Setup guide · from scratch
Sync the token and assign a VPP app with silent device licensing
After upload, sync so ABM apps appear in Intune, then assign them Required with DEVICE licensing to an Entra group for a silent, Apple-ID-less install. Never mix device and user licensing on the same target.
≈ 15 min
Apple — iPhone, iPad & Mac · step 8 of 12 · ≈ 15 min‹ PreviousNext ›
Do these first — this guide assumes you already have:
The Decolla way — skip the clicks.
Decolla syncs your VPP token and assigns each app Required with DEVICE licensing to the right device group for you - no clicking through Properties > Assignments app by app. It never mixes device and user licensing on the same target, so the collision this guide warns about simply cannot happen in a Decolla build.
You get back: a per-app assignment confirmation, the device-licence count consumed against your ABM quantity, and a per-item rollback entry so you can lift any assignment later without a wipe.
⏱ By hand: about 15 min of clicking per app, on every build. The Decolla way: every VPP app assigned in one tenant connect, correctly the first time.
Before you start
- The VPP/location token already uploaded and showing a valid status in Intune (Tenant administration > Connectors and tokens > Apple VPP tokens).
- Licences already 'Got' in ABM for each app, against the SAME Location this token owns - device installs consume them one per device.
- The target Entra DEVICE group created and populated - a user group will break silent, Apple-ID-less licensing.
- An Intune Administrator sign-in to intune.microsoft.com.
The steps
- In Tenant administration > Connectors and tokens > Apple VPP tokens, click '...'…
- Wait a few minutes, then go to Apps > All Apps; the ABM apps you 'Got' now appear…
- Click the app > Properties > Edit next to Assignments.
- Choose 'Required' (auto-install). Note: 'Available' is NOT supported for device…
- Click 'Add group' and pick the Entra device group.
- Keep the default licence type 'Device' for silent install; never add a user-…
- Click Save.
0 of 7 done
Step 1. In Tenant administration > Connectors and tokens > Apple VPP tokens, click '...' next to the token and choose 'Sync'.
Screenshot: '...' > Sync action on the token (captured during a live customer build — coming to this page)
Why: Sync pulls the licences you 'Got' in ABM into Intune - until it runs, none of those apps exist in All Apps to assign.
Watch for: Intune only auto-syncs roughly every 12-24 hours, so a freshly acquired app can stay invisible until you force it here.
Don’t: Do NOT spam Sync - a sync already in progress ignores repeat clicks and won't finish any faster.
If this step errors: Duplicate apps in Intune after VPP token renewal
If this step errors: Intune T_C_NOT_Signed error: accept Apple's new ABM terms
If this step errors: Apple tokens in Intune: APNs, ADE and VPP renewal explained
Step 2. Wait a few minutes, then go to Apps > All Apps; the ABM apps you 'Got' now appear with a VPP token column.
Screenshot: All Apps showing freshly synced VPP apps (captured during a live customer build — coming to this page)
Why: The VPP token column is how you tell a volume-purchased copy from a plain App Store one - assign the wrong one and you lose the silent, Apple-ID-less install.
Watch for: Only apps you actually 'Got' licences for appear; a missing app usually means it was bought against a different Location than this token owns.
Step 3. Click the app > Properties > Edit next to Assignments.
Screenshot: App Properties > Assignments Edit pane (captured during a live customer build — coming to this page)
Why: Assignments is where a synced app gets pointed at real devices - without one it just sits in the catalogue doing nothing.
Step 4. Choose 'Required' (auto-install). Note: 'Available' is NOT supported for device groups.
Screenshot: Required intent selector (captured during a live customer build — coming to this page)
Why: Required force-installs the app with no user tap - the whole point of a hands-off corporate build.
Watch for: 'Available' against a device group silently never installs - there's no error, the app simply never lands.
Don’t: Do NOT pick 'Available' for a device-group deployment expecting a Company Portal listing - it isn't supported.
Step 5. Click 'Add group' and pick the Entra device group.
Screenshot: Group picker (captured during a live customer build — coming to this page)
Why: This scopes the install to a defined set of devices rather than the whole tenant - your enrolment group becomes the target.
Watch for: Pick a DEVICE group, not a user group - device licensing needs a device target to stay Apple-ID-less.
Step 6. Keep the default licence type 'Device' for silent install; never add a user-licensed assignment to the same app/group.
Screenshot: Device licensing option selected (captured during a live customer build — coming to this page)
Why: Device licensing ties the licence to the hardware, not a person, so the app installs with no Apple ID sign-in anywhere in the flow.
Watch for: Each install still burns one ABM licence - if the app never arrives, check you haven't run out of the quantity you 'Got'.
Don’t: Do NOT add a second, user-licensed assignment to the same app and group - the two licence types collide and installs fail unpredictably.
Step 7. Click Save.
Screenshot: Saved assignment showing Required + device licensing + the group (captured during a live customer build — coming to this page)
Why: Nothing reaches devices until you Save - the assignment only ships on the next Intune check-in.
Watch for: Installs aren't instant - devices pull the Required VPP app on their next check-in (often ~15 minutes, longer if offline), not the moment you click Save.
If it goes wrong
The failures people actually hit on this process, each with the diagnosis and fix:
- Duplicate apps in Intune after VPP token renewal — Renewing an Apple VPP token as a new entry duplicates every app in Intune. How to renew in place, recover from duplicates, and catch early expiry.
- Intune T_C_NOT_Signed error: accept Apple's new ABM terms — Intune stopped syncing with Apple after an iOS release? T_C_NOT_Signed means new ABM terms need accepting. Who can sign, how to fix it, how to prevent it.
- Apple tokens in Intune: APNs, ADE and VPP renewal explained — The APNs certificate, ADE enrolment token and VPP token all expire yearly and each breaks something different. A one-page matrix and the renewal rules.
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access