App Store apps reach your devices through Apple's Volume Purchase Programme (VPP). You buy licences in bulk and send apps to macOS, iPhone and iPad without employees needing their own Apple IDs.
Overview
| macOS | Windows | Linux | iOS / iPadOS | Android |
|---|---|---|---|---|
| ✅ | ✅ |
Use App Store apps when:
- The app is published on the Mac App Store or the iOS App Store.
- You want Apple to keep the installer up to date.
- You need to deploy apps to supervised iPhones and iPads.
Before you start, you need:
- An Apple Business account.
- VPP connected to the Factorial IT console.
Connect your content token (new setup)
- Download a content token from Apple Business. In Apple Business, open Preferences > Payments & Billing > Apps & Books. Under Content Tokens, click Download next to the location you want to use.
- Import the token. In Factorial IT, go to MDM > Software > Add app > App Store (VPP), choose the "No Team" scope, and upload the token file.
- Buy enough licences in Apple Business. Go to Apps and Books, search for the app, buy the number of licences you need, and assign them to the location linked to your content token.
Licences are reassigned automatically when a device is unenrolled.
Never connect one content token to two MDMs at the same time. It causes conflicts and can remove apps from devices. If you are moving from another MDM, follow the next section instead.
Connect your content token (moving from another MDM)
Apple requires the token to be removed from the old MDM before you upload it anywhere else, so keep to this order:
- Remove the content token from your previous MDM. Your old provider does it, or you do it in their console.
- Download a new content token in Apple Business. Open Preferences > Payments & Billing > Apps & Books and, under Content Tokens, click Download next to the location.
- Upload the token using the import step from the new setup above.
- Reassign apps that come back unassigned. Some apps may need to be assigned to devices again by hand once the new token is active.
Apps already on devices keep working for up to 30 days after the old token is removed, or until the app developer runs a receipt check. Do not stretch the migration beyond that.
Content token validity
- A token lasts one year from the day it is created.
- It stops working if someone changes the password of the Managed Apple Account that created it.
- Recommended: create a dedicated Managed Apple Account with a custom role that only has the "Assign licences for Apps and Books" permission. That way the token does not break when a person changes their password or leaves.
Deployment options
- Install automatically. The app is pushed silently to every targeted device (macOS, iOS, iPadOS).
- Self-service. Employees find the app in the Self-Service portal and install it when they want it (macOS, iOS, iPadOS).
- Install during Zero Touch. The app is installed while the device is being provisioned (macOS only).
Employees reach the Self-Service portal differently on each platform:
- macOS: through the Fleet Desktop icon in the menu bar.
- iOS / iPadOS: through the portal's web URL. Add it to the Home Screen with the Web Clips control and its Add the Self-Service web clip option.
On iPhone and iPad, the portal is also the only way to restart a VPP install if the employee dismissed the App Store confirmation prompt. They open the app in the portal and tap Retry.
How to use
- Go to MDM > Software and click Add app.
- Choose App Store (VPP) and a platform: macOS or iOS/iPadOS.
- Browse or search the App Store catalogue to find the app.
- Set the deployment options.
- Click Add software.
App patching
| Keep installer updated | ✅ The installer always comes straight from the App Store, so it is never out of date. |
| Automatically patch devices | ✅ Devices on an older version are updated automatically. |
Tips and Best Practices
- Use a dedicated Managed Apple Account for the token. It keeps VPP working when people change passwords or leave.
- Note the token's renewal date. It expires one year after creation.
- Buy licences before you deploy. Without enough licences assigned to the token's location, the app cannot go out.
- Finish migrations quickly. Installed apps only keep working for up to 30 days after the old token is removed.
- Give iPhone and iPad users the Self-Service web clip. They need it to reach the portal and to retry a dismissed install.
Troubleshooting and FAQ
Troubleshooting
- Apps disappeared from devices after connecting the token. The same token may still be connected to another MDM. Remove it there. One token must only ever be active in one MDM.
- VPP stopped working. The token may have expired after a year, or the password of the Managed Apple Account that created it was changed. Download a new token and upload it again.
- An employee on iPhone dismissed the App Store prompt and the app never installed. Ask them to open the app in the Self-Service portal and tap Retry.
- Apps show as unassigned after a migration. Reassign them to devices by hand once the new token is active.
FAQ
-
Do employees need their own Apple ID?
No. VPP licences let you push apps without individual Apple IDs.
-
Can I install App Store apps during zero-touch deployment on iPhone?
No. Installation during Zero Touch is available on macOS only.
-
What happens to a licence when a device is unenrolled?
It is reassigned automatically.
-
Do I need to update App Store apps myself?
No. The installer always comes from the App Store and older versions on devices are updated automatically.