Device-Based VPP requires admin account to install?

[easyedc]

Testing out Device-Based VPP (JSS 9.82/OS X 10.11.2&3) and after banging my head against the wall, tried switching from my non-admin to my admin account and things installed instantly. Is this normal behavior? Am I the only one who didn't know this? Our goal around device-based VPP was to deploy to standard users - not helping. Have other seen this? When using my standard account, I get presented with this prompt:

[jarednichols]

Device-based VPP assignments are not supported on OS X yet.

[easyedc]

@jarednichols It is with JSS v.9.82 and OS X 10.11 in both some of my testing and JAMF's Site

[easyedc]

... and for what it's worth, my TAM acknowledged the issue that I'm seeing is working sort of as expected.

[tobiaslinder]

That would be very unfortunate. I also realized that the installation gets interrupted when the user logs out and is not resumed later :-(

[mrowell · Accepted solution]

@easyedc I saw the “storedownloadd is trying to install new software. Type administrator’s name and password to allow this.” error when I had the "Require admin password to install or update apps” restriction enabled.

Removing that restriction resolved the issue.

[easyedc]

I'm a day late and a dollar short. @mrowell that was the case. I forgot to update this thread saying that did solve the issue. My TAM brought that same issue up and it fixed it, so you are correct.

[Kyuubi]

@mrowell Where is this found please? I can't find that bit and am having the same problem. Many thanks.

[easyedc]

@Kyuubi I would check under the configuration profiles "Restrictions" payload. That's where I found that it had been checked and fixed after I unchecked it.

[Kyuubi]

@easyedc Many thanks. That did it

[sendhil103]

Hi , I am looking for Casper Admin jobs in Australia.

I have 4 years exp in Casper Admin. Managing 5500 endpoints.

Kindly let me know if there is an vacancy.

Regards, Senthil

[NCSD]

Sorry for the necrobump - is there a control to remove the message in the OP? Unchecking the "require admin password" restriction is not a reasonable option in a school environment, but getting this message on log-in is less than ideal as well.

[bentoms]

@NCSD VPP installs run within the user context if you want this to change you need to inform Apple.

You really do need to uncheck "Require admin password to install or update apps" in your restrictions profile to stop getting the message.

But you can counter this somewhat by checking "Restrict App Store to MDM installed apps and software updates"

So even if a student open the Mac App store, it would show the macOS updates tab only & they would need to be admins to install items from there.

[NCSD]

Thanks for the info, @bentoms .

I guess the related question is then, is there a way to prevent this from popping up on the first log-in for each user?

[bentoms]

@NCSD Not currently

[supson]

Here is your SecureTokenBypass info - Make a Custom Setting in a Config Profile, and it works.