DecollaDecolla
Home › Setup guides › Deploy Company Portal for iOS as a required VPP app
Setup guide · from scratch

Deploy Company Portal for iOS as a required VPP app

ADE devices need the VPP/device-licensed Company Portal, NOT the App Store version (which is incompatible with ADE and won't auto-update). Assign it Required with device licensing.

Intune admin center (Apps) + Apple VPP token
≈ 15 min
Apple — iPhone, iPad & Mac · step 9 of 12 · ≈ 15 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — skip the clicks.

Every step below can be done by hand. Or connect your Microsoft tenant to Decolla once, and Decolla performs this for you over Microsoft Graph in your own tenant — then hands back a verified result you can see and roll back per item. It also puts the fundamentals this step depends on in place — the target group, the licence allocation — so a build is never blocked half-way by a missing dependency.

⏱ By hand: about 15 min of clicking, every build. The Decolla way: part of one tenant connect, then automatic.
Before you start
  • The .vpptoken already uploaded and showing valid in Intune - Company Portal deploys through it, not the App Store.
  • Company Portal licences already 'Got' in ABM against the SAME Location as that token.
  • The Entra device group that scopes your ADE iPhones/iPads.
  • Intune Administrator sign-in to intune.microsoft.com.
The steps
  1. Ensure a VPP/location token is already uploaded (Tenant administration > Connectors…
  2. Go to Apps > All Apps > Create and pick the VPP/volume-purchase Company Portal app.
  3. Open the app > Properties > Assignments.
  4. Under 'Required' add the target device group and set License type = Device…
  5. In the VPP/location token settings set 'Automatic app updates' = Yes so Company…
  6. Do NOT add the App Store Company Portal to ADE groups, and do not manually push its…
0 of 6 done
Step 1. Ensure a VPP/location token is already uploaded (Tenant administration > Connectors and tokens > Apple VPP tokens).
Screenshot: Apple VPP token present and active (captured during a live customer build — coming to this page)
Why: The device-licensed Company Portal only exists in Intune once this token has synced the ABM catalogue in - no valid token, nothing to assign.
Watch for: A token showing anything but valid means the sync never ran, so the Company Portal you 'Got' in ABM simply won't surface under All Apps.
Don’t: Do NOT 'fix' a missing app by adding Company Portal as a fresh iOS store app - that hands you the wrong, ADE-incompatible build.
On a schedule: The VPP/location token expires 12 months after it was generated - diarise the renewal now; when it lapses Company Portal and every other VPP app stops installing.
If this step errors: Duplicate apps in Intune after VPP token renewal
If this step errors: Apple tokens in Intune: APNs, ADE and VPP renewal explained
Step 2. Go to Apps > All Apps > Create and pick the VPP/volume-purchase Company Portal app.
Screenshot: App type picker with iOS store / VPP app (captured during a live customer build — coming to this page)
Why: This is the device-licensed build that installs with no Apple ID and honours ADE - the entire reason for this guide.
Watch for: Two Company Portals can appear. The VPP one carries the token/Location in its column; the plain store one does not - pick by that, not the icon.
Don’t: Do NOT pick the 'iOS store app' Company Portal - it's incompatible with ADE and will never auto-update.
Step 3. Open the app > Properties > Assignments.
Screenshot: Company Portal Assignments tab (captured during a live customer build — coming to this page)
Step 4. Under 'Required' add the target device group and set License type = Device licensing.
Screenshot: Required intent + Device licensing selected (captured during a live customer build — coming to this page)
Why: Device licensing draws from the token's licence pool and installs silently - no user Apple ID, no App Store prompt.
Watch for: Exhaust the licences you 'Got' in ABM and installs quietly stall - the quantity you bought is the hard ceiling.
Don’t: Do NOT switch this to User licensing - it reintroduces the Apple ID prompt that device licensing exists to remove.
Step 5. In the VPP/location token settings set 'Automatic app updates' = Yes so Company Portal self-updates.
Screenshot: VPP token settings with Automatic app updates = Yes (captured during a live customer build — coming to this page)
Why: ADE-supervised devices can't be updated from the App Store, so this token setting is the only thing keeping Company Portal current.
Watch for: It's a token-wide switch, not per-app - turning it on updates every VPP app riding that token, not just Company Portal.
Step 6. Do NOT add the App Store Company Portal to ADE groups, and do not manually push its app-config to Setup-Assistant modern-auth devices.
Screenshot: ADE group confirming no App Store Company Portal assigned (captured during a live customer build — coming to this page)
Why: Two Company Portals fight each other, and the App Store build can't complete Setup-Assistant modern auth - so enrolment hangs.
Watch for: The clash is silent: devices look correctly assigned while Company Portal never settles or users drop into an auth loop.
Don’t: Do NOT leave an old App Store Company Portal assignment lingering on the ADE group from an earlier trial - remove it.
If this step errors: Mac stuck at 'Awaiting final configuration' in Intune

Put these on a schedule

StepRecurring action to diarise
Step 1The VPP/location token expires 12 months after it was generated - diarise the renewal now; when it lapses Company Portal and every other VPP app stops installing.

If it goes wrong

The failures people actually hit on this process, each with the diagnosis and fix:

‹ Sync the token and assign a VPP app with silent device licensingAdd a free iOS App Store app by URL (no VPP) ›

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access