Apple offers the Apple Configurator and the Apple Device Enrollment Plan (DEP) to enable IT administrators to deploy and manage large numbers of Apple iOS devices. AirWatch integrates with both programs, as well as integrating with Apple's Volume Purchase Program (VPP). All programs aim to help maintain and manage bulk device and content.

To reduce the risk of license inconsistencies or other issues with your managed distribution VPP content, review these suggestions and guidelines for deploying Apple Volume Purchase Program (VPP) content to devices that you stage using Configurator and the DEP.

Note:

This information does not apply to VPP applications assigned to device serial numbers.

Avoiding License Inconsistencies

To distribute Volume Purchase Program (VPP) content bought using the managed distribution method:

  • Use a service token (sToken) in one MDM environment and not in multiple environments. Some examples include not using an sToken in AirWatch and in another MDM system or in a trial environment and in a production environment.
  • Use an sToken in one organization group and not in multiple organization groups within AirWatch.
  • Apply one device to one Apple ID and do not change the Apple ID on the device.

These actions reduce the risk of losing a license in one environment because it was revoked in another environment. However, it may not be economically possible to have the number of licenses needed to cover your staged devices using these actions. VPP deployment in a staged environment is still quite manageable but it may take extra maintenance with special attention paid to the Apple ID.

Apple IDs

Apple IDs are an important part of the system AirWatch uses to manage VPP content for staged users. An Apple ID is an identification created by users registering with Apple programs. Users in this scenario also have their credentials for AirWatch. The user enrolls with AirWatch and then AirWatch registers the user with Apple and sends an invitation to join the Apple VPP. The user accepts the invitation and joins the VPP using the Apple ID. At this time, AirWatch stores the association of the Apple ID with the user.

It is important to manage the Apple ID in staged environments because the Apple ID controls access to the user's specific set of VPP content. When users change Apple IDs on devices without communicating the change to their admins, they may experience access difficulties.

MAM_VPP_AppleID

Guidelines for Staging

Use the following processes to reduce license inconsistencies in AirWatch.

Staging

Method

Assign VPP 

Content To

Accepts VPP

Invitation

Installs Apps

Updates Apps

Maintenance Risks

Single User, Standard (Self-Registration)

Individual devices with unique Apple IDs

Not a staging user

End-users with unique Apple IDs End-users install applications End-users update applications

No maintenance of Apple IDs

Least risk because end-users maintain their own Apple IDs on individual devices

Single User, Advanced (Pre-Configured) Pre-configured devices with pre-configured Apple IDs End-users with pre-configured Apple IDs End-users install applications End-users update applications
  • Maintain pre-configured Apple IDs
  • Provide pre-configured Apple IDs to end-users
  • End-users change Apple IDs
  • End-users do not return devices to the pre-configured Apple ID
Multi Users
  • Staging user
  • Individual users
  • Admin with the staging user Apple ID
  • End-users with respective unique Apple IDs
  • Admin installs common applications with staging user Apple ID
  • End-users install unique applications with individual Apple IDs

 

  • Staging user ID must update common applications with staging user Apple ID
  • End-users update unique applications with their individual Apple IDs
  • Maintain a staging user Apple ID for a common set of VPP content on all devices checked to staging user
  • Maintain end-user Apple ID on check-out of devices
  • All devices checked in to staging user do not have same Apple ID
  • Admins do not change devices to the staging user Apple ID upon device check-in
  • End-users do not change the staging user Apple ID to their unique Apple IDs upon device check-out

For an outline of the support for the managed distribution method by Apple IDs, see Managed Distribution by Apple IDs Overview.