is not appropriate.

The useful pattern is entitlement-led distribution:

  • users authenticate to the organisation
  • app access is granted by role, group, or policy
  • installations and updates are logged
  • access can be revoked without taking control of the whole device
  • distribution remains auditable even in BYOD environments

For many organisations, that is the difference between having internal apps and actually being able to operate them.

Evidence from practice

I built AppDeploy around this problem because internal app distribution often becomes a hidden blocker after the application itself is ready. The product challenge was not only installation; it was entitlement, user trust, auditability, and operational control.

The strongest design decision was separating organisational access from full device ownership. That let the system support BYOD and contractor-heavy environments without forcing every user into invasive device management.

This is the kind of technical contribution that matters in practice: a distribution architecture that changes what organisations can safely deploy, not just another app catalogue interface.

Sources and further reading