Apple uses Web services to manage license codes. The Workspace ONE UEM console accesses Apple's Web services with the service token, or sToken, you upload to the console. Workspace ONE UEM retrieves your VPP content with the license data on the sToken.

You can upload an sToken at the top Customer level and below. The Workspace ONE UEM system prompts you to register your sToken, so thatWorkspace ONE UEM can detect if the sToken is used in other environments.


  1. Navigate to Groups & Settings > All Settings > Devices & Users > Apple > VPP Managed Distribution.
  2. Configure the following settings.




    Enter your VPP Account ID.

    Using your VPP Account ID as the description has several advantages.

    • If you use multiple sTokens, it identifies the correct account.

    • Reminds you the correct account when you renew the sToken.

    • Identifies the correct account to others in your organization who assume management of the VPP account.

    sToken Upload

    Select Upload to navigate to the sToken on your network.

    VPP accounts in Apple School Manager and Apple Business Manager can now be associated to locations to allow moving licenses from one VPP account to another. If an sToken that is associated to a location is uploaded, the location name is displayed in the console.


    Select where Workspace ONE UEM validates the sToken.

    This value reflects the region from where you bought content and ensures Workspace ONE UEM uploads the correct versions of your purchases.

    When you sync your licenses, Workspace ONE UEM pulls the correct regional version of the content.

    If Workspace ONE UEM cannot find the content in the app store from the region entered, Workspace ONE UEM automatically searches the iTunes App Store in the United States.

    Automatically Send Invites

    Send invitations to all the users immediately after you save the token. The invitation request users to join and register with Apple's VPP. Registration gives users access to the terms of use to participate in the program.

    Use the Message Preview option to review the invitation.

    If your environment includes VPP applications set to the Assignment Type, Auto, then Workspace ONE UEM sends invitations no matter how you configure this option. This behavior facilitates quick access to applications upon enrollment.

    Workspace ONE UEM automatically sends users of Apple iOS v7.0.3+ and macOS 10.9+ (if supported) an invite command when you enable this option. It does not send them an email message.

    You do not have to enable this option immediately. You can leave it disabled and still upload your token. Return and enable this feature to send invitations to all the enrolled devices whose users have not yet accepted to join the VPP.

    For Device-Based VPP, disable this check box for the device-based VPP system because invitations are not necessary. If you assign a device-based VPP device to a regular VPP app (a user-based VPP app), devices still receive invitations.

    Message Template

    Select an email template for an email message invitation for Apple iOS devices on Apple iOS v7.0.0 through v7.0.2.

  3. Save the sToken and confirm the addition of the token.