Provisioning Profiles Can Be Installed Using MDM

Question

Apple's Mobile Device Management Protocol Reference states on page 44 at the bottom

Third-party enterprise applications require provisioning profiles in order to run them. You can use MDM to deliver up-to-date versions of these profiles so that users do not have to manually install these profiles, replace profiles as they expire, and so on. To do this, deliver the provisioning profiles through MDM instead of distributing them through your corporate web portal or bundled with the application.

Does this mean that I should remove or unbundle the embedded.mobileprovision from the application before installation?

Or does it mean,

Installing the provisioning profile via an MDM server separately before installing the app?

If the answer is the first one, how does one remove the embedded.mobileprovision without breaking the app. If the answer is the 2nd, does subsequently updating the app mess up the profile installed by the MDM server?

Answer 1

Second one. The MDM server installs provisioning profiles on the device before installing the app. It's generally part of "setting up the device" with the MDM.

Installing or updating the app after that point would be done through the MDM, so everything stays hunky dory.

Updated provisioning profiles get put up on the MDM (by developer/admin), then the MDM app on the user's device notifies the user of an update. They tap the update button and the new profiles get downloaded and installed.

EDIT 3/12/14: Apple has introduced the Device Enrollment Program(DEP) which now allows for "no-touch" installation of MDM provisioning profiles, setting up supervision and silently installing apps without ever taking the device out of the box. The system is based around:

1. Company account buys all devices (Apple maintains list of which serial numbers belong to company/account)
2. Company tells Apple which MDM has permission to make changes.
3. Company links MDM to Apple.
4. MDM now sends requests to Apple, which sends requests to device.

This will allow us to only screw, er setup, devices we bought. There are ways to "switch" ownership of devices/serial numbers of they were not all bought under the same account.