While building the TWG Platform for a client, I shipped two iOS apps: a public Client app and an internal Staff app. The client app went through review normally. The staff app was rejected under Guideline 3.2 (Business). Here is what that means and how we solved it.
Why the rejection happened
The App Store is meant for apps the general public can use. A staff app that only works for one company's employees falls into Apple's business guidelines: it should not appear in public search results for everyone.
The reviewer was not saying the app was broken. They were saying it was being distributed the wrong way.
Your options for internal apps
| Option | Good for | Notes |
|---|---|---|
| Unlisted app distribution | Staff, partners, members | Same App Store, but only reachable by direct link |
| Apple Business Manager custom apps | Organizations enrolled in Business Manager | Distributed privately to specific organizations |
| Apple Developer Enterprise Program | Large companies with in-house apps | Separate membership with strict eligibility |
| TestFlight | Testing only | Builds expire, not for production use |
For our case, unlisted distribution was the simplest fit.
How unlisted distribution works
- The app goes through normal App Store review.
- It does not appear in search, charts or recommendations.
- Anyone with the direct link can install it, so you control who gets the link.
- Updates work like any other App Store app.
The steps
- Respond to the rejection in App Store Connect explaining who the app is for.
- Submit Apple's request form for unlisted app distribution with the app details.
- Once approved, release the app and share the link only with staff.
- Keep proper login in the app; the link is not security on its own.
Tips to avoid surprises
- Decide at the start whether each app is public, unlisted or private.
- Give reviewers a demo account that works.
- Explain clearly in review notes who uses the app and why.
- Keep the public and internal apps as separate App Store records if their audiences differ.
Takeaway
A rejection is often a distribution question, not a code problem. Read the guideline number carefully before rewriting anything.
Need help publishing an iOS or Android app? Get in touch.