AirWatch developed a VPP Bulk Express custom process for distributing Apple Volume Purchase Program (VPP), Manged Distribution licenses in bulk deployments. School environments are the key target for this custom process and the process aims to greatly reduce the time taken to deploy VPP applications to devices. AirWatch designed the process based on suggestions from Apple and from current school deployments using the system.
High Level Outline
We can divide the VPP Bulk Express process into two phases.
Phase I: Retrieving available licenses
- AirWatch admin configures a spreadsheet with pre-registered users and uploads it to AirWatch.
- AirWatch creates pre-registered users based on the spreadsheet.
- AirWatch requests Apple to send the licenses for auto-deployed applications to be assigned to the pre-registered users. Note: AirWatch does not save the licenses to the AirWatch Database yet.
Phase II: Pushing VPP apps
- AirWatch admin enrolls pre-registered users to their respective devices.
- AirWatch sends invitations to join the Apple VPP, which is similar to the current VPP process.
- Pre-registered users accept the invitation on their respective devices.
- AirWatch periodically polls Apple for results to invitations and Apple returns with the status of pre-registered user’s acceptance who are now active.
- AirWatch saves the licenses retrieved in Phase I for only those applications assigned to devices of the pre-registered users to the AirWatch Database.
- AirWatch pushes install commands of assigned applications to pre-registered users.
Comparing the Current Process and VPP Bulk Express
The following comparison table of the two VPP processes shows the major steps in each process and when they occur.
|Current Process||VPP Bulk Express|
1.Admin adds users or syncs with Active Directory.
1. Admin uploads spreadsheet with pre-registered users identified.
|2. AirWatch creates pre-registered users.|
|3. AirWatch associates licenses for the pre-registered users for all their apps.|
|2. Users enroll devices.||4. Users enroll devices, receive invitations, and accept invitations to join Apple VPP.|
|3. AirWatch creates VPP users.||
5. Devices receive installation commands for VPP apps.
No delay after enrollment to receive installation commands.
|4. Users receive invitations and accept invitations to join Apple VPP.|
|5. AirWatch associates licenses.|
|6. System adds delay for facilitating the refreshing of purchase history.|
|7. Devices receive installation commands for VPP apps.|
This VPP Bulk Express process is not for every VPP deployment. It is vital that organizations considering to use this custom process review the listed considerations:
AirWatch still offers the regular VPP process for environments. Even if an organization enables this process, they can still use the regular process.
AirWatch uses one license for every one user no matter the Apple ID or the device. Staged environments, where the Apple ID is the catalyst for retrieving Managed Distribution licenses and VPP apps may not benefit from using this custom process.
Admins must know the number of available licenses every time they run this custom process. It is essential that the deployment have exactly the number of licenses needed or more. If an organization does not have enough licenses, then not all pre-registered users get their assigned VPP apps.
AirWatch retrieves licenses for apps from every sToken in the AirWatch Organization Group (OG) hierarchy so that any app can be provisioned to the device no matter the OG in which it is enrolled. Although AirWatch retrieves up and down the OG hierarchy, it does not retrieve horizontally, so peer OGs are not affected.
Admins should wait to use the Clear License feature close to the end of the cycle. If admins select to clear licenses before AirWatch has requested licenses from Apple and associated the licenses with assigned apps, the data is cleared and the process must be started from the beginning.
AirWatch disables the Sync License function while retrieving licenses. Admins have to wait until AirWatch completes requests for available licenses to sync licenses for regular users. Due to disabling the sync license function, it is best to sync at the end of a use-cycle (end of day, end of week, or the applicable time frame).
AirWatch could consume extra licenses because of the following reasons:
AirWatch gets the licenses before devices enroll with the system.
AirWatch retrieves licenses from all sTokens up and down the OG hierarchy.
AirWatch overrides many checks, like the correct Apple ID for the correct application with the correct license, to gain pre-registered users immediate access to VPP apps.
VPP Bulk Express Process
For efficacy, organizations should follow the VPP Bulk Express process as outlined in this article.
1. Upload Service Tokens (sTokens) and Sync
Admins should upload sTokens to the AirWatch Admin Console and have synced the sToken to display the purchased applications in the Console.
2. Enable the System Code
Admins contacat their AirWatch Support Representative and have the Representative enable the system code for the VPP Bulk Express process.
3. Audit Available Licenses
Admins must ensure they have enough licenses to cover the number of applications pushing to devices for this cycle, whether the cycle is daily, weekly, or some other time frame.
4. Assign Apps to Pre-Registered Users
Admins assign purchased apps to Smart Groups.
Note: Admins can assign purchased apps to Smart Groups at any point during the VPP Bulk Express deployment process; however, it is best to assign them before adding the spreadsheet for batch import.
5. Configure and Upload a User Spreadsheet for Batch Import
Admins configure and upload a batch import spreadsheet to the AirWatch Admin Console.
Follow the process for Batch Import which is repeated here and which is outlined in the AirWatch Mobile Device Management (MDM) Guide.
Note: Saving the spreadsheet to AirWatch disables the sync licenses function until AirWatch retrieves all required licenses for pre-registered users. Admins should consider if they need to sync licenses for regular VPP users before starting this process.
Navigate to Accounts ► Users ► Batch Status and select Batch Import.
Enter the basic information including a Batch Name and Batch Description for reference in the AirWatch Admin Console.
Select the Users And/Or Devices batch type from the Batch Type drop-down menu.
Select the information icon to access available templates.
Select Download Advanced Template and Example for this Batch Type under Users And/Or Devices and save the .csv file somewhere accessible.
Open the .csv file, which has a number of columns corresponding to the fields that display on the Add / Edit User page. Columns with an asterisk are required and must be entered with data.
Enter the following information in the Pre Register For VPP column. Entries are not case sensitive.
Yes represents a pre-registered user. IMPORTANT: Once a user is tagged as Yes in the system, you cannot edit the tag to No. You have to delete the user from the system and add them as a No.
No or a blank represents a user that is not participating in the VPP Bulk Express.
Save the spreadsheet when complete.
Return to the Batch Import screen in the AirWatch Admin Console, select Choose File to locate and upload the saved comma-separated values (.csv) file.
Select Save to upload users into the AirWatch Admin Console.
6. Enroll Devices to Users
Admins enroll devices for their pre-registered users to save time. However, pre-registered users can enroll themselves.
7. Accept VPP Invitation
Users accept the invitation to join the VPP. Apple identifies the pre-registered user as active and when AirWatch polls Apple for the results of sent invitations, Apple reports the pre-registered user status to AirWatch.
8. Install Applications
AirWatch checks for the licenses assigned to users and saves the licenses for all the assigned apps. AirWatch then sends installation commands for the VPP apps, and pre-registered users install them to their devices.
9. Clear Unused Licenses
Admins use the Clear License feature to free up unused licenses and to use them for pre-registered users at the beginning of the next cycle. The feature is at Groups & Settings ► All Settings► Apps ► Catalog ► VPP Managed Distribution. The presence of this feature is an indication that the environment is enabled for this custom process.
10. Sync Licenses
Admins sync licenses at the end of a cycle (like the end of the school day) to have the correct number of licenses available for the next cycle.