VPP Integration

What is Apple Business Manager Apps & Books (formerly VPP)

Apple Business Manager Apps & Books (previously known as the Volume Purchase Program, or VPP) is Apple's enterprise app distribution platform. It allows organizations to purchase app licenses in bulk and assign them to devices or users without requiring individual Apple IDs or credit card information on each device.

Key capabilities:

• Volume purchasing — buy app licenses in bulk at a discount
• Silent installation — deploy apps without user interaction
• License management — assign, reassign, and revoke licenses centrally
• Device- or user-based assignment — choose how licenses are allocated
• Tax benefits — eligible for business tax exemptions in supported regions

Uploading VPP Token

To integrate with Apple Business Manager, you must upload a VPP token obtained from your Apple Business Manager account.

1. Navigate to Settings > VPP in the GuardMDM console
2. Click Upload Token
3. Select the .vpptoken file downloaded from Apple Business Manager
4. Click Save

The token authenticates GuardMDM with Apple's servers, enabling license lookup, app metadata sync, and silent installation commands.

Token Metadata

Once uploaded, the token details are displayed in the console:

Field	Description
Organization Name	The legal entity registered in Apple Business Manager
Location	The country or region associated with the token
Expiry Date	The date the token expires (tokens are valid for 12 months)
Status	Active, Expiring Soon, or Expired
Last Synced	Timestamp of the last successful sync with Apple

GuardMDM displays a warning banner when a token is within 30 days of expiry.

Syncing Assets from Apple

After the token is uploaded, GuardMDM syncs available apps and books from Apple Business Manager.

Manual Sync

1. Go to Settings > VPP
2. Click Sync Now
3. Wait for the sync to complete (typically 30-60 seconds)
4. Verify updated asset list in Apps & Books

Automatic Sync

GuardMDM automatically syncs every 24 hours. You can also trigger a sync after uploading or renewing a token.

What Gets Synced

• App catalog — all available free and paid apps
• License counts — total purchased, assigned, and available licenses
• App metadata — name, version, icon, supported devices, category
• Books — available Apple Books (if applicable to your organization)

Push Notification Subscription for Real-Time Updates

GuardMDM supports Apple's push notification service for VPP to receive real-time updates about license changes, app availability, and token status.

Enabling Push Notifications

1. Go to Settings > VPP
2. Under Push Notifications, click Subscribe
3. GuardMDM registers a callback URL with Apple Business Manager
4. Apple sends push notifications when:
   • License counts change
   • New apps become available
   • Token is about to expire
   • Token has expired

Benefits

• Immediate awareness of license changes without waiting for the next sync cycle
• Proactive expiry warnings — GuardMDM can alert admins before the token expires
• Reduced sync load — sync only when Apple reports a change, not on a fixed schedule

Token Renewal Process

VPP tokens expire every 12 months. A valid token is required for app deployment and license management.

Renewal Steps

1. Log in to Apple Business Manager
2. Navigate to Settings > Apps & Books > Tokens
3. Download a new token (renewing does not invalidate the current token until the new one is uploaded)
4. In GuardMDM, go to Settings > VPP
5. Click Renew Token
6. Upload the new .vpptoken file
7. Click Save

What Happens After Renewal

• All existing license assignments remain intact
• The sync schedule continues uninterrupted
• Push notification subscriptions persist
• Deployment policies continue to work

Expired Token

If a token expires before renewal:

• New app installations will fail
• License reassignment is blocked
• App metadata sync stops
• Existing installed apps continue to function
• Push notifications are no longer received

Renew the token as soon as possible to restore full functionality.

VPP Token Expiry — License Management Frozen

Feature	Before Expiry	After Expiry
New App Install	✅ Working	❌ Fails
License Assignment	✅ Working	❌ Blocked
App Catalog Sync	✅ Working	❌ Stops updating
Installed Apps	✅ Working	✅ Continue running
Push Notifications	✅ Working	❌ No longer received

Recovery: Download a new token from Apple Business Manager and upload it to GuardMDM. All existing license assignments remain intact.

---

Next: App Deployment Workflow