How can I make a VPP assigned app a managed app

[philipwoods]

In a nutshell my question to the community is, how can I turn a VPP app assigned to a supervised device with automatic downloads turned on in to a ‘Managed App’?

To illustrate my question a little better:

We’ve just installed our VPP token in to our JSS, and successfully associated an Apple ID with my user. I’ve then setup a simple VPP assignment which assigns one app to me. My iPad is supervised with automatic downloads enabled so the app is silently installed. Bingo! Worked a treat

But........ the inventory for my iPad on the JSS it shows that the app is installed, but shows that it’s not a managed app. So I’ve been trying to figure out what the second step is to make it a managed app.

I’ve tried a second step of adding it in mobile devices / apps to install it like a normal managed app, but that just reports an error in JSS that the app is already installed because the VPP assignment has installed it as an unmanaged app already.

I really don't want to have to turn off automatic downloads on my supervised iPads because silent installation of apps is important to us moving forward.

Can anyone think of a solution?

If my question doesn't make any sense please tell me so I can explain a little better.

[philipwoods]

I've done a bit more work on this myself. Will post here just in case useful to others.

Supervised iPad + Automatic App Store downloads turned on + VPP Assigned app
Using JSS 9.3.2 this gives you a swift installation on the device, but as unmanaged apps. Why do you need an app to be managed? Casper focus needs the app to be managed to be able to use it as a focus, and you can only manage document availability in and out of managed apps. I'm sure there are more reasons, but these are the two which have made us look in to this issue.

Supervised iPad + Automatic App Store downloads turned off + VPP Assigned app + Managed App installation
This is how you end up with a VPP assigned app as a managed app using JSS 9.3.2. The VPP assignment puts it in to the purchased list of the users Apple ID, then the managed app installation actually installs it on to the device in 'managed' form. From my testing this was still a silent installation with no intervention needed from the user.
It's not a perfect solution though for the following reasons:
1. There's no way of setting the automatic app store downloads status to off with a profile, so you would have to rely on your users to turn this setting off on their device. 2. The process requires additional group management on the JSS because VPP assignment is done by user group, and managed app installation is done by device group. So your admin will have to be sure that the same devices / users are in the scope of the VPP assignment and managed app installation.

In summary, you can make the JSS do what you want it to do, but the uncontrollable variable of relying on the end user to keep the automatic app store downloads turned off sounds like an unrealistic expectation to me. This process could do with some tightening up in future releases.

[brandonusher]

I like your end result of "This process could do with some tightening up in future releases".

I am at a point in out deployment that we are not sure if Automatic Downloads is on or off without going around, one device at a time again to double check the setting, which is a lot of work.

My idea for deployment is that I am going to have to have a group of all iPads that get a specific app and all users that get a specific app and assign it both ways (managed app and VPP assignment).

It is my idea that since the introduction of users, we should be able to have an app set to be deployed to a group of users and it be managed.

Maybe we can get a feature where User groups show up under Scope for an app. Then the JSS just figures out what devices are assigned to each user in the group and pushes the app from there. This is the only way I can see this being more manageable. It would be easier, however, to set whether or not an app will be managed when assigning it under the Users tab and doing as I described above.

[philipwoods]

Thanks for responding usher.br. Always nice to know that you're not the only one with a problem.

You're spot on with you're suggestion, and it's something I'd not thought of. The easy fix for Jamf is to have a check box when setting up a VPP assignment to make the apps in that assignment managed. Then there's no need to worry about the state of the automatic app download setting on each device.

I've raised this article to the attention of a Jamf Systems Engineer in the UK, and he has said that in turn he'll bring it to the attention of their product dev team. Fingers crossed for an improvement in the near future.

[Nick_Gooch]

We have the same issue... We assign all of our apps free and paid to each user through VPP. It's especially an issue now with the Self Service Mobile App. Half of the users had the app auto installed through itunes the other half had it installed through Casper. That means half of the kids have a functioning self service the others do not.

[nandruschak]

We are struggling with the same thing.

Has anyone noticed if end users can install apps with accepting the VPP invitation? Is it even possible?

[cdenesha]

If they accept the VPP Invitation and they are assigned an app, Apple adds the app to their Purchased app listing. This is without configuring the app on the Mobile Devices side.

For the app to be Managed, you have to have it configured in Mobile Devices, where the above issues come into play.

chris

[philipwoods]

This has been addressed by Jamf now
http://www.jamfsoftware.com/resources/casper-suite-97-assign-and-deploy-content-with-managed-vpp/