Volume Purchase Program (VPP) Troubleshooting Guide

Newly purchased applications are not syncing into the Workspace ONE UEM Console

When navigating in the console to Apps & Books > Applications > List View > Purchased, you may see a sync error where the sync does not complete. If this is the case, follow the troubleshooting steps below for resolution or further information.

  • Get your sToken from Apple’s Volume Purchase Program portal
  • Open the sToken in a text editor and copy the encrypted code in the sToken.
  • Search for the newly purchased application in the web browser and look for the iTunes link. For instance, if One Drive is the newly purchased app, search for the phrase “One Drive iTunes” and you find the app store web link for the app
  • Open the link. In the URL, copy the numerical value between id and a question mark. For instance, if https://itunes.apple.com/ca/app/onedrive-cloud-storage-for/id477537958?mt=8 is the link, the numerical value is 477537958. This is known as the Admin ID of the app.
  • Download Advanced REST API client to Google Chrome
  • Use https://vpp.itunes.apple.com/WebObjects/MZFinance.woa/wa/getVPPLicensesSrv as the request URL in the plugin.
  • Paste the sToken and adminID values in the Payload of the REST API call in the plugin.
  • Click send and scroll down to the end of the response. If this brings up the appropriate number of licenses as indicated by “totalCount”, get back to the AirWatch console and perform a sync.
  • If this does not show the appropriate license count or any other error message, the console will not be able to reflect the right count.
  • If the error message reads “The sToken has been revoked”, please renew the sToken as this usually happens when you have changed the password of the Apple ID used to download the sToken.
  • Report any other error code that you see to AirWatch support for further assistance.


Applications fail to install with “Error Code: Pending”

If an application fails to install, it is helpful to check the Troubleshooting Logs of the device on the console. Below AirWatch Console 9.1, the console will only log a generic error code for the app installation issue ("Error Code: Pending"). For AirWatch Console 9.1+, the logs will give a more details error code such as the following examples:

  • "XXX is already scheduled for management."
  • "License for app with iTunes Store ID XXXXXX could not be found."

Here you may notice several Install Application Failed events with Error Code: Pending, which are generally caused when the Apple IDs on the device is changed after having accepted the VPP invitation to install purchased apps. In the AirWatch database, an encoded form of the Apple ID that is used to accept the VPP invite is stored along with the AirWatch user and this combination is used as a reference for the console to assign purchased applications. A change in the Apple ID causes a mismatch in our records and thus app assignment cannot be completed. This can be confirmed by AirWatch support if the Apple ID username and password currently in use on the device are provided. The encoded form of the one provided would not match with the one that was used to register this user in the Volume Purchase Program if the Apple ID had been changed.

There are a couple of ways to rectify this issue. One would be to change the Apple ID on the device to the one that was present when the device was registered in VPP. We only have the encoded form of the Apple ID; AirWatch will not be able to retrieve the actual value for you. The other way to rectify this is to delete the user record from the AirWatch database through the console. You can do this by carrying out the following steps:

  • Delete the device from the AirWatch console (and ensure that it is unenrolled)
  • Delete the AirWatch user account from the console
  • Add the user back to AirWatch (perform a user group sync if you are using Active Directory)

Following that , enroll the device and accept the VPP invitation again. You should then be able to install any purchased applications until the Apple ID remains the same.


Externally redeemed licenses (cause and resolution)

Externally redeemed licenses are usually caused when the license of an unenrolled device is not revoked prior to un-enrollment.

On clicking the application in the purchased tab of the Admin Console, you should see the count of externally redeemed licenses in the left pane.

Below AirWatch Console 9.1:


 AirWatch Console 9.1+:


If this shows a positive count, click on the number of devices that have installed the app to see the license and device using that particular license.


Externally redeemed licenses would be revocable with the revoke button enabled. If this is disabled for all the licenses and yet you have a positive count of externally redeemed licenses, then AirWatch support can revoke the licenses manually through a script on the backend database. This also applies when you see a negative count in the license allocation.


Applications showing as removed for the status in the console

Open the troubleshooting logs by clicking on the More tab in the device details view. If you notice Install Application Failed events with Error Code: Pending as the reason, then ensure that the Apple ID that accepted the VPP invitation is still present on the device. If this is not the case, please retry installing the application and observe the behavior on the device itself. If the app appears to install but stops and disappears, we will need to collect the device logs. Contact AirWatch support for instructions regarding this. It would also help if you enable Targeted Logging by clicking on Targeted Logging under the More tab for that particular device.


Unable to renew VPP token: “Country is required”

When renewing a VPP sToken, a 'Country is Required' error may appear, causing the renewal to fail. If this occurs, simply re-save the existing settings before choosing the option to renew. This will ensure that the saved data matches the correct information when renewing the token.



Unable to install VPP apps to devices from AirWatch console

Ensure user has accepted VPP invitation

You may notice that you are unable to manually push applications to certain devices in the AirWatch Console. If you navigate to the apps section of the Device Details page of a particular device, you may see that certain VPP apps have the options to install grayed out. In these cases, you will be unable to push the app to the device from the console. 


A common reason for this behavior is that the user has not accepted the VPP invitation yet. To validate this, navigate in the console to Applications -> List View -> Purchased. To the right of the app in question, select the magnifying glass icon to open the "Manage Devices" page. Here, you will be able to confirm if a device has accepted the VPP invitation or not, and can also choose to resend the invitation to a device if necessary. Once AirWatch receives confirmation that the invitation has been accepted, admins will be able to manually push VPP apps to these devices.



VPP applications do not get pushed to devices

Check license availability

If apps are not pushing to newly assigned/enrolled devices, double check to ensure that you still have available licenses for this app. If you navigate to Apps & Books -> Applications -> List View -> Purchased and select the name of the app in question, you will see information similar to the image below. In particular, ensure that there are still some unallocated licenses left for new devices. In the event that there are no available unallocated licenses, additional licenses must be added to the assignment. If any licenses have previously been marked as 'On Hold', these can be reduced as well to ensure that more licenses are available for devices. Additionally, on the right hand side of this same window, ensure that the total redeemed quantity is less than the total allocated quantity.


Users with multiple devices

When allocating licenses, AirWatch allocates a single license to each assigned user account. Further, on a device level, different devices that use the same Apple ID can share application licenses. As a best practice, AirWatch recommends that devices enrolled under the same AirWatch user also use the same Apple ID when using VPP. If a single AirWatch user has multiple devices enrolled, and each device utilizes a different Apple ID, then the app license will not be shared between the devices. In these cases, the app will install on devices using the same Apple ID as the first device to download the app, but will remain unallocated on other devices. If it is a requirement that these devices use different Apple IDs, AirWatch recommends enrolling them under separate user accounts.

However, note that there are also considerations to be made for the maximum number of devices tied to a single Apple ID. For more information, please read Apple's documentation here.


App store restrictions

Devices must have the App Store available in order to properly process the VPP Invitation when first signing up for the program. In cases where the invitation does not come down to devices, double check to ensure there are no restrictions to app store availability on this device. In particular, ensure that both the 'Restricted App Mode' (left) under Settings -> Apps -> Catalog -> App Restrictions is not enabled at the Organization Group where the device is enrolled and that there is not a restriction profile that blocks the installation of public apps (right) pushed down to the device.



Application compatibility

If you experience issues where an application does not install on certain device models (ex: it installs on iPads but not iPods, or it only installs on iOS 7 devices) verify the compatibility of the app in the App Store directly. This can be done by searching for the app in iTunes and verifying the details below on the information page of the app itself.

Additionally, an age range restriction can result in applications not installing if there is a restriction profile on the device that filters the media content to certain level/ages.


Install delays

Sometimes users may experience a slight delay between selecting the install option and the install processing beginning on a device. As this process requires communication and approval of several different components (ex: the device, the AirWatch infrastructure, and Apple's infrastructure), please allow up to 3-5 minutes for an install command to process during times of high latency.

Other Languages: 日本語

Have more questions? Submit a request


Article is closed for comments.