Development provisioning profile devices

Question

After lots of research, I understand that an app signed with an iOS development provisioning profile can only be installed on devices which have their UDIDs listed within the provisioning profile (which is done on the dev portal). To further my understanding of how this all works, I've created a new development provisioning profile which has only 1 device listed, and that device isn't the one I'm using. For some reason, when I sign an app using this provisioning profile through both xcode and cordova, the app will be installed and deploy as if that device's UDID were listed within the provisioning profile (which it isn't).

I've been using the following to inspect the embedded.mobileprovision profile within the .ipa

security cms -D -i <provprofile>

And there's only 1 device listed, and the UDID of that device doesn't match the UDID of the device which I've managed to install the app on.

Am I missing something here? This issue linked below seems to indicate that this shouldn't work.

Development Provisioning Profile

Answer 1

The embedded provisioning profile with the app isn't the only profile at play here. The device will allow the app to run as long as there is a valid provisioning profile that includes the device and includes the app ID the app is using.

I suspect you had previously installed the app (or another app) that had a valid provisioning profile for that device. The profile either had the same app ID, or was using a wildcard app ID, and is likely still on the device. Because iOS can find a valid profile, it lets the app run.

To verify if this is the case, Plug the device into a Mac, open Xcode, and go to the Devices window. Select the device in question, right-click on it, and select the "Show provisioning profiles..." menu item. You may see other provisioning profiles that are still on the device from previous installs.