Assign VPP content to computers

[bazcurtis]

Hi,

I am trying to assign VPP content to computers. I've allocated the software to the computer and it appears in Self Service despite me having set Install Automatically/Prompt User.

Anyone know why it would do this?

Best wishes

Michael

[murph]

I am currently having the same issue with it not automatically installing. I currently have a case open with support to hopefully figure out what's going on. It just queues up the commands on the server but never actually installs it.

[Josh_A1]

Hey guys,

I've been chatting to @bazcurtis about all this. Here's the steps we've followed so far that work for me but not for him.

*

1 - Grab your VPP codes from Apple for your App and wait till they are available. 2 - Jump into Casper and make sure your VPP account is added (it will be already if you're done VPP to iPads) 2a - Settings > Global Management > VPP accounts > 'your account' > Content > Mac App Store App > then hit 'Update Purchased Content' 3 - Then, Computers > Mac App Store Apps. I searched for my App I just purchased with VPP, remember to set the store to the same account used on your VPP account (caught me out first time). Hit 'next'. 4 - Hit 'add' on the app when found. Now under 'dist. method' change to 'Install auto...' 5 - Sort out your scoping methods, I used some device groups. 6 - Hit the VPP tab and then check the 'Assign VPP Content' box. Ticking this means it will check you VPP codes for some for this App rather than Casper grabbing the App from the store directly. 7 - After ticking the box you should see the 'VPP content' box get populated with your available licences. 8 - Hit 'Save'. The Apps will now deploy to the scopes. *

[bazcurtis]

A quick update. It is working fine on all new builds. It just doesn't work on an old El Capitan build.

It had an error - Redownload not offered by store and I flushed that. It is now saying No Pending Commands.

I have taken the machine out of the scope and rescoped it, but still see No Pending Commands.

[bazcurtis]

I had another chat with Josh and he said that he had used an old machine built with El Capitan and saw the same issue.

This was interesting as when I say new builds these were builds to you machine just purchased. The machine I was using to test with was an older Macbook Pro. I'm going to rebuilt it tomorrow and see what happens this time.

[bazcurtis]

After a rebuild of the machine it has now installed Microsoft Remote Desktop fine. It still shows up in Self Service despite the fact it is installed. It also says install as the option.

Best wishes

Michael

[Josh_A1]

Also following up on this. I now can not get apps to deploy to devices on either an upgraded to El Capitan machine or a shipped with El Capitan machine. Nothing in my enviroment has changed.

Self service states that the application has been installed though it does not show in the applications folder or in the console logs.

Has anyone had success deploying VPP to devices yet?

--- edit 3

Just got another fresh laptop. Scoped to group. Instantly works. What on earth?

[spraguga]

@Josh.A @bazcurtis @smurphyusd346 I have been having the same issue. Here's my test case.

1. Ran El Capitan build with API post run script to add computer to VPP static group.
2. VPP app installed fine
3. Removed computer from JSS
4. Rebuilt the computer same as step #1
5. Computer did not receive the VPP app this time.
6. The VPP dropdown is set to "Install Automatically/Prompt User" but the app is now showing in Self Service.
7. If I click Edit for the VPP app and then click "Force Updates" the app will install again immediately.
8. The VPP app is no longer in Self Service.

[murph]

@spraguga I have been given a defect number of D-010147 for this issue of not being able to install apps after a reenrollment of a machine. Here is how I can fairly reliably getting apps to install.

1. Run sudo jamf removeframework not sure this step is needed
2. Remove device from JSS
3. Image Machine
4. Enroll machine
5. Run sudo jamf policy

If I reimage machine without removing from JSS it will not install apps anymore.

[spraguga]

@smurphyusd346 Have you tried VPP App : Edit : Force Updates instead?

[Josh_A1]

@spraguga Thanks for your input. Seems we do have something odd going on here. I'm going to try your Force update method.

On a site note, I'm interested in that API post run script. Sounds super useful! ;)

[spraguga]

@Josh.A First you'll need to setup an API user with the proper access, if you haven't already.

Next create an empty Static Group in your JSS.

Then get the ID in the URL of the Static Group.

Now add the ID to the curl command in the script below. I'm using ID 100 in the example below.

Finally, you can add the script below as a reboot script to your build. You'll want to make sure it's after enrollment though.

#!/bin/sh

# Get computer name
COMPNAME=`scutil --get ComputerName`

# Add computer to the Static Group of ID=100
curl -g -s -k -i -u user:pass -X PUT -H "Content-Type: text/xml" --data "<?xml version="1.0" encoding="UTF-8"?> <computer_group><id>100</id><computer_additions><size>1</size><computer><name>$COMPNAME</name></computer></computer_additions></computer_group>" [https://your.jss.com:8443/JSSResource/computergroups/id/100] "https://your.jss.com:8443/JSSResource/computergroups/id/100"

Cheers! ;)

[Josh_A1]

Just a couple of updates on this.

The application showing in Self Service despite having "Automatically install' checked: - This has been reported as a feature of device VPP. It allows users to reinstall the application manually if required.

VPP scopes: - There is a now confirmed bug with scoping to devices for VPP. You cannot scope to single devices. You must put the device into a group and scope to this instead.

[bazcurtis]

Thanks for the update. Is the a Casper bug or a Apple bug with the VPP scopes?

[Josh_A1]

@bazcurtis

I know we have a Product Issue where Device-Based VPP OS X apps are not deploying when scoped to an "individual device" instead of a Group.

From this I'd say it's a Casper bug.

[michaelhusar]

A finding in regard to DEP machines:
When you want the Apps to install with local users:

jamf mdm -verbose or jamf mdm -userLevelMdm

will only work when you choose "Allow MDM Profile Removal" in your

PreStage Enrolments:
Allow MDM Profile Removal (Allow the user to remove the MDM profile)

[TomDay]

Thanks for posting this info, helped me out. We get a couple of machines per week with device based VPP app installs. Nothing reported in the log files, everything is so cryptic, no rhyme or reason. Used the method posted above but altered it just a bit, worked perfectly:

Run sudo jamf removeframework
Remove device from JSS
Enroll with Recon
Once enrolled, add assign a user to the device
Run sudo jamf policy

The assigned apps start to flow down to the device right away!

Love the device based VPP feature, but I pull my hair out some weeks with the bugs.

BW, we are running 9.93

[TomDay]

sorry, wrong thread