Setup guide · from scratch
Get / buy app licences in ABM Apps and Books
Before Intune can deploy an Apple app you must 'Get' its licences in ABM against the SAME Location as your uploaded token. Free apps still need a licence quantity; that count becomes your ceiling in Intune.
≈ 5 min
Apple — iPhone, iPad & Mac · step 6 of 12 · ≈ 5 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — the one bit no tool can click for you.
Apple Business Manager (business.apple.com) needs a human to sign in, so this stays manual on purpose. Decolla makes it painless: the wizard shows these exact screens at the moment you need them and flags precisely what to bring back — a token, a file, an ID — so the automated steps either side of it run without a hitch.
⏱ A genuine human step — Decolla cuts the coordination around it, not the sign-in itself.
Before you start
- An Administrator (or a role with Apps and Books rights) signed in to business.apple.com.
- The exact Location name that matches the VPP/location token you uploaded to Intune - you will need to assign against it.
- Your app shortlist (e.g. Company Portal, Microsoft Authenticator) and a device headcount, so the licence quantity covers the fleet with a little headroom.
- For paid apps, a payment method already set up in ABM before you click 'Buy'.
The steps
- In ABM's left navigation click 'Apps and Books' (labelled 'Apps' in some tenants).
- Type the app name in the search box (e.g. Company Portal, Microsoft Authenticator).
- Click the app in the results.
- Under 'Assign to' select the LOCATION that matches the token you uploaded to Intune.
- Enter the number of licences (quantity) you need.
- Click 'Get' for free apps (or 'Buy' for paid apps).
- Confirm the licences appear under 'Manage Licenses' for that Location.
0 of 7 done
Step 1. In ABM's left navigation click 'Apps and Books' (labelled 'Apps' in some tenants).
Screenshot: Apps and Books navigation item (captured during a live customer build — coming to this page)
Why: This is where every licence Intune will later sync gets claimed - nothing shows up in Intune until it is acquired here first.
Watch for: In some tenants the item simply reads 'Apps' - same place, older label.
If this step errors: Duplicate apps in Intune after VPP token renewal
Step 2. Type the app name in the search box (e.g. Company Portal, Microsoft Authenticator).
Screenshot: Search result for the target app (captured during a live customer build — coming to this page)
Why: ABM searches the whole App Store, so you must land on the exact title you intend to deploy.
Watch for: Near-identical titles and copycats exist - match the real publisher (e.g. Microsoft Corporation) before you go further.
Step 3. Click the app in the results.
Screenshot: App detail page (captured during a live customer build — coming to this page)
Why: Opens the app's licensing page, where the Location and quantity fields live.
Step 4. Under 'Assign to' select the LOCATION that matches the token you uploaded to Intune.
Screenshot: 'Assign to' Location selector (captured during a live customer build — coming to this page)
Why: Licences are owned by a Location - only the Location whose token sits in Intune will ever sync these apps across.
Watch for: With more than one Location the names look alike - confirm it is the exact one behind your Intune VPP token.
Don’t: Do NOT assign to a different Location 'just to test' - those licences are stranded and invisible to Intune.
If this step errors: Apple tokens in Intune: APNs, ADE and VPP renewal explained
Step 5. Enter the number of licences (quantity) you need.
Screenshot: Licence quantity field (captured during a live customer build — coming to this page)
Why: This count becomes your hard ceiling in Intune - deployment stops the moment the licences run out.
Watch for: Even free apps consume one licence per device; buy a little headroom above your device count.
Don’t: Do NOT enter 1 for a fleet - a device with no free licence simply fails to install, though you can always claim more later.
If this step errors: Intune T_C_NOT_Signed error: accept Apple's new ABM terms
Step 6. Click 'Get' for free apps (or 'Buy' for paid apps).
Screenshot: Get / Buy button (captured during a live customer build — coming to this page)
Why: 'Get' claims free licences at no cost; 'Buy' charges the payment method on file - both land the licences in the same place.
Watch for: 'Buy' will fail without a payment method already set up in ABM.
On a schedule: Re-accept Apple's terms whenever they change - an un-accepted update silently blocks every new 'Get' and 'Buy'.
Step 7. Confirm the licences appear under 'Manage Licenses' for that Location.
Screenshot: Manage Licenses showing the acquired count (captured during a live customer build — coming to this page)
Why: 'Manage Licenses' is the proof the claim stuck; if the count is here, Intune's next VPP sync can pick it up.
Watch for: These won't appear in Intune until the VPP token is synced - claiming them here is only half the job.
Put these on a schedule
| Step | Recurring action to diarise |
|---|---|
| Step 6 | Re-accept Apple's terms whenever they change - an un-accepted update silently blocks every new 'Get' and 'Buy'. |
If it goes wrong
The failures people actually hit on this process, each with the diagnosis and fix:
- Apple tokens in Intune: APNs, ADE and VPP renewal explained — The APNs certificate, ADE enrolment token and VPP token all expire yearly and each breaks something different. A one-page matrix and the renewal rules.
- Duplicate apps in Intune after VPP token renewal — Renewing an Apple VPP token as a new entry duplicates every app in Intune. How to renew in place, recover from duplicates, and catch early expiry.
- Intune T_C_NOT_Signed error: accept Apple's new ABM terms — Intune stopped syncing with Apple after an iOS release? T_C_NOT_Signed means new ABM terms need accepting. Who can sign, how to fix it, how to prevent it.
‹ Download the Apple location (VPP content) token from ABMUpload the VPP/location token into Intune ›
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access