Apple uses Web services to manage license codes. The Workspace ONE UEM console accesses Apple's Web services with the service token, or sToken, you upload to the console. Workspace ONE UEM retrieves your VPP content with the license data on the sToken.

You can upload an sToken at the top Customer level and below. The Workspace ONE UEM system prompts you to register your sToken, so that Workspace ONE UEM can detect if the sToken is used in other environments.


  1. Navigate to Groups & Settings > All Settings > Devices & Users > Apple > VPP Managed Distribution.
  2. Configure the following settings.
    Setting Description
    Description Enter your VPP Account ID.
    Using your VPP Account ID as the description has several advantages.
    • If you use multiple sTokens, it identifies the correct account.
    • Reminds you the correct account when you renew the sToken.
    • Identifies the correct account to others in your organization who assume management of the VPP account.
    sToken Upload Select Upload to navigate to the sToken on your network.

    VPP accounts in Apple School Manager and Apple Business Manager can now be associated to locations to allow moving licenses from one VPP account to another. If an sToken that is associated to a location is uploaded, the location name is displayed in the console.

    Automatically Send Invites Send invitations to all the users immediately after you save the token. The invitation request users to join and register with Apple's VPP. Registration gives users access to the terms of use to participate in the program.

    Use the Message Preview option to review the invitation.

    If your environment includes VPP applications set to the Assignment Type, Auto, then Workspace ONE UEM sends invitations no matter how you configure this option. This behavior facilitates quick access to applications upon enrollment.

    Workspace ONE UEM automatically sends users of Apple iOS v7.0.3+ and macOS 10.9+ (if supported) an invite command when you enable this option. It does not send them an email message.

    You do not have to enable this option immediately. You can leave it disabled and still upload your token. Return and enable this feature to send invitations to all the enrolled devices whose users have not yet accepted to join the VPP.

    For Device-Based VPP, disable this check box for the device-based VPP system because invitations are not necessary. If you assign a device-based VPP device to a regular VPP app (a user-based VPP app), devices still receive invitations.

    Message Template Select an email template for an email message invitation for Apple iOS devices on Apple iOS v7.0.0 through v7.0.2.
  3. Save the sToken and confirm the addition of the token.