Device based VPP App Deployment

[jschmidtlein]

I am currently using JSS 9.93 to manage iOS 10 devices. I am attempting to push VPP apps to the device without requiring an iTunes logon. This is my first time working with iOS MDM. I have a VPP account and "purchased" several free applications via the VPP web interface. All applications are listed as device assignable. In JSS I have setup the applications making sure the source is from my "purchased" VPP apps. I have removed the setting that makes previously installed versions of the app managed if possible as I read this can cause problems. I am using configurator 2 to enroll my devices. Once I have enrolled a fresh iOS device running Windows 10 I get a prompt that asks to sign into an itunes account to allow my jss server to manage my applications. This takes place before the self service app is installed. If I log in with an iTunes account everything work and apps flow to the device. If I don't log in apps never get to the device. I have made sure to check use device based enrollment under each apps VPP settings.

So here is the hear of my question. Do I need to have an iTunes account signed into the device for this process to work. The documentation makes it seem like I should not. How are iTunes accounts typically handled. I had envisioned giving my customers a device without an iTunes account associated so they could use their own if they wanted. It seems like I am missing something. Any help would be appreciated.

I am basing most my work off the JSS admin guide and this supplemental guide https://jamfnation.jamfsoftware.com/article.html?id=418

[jschmidtlein]

Update: This is the error I am seeing.

[CGundersen]

Perhaps missed above description, but you ticked the "Assign VPP Content" box when configuring the Self Service Mobile App? Or, are you using the web clip ... that might be your problem?

[mpermann]

@jschmidtlein I believe you need to be using JSS 9.96 for compatibility with iOS 10. We had to recently upgrade from 9.93 because of issues with assigning apps to devices using managed distribution. You might want to check with your TAM so they can weigh in on the issue.

[CGundersen]

Good point @mpermann. We updated to 9.96 (from 9.92 patch version) last night as we were having issues with iOS 10 device assignment. If you had issues with 9.93, that's probably it ... I thought 9.93 supported basic iOS 10 functionality, but I guess not.

[jschmidtlein]

@CGundersen In management settings under under mobile device management there is no check box for the option listed. I don't actually have an app deployement for the self service portal. When the device is enrolled in JSS it seems to be the first thing it wants to install. Is it customary to deploy the application for greater control or do most people left JSS handle it?

@mpermann I suspect that this may have something to do with the issue. We have downtime scheduled for Monday to update so I will report back once that is done. Thanks for the advice.

[CGundersen · Accepted solution]

@jschmidtlein So I believe you would just set Self Service to "Neither (manual installation)" and then "buy" up the app/desired quantity using your VPP account. It will then appear in your Mobile Device Apps, allowing you to set the app under VPP tab to support device assignment.

Dunno, pretty sure the web clip deployment will prompt (regardless of JSS version). We pretty much had to update to 9.96 as 9.92 (patch version) was causing us prompts with iOS 10.

Give JAMF support a ring/email, this should be a softball question for them. Good luck and update with resolution.

edit: not likely Self Service web clip as I stated above, but mobile app via framework that would prompt for Apple ID.

[bentoms]

Is there a restriction on the devices requiring signin to itunes to download/install apps?

[FredG]

Hi,
I've updated to IOS 10 / JSS 9.96 . I have the same problem :

I get a prompt that asks to sign into an itunes account to allow my jss server to manage my applications

I don't have changed anything on my Jss settings.

thanks alot

[St0rMl0rD]

Are your devices unsupervised by any chance?

[FredG]

No, they are all supervised and managed.

[jschmidtlein]

After updating to 9.96 the problem persisted. I took @CGundersen suggestion and "bought" the JAMF mobile self service app from from VPP. I deployed that application and turned off the automatic deployment of the built-in self service app. The problem went away and I am now able to push apps without needing to sign into iTunes on the device. Thanks for everyone's help.