Skip to main content
Jamf Nation, hosted by Jamf, is a knowledgeable community of Apple-focused admins and Jamf users. Join us in person at the ninth annual Jamf Nation User Conference (JNUC) this November for three days of learning, laughter and IT love.

Moving from User- to Device-based Volume Purchasing Assignments

Overview

Device-based volume purchasing assignments (also referred to as "VPP-managed distribution") allow you to distribute apps directly to a computer or mobile device without requiring an Apple ID. This is an ideal model for organizations that assign one device per user, or organizations that assign many users per device. This model is not ideal for organizations that assign multiple devices per user.

Note: If multiple devices in your environment share the same Apple ID, ensure that you have enough managed distribution licenses for an app before you move from user- to device-based assignment for that app.

If your organization is currently using user-based app assignments, you can use the workflow in this article to move to device-based assignments. The transition involves the following steps:

  1. Verify that the apps are device-assignable.
  2. Turn off notifications.
  3. Revoke apps from users.
  4. Assign apps to devices.

To ensure that the transition process goes smoothly, it is recommended that you move your apps to device-based volume purchasing assignment during a time when there is low activity on the Jamf Pro, and avoid revoking and reassigning all of your apps on the same day.

Note: Using user- and device-based app assignments in the same environment can make app management complex, especially with multiple administrators. It is recommended that you use one model or the other. 

Requirements

  • Jamf Pro 9.82 or later
  • Computers with macOS 10.11 or later and/or mobile devices with iOS 9 or later
  • A VPP account set up in Jamf Pro
  • App Store apps or VPP store apps (including custom B2B apps) purchased through Apple's Volume Purchasing

Verify that Apps are Device-Assignable

Not all apps support device-based assignments. Use Jamf Pro or a volume purchasing portal, such as Apple Business Manager (ABM) or Apple School Manager (ASM), to verify whether an app is device-assignable.

Use Jamf Pro:

  1. Log in to Jamf Pro.
  2. Navigate to the appropriate App Catalog: For macOS apps, click Computers at the top of the page and then click Mac App Store Apps. For iOS apps, click Devices at the top of the page and then click Mobile Device Apps.
  3. Click an app and then click the VPP tab. A message like the following is displayed if the app is not device-assignable: "Content not available to assign to mobile devices".

Use the volume purchasing portal:

  1. Log in to the volume purchasing portal, such as ABM or ASM.
  2. Search for the app.

As shown below, “Device Assignable” is displayed on the application page if the app supports device-based assignments.
App specific page in ASM

Turn off Notifications

When an app is revoked from a user, the user is notified that the app is no longer assigned to them. Turn off that notification so users are not notified.

  1. Log in to Jamf Pro.
  2. In the top-right corner of the page, click Settings.
  3. Click Global Management.
  4. Click VPP Accounts.
  5. Click the VPP account and then click Edit.
  6. Deselect Notify users when an app is no longer assigned to them and then click Save.

Revoke Apps from Users

  1. In Jamf Pro, click Users at the top of the page.
  2. Click VPP Assignments.
  3. Click the VPP assignment and then click Edit
  4. Click the Scope tab and remove users from the scope as needed.
  5. Click Save.
  6. Click Search VPP Content in the sidebar and search for the apps that were revoked. 
  7. Refresh the page to see the number of apps in use decrease.

Assign Apps to Devices

After the apps are available for use they can be assigned to devices.

  1. In Jamf Pro, navigate to the appropriate App Catalog: For macOS apps, click Computers at the top of the page and then click Mac App Store Apps. For iOS apps, click Devices at the top of the page and then click Mobile Device Apps.
  2. Add a new app or edit an existing one.
  3. Click the Scope tab and add devices to the scope. 
  4. Click the VPP tab and select Device Assignments.
  5. Select Assign VPP Content.
  6. Choose a VPP account and click Save.

Additional Information

For additional information on how to move from user- to device-based VPP assignments, see the following video:
Device-Based VPP with Casper Suite 9.82

Like Comment
Order by:
SOLVED Posted: by zsmith

Turn off Notifications
When an app is revoked from a user, the user is notified that the app is no longer assigned to them. Turn off that notification so users are not notified.

Log in to the JSS with a web browser.
In the top-right corner of the page, click Settings.
Click Global Management.
Click VPP Accounts.
Click the VPP account and then click Edit.
Deselect Notify users when an app is no longer assigned to them and then click Save.

We are not seeing this option when we select the VPP options under Global Management.

Is there a missing step?

Like
SOLVED Posted: by btaitt

@zsmith Is your JSS updated to 9.82?

Like
SOLVED Posted: by zsmith

No we're using JSS 9.81.1445289067.c

Is that feature a part of the 9.82 update?

Like
SOLVED Posted: by btaitt

Yes, it's part of the 9.82 update. Once you update you'll find it in that location.

Like
SOLVED Posted: by BVikse

I know you cannot revoke ebooks once assigned to an Apple ID, but can you do device-based ebook distribution and re-use ebook licenses that have not been assigned yet?

Like
SOLVED Posted: by St0rMl0rD

No, paid books cannot be distributed in this way.

Like
SOLVED Posted: by jlyle

Is there a way to mass add apps to mobile device groups the way you can in user groups? Or should I be posting this as a feature request?

Like
SOLVED Posted: by BVikse

Mass add apps, no. Add an app to mass devices, yes.

For each app, in mobile devices click apps on the left pane, click your app in the list, slick scope then mobile device groups. Add your group from the list and save your changes.

Devices have to be iOS 9, no Apple ID needed. Great for K-12 carts and 1:1, students don't need to remember an Apple ID, no classroom interruption just because IT added a new app. Love it!

Like
SOLVED Posted: by jlyle

Thanks, i am aware of how to do that but we have over 5000 devices moving to multiple device groups and over 100 apps per device group. I need a way to quickly assign apps to a device group like vpp assignment in the user groups.

Like
SOLVED Posted: by BVikse

Wow, that is a big project. You might check the API, I am not familiar with it enough to tell you whether it would have a solution for you. Your TAM might know or know someone who does.

We had some issues in a 1:1 roll out that the API made easy, but I don't remember the name of the person my TAM hooked me up with.

Like
SOLVED Posted: by jlyle

Yeah, I hear a lot of people telling me a 1:1 decision makes my job easier but thats not my call. I have a scheduled chat with my TAM and will bring this up. Thanks

Like
SOLVED Posted: by belldesean

@jlyle We are in the same boat. https://jamfnation.jamfsoftware.com/featureRequest.html?id=4746 It would be so much easier and less time consuming if we could select multiple apps (like User-Based VPP Assignments) and assign them to a device group. Surely if it works on one side of the fence it should be able to work the same or similar on the other side. I'm actually curious why this option isn't already available for device-based VPP assignments. I have brought this up with my TAM and she recommended that I submit a feature request. We're hoping JAMF Nation is already on the ball with this and getting a solution as I type. I'm remaining hopeful.

Like
SOLVED Posted: by mhayden

I have done these steps and my users are still getting a prompt to log in to the App Store. How can we fix this? Or if there is a rogue app, how do we decipher which one it is?

Do you have to do it through VPP even if it is a free app? Is that the issue?

Like
SOLVED Posted: by andy.cauble

You would need to purchase VPP copies even if its a free app. Otherwise you will continue to get the app store prompt.

Like
SOLVED Posted: by timvenchus

In the video, the instructor indicates that apps used for device-based assignment should be set to auto install rather than made available self service. Is this mandatory? Can I use device-based app assignment with self service?

Sorry I can't test this right now on my own instance and I can't find an answer in any documentation.

Like
SOLVED Posted: by andy.cauble

We've been using it with our "Day 1 apps needed" apps set to Install automatically (about 10 apps), and all others are set to be in Self Service. So far everything has been working perfectly regardless of that particular setting.

Like
SOLVED Posted: by timvenchus

Thanks, @andy.cauble!

Like
SOLVED Posted: by lcopeland

We've had nothing but issues using this set up. Apps get hung up and never install, updating doesn't happen at the designated time (so right in the middle of class when they need the app!!). Or you do install the update but the app doesn't actually update so self-service keeps prompting students to update. Total mess. Seriously considering switching back to user based.

Like
SOLVED Posted: by tommy.xie

We are using the Device-based VPP for app distribution, everything work well but only one problem: how can i prevent the system to push APP update to all device? sometimes, our user devices use the cellular data, but the system will distribute the update automatically at any time when the APP has new version, it causes big cellular traffic when without WIFI, may i know if any control mechanism for admin? like set up a schedule time, or we can stop it?

Like
SOLVED Posted: by bcampbell

Is there a chance of data loss when following this procedure for mobile devices? i.e. Is there a chance the app gets removed (with its data) when the user licenses are revoked but before the device app licenses are assigned?

Or, will apps not ever be deleted when a user-based license is revoked as long as some app object still has the device in-scope? Then, I assume one can just enable device-based licenses for that app object.

My understanding of VPP user licensing makes me think the latter, preferred condition, is true, but this is the kind of thing I don't want to get wrong. Automatically deleting user data is a bad thing (and one reason I don't like managed apps although I still use them since it's the only way to do an auto install).

Like
SOLVED Posted: by pmullen

VPP Assignments = Blank.
VPP Content = Blank
Device Assignments = Plenty available.
Running 9.98
Device is properly in the All Managed Clients group and this is what the VPP should deploy to.
Hundreds and hundreds of devices. 98-99 out of 100 work fine. A handful or a little more launch the App Store when asking for an app from Self Service. Frustrating.

Like
SOLVED Posted: by piotr.oszenda

This article has been updated as follows:

  • Added information about Apple Business Manager (ABM) and Apple School Manager (ASM)
  • Image now shows the recent view of ASM
Like