Apple Business Manager’s Volume Purchase Program (VPP) lets organizations purchase iOS, iPadOS, and macOS apps in bulk and distribute them via an MDM solution such as Swif. This article explains:
Which device enrollments allow VPP app installation?
How VPP distribution works (e.g., silent installs vs. user confirmation).
Setup steps for ABM VPP in Swif.
BYOD notes.
Troubleshooting & Best Practices.
1. Overview of VPP App Distribution
ABM & VPP: You use Apple Business Manager to “purchase” (even free) apps at scale, then upload a VPP token into Swif.
Licensing Models:
Device-based VPP: Ideal for corporate-owned, supervised devices. Installs can be silent. No Apple ID is needed on the device.
User-based VPP: Ties the app license to a specific Apple ID (Managed or personal). The user typically must tap “Install,” but won’t pay if it’s a paid app—your organization already owns the license.
Swif’s Role: Syncs your purchased licenses from ABM and pushes the apps to devices based on your chosen assignment.
2. Mac Scenarios: Where VPP Apps Work (or Don’t)
A. Corporate-Owned, Managed via ABM
Examples:
A Mac enrolled through Apple’s Automated Device Enrollment (formerly DEP).
A Mac recognized in ABM as company-owned and enrolled in Swif MDM through Swif Installer or Platform SSO.
VPP Installation: Supported
Swif can install VPP apps silently if the Mac is fully managed and marked as corporate-owned.
On macOS 14+, account-driven enrollment with a Managed Apple ID can also grant a supervision-like status (depending on Apple’s configuration). In either case, VPP is allowed.
B. BYOD Mac (Personal Device Enrollment)
Example:
A personal Mac where the user runs the Swif installer or Platform SSO, not listed in ABM as company-owned.
VPP Installation: Not supported
Apple does not permit managed VPP app installation on truly personal macOS devices that haven’t gone through ABM or a “supervision-like” process.
Attempting to push a VPP app to such a BYOD Mac will generally fail or remain stuck.
3. iOS/iPadOS Scenarios: Where VPP Apps Work (or Don’t)
A. Corporate-Owned iPhone/iPad (DEP/ADE Enrollment)
VPP Installation: Supported (often silent)
Since the device is supervised, Swif can push apps silently. No Apple ID prompt is needed if using device-based VPP.
B. Company-Managed iPhone/iPad (Non-DEP but Recognized as Company-Owned)
VPP Installation: Supported
The user may see a simple “Install?” prompt on unsupervised devices, but no Apple ID login if you use device-based licensing.
If the device is enrolled on Swif through a QR Code or Platform SSO.
C. BYOD iPhone/iPad
VPP Installation: Supported, with user confirmation
iOS/iPadOS “User Enrollment” or a basic profile install on a personal device still allows VPP apps, but the user must tap “Install” to proceed.
You cannot do a fully silent install, because it’s a personal device.
If the BYOD device is enrolled on Swif through Platform SSO.
If the user later removes the MDM profile, those managed apps are removed too.
4. $2.99/Month Subscription (Apple Business Essentials)
Apple offers a service called Apple Business Essentials, which starts at $2.99 per user per month. Some key points:
VPP apps can appear in the user’s App Store even on devices not enrolled with Swif MDM, if they’re signed in with a Managed Apple ID that’s part of your Apple Business Essentials subscription.
This is not the same as having the device fully under Swif MDM management. Without enrollment, you can’t forcibly install or remove the apps—users see them as free downloads associated with their Managed Apple ID.
5. Setting Up ABM VPP in Swif
Once you know your devices’ enrollment types and whether VPP is supported, here’s how to configure it:
Download VPP Token from Apple Business Manager
In ABM, go to Settings (or Preferences) > Apps and Books.
Download the
.vpptokenfile for your location.
Upload Token to Swif
In the Swif Admin Console, add your “VPP account” by uploading the
.vpptoken.Swif will sync all apps (free or paid) you’ve acquired in ABM.
Purchase or “Get” Apps in ABM
Even free apps must be “purchased” (quantity set to some number or unlimited).
Verify you have enough licenses for each device or user.
Assign Apps to Devices/Groups
On Swif, you will assign VPP apps to devices or device groups. Swif will then assign VPP apps based on known information to choose one of these two kinds of assignment:
Device-based assignment: For supervised or corporate-owned iPhones/iPads, and for managed Macs, this usually enables silent install.
User-based assignment: Often used for BYOD iPhones/iPads, or if an app developer doesn’t allow device-based licensing.
Deploy
In Swif, pick the devices or user groups, then click Install (or Deploy).
On supervised iOS, the app installs silently. On unsupervised or BYOD, users see an “Install?” prompt.
If it’s a Mac that isn’t recognized as corporate-owned, the installation will fail.
Renew VPP Token Annually
The
.vpptokenexpires after one year. Download a fresh token from ABM and replace it in Swif to maintain functionality.
6. Self-Service for Optional Apps
You may want to recommend some apps rather than forcing installation. In such cases, you can make them optional:
User-Based VPP in the App Store
Import a user’s Apple ID (Managed or personal) to their employee record on Swif. Swif will choose to install it based on the user's Apple ID.
The user sees the app under their “Purchased” tab or with a cloud icon in the App Store.
They can install it at will; once installed, it’s managed by Swif.
Benefits
Respect user preferences—especially on BYOD devices.
Saves licenses, since only those who want the app install it.
Still allows IT to remove the app later by revoking the VPP assignment or unenrolling the device.
7. Troubleshooting & Best Practices
A. Mac BYOD Fails VPP Installs
Reason: Apple disallows VPP for personal Macs that aren’t recognized as company-owned. If your push fails repeatedly, confirm the device’s enrollment type in Swif. If it’s truly BYOD, VPP is not an option.
B. iOS BYOD Requires User Confirmation
Reason: Apple’s privacy stance on personal devices. MDM can’t silently add apps to a user’s personal iPhone/iPad. The user must tap “Install” when prompted.
C. Token Expired
If you see errors like “VPP token invalid” or no new licenses sync, you may need to re-upload an updated
.vpptokenfrom ABM.
D. License Shortage
Free apps and paid apps both require specifying license counts in ABM. If you run out, new installs fail. Increase the count in ABM and sync again in Swif.
E. Supervision vs. Unsupervised
On supervised (corporate-owned) iOS devices, you can do silent installs. On unsupervised devices, expect an install prompt.
For Macs, supervision equivalents come via Swif managed with Swif installer, Platform SSO, or DEP enrolled. Otherwise, VPP installs may not be possible at all.
F. Communication with End Users
Let BYOD users know they’ll see an “Install?” popup for corporate apps.
Encourage them to accept if it’s required for work. If they decline, you can always re-push later or instruct them how to get it from Swif's App Store.
Conclusion
Swif’s integration with Apple Business Manager (ABM) enables seamless Volume Purchase Program (VPP) app distribution—but only under the conditions Apple supports:
macOS: Must be company-owned and recognized via ABM for VPP installs. Purely personal (BYOD) Macs cannot receive managed VPP apps.
iOS/iPadOS: Both corporate and BYOD devices can receive VPP apps, though BYOD requires the user to confirm an installation. Supervision allows silent installs on corporate iPhones/iPads.
Self-service is recommended for optional apps, letting users install them on demand.
By uploading your VPP token to Swif, assigning apps appropriately, and following Apple’s enrollment guidelines for Mac/iOS devices, your organization can provide the right apps to the right users with minimal friction—while staying within Apple’s BYOD and corporate-owned device policies. For additional help, please contact Swif Support.