It took some time to figure this out because it's so obvious :) My mistake was that I was trying to test with an IPA exported for App Store submission. There is a different method in the export options called release-testing, and with that method the exported IPA can be deployed via MDM. (The devices need to be registered for development on the account, the provisioning profile needs to include those devices, and developer mode needs to be turned on.) Yay!