Setup guide · from scratch
Download the Apple location (VPP content) token from ABM
The .vpptoken lets Intune push App Store apps silently with no personal Apple ID. It lives in ABM under Payments and Billing > Content Tokens. One token per Location, per MDM; valid 12 months — diarise renewal.
≈ 10 min
Apple — iPhone, iPad & Mac · step 5 of 12 · ≈ 10 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — the one bit no tool can click for you.
Apple Business Manager (business.apple.com) needs a human to sign in, so this stays manual on purpose. Decolla makes it painless: the wizard shows these exact screens at the moment you need them and flags precisely what to bring back — a token, a file, an ID — so the automated steps either side of it run without a hitch.
⏱ A genuine human step — Decolla cuts the coordination around it, not the sign-in itself.
Before you start
- Administrator sign-in for Apple Business Manager at business.apple.com.
- A company payment card to add - Apple needs one on file even if you only ever deploy free apps.
- The name of the ABM Location this Intune tenant will own (each MDM needs its own, never shared).
- A secure place to store the .vpptoken and a note of the Apple ID email it belongs to.
The steps
- Sign in to https://business.apple.com/ as an Administrator.
- Add a payment method: click your account name (lower-left) > Preferences > Payments…
- Confirm or create your Location under Settings > Locations — each MDM needs its own…
- Go back to account name > Preferences > Payments and Billing; the Apps and Books…
- Scroll to the 'Content Tokens' section on the right.
- Next to the Location this Intune tenant will own, click 'Download'.
- Save the .vpptoken file securely and note the associated Apple ID email — this is…
0 of 7 done
Step 1. Sign in to https://business.apple.com/ as an Administrator.
Screenshot: ABM signed in showing the org name (captured during a live customer build — coming to this page)
Why: Only an Administrator sees Payments and Billing and the Content Tokens beneath it - a lower ABM role won't expose the Download button you need.
If this step errors: Intune T_C_NOT_Signed error: accept Apple's new ABM terms
Step 2. Add a payment method: click your account name (lower-left) > Preferences > Payments and Billing, and add a card (required even for free apps on first acquisition).
Screenshot: Payments and Billing payment-method screen (captured during a live customer build — coming to this page)
Why: Apple processes every app as a purchase, free ones included at £0, so a payment method must exist before the store will release any licences.
Watch for: Preferences hides behind your account name in the lower-left corner, not the top navigation - people hunt for it.
Don’t: Do NOT skip this because you only deploy free apps - Apple still needs a card on file for the first acquisition.
Step 3. Confirm or create your Location under Settings > Locations — each MDM needs its own Location/token, never shared.
Screenshot: Locations list showing the dedicated Location (captured during a live customer build — coming to this page)
Why: A Location is the container the token is scoped to; one Location maps to exactly one MDM, so licences bought against it flow only to this Intune tenant.
Watch for: In newer ABM it's Settings > Locations, not Preferences - an easy menu to overlook.
Don’t: Do NOT reuse a Location another MDM already owns - sharing one token across two MDMs collides over the same licences.
If this step errors: Apple tokens in Intune: APNs, ADE and VPP renewal explained
Step 4. Go back to account name > Preferences > Payments and Billing; the Apps and Books tab is usually already selected.
Screenshot: Payments and Billing > Apps and Books tab (captured during a live customer build — coming to this page)
Why: This is the same Payments and Billing page as the card step - you're back here for the token now, not the card, so don't be thrown by the repeat.
Watch for: If Apps and Books isn't already the selected tab, select it manually - Content Tokens won't appear until you're on it.
Step 5. Scroll to the 'Content Tokens' section on the right.
Screenshot: Content Tokens section (captured during a live customer build — coming to this page)
Why: Content Tokens is where every Location's server token is issued - one row per Location.
Watch for: It sits low on the right of the page, often below the fold - scroll down or you'll think it's missing.
Step 6. Next to the Location this Intune tenant will own, click 'Download'.
Screenshot: 'Download' button beside the correct Location (captured during a live customer build — coming to this page)
Why: This .vpptoken is the credential Intune uses to authenticate to Apple and pull your app licences.
Watch for: Several Locations mean several Download buttons - pick the row for the Location this Intune tenant owns, matching what you confirmed in step 3, or you'll wire Intune to the wrong licence pool.
On a schedule: The token is valid for 12 months from this download - diarise the renewal now; when it lapses, app installs and updates stop until you download and upload a fresh one.
Step 7. Save the .vpptoken file securely and note the associated Apple ID email — this is what you upload to Intune.
Screenshot: Saved .vpptoken with the Apple ID email visible (captured during a live customer build — coming to this page)
Why: Both halves go into Intune together - the .vpptoken file AND the Apple ID email - so capture the email now; the connector shows invalid if it doesn't match.
Watch for: The associated Apple ID email is easy to forget and can't be read back off the token file later, so note it the moment you download.
Don’t: Do NOT leave the token in Downloads or email it around - it's a live credential that can license apps to your tenant.
If this step errors: Duplicate apps in Intune after VPP token renewal
Put these on a schedule
| Step | Recurring action to diarise |
|---|---|
| Step 6 | The token is valid for 12 months from this download - diarise the renewal now; when it lapses, app installs and updates stop until you download and upload a fresh one. |
If it goes wrong
The failures people actually hit on this process, each with the diagnosis and fix:
- Apple tokens in Intune: APNs, ADE and VPP renewal explained — The APNs certificate, ADE enrolment token and VPP token all expire yearly and each breaks something different. A one-page matrix and the renewal rules.
- Duplicate apps in Intune after VPP token renewal — Renewing an Apple VPP token as a new entry duplicates every app in Intune. How to renew in place, recover from duplicates, and catch early expiry.
- Intune T_C_NOT_Signed error: accept Apple's new ABM terms — Intune stopped syncing with Apple after an iOS release? T_C_NOT_Signed means new ABM terms need accepting. Who can sign, how to fix it, how to prevent it.
‹ Create the Apple ADE enrolment policy (out-of-box experience)Get / buy app licences in ABM Apps and Books ›
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access