Skip to content

Manage Apple Business Manager apps

To manage the apps you buy in Apple Business Manager with Sophos Mobile, you must transfer a content token from Apple Business Manager to Sophos Mobile and configure app assignment.

A content token is valid for one year.


You can use each content token for a single Mobile Device Management (MDM) provider only. To make sure that you don’t accidentally assign a token twice, we recommend that you revoke and remove any tokens used with other MDM providers before uploading a token to Sophos Mobile.

To set up managing apps from Apple Business Manager, do as follows:

  1. Sign in to Apple Business Manager with an account that has the Administrator or Content Manager role.
  2. Download a content token for your Apple Business Manager location that you want to connect with Sophos Mobile.

    See Manage content tokens in Apple Business Manager.

    When you buy apps in Apple Business Manager, you assign them to a location. If you want to manage apps from several locations, you must use a separate Sophos Mobile account for each location.

  3. In Sophos Mobile, go to Setup > Apple setup > Apple VPP.

  4. Configure the following settings:

    Setting Description
    Automatically assign iOS VPP apps on installation

    Select if and how Sophos Mobile automatically assigns Apple Business Manager apps to users and devices.

    Prioritize device assignment: Sophos Mobile assigns apps to the device. If the device doesn’t support assignment, Sophos Mobile assigns apps to the device user. For example, Apple User Enrollment devices only support user assignment.

    Prioritize user assignment: Sophos Mobile assigns apps to the device user. If there’s no device user, Sophos Mobile assigns apps to the device.

    Disabled: You must assign apps manually. You can’t assign macOS apps to users.

    Both options, Prioritize device assignment and Prioritize user assignment, turn on automatic device assignment.

    Automatically update iOS VPP apps assigned to devices

    For apps assigned to iPhones or iPads, users receive a notification on their device when there’s an update available.

    For apps assigned to users, the user must check the App Store for updates.

    Apple ID Your organization’s Apple ID.

    The App Store country.

    Some apps aren’t available in certain countries. When searching for apps, Sophos Mobile uses the country you selected.

    For a list of country codes, see ISO Online Browsing Platform: List of country codes.

    Upload a file

    Upload the .vpptoken file with the content token you downloaded from Apple Business Manager in step 2.

    Sophos Mobile shows the token information in Organization and Expiration date.

  5. Click Save.

You can now start assigning apps to devices. Before assigning apps to users, you must invite them to Apple Business Manager apps. See Invite users to Apple Business Manager.