I am currently using JSS 9.93 to manage iOS 10 devices. I am attempting to push VPP apps to the device without requiring an iTunes logon. This is my first time working with iOS MDM. I have a VPP account and "purchased" several free applications via the VPP web interface. All applications are listed as device assignable. In JSS I have setup the applications making sure the source is from my "purchased" VPP apps. I have removed the setting that makes previously installed versions of the app managed if possible as I read this can cause problems. I am using configurator 2 to enroll my devices. Once I have enrolled a fresh iOS device running Windows 10 I get a prompt that asks to sign into an itunes account to allow my jss server to manage my applications. This takes place before the self service app is installed. If I log in with an iTunes account everything work and apps flow to the device. If I don't log in apps never get to the device. I have made sure to check use device based enrollment under each apps VPP settings.
So here is the hear of my question. Do I need to have an iTunes account signed into the device for this process to work. The documentation makes it seem like I should not. How are iTunes accounts typically handled. I had envisioned giving my customers a device without an iTunes account associated so they could use their own if they wanted. It seems like I am missing something. Any help would be appreciated.
I am basing most my work off the JSS admin guide and this supplemental guide https://jamfnation.jamfsoftware.com/article.html?id=418