In work I often have to create ipa files using various provisioning profiles. And every now and then I would get a message 'The app "XXXX" was not installed on the XXXXXXX because the entitlements are not valid'. I couldn't see what was causing this as I knew that on other projects I had used that same provisioning profile successfully and if i switched to certain other provisioning profiles to sign I didn't get it.
After much swearing at I various pieces of software - xCode3 and 4, iTunes, iOS, etc I finally stumbled upon what was causing this:
In the Target's build settings for "Code Signing Identity", the profile selected here was not the same as the profile I was then going on the use to sign the ipa file with, when I changed this to be the same one as I was signing the application with all was good in the universe and I was able to get a working ipa file out there. In these cases I was creating more than one ipa file of the same build with different provisioning and didn't want to have to rebuild the project so was just switching the signing profile at share time. It was this shortcut that ended up costing me time. Lesson learnt.