You can keep your VPP deployment and your paid public iOS applications in separate organization groups. You can also enable the paid public status option in the organization group where applicable devices are enrolled.

Ensure that you do not deploy the same paid public iOS application in the organization group that has VPP configured and that contains a service token (sToken). If you have the VPP configured in the organization group, use licenses from the sToken, which offers a greater management and control of the application.

Devices that receive application assignments from the closest organization group to them. Be aware of the organization group hierarchy and where you enable paid public iOS applications. If you assign the application in an organization group that has no effect on the device, installations can fail or the application can install on the wrong device.
Table 1. Example of a Paid Public Application Assignment Depending on the Organization Group
Organization Group Paid Public Status Device Enrolled Result
Parent Enabled No The device does not receive the managed paid public application and the system redirects the device to the store to install the application.
Child Disabled Yes