When are profiles renewed when using "Automatically manage signing"/allowProvisioningUpdates?

Question

I have an enterprise distributed app which is built on a build server using ​xcodebuild. Last year we made a change to use the "Automatically manage signing" feature with the "-allowProvisioningUpdates" flag. The provisioning profile is generated fine using this technique, but we're coming up to a year with this profile, and it expires in 31 days.

Initially I was under the impression that using "allowProvisioningUpdates" would cause the provisioning profile to be regenerated on each new build, but if that were the case it wouldn't be expiring. We need to do a new build with an updated profile so our users aren't left with a broken app in a months time. However the generated provisioning profile is not shown in the "Certificates, Identifiers & Profiles" section in the Apple Developer Center, and I cannot find any way to force Xcode or xcodebuild to generate a new provisioning profile. How can I force this to happen to ensure no down time for our users? What will happen when the profile finally expires?

Answer 1

I contacted Apple and here's what they had to say:

Automatically manage signing on Xcode only creates a new provisioning profile after the expiration date of the previous.

That is the best option for new builds that needs to be submitted to App Store because there is no downtime from current users when the provisioning profile.

As you are developing in-house apps, if you let the provisioning profile expire to automatically sign for your new build (with new provisioning profile auto-created) your users will not be able to access you app.

Therefore the answer seems to be that we shouldn't be using automatic signing for in-house/enterprise distibution, but instead only for App Store deployments.

Answer 2

I was having this same problem with a few apps that we distribute in-house... The solution that finally worked for me, was deleting the App ID from the developer center, then letting Xcode re-create it and any accompanying provisioning profiles. One thing to keep in mind though, is that if you only have 1 app ID in your developer center, then deleting it will also delete your signing certificate along with the provisioning profiles. We have several apps dependent on our certificate, so it wasn't deleted. However the main issue regarding the soon-to-be-expiring provisioning profile was resolved.