When are profiles renewed when using "Automatically manage signing"/allowProvisioningUpdates?

I contacted Apple and here's what they had to say:

Automatically manage signing on Xcode only creates a new provisioning profile after the expiration date of the previous.

That is the best option for new builds that needs to be submitted to App Store because there is no downtime from current users when the provisioning profile.

As you are developing in-house apps, if you let the provisioning profile expire to automatically sign for your new build (with new provisioning profile auto-created) your users will not be able to access you app.

Therefore the answer seems to be that we shouldn't be using automatic signing for in-house/enterprise distibution, but instead only for App Store deployments.

I was having this same problem with a few apps that we distribute in-house... The solution that finally worked for me, was deleting the App ID from the developer center, then letting Xcode re-create it and any accompanying provisioning profiles. One thing to keep in mind though, is that if you only have 1 app ID in your developer center, then deleting it will also delete your signing certificate along with the provisioning profiles. We have several apps dependent on our certificate, so it wasn't deleted. However the main issue regarding the soon-to-be-expiring provisioning profile was resolved.

Try to manually create second provisioning profile at Dev portal, remove old profile from build server's ~/Library/MobileDevice/Provisioning Profiles, download and install new profile.