Who it's for: the single operational guide for the Sport e Salute IT team, who must distribute the Zerolatency Live Player app to the 1250 stadium iPads via MDM.

MDM choice: Microsoft Intune, already in use in the Sport e Salute organization, linked to Apple Business Manager via Enrollment program token, with device licensing and zero-touch distribution (the iPad comes out of the box, ABM recognizes it, Intune installs the app: the user turns on the iPad and the app is ready).

1. Which MDM

Microsoft Intune (included in Microsoft 365 E3/E5 / Enterprise Mobility + Security; otherwise Intune standalone).

Feature	Detail
Link to ABM	Enrollment program token (ABM token → Intune)
Licenses	Device licensing (license per device, not per user)
Distribution	Zero-touch: iPad comes out of the box → ABM recognizes it → Intune installs the app
Updates	New version on App Store Connect → Intune updates all iPads

2. Publishing the IPA on App Store Connect

⚠️ Before uploading the IPA you need the Distribution Certificate to sign the build (see section 3): without a valid signature the upload is rejected.

1. Sign in to App Store Connect (appstoreconnect.apple.com) with the company Apple ID
2. My Apps → + → New App → create a new app record
3. Enter the Bundle ID: com.zerolatency.liveplayer (already created in Certificates, Identifiers & Profiles, see section 3)
4. Upload the signed IPA with one of the tools:
   • Xcode Archive → Distribute (organizer: open the archive → Distribute App)
   • Transporter (drag the IPA into the window)
5. App Store Connect → App → Pricing and Availability → App Distribution Methods → Private
   • Type: Organization ID
   • Enter the ABM Organization ID: 66676415
   • ⚠️ Irreversible after approval: once approved, the distribution method can no longer change (no switch to Public without a new app record)
6. Set the license price (free or paid — to be decided)
7. Submit for App Review (1–2 business days):
   • A demo login is required for the reviewer — there is no user login: state in the form that auth is an API key injected at build time (no reviewer account needed)
   • Fill in the App Review Notes (see section 7bis of the Apple guide: kiosk/LAN description, how to test, demo material)
   • ⚠️ Before submission: privacy policy URL to publish and enter (mandatory field) and a demo video of the iPad walkthrough
8. App approved → it does not appear on the App Store → it appears in business.apple.com → Apps and Books → Custom Apps of Sport e Salute

Warnings not to ignore

Warning	What to do
App icon	Upload all required sizes before submission
Screenshot	Provide valid screenshots (mandatory for review)
Privacy policy	Publish the URL and enter it in App Store Connect before submission (mandatory field)

3. Certificates for the 1250 iPads — how to generate them

🔑 Golden rule: you do NOT need a certificate per device and NO UDIDs. You need A SINGLE Apple Distribution Certificate, which signs all iPads.

Why one certificate is enough

App on the App Store (even private)
       ↓
ABM + MDM install it on ALL iPads
       ↓
No UDIDs, no manual profiles

The iPads "register" themselves: with ABM + MDM you don't need to add UDIDs. For Private App Store distribution you need a Distribution Certificate (NOT an Ad Hoc one).

Full procedure — Distribution Certificate

1. Generate the CSR from the Mac (one-time)

1. On a Mac, open Applications → Utilities → Keychain Access
2. Menu Keychain Access → Certificate Assistant → Request a Certificate from a Certificate Authority…
3. Fill in:
   • User Email: the Apple Developer account email
   • Common Name: the company/colleague name (e.g. Sport e Salute IT)
   • Request: check "Saved to disk"
4. Click Continue and save the CertificateSigningRequest.certSigningRequest file

2. Create the certificate on Apple

1. Go to developer.apple.com/account → Certificates, Identifiers & Profiles
2. Click + → Certificates section → choose Apple Distribution
3. Upload the CSR file generated in step 1
4. Download the distribution.cer file

3. Install the certificate

1. Double-click the .cer → it installs in Keychain Access (Keys section)
2. Verify: Keychain Access → Keys → you'll see the private key associated with the certificate
   • ⚠️ If the private key is missing, you can't sign — you must regenerate the CSR from the same key
   • To sign from a different Mac: export the private key as .p12 (right-click the key → Export) and import it on the new Mac

4. Verify Xcode uses it

1. Open the project: open ios/Runner.xcworkspace
2. Runner → TARGETS → Runner → Signing & Capabilities
3. Make sure Team = R5ZAZYF526 and Xcode reports no provisioning errors
4. In Xcode: Settings… → Accounts → the certificate must appear as valid (not "Expired")

5. Expiry and renewal

• Valid for 1 year
• ⚠️ If it expires, the app can no longer be updated on App Store Connect
• To renew: generate a new CSR (or reuse the same private key if available) and repeat steps 2–3
• Keep the .p12 private key in a safe place (e.g. password manager/Vault) — without it you can't sign anything anymore

Provisioning Profile for Private distribution

• For Private App Store distribution the provisioning profile is the App Store / Distribution one (in Xcode managed automatically with Signing & Capabilities → automatic signing)
• You do NOT need an Ad Hoc profile for the 1250 iPads: the Ad Hoc profile is only for testing on 1–2 iPads (with manually selected UDIDs)
• With ABM + Intune the iPads register themselves: no manual profile to distribute

4. Installation on the 1250 iPads

Complete flow

1. ABM recognizes the serials of the iPads (if purchased from third parties and not recognized: add them with Apple Configurator 2)
2. Intune enrollment — link ABM → Intune (one-time):
   • In Intune → Devices → iOS/iPadOS → Enrollment program tokens → Add
   • Download the public key generated by Intune
   • In ABM → Settings → MDM Servers → Add create the "Microsoft Intune" server and upload the public key
   • Download the token from ABM and upload it back to Intune
   • In ABM → Devices assign the iPads to the Intune MDM server (or the default MDM server)
3. ABM licenses — buy 1250 licenses on business.apple.com → Apps and Books → Custom Apps:
   • Select the app → Buy Licenses → select Location → quantity 1250
   • ⚠️ Max 1000 licenses per blueprint/location → split across 2 locations (e.g. Stadio - 1000, Stadio - 250), then assign via Intune
4. Custom app synced into Intune — the app published as private on App Store Connect and linked to the Organization ID appears in ABM as a Custom App and is synced into Intune after the token link
   • Intune → Apps → iOS store / VPP app → Add → select the custom app
   • License: Device licensing
5. Assign to the group — Intune → Apps → Assign → "Stadio iPad" group (1250 devices) → Required → automatic installation
6. ✅ Zero-touch: iPad comes out of the box → ABM recognizes it → Intune installs the app → the user turns on the iPad and the app is ready

5. Checklist — who does what

Colleague (IT)                    Dev
─────────────────────────────┬───────────────────────────
1. Create Apple Developer Acct │
2. Request D-U-N-S             │
3. Activate ABM                │
4. Configure MDM (Intune)      │
5. Link ABM → Intune           │
                              │ 6. Generate Distribution Cert
                              │ 7. Publish app PRIVATE on App Store Connect
                              │    (linked to the Sport e Salute Organization ID)
                              │ 8. Approve the Custom App → it appears on ABM
9. Buy 1250 licenses on ABM    │
10. Assign app via Intune      │
├─────────────────────────────┴──────────────────────────
11. ✅ The app is on ALL iPads

IT-side checklist (Sport e Salute / colleague)

• [ ] ABM active with Organization ID 66676415
• [ ] Microsoft Intune configured and linked to ABM (token)
• [ ] 1250 licenses bought in ABM (across 2 locations if >1000 per location)
• [ ] Device group in Intune with the 1250 iPads
• [ ] Custom app assigned to the group (Required, device licensing)

6. Useful links

Item	URL
Apple Developer Enrollment	developer.apple.com/programs/enroll
Apple Developer Account	developer.apple.com/account
Apple Business Manager	business.apple.com
App Store Connect	appstoreconnect.apple.com
Microsoft Intune - Apple Business Manager	learn.microsoft.com/intune
Microsoft Intune - VPP app	learn.microsoft.com/intune/vpp
Apple Configurator 2	apps.apple.com/app/id1037126344

7. Common issues

Issue	Solution
D-U-N-S not found	Call Dun & Bradstreet Italy: +39 02 5161 2800. Then contact Apple
ABM doesn't recognize serials	If purchased from third parties, use Apple Configurator 2 to add them
App crashes on launch	Expired certificate. Regenerate the Distribution Certificate
1000 UDIDs to enter?	No. With ABM+MDM it's not needed. See section 3
Licenses above 1000	For 1250 iPads: Apple allows max 1000 licenses per blueprint/location in ABM → buy the licenses across 2 locations (e.g. 1000+250) or across multiple blueprints, then assign via Intune
IPA upload rejected	Verify the Distribution Certificate is valid and the IPA is signed (Xcode Archive → Distribute / Transporter)
Distribution method already approved	Irreversible: to switch to Public you need a new app record