Distribute iOS apps with Apple VPP

Supported editions for this feature: Frontline Starter, Frontline Standard, and Frontline Plus; Business Plus; Enterprise Standard and Enterprise Plus; Education Standard, Education Plus, and Endpoint Education Upgrade; Enterprise Essentials and Enterprise Essentials Plus; G Suite Basic and G Suite Business; Cloud Identity Premium. Compare your edition

As an administrator, you can use the Apple Volume Purchase Program (VPP) to purchase apps in bulk and distribute them to all iOS devices in your organization. To do so, you connect Apple Business Manager with your Google Workspace or Cloud Identity subscription. You can purchase app licenses and install licensed apps on managed devices.

Before you begin

• Turn on advanced mobile management for the organizational unit that will use the devices. For details, go to Set up advanced mobile management. 
• Apple VPP is available for user-enrolled iOS devices running iOS 15.5 and later and device-enrolled iOS devices running iOS 7 and later.
• Make sure you have sign-in details for the Google Admin console and Apple Business Manager or Apple School Manager.

Step 1: Purchase app licenses

You need licenses for the Google Device Policy app and any other apps that you want to distribute to iOS devices.

1. Open Apple Business Manager or Apple School Manager and sign in with your business Apple ID.
2. On the side, click Apps and Books. 
3. Find Google Device Policy app and click it.  
4. Select the location where you want to assign the app licenses. 
   If you can’t find the location you want, you can create it. For details, go to Configure locations in Apple Business Manager.
5. Enter the number of licenses you want to purchase and click Get.
6. Purchase licenses for the other apps you want to distribute to users. 

Step 2: Upload a content token to the Admin console

You must be signed in as a super administrator for this task.

To distribute apps to users in the Google Admin console, you need a content token. You get the token from Apple Business Manager or Apple School Manager. The token expires annually. To avoid interruption of service, set a calendar reminder to download an updated token and upload it to the Admin console before your current token expires. If you replace your token with one that was associated with a different mobile management provider, your app license assignments will be cleared.

1. Open Apple Business Manager or Apple School Manager and sign in with your business Apple ID.
2. Click PreferencesPayments and BillingsApps and Books.
3. For Content Tokens, next to the location token you want to download, click Download. 

Continue in the Google Admin Console:

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2. Go to  Menu  Devices > Mobile & endpoints > Settings > iOS.
3. Click Apple Volume Purchase Program (VPP).
4. Choose an option: 
   • To upload a new token, click Upload Apple VPP token.
   • To replace an existing token, click Replace token.
5. Locate the content token you downloaded earlier and click Upload.
6. Click Save. 
7. Click Sync VPP to import the apps associated with the token.
   If you purchase more app licenses later, you need to sync VPP again.

Step 3: Distribute VPP apps to users 

Users can get apps in the Google Device Policy app on their device. If you turn on VPP Mandate Install for an app, users cannot access any work data on their device until they install that app.

The app is installed during device setup. For company-owned devices, mandated apps are also installed during device sync. If a required app is already on the device, it becomes managed.

1. Sign in with an administrator account to the Google Admin console.

   If you aren’t using an administrator account, you can’t access the Admin console.

2. Go to Menu  Apps > Web and mobile apps.

   Requires having the Mobile Device Management administrator privilege.

3. Click the name of the app. To find VPP apps:

   • Click Add a filterPlatformiOSApply.
   • Click Add a filterDistribution typeVolume Purchase Program (VPP).
4. Click User access and distribution.
5. (Optional) To apply the setting only to some users, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

6. Check the Make this app available to users in this organizational unit and Allow this app to be distributed to users via Volume Purchase Program boxes.
   • You can't explicitly turn off app access for a group. When you uncheck the Make this app available box, users in that group inherit the setting from higher-ranked groups or the user's organizational unit.
   • When you turn off VPP Distribution, existing VPP licenses are revoked. When you turn VPP Distribution back on, the licenses are reassigned on the next device sync.
   • If you move a user from an organizational unit with VPP Distribution on for an app to one with VPP Distribution off for the same app, the user’s VPP license is revoked. If the user is then moved to an organizational unit with VPP Distribution on for the app, the license is reassigned on the next device sync.
7. (Optional) To require users to install the app to access Google Workspace on their device, select an option:
   • Require users to install this app for User Enrollment
   • Require users to install this app on user-owned devices for Device Enrollment
   • Require users to install this app on company-owned devices

   The app is installed during device setup. For company-owned devices, mandated apps are also installed during device sync. If a required app is already on the device, it becomes managed. User-enrolled devices may require unmanaged apps to be manually converted to managed apps through the Google Device Policy app.

8. If you set user access and distribution for multiple groups, review the order of the groups and set their precedence:
   • On the side, click Groups.
   • Drag the groups into the desired order of precedence. When a user belongs to more than one group, they will inherit the settings belonging to the group that is closest to the top. 
9. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit (or Unset for a group).

Manage & monitor VPP app distribution

Expand section  |  Collapse all & go to top

Related topics

• Separate work and personal data on iOS devices
• Manage mobile apps for your organization