We all know about shadow IT and the trials of BYOD, but what if you could create a private corporate app store offering all available IT-approved Web and mobile apps (for all approved operating systems).

Salesforce.com announced Thursday that it's turning that what-if into a reality with the Salesforce Private AppExchange. As the name suggests, it's a corporate-customizable spin on the Salesforce AppExchange, but it's not limited to AppExchange partner applications like Concur, DocuSign, Dropbox or Evernote. You can add custom corporate apps or public apps (even Angry Birds) to your Private AppExchange if you so wish, but not all apps, and indeed not all users, get equal treatment.

One of the benefits of an app store is that it handles all the messiness of installing and provisioning apps. In the corporate context this involves identity access controls and authorizations as well as, where applicable, provisioning access to corporate servers and systems. Companies may already have something like an app portal or resource page within an intranet or collaboration environment, but the provisioning part likely involves a clunky IT ticket logging process.

Salesforce says Private AppExchanges eliminate the provisioning hassles by taking advantage of Salesforce access controls and the company's recently launched Salesforce Identity service. Here's where differences might emerge.

[ Want more on the Salesforce Identity service? Read Salesforce.com Creates Single-Sign-On Cloud. ]

The Private AppExchange is a free service for Enterprise and Unlimited subscribers. If you want to provide access to employees who do not have enterprise seats, you can add them through the Salesforce Identity service, which is also free to Enterprise and Unlimited Edition licensed users but is $5 per user, per month for non-Salesforce subscribers. [Author's note: this article was updated to note the $5 per-user, per-month charge for adding employees without enterprise seats.]

There's also a Salesforce Identity connector to corporate identity directories such as Active Directory and flavors of LDAP. The connector adds a $1 per-user, per-month charge to Salesforce Identity.

There are more bells and whistles to the Private AppExchange, including the ability to give the store a custom look and feel, organize categories of apps and create an app approval process if you want to limit certain apps to certain users (sales apps to salespeople, etc.). You can also monitor and measure traffic, downloads and app usage by page, category and app.

Here's where differences by app may emerge. If it's a public app that's not on the AppExchange, the Private AppExchange may have to send you off to the Apple or Android app stores to do the actual download. You can still see how many people browsed and who downloaded the app (because the Private AppExchange served as the gateway), but if there's no tie to Salesforce subscriber or Salesforce Identity logins, you can't monitor the usage of the app.

There's a bit of overlap here with the Salesforce Identity App Launcher, which lets users launch the specific AppExchange apps they are entitled to use, but that tool does not support the wide world of apps that aren't in the AppExchange.

With the Private AppExchange, Salesforce is giving companies another reason to choose Enterprise subscriptions and to add the Salesforce Identity service and an LDAP connection to all employees. From IT's perspective, it's an option for reigning in the chaos and clunky processes that currently prevail for disseminating IT-approved applications.