To retrieve the data on the sToken, Workspace ONE UEM syncs with Apple Web services, and then displays the content for assignment and deployment. Workspace ONE UEM distributes licenses by smart group and publishes the content when you save an assignment rule in the flexible deployment feature.

The Enable Device Assignment option displays for applications that are eligible for distribution by device serial number. For information about the device-based distribution method, see Managed Distribution by Device Serial Number.

For information on flexible deployment and how to prioritize assignment rules, see Add Assignments and Exclusions to your Applications in the Application Management guide.

To publish with flexible deployment, assign content acquired from Apple's Volume Purchase Program (VPP) with managed distribution codes to smart groups.


  1. Navigate to Resources > Apps > Native > Purchased.
  2. Select the application and select Assign. The Assignment page appears.
  3. On the Assignment page, select Add Assignment and complete the options.
    1. In the Distribution tab, enter the following information.
      Setting Description
      Name Enter the assignment name.
      Description Enter the description for the assignment.

      License Distribution

      Enter the smart group name to which you want to assign the application and the number of licenses you want to allocate.

      As you enter the smart group name, options are displayed and you can select the appropriate smart group from the list. The allocated licenses must not exceed the total number of available licenses. You can also view the number of licenses that have already been redeemed, if any.

      If necessary, you can add more assignment groups.

      App Delivery Method
      • On Demand – Deploys content to a catalog or other deployment agent. The device user can decide if and when to install the content.

        This option is the best choice for content that is not critical to the organization. Allowing users to download the content when they want helps conserve bandwidth and limits unnecessary traffic.

      • Automatic – Deploys content to a catalog or other deployment Hub on a device upon enrollment. After the device enrolls, the system prompts users to install the content on their devices.

        This option is the best choice for content that is critical to your organization and its mobile users.

      If the Assignment Type is set to Auto when you Publish, Workspace ONE UEM sends an invitation to Apple iOS 7.0.3+ and macOS 10.9+ devices. The invitation enables users to register with Apple's VPP.

    2. In the Restrictions tab, enter the following information.
      Settings Description
      Remove on Unenroll

      Set the application to be removed from a device when the device unenrolls from Workspace ONE UEM. Workspace ONE UEM enables this setting by default.

      If you enable this setting, supervised devices are restricted from silent app installation. This is because the device is locked and the provisioning profile installation is in the command queue which requires a device to be unlocked to complete the installation.

      If you disable this setting, provisioning profiles are not pushed with the installed application. That is, if the provisioning profile is updated, the new provisioning profile is not automatically deployed to devices. In such cases, a new version of the application with the new provisioning profile is required.

      Prevent Application Backup Disallow backing up the application data to iCloud. However, the application can still back up to iCloud.
      Prevent Removal If you enable this setting, the user is prevented from uninstalling the app. This is supported in iOS 14 and later.
      Make App MDM Managed if User Installed

      Assume management of applications previously installed by users on their devices, whether applications are supervised or unsupervised.

      Enable this feature so that users do not have to delete the application version installed on the device. Workspace ONE UEM manages the application without having to install the AirWatch Catalog version on the device.

    3. In the Tunnel & Other Attributes tab, enter the following information.
      Settings Description
      Per App VPN Profile

      Select a VPN profile that you want to use for the application. Users access the application using a VPN, which helps ensure that application access and use is trusted and secure.

      Other Attributes App attributes provide device-specific details for applications to use. For example, when you want to set a list of domains that are associated to a distinct organization.
    4. In the Application Configuration tab, enter the following information.
      Settings Description
      UPLOAD XML You can upload an XML file that contains the key value pairs supported by the application for the app configuration.
  4. Select Create.
  5. Select Add Assignment to add more assignments for your publication.
  6. Configure the flexible deployment settings by setting the priority for your app assignments.
    Table 1.
    Settings Descriptions
    Priority Select the value from the drop-down menu to set the precedence for the assignments.

    Devices receive applications from the assignment groups based on the priority set for the assignment groups. Adjusting the priority for a single assignment automatically reprioritizes other assignments.

    Copy From the more options menu, select copy to duplicate the selected assignment.
    Delete From the more options menu, select delete to remove the selected assignment.
  7. Select Save & Publish.