Configure VPP

When acquiring and distributing apps to users, the administrator of an MDM system faces certain challenges. When users obtain an app from the Apple App Store, whether from a school/corporate or personal device, the app must be downloaded individually using a personal Apple ID. The app license then does not belong to the school or company, but is assigned to the private Apple ID.

This is especially a problem with paid apps when the procured app license is reimbursed to the users in the form of cost reimbursement or purchased coupons, as users always remain the owner of the app license via the personal Apple ID. If the school is changed or the company is left, the app license is irrevocably lost with the students or employees. If an app is to be distributed to a large number of devices, the use of personal Apple IDs quickly creates a confusing and difficult-to-control situation for the administrator.

What is Apps and Books (VPP) for? #

To solve the challenges described above and to be able to distribute apps from the Apple App Store via Relution without requiring an Apple ID on the mobile device, there is Apple’s Apps and Books program (VPP in the portal), formerly the Apple Volume Purchase Program. This allows apps to be purchased centrally in large quantities and distributed independently of the user without requiring an Apple ID on the devices. App licenses from Apps and Books, called VPP licenses in the portal, are thus centrally managed without ever changing ownership and can be withdrawn at any time by the administrator.

Apps and Books is mapped and configured via the Apple Business Manager or Apple School Manager. This is also where app licenses are procured centrally using a school or company Apple ID. This applies to both free and paid apps.

How is VPP linked to Relution? #

In order to distribute procured VPP licenses via Relution, the two systems must be linked. In Apple Business Manager or Apple School Manager, a new location is first created under Locations.

To connect this location to an MDM server, a VPP token (content token) is downloaded for the respective location. In Apple School Manager, the location is selected under Locations and Download is clicked in the Content Token section. In Apple Business Manager, the token is available under Settings → Apps and Books.

Once the VPP token is uploaded to Relution under Settings → Volume Purchase Program (VPP) → Account, the two systems are linked.

If the token is already managed by another MDM server, the dialog points this out when the account is created. When the account is created, Relution takes over the management of the token. The Subscription State column in the account list shows whether Relution is registered for notifications from Apple for this account. This requires the Relution server to be reachable for the Apple servers.

Email notifications for expiring and expired VPP and DEP tokens are enabled by default and can be adjusted under Settings → Notifications via VPP token will expire soon, VPP token is expired, DEP token will expire soon and DEP token is expired. The first reminder is sent 30 days before expiration, then daily from 15 days before expiration. The emails go to the users who are permitted to manage the VPP or DEP settings.

The use of multiple VPP tokens in a Relution organization is described in a separate section.

After pairing, the menu items Purchased Apps and Media appear in Relution under Apps. Purchased Apps lists all apps procured via Apps and Books and the corresponding VPP licenses (number), Media contains the procured books. The VPP licenses are automatically synchronized at regular intervals. In addition, the VPP licenses for the organization can also be updated manually via Synchronize. The history of synchronizations, including failed runs, is shown under Settings → Volume Purchase Program (VPP) → Synchronization History.

How are app licenses obtained in VPP? #

In Apple School Manager, app licenses are obtained via App Store in the left sidebar. After searching, the desired app is added to the library via Add on its detail page.

In the Add to Library dialog, the locations that receive access to the app are selected under Locations. The selection is applied with Add and then confirmed via Review.

In Apple Business Manager, app licenses are obtained under Apps and Books and assigned to a configured location.

Once loaded, they are available in Apple Business Manager or Apple School Manager. In addition, the app licenses can be distributed to devices in the appropriate organization in Relution associated with the selected location via a VPP token.

Can VPP also be used to manage app licenses for different organizations or locations? #

If multiple organizations are managed in Relution via the multi-client capability, as is the case, for example, with a school board with multiple schools, then app licenses can be procured centrally with an Apple ID of the school board and distributed to the respective schools. To do this, a location must be created in Apple School Manager for each school and the VPP token must be stored in the corresponding Relution organization of each school. This applies analogously to Apple Business Manager in the corporate context.

Purchased VPP licenses can be managed in Apple Business Manager or Apple School Manager and transferred to other locations. This makes it possible to procure app licenses centrally once for a leading site and then distribute them to other sites in packages.

Is it possible to use multiple VPP tokens within a Relution organization? #

Within Relution, it is possible to store multiple VPP tokens under Settings → Volume Purchase Program (VPP) → Account. The purpose of this is to link different Apple School Manager accounts, e.g. if a school is equipped with VPP apps by a school board, but at the same time also owns and uses its own VPP licenses. Analogously, this also works with Apple Business Manager.

The sum of all app licenses from multiple VPP tokens for an organization is displayed aggregated in the Purchased Apps view. A drop-down list can be used to filter VPP licenses by location from Apple School Manager.

VPP licenses are assigned under Apps → Purchased Apps: after selecting an app, Associate license opens a dialog for selecting devices, users or groups. If the app license exists in more than one stored VPP token, the token to use for the app license is selected first. Revoke license removes an assignment again. As of Relution 26.5.5, only assignments from the current organization and its sub-organizations are revoked; revoking across organizations is only possible from the global organization. Assignments outside this scope remain in place, and a warning shows their number.

Global VPP #

With Relution, it is possible to integrate VPP tokens into the global organization. This allows centrally purchased apps to be distributed down to tenants.

A VPP token in the global organization is automatically available in all organizations, a VPP token in a meta organization in its sub-organizations. Apps from VPP accounts of the global organization automatically replace existing apps in the other organizations; this cannot be undone. In the subordinate organization, the inherited token cannot be edited (including the app update settings); only its order can be changed. In Purchased Apps and Media, the assignments shown refer to the current organization, while the total number of licenses applies across all organizations.

This eliminates the need for multiple setups in the Apple School Manager / Apple Business Manager as well as the repeated updating of multiple tokens. In the best case, only a single token needs to be renewed once per year.

Important note on licensing #

It is essential that sufficient VPP licenses are purchased for all devices and tenants.

Example:

• Organization 1: 250 devices
• Organization 2: 100 devices
• Organization 3: 1000 devices

In this case, at least 1350 VPP licenses should be purchased globally.

Tenant-specific VPP tokens #

If a site requires paid apps or an additional separate VPP token with its own apps, this can be integrated directly into the respective tenant.

This allows a clear separation of costs and licensing between global and local management.

Can VPP licenses in Relution also be automatically assigned to devices? #

If apps are automatically installed on devices via auto-deployments or a policy (app compliance), Relution checks if a VPP license is stored for this app. If so, the VPP license is automatically assigned to the device. For App Store apps that support only macOS or only tvOS, VPP licenses are a prerequisite for an auto-deployment: without available VPP licenses in the organization, no auto-deployment can be configured for these apps. For iOS apps, the VPP license is optional. If multiple VPP tokens are stored for the organization and the app license is present in all of them, the VPP license from the first VPP token in the list is used. Under Settings → Volume Purchase Program (VPP) → Account the order of the VPP tokens can be changed to determine from which token the VPP license should be used in case of automatic assignment via auto-deployments.

Whether Relution installs available updates of apps from Apps and Books on the devices is defined under Settings → Volume Purchase Program (VPP) → App updates with Perform app updates: Never, Immediately, after an app update was detected or Scheduled. For a schedule, the weekdays are specified under Repeats on together with the Start time.

Common errors when uploading tokens, an overview of file extensions and reasons for premature token invalidation are described under Important Notes & Troubleshooting →.