Volume Purchase Program (VPP) Troubleshooting Guide

Newly purchased applications are not syncing into the Workspace ONE UEM Console

When navigating in the console to Apps & Books > Applications > List View > Purchased, you may see a sync error where the sync does not complete. If this is the case, follow the troubleshooting steps below for resolution or further information.
Note: Newer console versions will remind you if the sToken is invalid.

  • Get your sToken from Apple Business Manager (ABM), Apple School Manager (ASM) or VPP portal
  • Open the sToken in a text editor and copy the encrypted code in the sToken.
  • Search for the newly purchased application in the web browser and look for the iTunes link. For instance, if OneDrive is the newly purchased app, search for the phrase OneDrive iTunes and you find the app store web link for the app
  • Open the link. In the URL, copy the numerical value between id and a question mark. For instance, if https://itunes.apple.com/ca/app/onedrive-cloud-storage-for/id477537958?mt=8is the link, the numerical value is 477537958. This is known as the Admin ID of the app.
  • Download Postman API client
  • Use https://vpp.itunes.apple.com/WebObjects/MZFinance.woa/wa/getVPPLicensesSrvas the request URL
  • Paste the sToken and adminID values in the request body of the REST API call
  • Click Send and scroll down to the end of the response.
    • If this action brings up the appropriate number of licenses as indicated by totalCount, get back to the Workspace ONE UEM Console and perform a sync.
    • If the response does not show the appropriate license count or any other error message, the console will not be able to reflect the right count.
    • If the error message reads “The sToken has been revoked”, please renew the sToken as this usually happens when you have changed the password of the Apple ID used to download the sToken.


Applications fail to install

If an application fails to install, it is helpful to check the Troubleshooting Logs of the device on the console. For Workspace ONE UEM Console 9.1+, the logs present a more detailed error code such as the following:

  • License for app with iTunes Store ID XXXXXX could not be found.

Device Based VPP:
For device based VPP, installation issues are usually caused when device cannot verify the license. Please make sure that:

  • License is associated appropriately in console
  • Device network has access to vpp.itunes.apple.com
  • VPP sToken is not shared with another MDM
    Note: VMware has noted instances where other MDM vendor solutions auto-revoke device based licenses that are associated with Workspace ONE UEM

User Based VPP:
For user based VPP, installation issues usually occur when the Apple ID on the device is changed after having accepted the VPP invitation to install purchased apps. In the Workspace ONE UEM database, an encoded form of the Apple ID that is used to accept the VPP invite is stored along with the enrollment user information. This combination is used as a reference for the Console to assign purchased applications. A change in the Apple ID causes a mismatch in our records and thus app assignment cannot be completed. Our support team can confirm if the Apple ID username and password currently in use on the device are being provided correctly to the Console. The encoded form of the provided credentials would not match with the ones that were used to register this user in the Volume Purchase Program if the Apple ID had been changed.
There are several ways to rectify this issue. One would be to change the Apple ID on the device to the one that was present when the device was registered in VPP. We only have the encoded form of the Apple ID; the console will not be able to retrieve the actual value for you. The other way to rectify this is to delete the user record from the Workspace ONE UEM database through the console. You can do this by carrying out the following steps:

  1. Delete the device from the Workspace ONE UEM console (and ensure that it is unenrolled)
  2. Delete the enrollment user account from the console
  3. Add the user back to console (perform a user group sync if you are using Active Directory)

Following that, enroll the device and accept the VPP invitation again. You should then be able to install any purchased applications until the Apple ID remains the same.


Externally redeemed licenses (cause and resolution)

The scenarios where the licenses show as externally redeemed or unknown are:

  1. If a device is included in two smart groups assigned to one VPP application, deleting the assignment whose smart group id was attributed to the license association first in our database will cause the Edit Assignment menu to display the license as Externally Redeemed
  2. This behavior also appears when a device moves from one assigned smart group into another.
  3. If the license of an un-enrolled device is not revoked prior to un-enrollment.

For scenario 1 & 2, even though the license is counted as externally redeemed in the Edit assignment page, it is still in use and could not be revoked.
For scenario 3, if you click in to the associated license list, we could click into the associated license number of the affected app and manually revoke the unused licenses.
As long as there is no enabled revoke button in the associated license list, we are good. Sometimes the externally redeemed number will remain inaccurate in the app details view because the aforementioned scenarios. This has been improved in Workspace ONE UEM 1903+.

On clicking the application in the purchased tab of the Admin Console, you should see the count of externally redeemed licenses in the left pane.

Workspace ONE Console 9.1+:


If the pane on the left shows a positive count, click on the number of devices that have installed the app to see the license and device using that particular license.


For Workspace ONE UEM 1903+, we combine the redeemed and externally redeemed counts. Admins can still see the total redeemed license list by clicking in the list view of an app's licenses.
The total redeemed count is the sum of licenses redeemed by this Workspace ONE UEM console and licenses redeemed outside of this Workspace ONE UEM console. These licenses have been claimed by devices and must be revoked before they can be distributed.


Unable to renew VPP token: Country is required

When renewing a VPP sToken, a Country is required error may appear, causing the renewal to fail. If this occurs, simply re-save the existing settings before choosing the option to renew. This will ensure that the saved data matches the correct information when renewing the token.



Unable to install VPP apps to devices from Workspace ONE UEM Console (User Based VPP)

Ensure user has accepted VPP invitation
You may notice that you are unable to manually push applications to certain devices in the Workspace ONE UEM Console. If you navigate to the apps section of the Device Details page of a particular device, you may see that certain VPP apps have the options to install grayed out. In these cases, you will be unable to push the app to the device from the console.

A common reason for this behavior is that the user has not accepted the VPP invitation yet. To validate this, navigate in the console to Applications > List View > Purchased. To the right of the app in question, select the magnifying glass icon to open the Manage Devices page. Here, you will be able to confirm if a device has accepted the VPP invitation or not, and can also choose to resend the invitation to a device if necessary. Once Workspace ONE UEM receives confirmation that the invitation has been accepted, admins will be able to manually push VPP apps to these devices.


VPP applications are not pushed to devices

Check license availability
If apps are not pushing to newly assigned/enrolled devices, double check to ensure that you still have available licenses for this app. If you navigate to Apps & Books > Applications > List View > Purchased and select the name of the app in question, you will see information similar to the image below. Specifically, ensure that there are still some unallocated licenses left for new devices. In the event that there are no available unallocated licenses, additional licenses must be added to the assignment. If any licenses have previously been marked as On Hold, these can be reduced as well to ensure that more licenses are available for devices. Additionally, on the right-hand side of this same window, ensure that the total redeemed quantity is less than the total allocated quantity.


Users with multiple devices (User Based VPP)
When allocating licenses, console allocates a single license to each assigned user account. Further, on a device level, different devices that use the same Apple ID can share application licenses. As a best practice, VMware recommends that devices enrolled under the same enrollment user also use the same Apple ID when using VPP. If a user has multiple devices enrolled, and each device utilizes a different Apple ID, then the app license will not be shared between the devices. In these cases, the app will install on devices using the same Apple ID as the first device to download the app, but will remain unallocated on other devices. If it is a requirement that these devices use different Apple IDs, we recommend to use Device Based Licensing.
However, note that there are also considerations to be made for the maximum number of devices tied to a single Apple ID. For more information, please read Apple's documentation here.


App store restrictions
Devices must have the App Store available in order to properly process the VPP Invitation when first signing up for the program. In cases where the invitation does not come down to devices, double check to ensure there are no restrictions to app store availability on this device. In particular, ensure that both the Restricted App Mode (left) under Settings > Apps > Workspace ONE > App Restrictions is not enabled at the Organization Group where the device is enrolled and that there is not a restriction profile that blocks the installation of public apps (right) pushed down to the device.


Application compatibility
If you experience issues where an application does not install on certain device models (ex: it installs on iPads but not iPods, or it only installs on iOS 12 devices), please verify the compatibility of the app in the App Store. This can be done by searching for the app in iTunes and verifying the details below on the information page of the app itself.
Additionally, an age range restriction can result in applications not installing if there is a restriction profile on the device that filters the media content to certain level/ages.


Install delays
Sometimes users may experience a slight delay between selecting the install option and the install processing beginning on a device. As this process requires communication and approval of several different components (ex: Workspace ONE UEM Console, Apple servers, devices), please allow up to 3-5 minutes for an install command to process during times of high latency.

Other Languages: 日本語

Have more questions? Submit a request


Article is closed for comments.