Bonjour everyone. Today let’s learn how to Deploy Apps to iOS Devices through VPP (Volume Purchase Program) using Intune. Apple Volume Purchase Program helps purchase and distribute iOS/iPadOS/macOS apps in bulk.
We can distribute the apps purchased through VPP using the MDM solution or Redeemable Codes. Microsoft Intune helps admins to Sync, manage, and distribute the purchased apps. It also helps to track and retain the ownership of purchased apps in a controlled manner.
The VPP can be used for managing and distributing not only B2C apps but also B2B apps, where an organization has custom iOS apps developed by third-party vendors, and these apps can be procured privately by using the VPP app store.
In this article, we will be focusing on how to integrate VPP Tokens with Intune, how to purchase apps, and how to distribute these apps using Intune. Let’s learn how to do these and more about Apple’s Volume Purchase Program.
Enroll in Apple Volume Purchase Program
To start using Apple VPP, we need to enroll in Apple VPP. If you have already created Apple Business Manager Account, we can utilize the same for VPP. To create an ABM account, you may refer to the explanatory video on YouTube that illustrates the process of creating an ABM account.
Once the ABM account is created, log in to the ABM portal with the Administrator account, click Preferences, Payments, and Billing, and update the credit card information. This information is used to purchase the apps from the VPP store. If the app is free, no charges are added to the credit card. It is not mandatory to add the Payment details.
NOTE! Earlier, we could create a VPP account separately. Now Apple advises all to upgrade their VPP account and Apple Deployment program account to Apple Business Manager Account.
Integrate Volume Purchase Program with Intune
To start using Apple VPP, we must integrate Volume Purchase Token in Intune. Volume Purchase tokens are used to purchase and manage licenses of apps purchased in the Apple Business Manager account. We need to add these VPP tokens in Intune. We can have multiple tokens in Intune. We can add VPP to multiple MDMs as well.
In the steps below, let’s see how we can generate and upload a VPP token to Intune.
- Log in to the Apple Business Manager portal with the appropriate admin role.
- Click on your name at the bottom and click on Preferences
Now click on Click on Payments and Billing under Content Tokens, and click on Download the Token, this is the VPP token we need to upload in Intune. This Token is generated by default when you create the ABM account based on your Location.
You can add a new Token by adding a new Location under the Locations section. Let us see how to upload the VPP token in Intune with the below steps.
- Sign in to Microsoft Intune Admin Center https://intune.microsoft.com/
- Click on Connectors and Tokens
- Click on Apple VPP Tokens
- Click on Create
Now on the Basics page, provide the name for the VPP token and enter the email address used to download the VPP token. Upload the downloaded Token and click on Next.
Now on the settings page, choose the following settings and their values per the table below.
| Settings | Value |
|---|---|
| Take control of token from another MDM | Select Yes, if you want to reuse the MDM toke issued to another or third-party MDM. Else, select NO. |
| Country/Region | Select the Country to deploy the apps |
| Type of VPP account | Select Business for organizations and Education for educational institutions |
| Automatic app updates | Select Yes, if you want to reuse the MDM toke issued to another or third-party MDM. Else, select NO. |
After Selecting the settings Values, check “I grant Microsoft permission to send both user and device information to Apple.” When we accept, Intune shares the below information with Apple in the case of VPP. The below data is referred from Microsoft.
| Data Sent to Apple | Data used for |
|---|---|
| Intune UserId guid | GUID generated by Intune |
| Location Token/VPP Token | Detail of VPP token used to integrate with Intune |
| Managed AppleId UPN | The admin uses Apple Id to set up the integration between Intune and ABM accounts. |
| Serial Number | Serial number of the device |
Now click on Next to Scope tags page and add Scope tags, if you have any, and click Next. Review the settings and create the VPP token. This will establish the connection between ABM and Intune. The validity of the VPP token is one year. Now we are done with the first half of the article. Let us see how we purchase and deploy the apps to end users using Intune.
How to Purchase App from Apple Business Manager
Now that we have successfully added the VPP token to Intune Let us see how we can purchase the apps in the VPP store.
- Log in to the Apple Business Manager portal with the appropriate admin role.
- Click on Apps and Books
- Search for the app you want to deploy
Now click on the Application, this will open application details to buy licenses. Under the Assign to section, select the Location the app has to deploy, enter the quantity, and click on Get. As the above Application is free, the total cost is 0.
Let’s see the changes for purchasing paid apps in the VPP store. If the Application is a paid version, the total cost of the app license will be shown, and the amount will be deducted from the credit card we added. If the app is paid, we can choose how to distribute the app by selecting the license type. Rest options are the same as in free apps purchase.
The available license types are “Managed” or “Redemption code.” If you want to distribute the app through MDM, select the “Managed” license type. If you want to distribute to individual users without MDM, you can choose the Redemption code. Users have to use the redemption code while purchasing the app. Once the apps are purchased successfully, they will sync to Intune. The sync will take a while.
Once the apps are purchased, we can view all the apps we purchased. When we select an app, we can also view the number of licenses available, if you want to increase the license, we can do that by entering the license quantity.
Apple Business Manager Admins will receive a confirmation email regarding the purchase from Apple, stating that you have purchased the license for the Application as shown below.
Deploy Apps to iOS/iPadOS Devices purchased by the Volume Purchase Program in Intune.
Now we have applications successfully purchased from the VPP store. Once the apps are synced, we can view them in Intune and assign the apps to user groups. Follow the below steps to assign the apps in Intune.
- Sign in to Microsoft Intune Admin Center https://intune.microsoft.com/
- Click on Apps
- Search for the app
Intune shows the app types for Volume Purchased apps as “iOS Volume Purchased Program App.” As we have purchased the Company Portal app, let’s see the deployment of the Company Portal app. Select the app, and Intune will show all the app details in the properties section.
To assign the app, scroll to the bottom of the properties page and click Edit next to Assignments. Now we can add user groups to which the app has to be assigned. After selecting the groups, click on license type and choose the type of license to be assigned, “User licensing” or “Device licensing.” After selecting the required license type, click on save.
Now click on Next to review the assignments and Save the assignments. Once the User enrolls the device, the User will get the app per the assignments.
Note! Intune will not install the VPP Apps on user devices. Instead, Intune sends the data to VPP about which apps license to be assigned to which device, and Apple will take responsibility for installing the apps on devices.
End-user Experience
Once the User enrolls the device or is already enrolled in the device for the first time user is prompted with a popup stating to “Allow apps and Books Assignment,” the User needs to click on Continue. After clicking o Continue user will be prompted with an iTunes license agreement. Read the License Agreement and click on agree.
After agreeing to the license, the User gets confirmation that Organization and now assign the apps and books to the User. In addition to the Company Portal app, I have added the Zoom application to the VPP store and assigned the app as Required mode in Intune.
So, now the users will get a prompt to install the app, and the User can also observe that the message states the User is not charged for the app as it is deployed from the VPP store. Once the User clicks on Install, the app will be installed on the User’s device.
On the Apple Business Manager portal, we can view how many licenses are in use and the remaining licenses for each app as we installed the Zoom app. Once the user license is in use, the remaining licenses are 9.
So as we used the BYOD scenario and User license for the VPP, the User is prompted to join the VPP and install the apps on devices. If the license is assigned as Device-based, users are not prompted to join VPP.
Conclusion
So, the Apple Volume Purchase Program is very useful in scenarios where the devices enroll using Apple Device Enrollment Program( used for corporate devices) and when you have purchased apps and want to distribute them in a controlled way. We can reassign the licenses for a new user when the licensed User leaves the Organization.
In conclusion, implementing a volume purchase program can greatly benefit businesses. It provides cost savings and convenience and allows for easier management and distribution of apps and software within the Organization, as shown above. Let’s meet again with a new article. Stay tuned for more new topics.
Author
About Author – Narendra Kumar Malepati (Naren) has 11+ years of experience in IT, working on different MDM tools. Over the last seven years, Naren has been working on various features of Intune, including migration from different MDMs to Intune. Naren mainly focuses on Android, iOS, and MacOS.