Who it's for: the colleague who has to create the Apple Developer account and configure ABM to distribute the Zerolatency Live Player app to the stadium iPads.

Timeline: 3–5 business days (Apple requires manual verification)

1. What you need before starting

Item	Notes
Company VAT number / tax code	For the Apple Developer account
D-U-N-S Number	Dun & Bradstreet company identifier. If you don't have one, Apple generates it during enrollment (2–5 days)
Company email	E.g. it@company.com — not personal Gmail/Outlook
Company credit card	For the Developer Program payment
Physical iPad	For initial testing
Physical Mac	For building and signing the .ipa

2. Creating an Apple Developer Account

Type	Cost/year	Device limit	Manual UDIDs?
Individual	€99	100	✅ Yes
Organization	€99	Unlimited with ABM+MDM	❌ No with ABM
Enterprise	€299	Unlimited	❌ No

For 1000+ iPads → Organization (€99) + ABM + MDM is the right choice.

The Enterprise Program (€299) was needed before Apple allowed custom apps on ABM. No longer necessary.

Step 1 — Enrollment

1. Go to developer.apple.com/programs/enroll
2. Click "Start Your Enrollment"
3. Sign in with your company Apple ID
4. Choose Organization (€99/year) — on behalf of the company

Step 2 — D-U-N-S Verification

1. If you don't have a D-U-N-S, Apple requests it for you
2. Dun & Bradstreet verification takes 2–5 business days
3. ⚠️ The company name must match your VAT ID exactly

Step 3 — Activation

1. After verification, you receive a confirmation email
2. Go to developer.apple.com/account → "Activate Your Membership"
3. Enter billing info and credit card
4. ✅ Account active

3. Certificates and App ID (one-time setup)

Step 1 — Distribution Certificate

🔑 This is the certificate used to sign the IPA before uploading it to App Store Connect. For Private App Store distribution you need a Distribution Certificate (NOT an Ad Hoc one). A single certificate signs all iPads — you don't need a certificate per device.

1. Generate the CSR from the Mac (one-time)

1. On a Mac, open Applications → Utilities → Keychain Access
2. Menu Keychain Access → Certificate Assistant → Request a Certificate from a Certificate Authority…
3. Fill in:
   • User Email: the Apple Developer account email
   • Common Name: the company/colleague name (e.g. Sport e Salute IT)
   • Request: check "Saved to disk"
4. Click Continue and save the CertificateSigningRequest.certSigningRequest file

2. Create the certificate on Apple

1. Go to developer.apple.com/account → Certificates, Identifiers & Profiles
2. Click + → Certificates section → choose Apple Distribution
3. Upload the CSR file generated in step 1
4. Download the distribution.cer file

3. Install the certificate

1. Double-click the .cer → it installs in Keychain Access (Keys section)
2. Verify: Keychain Access → Keys → you'll see the private key associated with the certificate
   • ⚠️ If the private key is missing, you can't sign — you must regenerate the CSR from the same key
   • To sign from a different Mac: export the private key as .p12 (right-click the key → Export) and import it on the new Mac

4. Verify Xcode uses it

1. Open the project: open ios/Runner.xcworkspace
2. Runner → TARGETS → Runner → Signing & Capabilities
3. Make sure Team = R5ZAZYF526 and Xcode reports no provisioning errors
4. In Xcode: Settings… → Accounts → the certificate must appear as valid (not "Expired")

5. Expiry and renewal

• Valid for 1 year (the Enterprise Distribution lasts 3 years, but here we use the standard Apple Distribution)
• ⚠️ If it expires, the app can no longer be updated on App Store Connect
• To renew: generate a new CSR (or reuse the same private key if available) and repeat steps 2–3
• Keep the .p12 private key in a safe place (e.g. password manager/Vault) — without it you can't sign anything anymore

Step 2 — Bundle ID

1. Certificates, Identifiers & Profiles → Identifiers → +
2. Choose App IDs
3. Enter:
   • Description: KsoftLivePlayer
   • Bundle ID: com.zerolatency.liveplayer
4. Save

Step 3 — Provisioning Profile

⚠️ Only for testing on 1-2 iPads. For 1000+ iPads skip this step (see section 4).

1. Profiles → + → Ad Hoc
2. Select the Bundle ID and the Distribution Certificate
3. Select only the test iPads (1-2 devices)
4. Download the .mobileprovision

4. ✅ Distribution to 1000+ iPads — No UDIDs

With ABM + MDM you don't need to add any UDIDs.

How it works

App on the App Store (even private)
       ↓
ABM + MDM install it on ALL iPads
       ↓
No UDIDs, no manual profiles

What you need

Component	Cost
Apple Developer Organization	€99/year
Apple Business Manager (ABM)	Free
MDM (Microsoft Intune)	Already available with Microsoft 365 E3/E5 / Enterprise Mobility + Security; otherwise Intune standalone
App Store Connect	Included with the Developer Account

Flow

1. Upload the app to App Store Connect (it can be a private, unpublished app)
2. ABM makes it available as a "Custom App" (for your organization only)
3. MDM pushes it to all iPads automatically
4. ✅ The app reaches 1000+ iPads without ever touching a single UDID

Alternative: Even without ABM, if you use an MDM, you can distribute via VPP (Volume Purchase Program) without UDIDs.

5. Apple Business Manager (ABM)

Step 1 — Enrollment

1. Go to business.apple.com
2. Click "Get Started"
3. Enter company details
4. Apple calls the legal representative for phone verification
5. Wait for the activation email (24–48 hours)

Step 2 — Choosing an MDM

✅ Chosen: Microsoft Intune (already in use in the Sport e Salute organization).

With Intune the flow is the same: ABM → Intune (ABM token) → the custom app is synced into Intune → assigned to iPad groups → automatic installation.

Other MDM options (for reference):

MDM	Cost	Notes
Mosyle	~$1/device/month	Cheapest option, good for iPads
Jamf Pro	~$4/device/month	Market leader, widely used in sports
Kandji	~$3/device/month	Modern interface, zero-touch deploy

Step 3 — Uploading the app

1. business.apple.com → Apps & Books → Custom Apps
2. Search for your app (a Custom App published as private on App Store Connect and linked to the Organization ID)
3. Buy the licenses (e.g. 1250) → assign them via Intune
4. In Intune → Apps the app appears after syncing with ABM → assign it to device groups

Step 4 — Automatic deployment

With ABM + MDM:

• iPad comes out of the box → ABM recognizes it → MDM installs the app
• The user turns on the iPad, the app is already ready
• Updates: upload the new version to App Store Connect → MDM updates all iPads

6. Summary — Who does what

Colleague (IT)                    Dev
─────────────────────────────┬───────────────────────────
1. Create Apple Developer Acct │
2. Request D-U-N-S             │
3. Activate ABM                │
4. Configure MDM (Intune)      │
5. Link ABM → Intune           │
                              │ 6. Generate Distribution Cert
                              │ 7. Publish app PRIVATE on App Store Connect
                              │    (linked to the Sport e Salute Organization ID)
                              │ 8. Approve the Custom App → it appears on ABM
9. Buy 1250 licenses on ABM    │
10. Assign app via Intune      │
├─────────────────────────────┴──────────────────────────
11. ✅ The app is on ALL iPads

7. Common issues

Issue	Solution
D-U-N-S not found	Call Dun & Bradstreet Italy: +39 02 5161 2800. Then contact Apple
ABM doesn't recognize serials	If purchased from third parties, use Apple Configurator 2 to add them
App crashes on launch	Expired certificate. Regenerate the Distribution Certificate
1000 UDIDs to enter?	No. With ABM+MDM it's not needed. See section 4
Licenses above 1000	For 1250 iPads: Apple allows max 1000 licenses per blueprint/location in ABM → buy the licenses across 2 locations (e.g. 1000+250) or across multiple blueprints, then assign via Intune

7bis. Publishing the app PRIVATE for 1250 iPads (Sport e Salute)

Goal: distribute the app to 1250 iPads of the stadium, without making it public on the App Store. The app is visible only to the Sport e Salute organization via Apple Business Manager. MDM: Microsoft Intune.

Organization details (from the Sport e Salute ABM)

Item	Value
Company name	SPORT E SALUTE SPA
Organization ID (ABM)	66676415
D-U-N-S	563917090
iPads	1250

Complete flow (steps to do)

0. Create the Distribution Certificate (one-time, 15 min) → see section 3, Step 1 (CSR from the Mac → Apple Distribution → install .cer → verify in Xcode with team R5ZAZYF526)

1. App Store Connect → Pricing and Availability → App Distribution Methods → Private

   • Type: Organization ID
   • Enter the ABM Organization ID: 66676415
   • ⚠️ Irreversible after approval: once approved, the distribution method can no longer change (no switch to Public without a new app record)

2. Set the license price (free or paid — to be decided) and upload the first build

3. Submit for App Review (1–2 business days) — a demo login is required for the reviewer

4. App approved → it does not appear on the App Store → it appears in business.apple.com → Apps and Books → Custom Apps of Sport e Salute

5. On the Sport e Salute ABM (business.apple.com):

   • Apps and Books → Custom Apps → select the app
   • Buy Licenses → select Location → quantity 1250
   • ⚠️ Max 1000 licenses per blueprint/location → split (e.g. Stadio - 1000, Stadio - 250)

6. Link ABM → Intune (one-time):

   • In Intune → Devices → iOS/iPadOS → Enrollment program tokens → Add
   • Download the public key generated by Intune
   • In ABM → Settings → MDM Servers → Add create the "Microsoft Intune" server and upload the public key
   • Download the token from ABM and upload it back to Intune
   • In ABM → Devices assign the iPads to the Intune MDM server (or the default MDM server)

7. Intune → Apps → iOS store / VPP app → Add select the custom app (synced from ABM) → Device licensing

8. Intune → Apps → Assign → "Stadio iPad" group (1250 devices) → Required → automatic installation

9. ✅ The app reaches all iPads via Intune — zero-touch, no UDIDs

IT-side checklist (Sport e Salute / colleague)

• [ ] ABM active with Organization ID 66676415
• [ ] Microsoft Intune configured and linked to ABM (token)
• [ ] 1250 licenses bought in ABM (across 2 locations if >1000 per location)
• [ ] Device group in Intune with the 1250 iPads
• [ ] Custom app assigned to the group (Required, device licensing)

7ter. App Review Notes for submission

Fill in the form App Store Connect → App → App Review Information before each submission (the first build must pass review, then subsequent builds go much faster for custom/private apps).

Note for the reviewer (paste, adapt if needed)

App Type: Kiosk / enterprise app for stadium operators (Zerolatency Live Player).

The app is a kiosk-style live-streaming player that connects ONLY to a
private LAN backend (e.g. http://192.168.1.127:3002) — it is not a general
consumer app and has no public content, accounts, or social features.

How to test:
1. The app must be on the same local network as the streaming backend.
   Without the private server reachable, the app shows a connection
   error screen by design.
2. Authentication is injected at build time via --dart-define=API_KEY
   (API key of the private backend); no user login is required on-device.
3. A valid machine license (HMAC-signed license key, loaded on the backend)
   is required for the backend to serve streams.
4. Main screen shows the live slot; the DVR timeline bar allows seeking
   within the archive; WebSocket keeps the slot list in sync with the
   control room.

Demo material: a video walkthrough is attached below (see "demo video").

Note for the reviewer: no in-app purchases, no accounts, no data collected
or transmitted outside the private LAN. Privacy policy: <to be defined>.

Checklist before submission

• [ ] Demo video (mandatory if the reviewer can't reach the LAN): record a walkthrough on the iPad (full flow: startup → live stream → DVR seek → slot switch via WS) and attach the link in the notes form
• [ ] Privacy policy URL: placeholder <to be defined> — must be published and entered in App Store Connect before submission (mandatory field)
  • It must state: no data collection outside the LAN, internal event video, non-personal technical API keys/credentials
• [ ] Demo login: no user login — state in the form that auth is an API key injected at build time (no reviewer account needed)
• [ ] Consistent app category (e.g. Business/Utilities) and correct age rating
• [ ] Verify the build is the one with USE_VLC_CUSTOM (VLCKit, media_kit removed) and no debug leftovers (no _dartobservatory, restricted ATS)

8. Useful links

Item	URL
Apple Developer Enrollment	developer.apple.com/programs/enroll
Apple Developer Account	developer.apple.com/account
Apple Business Manager	business.apple.com
App Store Connect	appstoreconnect.apple.com
Microsoft Intune - Apple Business Manager	learn.microsoft.com/intune
Microsoft Intune - VPP app	learn.microsoft.com/intune/vpp
Apple Configurator 2	apps.apple.com/app/id1037126344
Mosyle	mosyle.com
Jamf Pro	jamf.com/products/jamf-pro
Kandji	kandji.io