Already released Managed Package to AppExchange

Question

I'm a bit overwhelmed by the amount of information on publishing apps to AppExchange. Could please someone clairify how the following scenarios would go?

Let's suppose that our clients are using our MP v.1 (not published on AE). Then we create v.2 and submit it for security review (the app is going to be free of charge).

1. Security review is successful. Will our already existing clients be able to upgrade their v.1 to v.2? Will they be visible in LMA?
2. Security review fails. This article states that in this case:

"You cannot publish your application on the AppExchange or distribute it to any customers until all findings have been addressed and a follow-up review has been conducted."

Will v.1 keep working?

Thanks in advance

Answer 1

Managed packages are automatically upgradeable by nature. As far as I'm aware, there's no technological constraint that would prevent v2 from being installed by customers, or upgradeable by your v1 customers. However, without a successful security review, you will be restricted from making your package public on the AppExchange, which is your ultimate goal. Technically, your package is installable without a security review.

For example, if you had a single client that you built a custom package for, but wasn't meant for the public, you could give them a package that you could maintain for them. The upgrade process works normally, as does LMA.

However, without a successful security review, it won't be a no-limit app (each field, object, etc will count against that org's limit). It also won't be able to use the API for free like a security-reviewed app can, nor will you have access to subscriber login access.