Distribute apps automatically to iPads

[brownbe]

I'm relatively new to JAMF and am trying to distribute a bunch of free apps to my school's iPads. Each iPad in each class share the same Apple ID (for example, 23 iPads in classroom 60 would all be logged into the same apple ID which is only for that classroom). We have devices set up in static groups and self service set up on every device. We are attempting to push out free apps first and paid apps later, but we are running into some issues.

First, whenever we try to push an app out to devices the device prompts for the Apple ID password. We are trying to avoid this because we don't want students or teachers to have that information.

Second, we have automatic app updates/downloads set up so that in theory if we push the app and sign in on one of the devices it will still download on each device... not the case. Each device still prompts for the password.

We also want to disable the app store but have yet to do so because we want to ensure the apps are up and working before rolling out the devices to students (hopefully Monday). We are running JSS 9.62.

Is there any documentation on how to do this? Do we need to VPP for even the free apps? I'm new to the job and trying to figure this all out as I go so any help/guidance would be greatly appreciated.

[adamcodega]

Well, for starters you should be signed up for VPP anyway if you're handling that many iPads. I use VPP even for free apps since it can make distribution and assignment easier.

[brownbe]

We do have VPP but I haven't been filled in on how to use it yet. Basically what I am assuming is that when I try to push an app it is prompting because it hasn't been "purchased" yet on the account, even though it's free. Am I safe to assume this?

[adamcodega]

Sorry let's back up a second, how are you assigning apps exactly?

If you assign an app via VPP to an account that is signed in everywhere, the app will install by going to the Purchases screen. Apps will update themselves via iOS auto updates.

If you distribute it from Mobile Devices > Apps, it will install automatically without an App Store account being on the device but I have seen mixed results on updated versions automatically appearing.

[brownbe]

I'm sorry if my terminology isn't quite clear, like I said this is all really new to me so I don't exactly understand completely how this all works.

We want to assign apps through Mobile Devices > Apps. We have static groups set up per classroom, for example room 53 has 21 iPads and all are in the static group "room53-<teacher name>". We have a list of apps each teacher wants and have added the apps to JAMF. Each app is scoped to the proper static groups and I've had varying levels of success getting them to automatically install.

I think I've solved my own problem though and I think the issue was in our configuration. I basically signed into the apple ID on iTunes and "purchased" the app I needed and then disabled automatic app downloads through configuration. It required canceling any failed commands on each individual device but it finally worked and the next few apps worked seamlessly. However with 300+ devices and 25 different Apple ID's all using similar apps this isn't exactly the easy route. Is there a way to cancel all failed commands on multiple devices at a time without having to look up each one individually? That would make my life SO much easier over the next few days...

[qhle373]

Do you deploy your enrollment through PreStage or with Configurator?

I ask because Configurator can at least sign into the devices with the Apple ID in use in that Mac's profile. It does have limitations on the number of devices it supports simultaneously, but it depends on how many devices are allocated per Apple ID.

I believe that what you are doing is correct though. Here's the section from the Admin guide for App distribution for auto-install. It deals directly with VPP except for the bottom:

"
- The device has iOS 7 or later
- The device is supervised
- The user is signed into the iTunes Store on the device
- The App Store has not been disabled on the device.
- The device is not configured to require an Apple ID password for all purchases.
- If the app wasn't assigned to the user for VPP-managed distribution, the user has recently authorized an iTunes Store purchase on the device, or the user's Apple ID has previously been used to install the app.

If these conditions are not met, users are prompted to install the app."

Admin Guide 9.62 Page 499

[brownbe]

@qhle373 This was my suspicion. How do you use VPP to purchase apps (both paid and free) for multiple Apple IDs?

[CasperSally]

@qhle373 - I thought you couldn't use both Configurator and VPP, it was one or the other?

[brandonusher]

@brownbe You navigate to the VPP website and sign in as your VPP Administrator has directed you to do, which can either use the main admin account or they will give you an account for yourself. Then you need to have the Apple ID's in the JSS as User Objects (so under "Users" tab). There you can also create VPP Assignments and assign whatever apps you need to, to certain Apple ID's.

@CasperSally You can use both if I recall correctly. Configurator can be used to setup the devices then a user signs with with their Apple ID and you can assign them apps via VPP.

[brownbe]

@usher.br I have searched high and low under the Users tab for a way to create User Objects but I cannot find it anywhere. Can you possible guide me in the right direction?

[brandonusher]

@brownbe You have to search for * in users then click add, or add their information on a device record. Unfortunately there isn't an easier way :/

[brownbe]

@usher.br Well the problem ended up being user error, I wasn't in Full JSS and as soon as i switched and searched the add button came up.

Another question. How does adding these users make a difference? We are trying to purchase apps through VPP and then roll them out to devices one class at a time. I just created a user for one of our Apple IDs, does JAMF know to send the VPP invitation to the devices using that Apple ID just by me putting it in as a user? This is the part we can't figure out and it's really confusing us

[brandonusher]

If you would like @brownbe you can email me and then I can share my number with you and I can help through these steps and how I layed it all out in our JSS for carts: redacted

Here is a brief description though:

VPP invites for a smart group for unassociated users in the JSS via email. Then static groups for all our apple ids that belong to a class cart. Each app assignment is then assigned to the group for easier app distribution. After that the app is available via the purchased tab in the App Store.

[brownbe]

@usher.br I may take you up on that offer. We spoke to our rep on the phone today and found out the missing link, I am going to test on a device later tonight and hopefully that will solve our issue. I will let you know!

[brandonusher]

Glad to hear that @brownbe !

Feel free to shoot me an email if you want a full walk through of how I setup our Apple IDs and Assignments

[BCPeteo]

I'm having a similar issue on an iPad. I have VPP setup, User assigned to device, accepted invitation on device and signed on with apple ID, assigned vpp app to group the user is in. auto download is setup in app store. App does no auto install. If i go to the app store it is listed under purchases

[brandonusher]

@ostrowsp Apple announced they will no longer allow Automatic Downloads for apps assigned via VPP.

I'm currently scouring my email and Google for the article published by JAMF or Apple about this, but I know I saw it somewhere

[brandonusher]

Ah, found it: https://support.apple.com/en-us/HT202995

[brownbe]

@ostrowsp

Auto app downloads no longer work with VPP assigned apps. Apple made the switch a few weeks ago. You'll need to go to mobile devices - apps - add the app and then set it to install automatically.

[adamcodega]

Apps assigned using MDM will not be automatically downloaded onto devices with automatic downloads enabled. The installation command must be sent from the MDM server.

https://support.apple.com/en-us/HT202995

So what does that mean? That the JSS could do this if the feature was there?

[brandonusher]

@adamcodega The feature is there already. When you assign an app via VPP, you then have to wait until Apple shows the app under "Purchased". Once that happens, you go to Mobile Devices > Apps and add the app along with assigning it to the device that belongs to the user.

[brownbe]

@usher.br How long does this usually take? I've been having issues where I assign an app through VPP then immediately push through mobile devices/apps and I receive an error. "iTunes store id for the application could not be validated" is a VERY common one. I usually have to wait a few days, clear all the failed commands on each device (manually), and repush for them to go through.

[brandonusher]

I'm not sure to be completely honest with you @brownbe I have not used this workflow yet since we were relying highly on Automatic App Downloads.

It seems roughly an hour and the app is assigned. Once that happens then maybe a few more hours for the iPads to recognize it. But this is just my experience with Auto Download not with Assign and Manage.

Although I do like the idea of a VPP Assignment, then an option for Force Install and Manage App all within the VPP Assignments area. I made a feature request for this last year, but have yet to hear anything other than "Under Review" https://jamfnation.jamfsoftware.com/featureRequest.html?id=2026

Please upvote my feature request so JAMF knows this is something a lot of people are interested in, if you are indeed interested in it of course.