Every app or book installed onto an Apple device requires a license, even if the content is free. The Volume Purchase Program (VPP) allows organizations to acquire licenses in bulk to distribute to their organization using an MDM solution, such as Vexluna.
Even if your organization doesn't need to distribute paid content to devices, VPP is sometimes the only way to deploy free apps to devices. Devices that are not signed into an Apple Account must have licenses (even free ones) assigned through VPP to deploy content through MDM. Additionally, if a device is signed to an Apple Account (for example, a user's personal account), the user must approve the free purchase to acquire a license to download your deployed app. VPP bypasses this requirement.
Getting Started
To get started with VPP, you need to have an account for your organization in either Apple Business Manager (ABM) or Apple School Manager (ASM).
You may already have an ABM/ASM account if you're using Automated Device Enrollment.
Log into ABM/ASM and click on Apps and Books on the sidebar. The first time you access this page, you may need to provide tax information for your purchases. If you only intend to deploy free apps through VPP, don't worry, no purchase is necessary to do so, but Apple still collects this information.
In the search box at the top of the pane just to the right of the sidebar, type the name of App Store app to search the catalog. Select the app you want, and then you can acquire licenses in the right-side pane. If the app is free, you can acquire as many licenses as you need without needing to provide payment details.
Connecting to Vexluna
To enable Vexluna to assign and deploy your VPP-acquired content, you need to connect a VPP Token to Vexluna.
VPP tokens must only be connected to one MDM solution at a time. If Vexluna detects that your VPP token is connected to a different MDM solution, Vexluna will stop managing that VPP account until you upload a new token.
Open Vexluna and select Apps in the sidebar, then choose Apple VPP. Click on New VPP Connection to open the dialog prompting for your VPP token.
Now, go to ABM/ASM and click on your name at the bottom of the left sidebar, and select Preferences. Go to Payments and Billing. Locate the Content Tokens section and download the token for the location you want to connect to Vexluna.
By default, ABM/ASM organizations have only a single location, but you can create new locations as needed. Use the Locations tab in the sidebar to create new locations. VPP licenses are assigned to a single location only, but unassigned licenses can be transferred freely between locations. A VPP connection in Vexluna associates with a single location within ABM/ASM.
Return to Vexluna and upload the token you downloaded to connect your VPP account.
VPP tokens expire after 1 year. Once expired, a new VPP token will need to be uploaded to Vexluna to maintain the VPP connection.
Revoking Licenses
Before you can assign a used license to a new device or reassign it to a new location, you must revoke the assigned license(s). In Vexluna, you can go to Apps > Apple VPP and select a VPP connection, which reveals an option to Revoke All Licenses. This will revoke all licenses that have been assigned to users or devices in that VPP account, even assignments that might have been made by another MDM solution.
When a license is revoked from a device, its entitlement to download that app from the App Store is revoked but if the app is already installed, it is not immediately uninstalled. To maintain the installation and update the app, a license must be reassigned.
When a device checks-in to Vexluna, if a configuration exists that assigns a VPP app to the device but the device has no active license, Vexluna will assign a license if one is available. Therefore, if you revoke a VPP license, it will be reassigned automatically at the device's next check-in as long as the app is still assigned to the device in Vexluna.
Deleting a VPP Connection
When deleting a VPP connection in Vexluna, you have an option to revoke all assigned licenses first. This is functionally the same as clicking the Revoke All Licenses button.
If you do revoke licenses, all licenses in that VPP account will be freed prior to deleting the connection in Vexluna. If not, licenses will remain assigned to any devices they're already assigned to.
Regardless of which option you choose, when a device next checks-in to Vexluna, any managed apps currently installed on the device that aren't currently configured to be assigned to the device will be uninstalled. If you don't revoke licenses, Vexluna won't be able to unassign the VPP license after you delete the connection. In this case, the license will remain assigned to the device, but the app will not be installed.
If you don't revoke licenses prior to deleting a VPP connection, those assigned licenses will remain unavailable in your VPP account to be moved to a new location. If you're moving your VPP account to a new MDM solution, this may not be a problem as the new MDM solution may be able to reuse those existing license assignments.
If you move a VPP account into Vexluna from a previous MDM solution, Vexluna will gracefully handle any already-assigned licenses. Licenses will be kept for devices that have their respective apps assigned in Vexluna, or they will be revoked if the devices don't have assignments for those apps. Any licenses assigned to devices not under Vexluna management will become dangling licenses.
Dangling Licenses
A VPP license that's assigned to a device or user that isn't under Vexluna management is known as a dangling license. Such licenses are effectively "lost" as they can't be used to access their granted content.
Vexluna will periodically audit assigned licenses to detect dangling licenses. If dangling licenses are found, Vexluna will revoke them automatically, freeing them up to be reused on other devices or to be transferred to different locations in ABM.
When a device unenrolls, Vexluna will automatically revoke its VPP licenses. However, if revocation fails for any reason, the assigned licenses become dangling licenses and will be cleaned up during the next automatic audit run.