Allow Mac App Store or not?

We are, although you need some clear rules on expensing chargeable apps. I've seen cases where the organisation provides an app for a particular job function, but the employee either doesn't know about it, or "doesn't like" the provided tool, and spends money on something else, causing version control and compatibility issues and wasting company money.

I'd rather people get software from the App Store over trying to find freeware or shareware via Google. Only preference is that departments let us know if they buy apps regularly so we can make it available via VPP/Self Service and repurpose licenses if someone doesn't need it anymore.

I work for a school district that has Macs for teachers and students. We leave the App Store open for all users. We do use VPP to assign apps to students and teachers. The nice thing about leaving it open for us is that there are plenty of apps in there they can be use for learning.

Any paid apps are purchased through the district's VPP account so that we retain ownership and the app can be assigned to those users that need it.

Also, are they admins on the devices? Are the devices assigned to the users and they are the only user for the device? Are they laptops that they take with them when they leave are can be used at home more freely? Many of these issue will help determine if the App Store is left abate for users.

Apple updates are not distributed through the App Store so if they are expected to update their own devices then it will need to be left available. Unless you create a policy through Casper to do it.

My entry became a little bit of a ramble of there are many things to consider when making the decision.

I used to be in the mindset of allow the users to update and install nothing. As I've gotten older and gained more experience, I've lightened up, a bit. We allow the App Store but limit it to updates only. This way we can control new applications installed but not limit patches. It works for us. I even don't mind delta os updates these days. Just major os changes do we block.

We operate very much like what @strider.knh describes. In our case, non-student users are admins and students are not. The students are BYOD and everyone else is COPE. We allow full MAS access for all of our community. We provide an extensive set of fully supported/managed applications, policies and profiles. However, we do encourage our users to explore other options. Since our users always have a completely supported solution for any curricular or administrative need, they are free to explore other, possibly more engaging or personalized software to accomplish similar or additional tasks. Just don't let that be confused with some of the edu's I've seen that are "totally open" or "totally locked down". There is a method and policy in our implementation for this that includes our students' faculty advisors, team leaders and dorm parents. Besides, we teach skills, not software (where possible).

As for the update process... we find it to be an important part of our students (and non-students) educational experience, to understand that updates and patches are a necessary part of life. We try to teach our users proper techniques for managing updates and basic computer upkeep so that they're prepared to head off to college (or classrooms/offices).

Additionally we send out monthly reminders to do a "Tech Refresh" which involves going to the MAS, installing relevant updates and then heading over to Self-Service to check for any other optional updates or software that we've provided. If someones computer is starting to fall out of our support envelope (i.e. a computer running 10.10.4 instead of 10.10.5) we prefer to use various notifications to prompt them to upgrade as opposed to automating every last thing. That's actually the biggest discussion point regarding my position around here. What do we automate/distribute and what do we "teach"/facilitate instead.