Manage Apple VPP apps

You can use the Apple Volume Purchase Program (VPP) to buy iOS and macOS app licenses. You can then distribute these within your organization.

After the order is completed you can download a service token (sToken). This contains the licenses for the purchased apps.

Assigning VPP apps to users or devices

For iOS, you can choose to assign a VPP app to a user or to a device. For macOS, you assign VPP apps to devices:

  • When you assign an iOS VPP app to users, they can install it on all iPhones and iPads enrolled with Sophos Mobile that are connected to their Apple ID.
  • When you assign an iOS VPP app to a device, you don’t need to associate it with an Apple ID.
  • When you assign a macOS VPP app to a Mac, it’s available to all users that sign in to that Mac.

See Manually assign VPP apps and Automatically assign VPP apps.

Inviting users to Apple VPP

Before you can assign a VPP app to a user, you must invite them to VPP. See Invite users to Apple VPP.

You don’t need to invite devices to VPP.

Installing VPP apps

You install VPP apps in Sophos Mobile Admin, the same way you install other apps. See Install app.

Users can install iOS VPP apps from the list of purchased apps in their App Store app. This is not possible for macOS VPP apps.

Unassigning VPP apps

You unassign a VPP app in the following ways:

  • You deselect the required users or devices on the app’s details page.
  • iOS apps: You deselect the app on a user’s details page.
  • macOS apps: You transfer a task bundle with an Unassign VPP app task to the device.

VPP licenses are automatically released in the following situations:

  • The app is uninstalled from the device.
  • The device is unenrolled from Sophos Mobile.

When you unassign a VPP app, users can continue to use it for 30 days.