.mobileprovision file

A .mobileprovision file is the on-disk representation of an Apple provisioning profile. The extension is .mobileprovision for iOS, iPadOS, tvOS, watchOS, and visionOS profiles, and .provisionprofile for macOS. Under the hood the format is identical: a Cryptographic Message Syntax (CMS) signed envelope around an XML plist.

Decode one from the command line

# CMS-aware: keeps the signature wrapper around the plist
security cms -D -i Profile.mobileprovision

# openssl alternative if you do not have macOS handy
openssl smime -in Profile.mobileprovision -inform der -verify -noverify

Fields you will actually look at

• AppIDName and Entitlements > application-identifier: the App ID the profile covers.
• TeamIdentifier: the Team ID.
• DeveloperCertificates: the public-key halves of the certificates this profile authorizes.
• ProvisionedDevices: the UDID list for Development and Ad Hoc profiles. Absent for App Store and Enterprise.
• ExpirationDate: when iOS will refuse to launch a build that embeds this profile.
• UUID: the profile's unique identifier, used by Xcode and PROVISIONING_PROFILE_SPECIFIER.

Where the file ends up

• Inside the .app bundle as embedded.mobileprovision (iOS) or embedded.provisionprofile (macOS), copied there by xcodebuild during the archive step.
• Installed on a developer's Mac at ~/Library/MobileDevice/Provisioning Profiles/, looked up by UUID.
• Stored in an MDM payload or fastlane match repo for distribution to teammates and CI.

Profile types inside a .mobileprovision

Why a build rejects its embedded profile

• The profile expired: ExpirationDate is in the past.
• The signing certificate is not listed in DeveloperCertificates, so the signature and profile disagree.
• The device UDID is not in ProvisionedDevices for a Development or Ad Hoc build.
• The app's entitlements do not match the profile's Entitlements, for example a Push entitlement with no matching capability.