App Deployment with Jamf: Using VPP to Push Apps Without User Interaction

Installing apps one device at a time works fine when you have three Macs. It stops working at thirty, and it becomes a genuine liability at a hundred — inconsistent versions, missing licences, and no real record of what's installed where.

The fix is VPP — Apple's Volume Purchase Program, now folded into Apple Business Manager — paired with Jamf. Together they let you buy app licences in bulk and push them to devices silently, with no App Store sign-in and no user action required.

What VPP Actually Is

VPP lets an organisation purchase app licences centrally through Apple Business Manager instead of relying on individual users' personal Apple IDs and personal payment methods. Once purchased, those licences live in a pool your MDM can assign, reassign, and reclaim — rather than being tied permanently to one person's account.

This matters for two reasons: it means the company, not the employee, owns the licence, and it means Jamf can install the app without the user ever touching the App Store or entering an Apple ID.

Device-Based vs User-Based Licensing

VPP supports two assignment models, and picking the right one matters:

• Device-based licensing — the app is tied to the device itself, installs automatically at enrollment, and requires no Apple ID at all. Best for shared devices, kiosks, and standard company-owned Macs and iPads.
• User-based licensing — the app is tied to a Managed Apple ID, follows the person across devices, and supports apps that sync data to a personal account (like some productivity or note-taking apps).

Most business deployments lean heavily on device-based licensing simply because it's frictionless — there's no invitation to accept, no account to sign into, nothing for the user to do.

Connecting VPP to Jamf

The setup itself is straightforward:

1. Generate a content token in Apple Business Manager under Preferences → Payments and Billing (or the Apps and Books section), scoped to your organisation.
2. Upload the token into Jamf Pro under Global Management → Volume Purchasing Locations.
3. Sync your purchased apps — Jamf pulls in everything already bought through ABM and makes it available to assign.
4. Assign apps to Smart Groups rather than individual devices, so new devices matching the group criteria pick up the right apps automatically.

One detail worth flagging: VPP tokens expire annually. It's a small thing, but an expired token silently stops new licence assignments from syncing — worth calendar-reminding a renewal before it lapses.

Install Automatically vs Self Service

Jamf gives you two ways to deploy a VPP app once it's assigned:

• Install Automatically — the app appears on the device without any user action, ideal for mandatory software like security tools, VPN clients, or company-standard apps everyone needs
• Make Available in Self Service — the app appears in the Self Service catalogue for users to install on demand, better for optional or role-specific software

Most fleets use a mix: core apps installed automatically at enrollment, everything else available on request.

Managing Licences at Scale

The real value of VPP shows up over time, not on day one. As devices are unenrolled — an employee leaves, a device is retired — Jamf can automatically reclaim the licence and return it to the pool, ready to be assigned to the next device. Without this, licences quietly leak: you end up paying for software installed on machines that no longer exist.

Reviewing your VPP licence usage in Jamf every quarter is a cheap habit that reliably catches this kind of waste.

Common Pitfalls

• Mixing personal Apple ID installs with VPP-managed ones — if a user already installed an app with their personal Apple ID before VPP was set up, Jamf can't cleanly take over management of that install; it often needs to be removed and reinstalled via VPP
• Assigning apps to individual devices instead of Smart Groups — works fine at ten devices, becomes unmanageable at a hundred
• Letting the VPP token expire — quietly breaks new licence syncs until someone notices
• Buying licences that don't match your device count — VPP purchases don't auto-scale; growth needs someone actively topping up the pool

---

If you want your app deployment properly automated instead of installed by hand, get in touch. We set up VPP and Jamf app deployment so new devices arrive fully provisioned — no manual installs required.