Renew DEP / VPP Tokens

Introduction #

Apple DEP and VPP tokens have a maximum validity of 1 year and must be renewed regularly to ensure uninterrupted device management and app assignment. This guide explains how to easily renew these tokens.

Additionally, as of version 5.33, Relution provides a centralized overview of all connected DEP tokens. Administrators of the Global organization can see at a glance:

• Which DEP tokens are valid or expired
• When the respective tokens expire

Token Overview in the Relution Portal #

Accessing DEP Accounts #

To access the central overview of DEP accounts, follow these steps:

1. Log in to the Global organization.
2. Open Settings in the left sidebar.
3. Navigate to the Device platform specific section.
4. Select Apple Automated Device Enrollment.
5. Open the All DEP accounts tab (available from version 5.33.0).

Accessing VPP Accounts #

To access the overview of VPP accounts, follow these steps:

1. Log in to the Global organization.
2. Open Settings in the left sidebar.
3. Navigate to the Volume Purchase Program section.
4. Select User Account.
5. Open the All VPP accounts tab (available from version 5.33.0).

Renewing VPP Tokens (Content Tokens) #

Download from Apple School Manager (ASM) #

1. Log in to the Apple School Manager.
2. Click on the logged-in user name in the bottom left corner.
3. Open Settings.
4. Select Apps and Books.
5. Download the content token for the desired location.
   • File format: sToken_for_[Location].vpptoken

Download from Apple Business Manager (ABM) #

1. Log in to the Apple Business Manager.
2. Click on the logged-in user name in the top right corner.
3. Open Settings.
4. Select Preferences → Payments and Billing.
5. Download the content token for the desired location.
   • File format: sToken_for_[Location].vpptoken

Uploading to Relution #

1. Log in to the Relution portal and switch to the corresponding organization.
2. Open Settings.
3. Navigate to Volume Purchase Program (VPP) → User Account.
4. Select the token to be renewed via the three-dot menu.
5. Click Update token.
6. Upload the previously downloaded file (*.vpptoken).
7. Complete the process by clicking Update token.

Renewing DEP Tokens (Server Tokens) #

Download from Apple School Manager (ASM) #

1. Log in to the Apple School Manager.
2. Click on the logged-in user name in the bottom left corner.
3. Open Settings.
4. Under Your MDM Servers, select the desired server.
5. Click Download Server Token.
6. Confirm the prompt:

   Downloading a new MDM server token will reset the existing token.

7. Download the token file.
   • File format: *_smime.p7m

Download from Apple Business Manager (ABM) #

1. Log in to the Apple Business Manager.
2. Click on Devices in the top center.
3. In the left navigation sidebar, select Management Servers.
4. Choose the desired MDM server from the list.
5. In the details pane on the right, click the three-dot menu (…) and download the token.
   • File format: *_smime.p7m

Uploading to Relution #

1. Log in to the Relution portal and switch to the corresponding organization.
2. Open Settings.
3. Navigate to Device platform specific → Apple Automated Device Enrollment.
4. Select the desired token via the three-dot menu.
5. Click Update token.
6. Upload the *_smime.p7m file via Select file.
7. Complete the process by clicking Save.

Important Notes & Troubleshooting #

Common Errors #

In practice, VPP tokens (.vpptoken) and DEP tokens (.p7m) are frequently mixed up and uploaded into the wrong menus. When this happens, Relution will trigger error messages such as “Invalid Token” or “Uploaded file invalid”.

File Extensions Overview #

Premature Token Invalidation #

A token can become invalid before its regular 1-year expiration date. Common causes include:

• Password Changes: The password of the underlying Managed Apple ID in ABM/ASM was changed.
• Account Status Changes: The administrator account used to generate the token was deleted, deactivated, or downgraded in permissions.
• New Apple Terms & Conditions: Apple has published updated terms of service in the ABM/ASM portal. Token communication is temporarily blocked until a main administrator accepts the new terms within the Apple portal.