Apple Volume Purchase Program (VPP) (2024)

Last updated
Save as PDF

The Volume Purchase Program (VPP) is an Apple portal for businesses and schools to purchase and license apps and books in volume.Systems Manager fully integrates with VPP to easily distribute, revoke, and centrally manage your licenses, supporting both of Apple’s methods of managed distribution and licensing via redemption code. This article will explain how to link your VPP account to Dashboard, and whatthe licensing distribution options are. VPP facilitates silent deployments of App Store and Mac App Store applications to iOS and macOS devices, while allowing your company/institution to maintain ownership of the applications you purchase.

In order to understand how Apple's managed distribution model is designed, it is strongly recommended to review Apple's Business and Education whitepapers on VPP app distribution before using this tool in Systems Manager.

Enrolling into VPP is free:

Businesses can enroll in VPP here.
Educational institutions can enroll in VPP here.

Note: Apple School Manager VPP accounts support location based VPP licenseswhere a single VPPaccount/token can be connected to Meraki Systems Managerwith licenses purchased from many differentVPP accounts. This makes purchasing licenses and syncing to Meraki Systems Manager a more simplified experience. For more information on location based VPP tokens and all of its features go here. Existing VPPaccounts can be invitedinto the new Apple School Manager location based VPPaccounts by following this.

Adding AppleVPP Account(s) to Systems Manager

Note:It is recommended that your Apple VPP token does not reside in multiple MDM solutions

In Dashboard, navigate to the Organization> MDMpage.
Scroll down to Apple VPPAccounts.
Select Add new.
In the Add VPPaccount windowinput the required information:

Name:Name of the VPP administrator's account. This will be shown on the email sent to invited users, and should indicate your organization.

Email:Email address on record for the VPP account.

Service token:For Education Customers using Apple School Manager (ASM) and Business Customers using Apple Business Manager (ABM), VPP tokens can be downloaded from Account > Preferences > Payments and Billing > Content Tokens.

Allowed admins:Which Dashboard administrators should be allowed to manage users and app licenses for this VPP in Dashboard.

Assignable networks: Which Systems Manager networks within an Organization are able to use VPP device assignment.

5. Click Update.

Note: If a "VPP service token can't be blank" error appearswhen attempting to save, make sure there are no special characters or trailing numbers such as '(1)'in the filename of the vpp service token. This can also indicate that your VPP token is already bound to another MDM solution. If this is the case, you will need to remove the token from the existing solution or generate a new VPP token to upload into Dashboard.

6. Once your account is synced, you should see your licenses populated in Systems Manager > Manage > VPP

Renewing a VPPToken

Renewing a VPPToken is as simple as repeating the steps for adding a VPP token to your Dashboard Organization, but instead of selecting Add Newin step 3 above, you select the pencil iconof the existing VPPToken entry and clickUpdate Token. From there, you can download the new copy of your VPPToken from the ABM/ASM portal,upload it to your Dashboard Organization, and save your changes to complete the VPP Token renewal.

VPP Deployment Methods

There are three options for VPP license distribution. Please see Apple's documentation for a full list of requirements and feature differences.

Device Assignment

Assign licenses to specific iOS, iPadOS,macOS, or tvOS devices, based on serial numbers. This allowsforpushing applications without requiring the device to be signed in with an Apple ID, as well assilently installing apps without any end user input when used with supervised devices.

User Assignment

Assign licenses to a specific users, based on an Apple IDs. This is useful in cases like 1:1 deployments for schools, where students have their own iPads and unique Apple IDs to sign-in with. User assignment can also be used to license iOS App Storeapplications.

Redemption Codes

Distribute licenses as redeemable codes, which can be given to end users to claim. This method is deprecated by Apple, and not recommended over the two managed distribution methods.

Device Assignment

VPP Device Assignment grants app licenses directly to a device, identifying it byserial number. This makes VPPDevice Assignment the best option to use when you do not want to associate your apps to end user's Apple ID(s). Furthermore, on Supervised iOS devices and macOS10.11+, apps install completely silently with VPP Device Assignment.For detailed steps on how to grant and revoke VPPDevice Assignment licenses, please watch the video below:

The following requirements must be met in order to use VPPDevice Assignment:

iOS 9+,macOS10.11+, or tvOS 12+
Systems Manager Enterprise
VPP enabled in Dashboard
Available licenses on the VPP portal

In addition to the above requirements, the app itself must support device assignment. This can be checked by navigating to Systems Manager > Manage > VPP, and checking theDevice-assignablecolumn (shown below). An app with aYsupports device licensing:

To enable VPP device licensing for anapp:

In Dashboard, make sure theapp has been added under Systems Manager > Manage > Apps.
Select the app to view more details.
Enable VPPdevice licensing:
- Free apps:Enable thecheckbox for Use VPP device license.
- Paid apps:Set thePurchase MethodtoVPP Device Assignment:
ClickSave Changes.

On app install, a licensefor the appwill be associated with the serial number of the device that downloaded it, allowing anyone to use the app on that device.

VPP Apple ID User Assignment

VPPUser Assignmentgrants apps to end user's Apple ID(s). This is a great option for 1-to-1 deployments where end users are already using their own Apple IDs. For detailed steps on how to grant and revoke VPP Apple ID licenses, please watch the video below:

Invite User to Receive Licenses

You can bulk import and inviteVPP users via CSV, as well as individually.

Navigate to the Systems Manager > Manage > VPPpage.
Click on the User managementtab.
Select + Add useron the right of page.
Input the account information of the user to grant VPP access.
Find and check the desired user(s) in the list, and select Send invitation(s).
Confirm thatUser statusfor the selected user(s) changes from Newto Invited.
Invited users will receive an email from Cisco Meraki. Accepting the invitation will require the user to sign in to iTunes or the App Store with their Apple ID, and accept Apple's VPP terms and conditions.

Note:Invitation links are unique and can only be accepted once. The Apple ID which is used to accept the invitation is notreceivedor reported by Systems Manager.

The following image shows a list of users with various statuses. Only 'Associated' users have accepted the invite.

Grant License for Desired App to User

To automatically assign licenses to users in scope, and avoid manually granting licenses to users, see this article.

Navigate to the Systems Manager > Manage > VPPpage.
Click on the Licensed applicationstab.
Select the app to grant license for (if multiple VPP accounts have been added on the Org > Settings page, ensure the proper account is selected from the VPP account' drop-down menu).
Check the box next to the user and click on + Grant license to user(s).
Confirm license access to selected number of users.

At this point, 'licensed' users have been granted a VPP license for the selected app. Licensed users will be able to download this app onto theirdevice by signing in with the licensed Apple ID, and navigating to the 'Purchased' tab in Apple's App Store.

In order for the licensed app to bemanaged by Systems Managerthe app must still be deployed via Systems Manager.

Deploying Apps with Systems Manager

Navigate to the Systems Manager > Manage > Apps page.
Select + Add new>iOSApp Store app or macOSApp Store app.
Search for and choose the desired app already licensed.
Define the scope of the app.This should cover the user/devices that were licensed through VPP.
(Paid apps only) Set the Purchase methodto VPP app assignment.
Confirm clients in scope at bottom of page.
Click Save Changes.

Apple Books (iBooks) App License

Apple Books are assigned per user and not per device. Please take note when assigning an Apple book via VPP:
VPPApple book licenses must be granted to an Apple ID (user) and requires an Apple ID to sign in.
VPPApple book licenses are not device assignable.
Apple Book licenses are permanent and cannot be revoked or reassigned.

Irrevocable next to an App verifies the license is permanent and cannot be revoked fromthe Apple ID it is assigned to.

Location Based VPPin Apple School Manager & Apple Business Manager

On Apple School Manager and Apple Business Manager, Apple has added a new concept called "Locations". Locations gives the Apple portal administratorthe ability to transferVPP licenses between different Locations (which willtransfer the VPP licenses between different VPP tokens). Be sure to add the VPPtokens to Org > MDM for all/any of theApple School Manager or Apple Business Manager Locations that you want to sync licenses from. Use the following screenshots to help confirm that the VPP licenses are in the desired VPP Location/token.

Troubleshooting VPP Installs

If you've followed the above steps and have issues installing apps onto your device, see the troubleshooting guide here.

Removing App licenses

Revoking Device Assignment App License

If the App was scoped to specific Devices with a tag,
1. Navigate to the Desired Device details pageSystems Manager > Devices > Desired device
2. Remove the tag from the device (ensuring the tag only affects the App license and not other settings)
3. Save changes at the bottom of the page.
If the App was scoped to All devices and only needs to be removed from some,
1. Navigate toSystems Manager > Manage > Apps page.
2. Search for and choose the desired app already licensed.
3. Define the scope of the app, you will now need to add the tag to all devices in the network that require the app.
4. Confirm clients in scope at bottom of page.
5. Click Save Changes.

Revoke license from removed Device: If the device was removedfrom the dashboard or the tag was removed but the device serial still shows up in the VPP section taking up a device license you can try the following workaround.

Navigate to the Systems Manager Apps list SM> Apps and
Select the specific App and scroll down to Licensing
Under License usage details there will be a "Revoke unknown Licenses" button -This will revoke the device-assigned licenses for any devices that are not currently enrolled and in scope of this app.

Revoking aUser's App License

To automatically revoke licenses from users who are no longer scoped for an app, and avoid manually revokinglicenses from users, see this article.

In order to re-claim a license, the user's app license must be revoked. A license can be revoked for a specific app or a user's access to all licensed apps can be revoked. As per Apple's policies, a revoked user will be granted a 30-day grace period before any re-claimed apps are removed from the user's purchase history. Once a license has been revoked for one user, it can be reassigned to another user after a brief time (typically about two minutes).

To revoke access to a specific app:

Navigate to the Systems Manager > Manage > VPP page.
On the Licensed applicationstab, click on the name of the desired app.
Check the box for the user to revoke access.
Select Revoke license from user(s).

To revoke licenses for all distributed apps by retiring user:

Navigate to the Systems Manager > Manage > VPPpage.
Select the User managementtab.
Check the box next to the user to revoke access.
Select Retire user(s).

aUser's App License

Apple Books (iBooks) App License are Irrevocable

Apple Book licenses are permanent and cannot be revoked or reassigned.

Irrevocable next to an App verifies the license is permanent and cannot be revoked fromthe Apple ID it is assigned to.