I have an enterprise distributed app which is built on a build server using xcodebuild. Last year we made a change to use the "Automatically manage signing" feature with the "-allowProvisioningUpdates" flag. The provisioning profile is generated fine using this technique, but we're coming up to a year with this profile, and it expires in 31 days.
Initially I was under the impression that using "allowProvisioningUpdates" would cause the provisioning profile to be regenerated on each new build, but if that were the case it wouldn't be expiring. We need to do a new build with an updated profile so our users aren't left with a broken app in a months time. However the generated provisioning profile is not shown in the "Certificates, Identifiers & Profiles" section in the Apple Developer Center, and I cannot find any way to force Xcode or xcodebuild to generate a new provisioning profile. How can I force this to happen to ensure no down time for our users? What will happen when the profile finally expires?
I contacted Apple and here's what they had to say:
Automatically manage signing on Xcode only creates a new provisioning profile after the expiration date of the previous.
That is the best option for new builds that needs to be submitted to App Store because there is no downtime from current users when the provisioning profile.
As you are developing in-house apps, if you let the provisioning profile expire to automatically sign for your new build (with new provisioning profile auto-created) your users will not be able to access you app.
Therefore the answer seems to be that we shouldn't be using automatic signing for in-house/enterprise distibution, but instead only for App Store deployments.