Content Token (VPP) Management

Apple Content Token(VPP) Management refers to the process of integrating your organization's ABM/ASM account with ManageEngine MDM using a Content Token/VPP (Volume Purchase Program) Token. This token acts as a secure, authenticated bridge between Apple and MDM. It allows you to:

• Synchronize Applications: Discover and import a catalogue of apps you've purchased or assigned in ABM.
• Manage Licenses: Assign, revoke, and track the usage of app licenses across your enrolled devices without using Apple IDs.
• Enable Automated App Distribution: Distribute apps to devices or users seamlessly.

Integrate a New Content Token(VPP) in MDM

Note: Only a MDM user with the "MDM Admin" role and "Application Management Full Control" privileges can perform this action.

1. On the MDM Console, navigate to Device Mgmt->App Management->Apple app Management. Select "Configure apps for Business" or "Configure apps for School" as your preference.
2. Log in to ABM/ASM with your corporate credentials.
3. On the ABM portal, click on your account on the bottom left corner and select Preferences.

   

4. Click on Payments and Billing > Apps and Books > Content Tokens.

   

5. Click the Download button next to your MDM Content Token entry. If your MDM Content Token is not listed, you may need to add it first.
6. Save the downloaded (.vpptoken) file securely.
7. Navigate back to the MDM Console and Upload Content Token by browsing to and select the .vpptoken file you downloaded from ABM.
8. The Content Token is valid for one year, and we need to renew the Token every year upon expiry. Provide your e-mail address to receive notifications prior to the expiry of the token. Click Upload to complete the process.
9. You have successfully created/renewed the content token on the MDM server. You can now distribute apps to the managed devices, assign or revoke licenses as per your requirement.
10. Upon successful upload, the MDM will immediately initiate a sync with ABM. The MDM will import all apps and their available license counts associated with this token in ABM.

Note: If this Content/VPP token was previously associated with another MDM server, uploading the new token here will automatically revoke the license to the devices assigned from the previous server. Once the License is revoked, the Apps installed from the previous server will automatically uninstalled after 14 days.

Renew an Expired Content Token

1. Each Content token(VPP/Apple Content Token) is valid for one year. When nearing expiration, it is essential that the token is renewed to distribute apps using the content tokens.
2. The MDM will display on the console and sends a notification on its expiration status.
3. To renew, generate a new token from the same location in ABM (Payments and Billing > Apps and Books > Content Tokens). The old token will be automatically invalid upon generation of the new one.
4. To upload the content token on the MDM server, go to Device Management -> App repository ->Apple app management . Choose the required content token and click on Renew Token.
   If multiple content tokens are present on the MDM server, click on the token to be renewed, choose Actions and Renew Token.
5. Upload the new .vpptoken file. The MDM will re-establish the connection and resume syncing app and license information.

Managing multiple content tokens in MDM

You can also upload multiple content tokens on the MDM console to manage department or location specific app purchases. To upload new tokens, navigate to App Repository -> Apple App Management -> Add Content Token -> Upload Token. Once uploaded, MDM will sync the apps added to the content token via ABM.

Note:
1. If you need to add a new location in ABM portal, go to Locations and click on Add a new location. It is recommended to give the location a descriptive name, for easier identification purposes.
2. While distributing apps via Apple Configurator, it is suggested to create and maintain a separate Content/VPP token.

Content Token (VPP) Management Scenarios and Effects

1. Removing a Content Token (VPP) from MDM
   Scenario:If an administrator removes a Content/VPP token from the MDM configuration.
   Effect: All apps that were synced into the MDM repository exclusively from that token will be revoked. The MDM will attempt to revoke all licenses assigned from that token and send uninstall commands to all devices that have the app installed.
   

   Note: Only remove a token if you are absolutely sure you no longer need to manage those apps and wish to reclaim all licenses in ABM.

2. Managing Duplicate Apps (Multiple Tokens)
   Scenario: The same app (e.g., "Creator app") is available from two different Content/VPP tokens uploaded to the same MDM.
   
   Effect:
   • The app will appear only once in the application repository.
   • The MDM will create a combined pool of licenses from all tokens that contain that app.
   • When assigning the app, the MDM will automatically consume licenses from any available token.
3. If the content token is already in use:

    

   1. When the content token is used in another MDM Server: If the same token is uploaded and synced with other MDM Server then a prompt will be shown saying the token had already been used in another MDM Server, checking the box will remove the app licenses linked with other the MDM server too.
   2. When the Content/VPP token is used in Apple Configurator: If the user signs into the Apple Configurator using the Apple ID and syncs the apps of Content/VPP token then a prompt will be shown saying the token had already been used in another MDM Server. Checking the box will remove associated license from Apple Configurator and sync in the present MDM Server.
4. Token Expiry or Revocation
   • Expired/Revoked Token: If a token expires or is revoked in ABM, the MDM can no longer sync with Apple for that token.
   • Existing Assignments:Apps already installed on devices will continue to function. The installed application is not disabled.
   • New Assignments: You cannot assign new licenses for apps from the expired token, or assign any new apps from that token, until a renewed token is uploaded.

Troubleshooting Tips

MDM server is not able to contact ABM to sync apps.
Check if vpp.itunes.apple.com is allow listed along with other domains and ports listed here. Ideally, it is recommended to Allowlist *.apple.com for seamless management of Apple devices. Also, verify the availability of the required Apple services.