The Apple Volume Purchase Program (VPP) allows organizations to purchase apps in volume to distribute to their managed iOS devices. After registering with the Apple VPP and on purchasing apps, ZENworks enables distribution of these purchased apps to the devices or to the users who have enrolled their devices. Using ZENworks, administrators can easily distribute, reclaim, and reassign iOS apps using the existing Bundles workflow. ZENworks also enables distribution of apps from multiple VPP accounts that your organization might possess.
ZENworks lets you purchase and distribute VPP apps using the Apple Deployment Programs account and Apple Business Manager. In Apple Deployment Programs all licenses are linked to the email ID of the VPP purchaser and it uses an account-based token (hereafter referred to as legacy token within this article). Whereas, in Apple Business Manager all licenses are linked to a location and it uses a location-based token. ZENworks lets you associate a location-based token to an existing subscription and it ensures that all existing bundle assignments work seamlessly with Apple Business Manager.
If you have already enrolled in the Apple Deployment Programs account and want to upgrade to Apple Business Manager, then before migrating, it is recommended that you review the best practices for migration by referring to both the Apple Support documentation (for general information on the migration process) and the Best Practices section (for information on migrating to a location-based token within ZENworks) in ZENworks Mobile Management Reference. This will ensure that Apple Business Manager works seamlessly with ZENworks and the existing bundle assignments are not affected.
IMPORTANT:If you are purchasing VPP apps using Apple School Manager, ensure that the Content Manager role is assigned to your Apple School Manager account. For more information, see the Apple School Manager Help.
To help ZENworks distribute the apps purchased through the Apple VPP, you need to create an Apple VPP Subscription in ZCC. This will enable you to link your ZENworks Server to the VPP account to retrieve all apps purchased using the VPP account.
NOTE:Before subscribing to Apple VPP, ensure that the configuration tasks to Get Started with the Mobile Management feature of ZENworks Configuration Management are already in place. For more information, see Getting Started.
Ensure that you have already enrolled for either of the two programs:
Apple Deployment Programs account: Navigate to deploy.apple.com and create your program agent account. For more information, see the Apple Documentation.
Apple Business Manager: Navigate to business.apple.com to create your Apple Business Manager account. For more information, see the Apple Documentation.
While creating an Apple VPP Subscription, you need to perform the following tasks:
Download the VPP Token: Navigate to the Volume Purchase Program web portal or the Business Manager web portal to download a legacy token or a location-based token, respectively.
Upload the token in ZCC: Navigate back to ZCC and upload the legacy token or the location-based token. This will link the ZENworks Server with the Apple VPP account. Henceforth, the Apple server will validate ZENworks as your EMM vendor based on the uploaded token, while performing any operation on behalf of your organization. The following might occur after a token is successfully uploaded:
Any existing licenses associated with the token are reset and the associated users, if any, are also retired.
If the token is already in use by another MDM solution, then ZENworks will notify with an appropriate message and you can Claim Management of the token.
If the token was previously used by a subscription (that is deleted but its bundles are retained) within the ZENworks zone, then the new subscription will reflect the licenses already consumed. This is achieved by reconciling the VPP account of the new subscription with the one of the deleted subscription.
Specify Bundle Details: You can choose to retain the default location where the VPP bundles should reside or choose another location. Within this folder location, another folder with the name of the subscription is created in which the bundles will reside. You can also specify other details for these bundles, such as allowing ZENworks to take ownership of the app or retaining the app after enrollment.
Specify the bundle creation schedule: Based on this schedule, ZENworks contacts the Apple Server and retrieves the latest apps associated with the VPP account and creates bundles for it in ZCC.
After creating the subscription, you can view its status in the Subscribe and Share section of ZCC. Claim in Progress and Claim Failed statuses indicate that the process to claim management of the VPP account from another MDM solution is either in progress or has failed. If the claim fails, ZENworks will retry until the claim is successful. However, if for any reason the status remains as Claim > Failed for a substantial period of time, then it is recommended that you delete the subscription along with its bundles and create a new subscription.Until the claim is successful, you will be unable to perform actions such as creating bundles, with this subscription.
IMPORTANT:Any replicated content objects, such as bundles that are associated with Apple VPP Subscriptions should not be shared across multiple zones.
ZENworks creates VPP bundles based on the Schedule Type selected while creating the Apple VPP Subscription. However, if you have not specified a schedule or if you want to create bundles immediately, then you can perform any of the following actions:
Click Run Now by navigating to Subscribe and Share > <Select a Subscription> > Quick Tasks > Run Now or by navigating to the Summary page of the Apple VPP Subscription. This action initiates a sync between Apple and ZENworks to retrieve the latest apps. Subsequently, bundles are created for these apps.
Click Create Bundle on the Apps Catalog page to create bundles specific apps.
If at any point in time bundle creation fails, then check the logs for details on this failure. Bundle creation might fail due to one of the following reasons:
The Apple Server is busy and not responding.
Apple is unable to provide the latest app metadata as Apple might have discontinued support for the app.
Apple has extended VPP support to a new country, which is not supported by ZENworks. Contact the Global Technical Support to include the country in ZENworks.
You can distribute apps purchased through the Apple Volume Purchase Program (VPP), by assigning VPP bundles to either the devices or to the users who have enrolled their devices to the zone.
When a bundle is assigned to a user or a device and the associated device syncs with the ZENworks Server, the app license is Consumed from Apple. Subsequently, the user is prompted to confirm the app installation. Based on the user’s response, the app is Installed on the device. The license consumption and installation count is updated on the Apps Catalog page in ZCC.
NOTE:If a bundle is assigned to multiple devices, device groups or folders, or multiple users, user groups or folders, then the app licenses are distributed based on the order in which the devices sync with the ZENworks Server.
VPP Bundles can be distributed to users, user groups, or user folders.
If a VPP bundle is assigned to a user for the first time, then as soon as the first device associated with the user syncs with the ZENworks Server, an invitation is sent to the user to join the Apple VPP.
To accept the invitation, the user needs to sign in with their personal Apple ID. This Apple ID is registered with the Apple VPP, but remains private and is unknown to ZENworks. As soon as the users agrees to the invite and accepts the iTunes Store terms and conditions, they are associated with ZENworks. In the next sync, the app license is consumed from Apple and a message is sent to the device prompting the user to confirm whether to install the app or not. Based on the user’s response, the app is installed on the device.
NOTE:The invite is not re-sent to the user for subsequent assignments, if the user has already associated with the Apple VPP.
The Apple ID which the user has associated with the Apple VPP, should be used across all the user’s devices to enable successful installation of VPP apps. Also, it is important that the Apple ID does not change, so that all bundle assignments are successful and all assigned apps are retained on the device. If the user logs into the iTunes account using a different Apple ID, then the apps distributed to the user are revoked.
NOTE:The terms Apple ID and iTunes ID are used interchangeably in ZENworks.
VPP bundles can be distributed to devices, device groups, or device folders.
VPP bundles can be distributed to only those iOS devices that are running on iOS versions 9.0 or newer.
When a bundle is assigned to the device and the device syncs with the ZENworks Server, the server consumes the app license for the device from Apple. If the license consumption is successful, the user is prompted to install the app on the device.
If at any point in time bundle assignment or distribution fails, then you need to check the bundle Deployment Status to identify the reason for failure. Bundle distribution might fail due to the following reasons:
A VPP bundle is assigned to a device with iOS version prior to 9.0. Apple supports device assignments on iOS versions 9.0 or newer.
A VPP bundle is assigned to a user and the invite to associate with the Apple VPP is not accepted by the user.
A VPP bundle is assigned to a user and the Apple ID on the user’s device is different from the Apple ID that the user had used to associate with the Apple VPP.
The app is not compatible with the device.
Deficit in the number of licenses.
The Apple VPP subscription is disabled or deleted.
The VPP token ownership has changed and is being used by another MDM solution.
Apple is unable to validate the iTunes Store ID of the specific app.
The app has discontinued in the iTunes Store.
Updating App License Information: Based on the schedule selected while creating the Apple VPP Subscription, ZENworks syncs with Apple to retrieve the latest apps and creates bundles for any newly purchased apps. However, irrespective of the schedule selected, ZENworks automatically syncs with Apple on a daily basis to obtain the latest license information for existing and new apps. However, bundles are not created during this sync.
You can also initiate this sync immediately, for which bundles are created for any newly purchased apps, by performing either of the following:
Click Run Now by navigating to Subscribe and Share > <Select a Subscription> > Quick Tasks > Run Now or by navigating to the Summary page of the Apple VPP Subscription.
Click the Refresh icon on the Apps Catalog page.
Updating Distributed Licenses: If an app license is assigned to a device or a user, then the license consumed and installed count is updated when the associated devices syncs with the ZENworks Server. Subsequently, the app is installed on the device.
Revoking Licenses: Unused app licenses are revoked when the device syncs with the ZENworks Server. However, in some cases the device might not sync with the ZENworks server due to one of the following reasons:
Mobile device management on the device is disabled.
The device is in a Retired or Wipe Pending state. In case of a device assignment, all apps assigned to the device are revoked. In case of a user assignment, if the device is the last device associated with the user, then the app licenses are revoked from the user.
Bundle assignment is removed.
User does not exist anymore.
ZENworks periodically (every two hours) revokes unused licenses from devices that do not sync with the ZENworks Server. However, if you do not want to wait for the device to sync or for the periodic schedule to revoke licenses, then click the Refresh icon in the Apps Catalog page.
If any of these tasks fail, then the relevant error messages are displayed when you visit the Apps Catalog page.
The validity of a VPP token is one year from the time the token is downloaded using the Apple VPP account. As soon as you upload the token while creating a new subscription in the ZENworks Management Zone, the expiry date of the token is displayed. You can also view the expiry date of token by visiting the Summary page of the Apple VPP Subscription. To renew this token, download the token again from the Apple VPP portal and upload it in the Summary page of the Apple VPP Subscription.
To revoke unused app licenses assigned to a user or a device, you can Block the bundle assignment, Remove the bundle assignment, or Disable the bundle. When any one these actions are performed and the device syncs with the ZENworks Server, an uninstall command is sent to the device and the app license is revoked.
For more information on the Apple Volume Purchase Program, see ZENworks Mobile Management Reference.