Deploying apps across a large fleet of supervised iOS devices without Apple’s Volume Purchase Program creates a management problem that compounds with every additional device. Without VPP, app installation either requires individual Apple ID credentials for each device, which is unmanageable at scale and violates Apple’s terms of service for shared devices, or requires employee Apple IDs, which creates personal account dependency on corporate hardware.
The Volume Purchase Program, now part of Apple Business Manager, solves this by allowing organizations to purchase app licenses in bulk and assign them to devices silently through MDM without requiring any Apple ID on the device. For any organization managing more than a handful of supervised iOS devices, understanding how VPP works and how to manage it efficiently through Moki is essential.
What VPP Actually Is
Volume Purchase Program is Apple’s mechanism for organizations to purchase app licenses at scale and distribute them to managed devices without end-user Apple IDs. Rather than each device needing an account to install an app from the App Store, the organization purchases a license count for each app through Apple Business Manager, and the MDM platform assigns those licenses to devices and pushes installations silently.
The app installs on the device without the user seeing an App Store prompt, without requiring a password, and without being tied to any personal account. When the device is decommissioned or reassigned, the license can be revoked from that device and reassigned to a new one, allowing license reuse across the device lifecycle.
This model is designed specifically for managed device fleets and is the correct approach for any organization deploying apps to supervised iOS devices in customer-facing or employee-facing roles.
How VPP Integrates with Moki
Moki’s iOS management platform integrates with Apple Business Manager’s VPP functionality through a token-based connection. The setup process involves:
- Generating a VPP token in Apple Business Manager and uploading it to Moki
- Purchasing app licenses through Apple Business Manager for every app that needs to be deployed to managed devices
- Assigning purchased licenses to device groups in Moki, which triggers silent installation on every device in the group
Once the integration is configured, app deployment through VPP is managed entirely from the Moki dashboard. Purchasing additional licenses, pushing new app versions, and revoking licenses from decommissioned devices are all operations that flow through Moki without requiring direct interaction with Apple Business Manager for routine management tasks.
License Counting and Availability Monitoring
License management at scale requires visibility into how many licenses are available, how many are assigned, and whether the organization is approaching the limit for any app. Running out of licenses for a required app means new devices cannot receive that app until additional licenses are purchased, which can delay deployments and create gaps in fleet configuration.
Best practices for VPP license management include:
- Maintaining a buffer of unassigned licenses for each app equal to at least 10 to 15 percent of the deployed count, providing headroom for fleet growth and device replacements without emergency license purchases
- Reviewing license utilization as part of the periodic fleet audit, comparing assigned licenses to the current enrolled device count for each app
- Establishing a procurement trigger for additional licenses when utilization reaches 80 to 85 percent of the purchased count
- Revoking licenses from decommissioned or unenrolled devices promptly so they are available for reassignment rather than sitting assigned to devices that no longer exist in the fleet
The Moki dashboard provides visibility into app assignment status across enrolled devices, which forms the basis for the license utilization review.
Handling Free vs. Paid Apps in VPP
Not every app requires a purchased license under VPP. Free apps available in the App Store can be deployed silently through VPP without purchasing licenses, but they still need to be added to the Apple Business Manager app catalog before they can be deployed through MDM. This requires adding the app to the organization’s catalog in ABM, which is a one-time step per app.
Paid apps require license purchases corresponding to the number of devices the app needs to be installed on. Volume pricing is available for many paid apps in the VPP program, which can reduce per-license cost for large fleets.
Custom apps, meaning apps developed specifically for the organization and distributed privately rather than through the public App Store, are distributed through Apple Business Manager’s custom app capability. These apps are not publicly available and are pushed to devices through the same VPP-integrated MDM workflow as public apps.
App Updates Across VPP-Deployed Apps
App updates for VPP-deployed apps are managed through Moki’s app management capabilities rather than through automatic App Store updates, which should be disabled on supervised devices to maintain version control. When a new version of a VPP-deployed app is available, the update is pushed through Moki to all devices in the assigned group silently and without user interaction.
This approach maintains version consistency across the fleet. Every device in a group runs the same app version, updates happen on the organization’s schedule rather than automatically, and new versions can be tested on staging devices before being pushed to the production fleet.
For organizations where app updates have a content or compliance dimension, such as a payment app update that introduces new PCI-relevant behavior, managed update deployment through Moki ensures updates are reviewed and authorized before reaching production devices.
License Revocation and Device Lifecycle
VPP licenses are revocable, meaning when a device is decommissioned, reassigned, or removed from the fleet, the app licenses assigned to it can be reclaimed and reassigned to a new device. This license reuse capability is one of the significant cost advantages of VPP management, particularly for organizations running multi-year device lifecycle programs where hardware is regularly refreshed.
The license revocation process in Moki is part of the device decommission workflow. When a device is unenrolled from Moki, VPP licenses assigned to that device are automatically or manually revoked depending on the platform configuration, returning them to the available license pool for reassignment.
Schedule a Moki demo to see VPP integration and iOS app license management in action, or start a free trial to begin connecting your Apple Business Manager account to Moki and deploying VPP-licensed apps. Moki’s support resources cover the ABM token setup and VPP configuration steps in detail.