growth purchase plan (2023)

To purchase and deploy content using the Apple Business Volume Purchase Program (VPP), register and purchase content on the Apple Business Manager website, then use theA UEM workspaceDistribute content.

  1. Purchase content: Purchase content in bulk through apps and books in Apple Business Manager.
  2. Application development: Distribute assets across your device fleet using redemption codes or managed distribution service token files (sTokens).
    • redemption code method
    • Distribution is managed by Apple ID
    • custom application
    • Distribution is managed by device serial number

redemption code method

This method uses redemption codes to assign content to devices and does not support code revocation from Apple iOS devices. Once the redemption code is redeemed, it cannot be reused. Additionally, Workspace ONE UEM cannot delete content purchased using device redemption codes.

Devices prior to Apple iOS 7 must use this method to purchase VPP content, as managed distribution does not work with older systems.

You cannot use redemption codes for macOS systems.

Complete all tasks to distribute redemption codes

To successfully distribute Apple Volume Purchase Program (VPP) content to end users, complete all steps of the implementation process. In return, end users must complete all steps on their devices to receive VPP content.

  1. Administrators push VPP content to end users.
    1. Purchase your app and download the redemption code spreadsheet from the Apple iTunes Store.
    2. Upload the spreadsheet to Workspace ONE UEM.
    3. Assign redemption codes to organization groups and smart groups toWorkspace ONE UEM Consoleand save the settings.
  2. The end user receives the content.

    This step happens automatically when an administrator publishes content.

    1. Get your Workspace ONE UEM redemption code.
    2. Contents of the installation directory.

Upload redemption code spreadsheet

you can use itA UEM workspaceManage and distribute apps and books purchased through VPP on your Apple iOS devices. Apple uses a web service to manage redemption codes. for himWorkspace ONE UEM ConsoleTo access Apple web services, you must first upload your redemption code spreadsheet.

  1. navigate to anyoneresource>application>applicationthisresource>books>application.
  2. chooseAdd tothisseriesAdd a redemption code spreadsheet.
  3. choosebuy public appthisPurchase a custom application(custom application) for applications.

    This option is not available for books.

  4. chooseSelect a documentupload itCSV filethisXLSFiles you downloaded from the Apple portal.

    This action creates an order.

  5. choosesavecontinueProduct Selection Form.
  6. Find the right product and choosechooseFinish loading the spreadsheet. Workspace ONE UEM does not display this step if your spreadsheet contains Adam ID.
    • If your spreadsheet includes Adam ID, you don't need to look up products.A UEM workspaceAutomatically add apps and books from the app store when the spreadsheet contains Adam's ID. Adam IDs are specific to iTunes, part of the Apple Search API, and unique to each application.
    • If your Apple VPP redemption code spreadsheet contains codes for multiple apps or books, Workspace ONE UEM lists multiple products in the table. You can only choose one per order.

iTunes uses the asset identifier Adam ID to automate content connection. If your spreadsheet includes Adam ID, you don't need to search for apps and books in the app store. For custom applications, Adam ID allowsA UEM workspaceUpdate the App ID in the UEM console.

Assign content to users

you need to enable itWorkspace ONE UEM ConsoleAssign redemption codes to users and devices. Select the appropriate Org Group and Smart Group to assign redemption codes.

  1. Go to the organization group where you uploaded the redemption code spreadsheet.
  2. I canresource>application>native>purchase.
  3. Select the application you want to assign.
  4. for himplace an ordertab, fill in the options below.
    Table 1. Order Allocation - General Tab Options
    work describe
    redemption code pending Enter the number of redemption codes you want to suspend. Use this option to save redemption codes for future use.
    SDK configuration file If you use the AirWatch SDK feature, assign an SDK profile to the application.
    Add work from

    Assign user codes to organizational groups or smart groups.

    • organization team– Assign redemption codes to organization groups. chooseall usersInclude all users in this organization group or select SelecteduserDisplays a list of users in the organization group. use itAdd toyesexcludebutton to select specific users to receive the application.
    • smart team– Assign redemption codes to smart groups by typing the group name. The options are displayed and you can select the appropriate smart group from the list. You can create a new smart group if necessary.

      • You can apply redemption codes to organization groups and smart groups at the same time. However, you can only assign users to organization groupscustomertype.
      • You cannot assign users to smart groups. However, you can edit the smart group to include the desired users.
    • Verify the information in the following columns for each assignment rule:

      • user– Number of users viewing orders.
      • assigned to– Enter the number of licenses to assign to the selected user. Do not exceed the total amount of the order.
      • he was redeemed– View the number of licenses redeemed (if any).
    Table 2. Order Assignment - Implementation Tab Options
    work describe
    job type
    • by order– Deploy content to catalogs or other deployment agents. Device users can decide whether and when to install content.

      This option is the best choice for content that is not critical to your organization. Allowing users to download content at any time can help save bandwidth and limit unnecessary traffic.

    • automatic– Deploy content to a directory or other deployment node on the device during recording. After the device is enrolled, the user is prompted to install the content on their device.

      This option is the best choice for content that is critical to your organization and mobile users.

    you can only useby orderFor custom B2B applications purchased through redemption codes.

    when. . . whenjob typeyesthis, only eligible Apple iOS 7+ devices will automatically receive the app or pre-order.

    delete on unsubscribe

    Configure to remove the app from the device when the device is not enrolled by Workspace ONE UEM. This option is enabled by default for ONE UEM workspaces.

    Enabling this option restricts silent installation of apps on supervised devices, since the device is locked and profile installation is queued, requiring the device to be unlocked to complete the installation.

    If you choose to disable this option, configuration files will not be provided with installed applications. That is, if the profile is updated, the new profile is not automatically deployed to the device. In this case, a new version of the application with a new configuration file is required.

    Deleting the app while the device is not registered will not retrieve the redemption code. Once installed, the app is associated with the user's app store account.

    Avoid Backup Apps Turn off Backup app data to iCloud. However, the app can back up to iCloud. This limitation applies only to managed applications. It does not apply to unmanaged applications.

    Let the app be managed by MDM if the user installed the app

    Manage supervised and unsupervised apps that users have previously installed on their devices.

    Enable this feature so that the user does not have to delete the version of the app installed on the device. Workspace ONE UEM does not require an AirWatch catalog version to be installed on the device to manage the application.

    use VPN

    Configure Application-Level VPN and select itVPN profiles per app.Users access the application through VPN to ensure the reliability and security of accessing and using the application.
    Send application settings

    Push application settings to Apple iOS devices so users don't have to configure those specific settings themselves.

  5. choosesaveWhen you are done assigning codes.

Application configurations are vendor-specific key-value pairs that you apply to applications to preconfigure applications for users.

redemption code information

Access information about your redemption codes so you can manage and track your VPP deployments.

To access in-app orders purchased with a redemption code, go toresource>application>redemption code.

  • View code availability status.

    table 3. Redemption Code Status Description
    situation describe
    usable Identifies a keycode that can be used to distribute purchased content. You can make this key code unusable or delete it.
    external redemption Identifies keycodes assigned and redeemed outside of the Workspace ONE UEM Procurement System (VPP). You cannot perform an operation on this keycode.
    he was redeemed Identifies the keycode assigned and redeemed in the Workspace ONE UEM Procurement System (VPP). You can make this key code unusable or delete it.
    not available Specifies a keycode that was not explicitly provided for various reasons. Reasons include separating code that you want to keep for users who may not be in your Workspace ONE UEM deployment.
  • View each redemption code and order number.
  • Check the redemption date for the redemption code.
  • See who the code was assigned to.
  • Delete the redemption code.

Distribution is managed by Apple ID

This method uses service token files (also known as sTokens) to validate mappings. It allows you to assign license codes to your Apple ID to distribute content to devices, and the method supports the revocation and recycling of those license codes.


By combining Apple's managed distribution system withA UEM workspace, you can distribute free and purchased Volume Purchase Program (VPP) applications and books. The hosted distribution model uses service tokens (also known as sTokens) to retrieve and distribute your VPP content to usingWorkspace ONE UEM Console.

Revoked Managed Distribution License

A UEM workspaceYou can revoke permissions for apps, but not for books.

Complete all distribution tasks managed by Apple ID

To successfully distribute VPP content to end users, complete all steps of the deployment process. In return, end users must complete all steps on their devices to receive VPP content.

  1. Administrators push VPP content to end users.
    1. Purchase content from the Apple iTunes Store and download your sToken.
    2. Upload the sToken to Workspace ONE UEM.

      You can use multiple sTokens in the Workspace ONE UEM hierarchy, but only one sToken per Organization Group.

    3. Synchronize permissions to display content in the console.
    4. Add a bundle ID for a custom application. This action enables management.

      Non-B2B applications and books do not require this step.

    5. Assign and assign permissions to smart groups, and enable appropriate applications for device-based assignments, if applicable. Then publish managed distribution content with flexible deployment capabilities.

      Publishing content triggers an invitation to the end user whose Apple ID the content is linked to.

  2. The end user accepts the invitation and receives the content.
    1. Accept the invitation and join Apple VPP.

      Device-based use does not require this step. This step ensures they have the terms of the program participation agreement.

    2. obtain a licenseA UEM workspace.
    3. Install content from a directory.

Users with multiple Apple iOS devices must choose one Apple ID and apply it to all devices. If the administrator provides the content on demand, the user can accept the invitation and join the VPP. They install the contents of the directory on any of their devices.

VPP tokens are charged to retrieve content and licenses that manage distribution

Apple uses a web service to manage license codes. heWorkspace ONE UEM ConsoleUse the service token or sToken you uploaded to the console to access Apple web services. Workspace ONE UEM uses the license data in the sToken to retrieve your VPP content.

You can load an sToken in the upper and lower client layers. heA UEM workspaceYou are asked to register your sToken in order toA UEM workspaceYou can detect if the sToken is used in other contexts.

  1. navigationGroups and Configurations>all settings>Devices and Users>apple>Managed VPP distribution.
  2. Configure the following settings.
    Table 4.
    work describe
    describe Enter your VPP account ID.

    There are several advantages to using your VPP account ID as the description.

    • If you use multiple sTokens, it will identify the correct account.
    • Reminds you of the correct account when renewing sTokens.
    • Identify the correct account for someone else in your organization who takes over management of the VPP account.
    symbolic accusation choosepromoteNavigate sTokens on your network.

    VPP accounts in Apple School Manager and Apple Business Manager can now be associated with locations to allow transfer of permissions from one VPP account to another. If the sToken associated with a site is loaded, the site's name will be displayed in the console.

    Automatically send invitations Send invitations to all users as soon as the token is saved. The invitation requires the user to register and join Apple VPP. Registration gives the user access to the terms of use to participate in the program.

    use itmessage previewOptions to control invitations.

    If your environment includesjob type, automatic, Workspace ONE UEM sends invitations regardless of how you configure this option. This behavior facilitates quick access to applications while recording.

    A UEM workspaceAutomatically send invite commands to Apple iOS v7.0.3+ and macOS 10.9+ users (if supported) when this option is enabled. You don't email them.

    You do not need to enable this option now. You can disable it and continue uploading your token. Go back and enable this feature to send invitations to all registered devices that the user has not agreed to join the VPP.

    For device-based VPP, clear this check box for device-based VPP systems, since invitations are not required. If you map device-based VPP devices to regular VPP applications (user-based VPP applications), those devices still receive invitations.

    message template Select the email invitation email template for Apple iOS devices on Apple iOS v7.0.0 to v7.0.2.
  3. savesToken and confirm adding the token.

VPP tokens expire annually and must be renewed annually. Administrators can manage and configure console notifications for VPP token expiration. For more information, seeConfigure notification settingsin the console basics guide.

Sync Hosted Distribution Content

Workspace ONE UEM has two methods for synchronizing managed deliverables, per project and per license.

The asset function synchronizes the metadata on the sToken with the claimed license information. The license function synchronizes information for a single project. It's useful for sTokens that contain thousands of permissions, and you only want to sync permissions that apply to a single project.

  • sync permissions
    1. Go to the organization group where you uploaded the sToken.
    2. Navigate to one of the following areas.
      • resource>application>native>purchase
      • resource>books>list display>purchase
    3. Check the item checkbox and choosesync permissionsAction menu options.
  • data synchronization
    1. Go to the organization group where you uploaded the sToken.
    2. Navigate to one of the following areas.
      • resource>application>native>purchase
      • resource>books>list display>purchase
    3. choosedata synchronization.
    4. Confirm that the sToken (if any) is registered with Workspace ONE UEM. If the system detects that the sToken is being used in another context, the system will request registration.
    5. To select Sync complete, refresh the screen.

      A UEM workspaceSynchronizes the metadata of purchased items, and if there are any claimed licenses, the items are synchronized from the claimed licenses. ONE UEM Workspace makes sync functionality unavailable until the transaction is complete.

Custom Apps and VPP

You can upload custom applications purchased through the Apple Business Manager Volume Purchase Program (VPP) to Workspace ONE UEM. ONE UEM Workspace works with both the redeem code method and the managed distribution method.

Workspace ONE UEM's ability to manage custom applications depends on the VPP system used to download the application.

  • redemption code– Workspace ONE UEM can install custom B2B applications purchased with redemption codes on the device. End users can install these apps on demand, but Workspace ONE UEM cannot manage them. Upload a custom B2B app purchased with a redemption code just like any other app purchased with a redemption code.

    I canredemption code methodLearn more.

  • management assignment– Workspace ONE UEM can install custom B2B applications purchased through managed distribution. End users can install these applications on demand, or you can deliver them automatically. Workspace ONE UEM can manage these applications. Upload custom B2B applications purchased through managed distribution just like other applications purchased through managed distribution. However, between the synchronization step and the delegation step, application management is enabled.

    • I canDistribution is managed by Apple IDDetails about uploading applications purchased through managed distribution.
    • I canEnable custom B2B application managementMore information on enabling management.

VPP, Custom Apps, and Push Mode

Workspace ONE UEM can manage custom apps purchased with managed distribution codes, but not with redemption codes.

Workspace ONE UEM's ability to manage custom applications determines the push capabilities available for application distribution.

table 5. Push function depends on VPP management
PPV method management ability input mode available
management assignment

they manage

Workspace ONE UEM can manage custom applications purchased using managed distribution keys.


by order

redemption code

I can not do it

Workspace ONE UEM cannot manage custom apps purchased with redemption codes.

by order

Enable Manage Custom Applications

When you use managed distribution codes to purchase apps from Apple's Volume Purchase Program (VPP), Workspace ONE UEM automatically displays all metadata for any apps it considers custom apps. The system retrieves metadata such as icon, name, and bundle ID from the Apple Metadata Service for App Store apps (both public and custom).

As an administrator, you have the option to edit the metadata text box. If custom application information was retrieved from the content metadata service, the Bundle ID text box should be cleared. Apps that are not managed are displayed asinertin the UEM console.


To update to the latest version of a custom application, as an administrator, you can navigate toresource>application>native>list display>purchaseand select a custom application from the list view of purchased applications, and click theapp updatechoose. Devices with an older version of the custom app installed will be automatically updated to the latest version, devices with the latest version of the custom app installed will not be affected.

Distribution is managed by device serial number

If your VPP deployment includes iOS 9+ or macOS 10.11+ devices, consider enabling Volume Purchase Program (VPP) app allocation by device serial number. This method does not require the user to be invited to the VPP.

Develop a device-based VPP application using the process described inOne UEM-managed distribution and workspace.

Workspace ONE UEM does not migrate applications to device-based systems. VPP applications already assigned to an Apple ID will remain assigned as-is.


Device-based systems offer many advantages.

  • Users do not need to accept invitations and register for VPP.
  • Admins with multiple sTokens in a VPP deployment do not need to manage invitations.
  • Administrators do not need to manage Apple IDs.


Device-based allocation is the best choice for deployment in the following scenarios.

  • Shared device with check-in and check-out system
  • company owned equipment
  • Organizational environment with one device per user
  • Workplace Devices ONE UEM for Education Deployment

A user-based system is the best choice for the following scenarios.

  • Multiple devices assigned to one Apple ID
  • maintenance license required

Supported Platforms and Operating Systems

Configure supported operating systems to use a device-based method for distributing applications purchased through Apple's Volume Purchase Program (VPP).

  • iOS 9+
  • Mac OS 10.11+

Petition form

VPP application developers must enable applications for use in device-based VPP.

Invitation card

With the Apple ID removed from the process, the device-based method no longer relies on an Apple ID enrollment invitation. However, the invitation will still be sent if the device meets the requirements.

  • The device is not running iOS 9+ or macOS 10.11+
  • The app does not have device-based VPPuse enabled
  • Device receives user-based VPP application
  • Automatically send invitationsEnable in Workspace ONE UEM

Appliance-Based VPP Deployment

The process of uploading an app based on a device (serial number) is similar to uploading a VPP app based on a user (Apple ID). The only difference is that the device-based method does not involve sending invitations.

great:Once the application is enabled for device-based useWorkspace ONE UEM Console, you cannot invert its state and use it in a user-based system.

  1. Upload or register the sToken to the desired Organization Group in Workspace ONE UEM.

    Skip this step if you already have sTokens in Workspace ONE UEM

    1. Disable if you do not want Workspace ONE UEM to send invitations to devicesAutomatically send invitations.

      Workspace ONE UEM will prompt you to register an sToken with the Workspace ONE UEM environment. Automatically send app invites based on users with permissionsthispush mode.

  2. Deploy and publish device-based VPP applications with flexible deployment capabilities

    During the allocation process, Workspace ONE UEM prompts you to enable the application by configuring it as a device-based methodEnable device mapping.

  3. Access licensing and application information through the Licensing page, Device Details page, and Manage Devices page.
  4. Revoke user licenses with various administrative functions.
    • Remove device.
    • Select Revoke Action on the information pages (License, Device Details, and Device Management pages).
    • Deactivate and delete tasks.
    • Removes the device from the smart group assigned to the VPP application.

Manually or automatically update device-based VPP applications

Set up automatic updates at the application level or manually push updates to device-based VPP applications. This feature provides update management from Workspace ONE UEM or allows you to push updates as a way to control application versions.

This feature does not apply to distributions managed by Apple IDs. VPP applications must have device-based distribution, also known as device serial number distribution, enabled. For general information on distribution methods for device serial number management , seeDistribution is managed by device serial number.This topic includes supported operating systems, permissions, and the need for non-VPP invitations.

use:Non-device-based VPP applications are marked asinvalid, this feature is not supported by such VPP applications.

System Behavior During Initial Configuration

When configuring for the first time, the system automatically queues the application installation commandEnable automatic updates. Workspace ONE UEM stores the version number of the application currently available on the App Store in the database. If the device reports a lower version than what is currently available in the App Store, Workspace ONE UEM can automatically trigger the device's install command to perform an app update. The Workspace ONE UEM system periodically checks for updates to the app store and records any new versions in the database to continue the process.

Upgrade Challenges for Device-Based VPP Applications

There is an update issue with the device-based VPP app due to signing out of an Apple ID. Workspace ONE UEM has developed a system to facilitate device-based application updates. You can set up automatic updates or send updates manually.


In the device-based VPP managed distribution method, the device serial number is the link between the license and the application. It replaces Apple ID. However, app updates are still associated with your Apple ID because your Apple ID is associated with your purchase history. Device-based apps may miss updates because the Apple ID is removed from the authorization process.


Workspace ONE UEM checks the app store for updates to the device-based VPP app and determines when user interface updates are available.

Enables automatic updates for device-based VPP applications, which Workspace ONE UEM will update when it determines an update is available.

If you want versioning of your app, turn off automatic updates and manually push updates when needed.


Top Articles
Latest Posts
Article information

Author: Rueben Jacobs

Last Updated: 07/01/2023

Views: 6064

Rating: 4.7 / 5 (57 voted)

Reviews: 88% of readers found this page helpful

Author information

Name: Rueben Jacobs

Birthday: 1999-03-14

Address: 951 Caterina Walk, Schambergerside, CA 67667-0896

Phone: +6881806848632

Job: Internal Education Planner

Hobby: Candle making, Cabaret, Poi, Gambling, Rock climbing, Wood carving, Computer programming

Introduction: My name is Rueben Jacobs, I am a cooperative, beautiful, kind, comfortable, glamorous, open, magnificent person who loves writing and wants to share my knowledge and understanding with you.