Home > Enterprise Mobility Management > Apps and Software > Using Apple’s Volume Purchase Program (VPP) with Systems Manager

Using Apple’s Volume Purchase Program (VPP) with Systems Manager

The Volume Purchase Program (VPP) is an Apple portal for businesses and schools to purchase and license apps and books in volume. Systems Manager fully integrates with VPP to easily distribute, revoke, and centrally manage your licenses, supporting both of Apple’s methods of managed distribution and licensing via redemption code. This article will explain how to link your VPP account to Dashboard, and what the licensing distribution options are.

In order to understand how Apple's managed distribution model is designed, it is strongly recommended to review Apple's Business and Education whitepapers on VPP app distribution before using this tool in Systems Manager. 

Enrolling into VPP is free:

  • Businesses can enroll in VPP here.
  • Educational institutions can enroll in VPP here.

Adding Apple VPP account to Systems Manager

  1. In Dashboard, navigate to the Organization > MDM page.
  2. Scroll down to Apple VPP Managed Distribution.
  3. Select Add an Apple VPP account.
  4. Input the required information:
    • Account Name: Name of the VPP administrator's account. This will be shown on the email sent to invited users, and should indicate your organization.
    • Account email: Email address on record for the VPP account.
    • VPP service token: Download from the Account Summary page on Apple's VPP site. If a "VPP service token can't be blank" error appears, make sure there are no special characters or trailing number (e.g. (1) or (2)) in the filename.
    • Allowed administrators: Which administrators should be allowed to manage users and app licenses for this VPP in Dashboard.
  5. Click Save Changes.
  6. Once your acount is synced, you should see your licenses populated in Systems manager > MDM > VPP

To remove a VPP account, use the X at the end of the row:

The following images show where to download the service token within VPP:

VPP Deployment Methods

There are three options for VPP license distribution. Please see Apple's documentation for a full list of requirements and feature differences.

  • Device Assignment 

Assign licenses to specific iOS devices, based on serial numbers. This allows for pushing applications without requiring the device to be signed in with an Apple ID, as well as silently installing apps without any end user input when used with supervised devices.

  • User Assignment

Assign licenses to a specific users, based on an Apple IDs. This is useful in cases like 1:1 deployments for schools, where students have their own iPads and unique Apple IDs to sign-in with. User assignment can also be used to license macOS applications.

Distribute licenses as redeemable codes, which can be given to end users to claim. This method is deprecated by Apple, and not recommended over the two managed distribution methods.

Note: It is recommended to license apps either by device or user, not both. 

Device Assignment

VPP Device Assignment grants app licenses directly to a device, identifying it by serial number. This makes VPP Device Assignment the best option to use when you do not want to associate your apps to end user's Apple ID(s). Furthermore, on Supervised iOS devices, apps install completely silently with VPP Device Assignment. For detailed steps on how to grant and revoke VPP Device Assignment licenses, please watch the video below: 

The following requirements must be met in order to use VPP Device Assignment:

In addition to the above requirements, the app itself must support device assignment. This can be checked by navigating to Systems manager > MDM > VPP, and checking the Device-assignable column (shown below). An app with a Y supports device licensing:

To enable VPP device licensing for an app:

  1. In Dashboard, make sure the app has been added under Systems manager > MDM > Apps.

  2. Select the app to view more details.

  3. Enable VPP device licensing:

    • Free apps: Enable the checkbox for Use VPP device license.

    • Paid apps: Set the Purchase Method to VPP Device Assignment:

       

  4. ​Click Save Changes.

On app install, a license for the app will be associated with the serial number of the device that downloaded it, allowing anyone to use the app on that device.

VPP Apple ID User Assignment

VPP User Assignment grants apps to end user's Apple ID(s). This is a great option for 1-to-1 deployments where end users are already using their own Apple IDs. For detailed steps on how to grant and revoke VPP Apple ID licenses, please watch the video below: 

The following requirements must be met in order to assign licenses on a per-user basis:

  • iOS 7+, or macOS 10.9+
  • VPP enabled in Dashboard
  • Available licenses on the VPP portal
  • Each user must have a personal Apple ID to receive managed distribution apps. This licensed Apple ID must then be signed in on the iOS device in order to receive VPP apps.

Note: Apple limits each Apple ID to 10 devices, so it is not recommended to use a shared Apple ID across all of your organization’s devices.

Configuring user assignment consists of the following steps:

  1. Invite user to receive licenses.
  2. Grant license for the desired app to the user.
  3. Deploy the app with Systems Manager.

A license can also be reclaimed by revoking a user's app license.

Invite User to Receive Licenses

You can bulk import and invite VPP users via CSV, as well as individually. 

  1. Navigate to the Systems manager MDM > VPP page.
  2. Click on the User management tab.
  3. Select + Add user on the right of page.
  4. Input the account information of the user to grant VPP access.
  5. Find and check the desired user(s) in the list, and select Send invitation(s).
  6. Confirm that User status for the selected user(s) changes from New to Invited.
  7. Invited users will receive an email from Cisco Meraki. Accepting the invitation will require the user to sign in to iTunes or the App Store with their Apple ID, and accept Apple's VPP terms and conditions. 

    Note: Invitation links are unique and can only be accepted once. The Apple ID which is used to accept the invitation is not received or reported by Systems Manager.

The following image shows a list of users with various statuses. Only 'Associated' users have accepted the invite.

Grant License for Desired App to User

To automatically assign licenses to users in scope, and avoid manually granting licenses to users, see this article.

  1. Navigate to the Systems manager > MDM > VPP page.
  2. Click on the Licensed applications tab.
  3. Select the app to grant license for (if multiple VPP accounts have been added on the Org > Settings page, ensure the proper account is selected from the VPP account' drop-down menu).
  4. Check the box next to the user and click on + Grant license to user(s).
  5. Confirm license access to selected number of users.

At this point, 'licensed' users have been granted a VPP license for the selected app. Licensed users will be able to download this app onto their device by signing in with the licensed Apple ID, and navigating to the 'Purchased' tab in Apple's App Store.

In order for the licensed app to be managed by Systems Manager the app must still be deployed via Systems Manager. 

Deploying Apps with Systems Manager

Although Systems Manager can license OS X App Store applications with VPP, it does not push out the downloads for them. See this article for steps on how to deploy OS X through installers.

  1. Navigate to the Systems manager > MDM > Apps page.
  2. Select + Add new > iOS app.
  3. Search for and choose the desired app already licensed.
  4. Define the scope of the app. This should cover the user/devices that were licensed through VPP.
  5. (Paid apps only) Set the Purchase method to VPP app assignment.
  6. Confirm clients in scope at bottom of page.
  7. Click Save Changes.

Revoking a User's App License

To automatically revoke licenses from users who are no longer scoped for an app, and avoid manually revoking licenses from users, see this article.

In order to re-claim a license, the user's app license must be revoked. A license can be revoked for a specific app, or a user's access to all licensed apps can be revoked. As per Apple's policies, a revoked user will be granted a 30-day grace period before any re-claimed apps are removed from the user's purchase history. Once a license has been revoked for one user, it can be reassigned to another user after a brief time (typically about two minutes).

To revoke access to a specific app:

  1. Navigate to the Systems manager > MDM > VPP page.
  2. On the Licensed applications tab, click on the name of the desired app.
  3. Check the box for the user to revoke access.
  4. Select Revoke license from user(s).

To revoke licenses for all distributed apps by retiring user:

  1. Navigate to the Systems manager > MDM > VPP page.
  2. Select the User management tab.
  3. Check the box next to the user to revoke access.
  4. Select Retire user(s).

 

Troubleshooting VPP Installs

If you've followed the above steps and have issues installing apps onto your device, see the troubleshooting guide here.

You must to post a comment.
Last modified
15:33, 26 May 2017

Tags

This page has no custom tags.

Classifications

This page has no classifications.

Article ID

ID: 5291

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case