A .mobileprovision file is the on-disk representation of an Apple provisioning profile. The extension is `.mobileprovision` for iOS, iPadOS, tvOS, watchOS, and visionOS profiles, and `.provisionprofile` for macOS. Under the hood the format is identical: a Cryptographic Message Syntax (CMS) signed envelope around an XML plist.
Decode one from the command line
bash
# CMS-aware: keeps the signature wrapper around the plist security cms -D -i Profile.mobileprovision # openssl alternative if you do not have macOS handy openssl smime -in Profile.mobileprovision -inform der -verify -noverify
Fields you will actually look at
- `AppIDName` and `Entitlements > application-identifier` — the App ID the profile covers.
- `TeamIdentifier` — the Team ID.
- `DeveloperCertificates` — the public-key halves of the certificates this profile authorizes.
- `ProvisionedDevices` — the UDID list for Development and Ad Hoc profiles. Absent for App Store and Enterprise.
- `ExpirationDate` — when iOS will refuse to launch a build that embeds this profile.
- `UUID` — the profile's unique identifier, used by Xcode and PROVISIONING_PROFILE_SPECIFIER.
Where the file ends up
- Inside the .app bundle as `embedded.mobileprovision` (iOS) or `embedded.provisionprofile` (macOS), copied there by xcodebuild during the archive step.
- Installed on a developer's Mac at `~/Library/MobileDevice/Provisioning Profiles/`, looked up by UUID.
- Stored in an MDM payload or fastlane match repo for distribution to teammates and CI.