Self Service for Licensed Apps

[sedwards]

I work in the IT department for a school district and I'd like a few of our teachers who manage iPad carts to be able to easily manage purchased apps. I'm thinking that making these purchased apps available in Self Service is the way to go.

My question is, how does license management work with regard to apps installed through Self Service? If I have 10 licenses for an app, and a teacher installs it on 10 iPads through Self Service, does that app then disappear from Self Service so no other users can install it (this would be ideal)?

What I don't want is for teachers to be able to install the app on my iPads than we have licenses for which absolutely would happen.

[blackholemac]

That's an ongoing concern regardless of the two methods I'm about to tell you about. You have to keep an eye on licenses.

First may I ask if you were doing user base VPP or device based? Is App Store open or closed? Two different places to check based on your answer and two differing ways for counting burned licenses.

If you use userbased and App Store is open, merely scoping an app to a user or user group doesn't "burn a license". it doesn't get burnt until a user installs.

If you are going by device with the App Store closed and using the app catalog, (likely what you are doing with Self Service), the license is burnt instantly upon scoping.

There is a third possibility...VPP assignment under users populated but using the app catalog to get it there with self service...license shouldn't get butt until install. Sounds great but I hate user based VPP as it involves Apple ids.

Hope this helps

[martinf]

I have a method i use to use device based VPP via self service and scope to all without burning a lic. However it's far from ideal and quite slow are requires multiple checkin and uses blank profiles.

I posted a question a while ago to see if anyone had a better method but didn't get any responses. It may help in the interim. With this the app will not install if you are over licence but you can see that in the device management pane.

https://www.jamf.com/jamf-nation/discussions/23469/send-an-e-mail-request-from-self-service-distribute-vpp-apps

[sedwards]

That's an ongoing concern regardless of the two methods I'm about to tell you about. You have to keep an eye on licenses. First may I ask if you were doing user base VPP or device based? Is App Store open or closed? Two different places to check based on your answer and two differing ways for counting burned licenses. If you use userbased and App Store is open, merely scoping an app to a user or user group doesn't "burn a license". it doesn't get burnt until a user installs. If you are going by device with the App Store closed and using the app catalog, (likely what you are doing with Self Service), the license is burnt instantly upon scoping. There is a third possibility...VPP assignment under users populated but using the app catalog to get it there with self service...license shouldn't get butt until install. Sounds great but I hate user based VPP as it involves Apple ids. Hope this helps

I'm using device based VPP but I currently have the App Store open so the users can install free apps themselves. What's the reasoning for closing the App store?

[blackholemac]

In our case, we have a 1 to 1 program where the kids take the devices home...bad things happen when students take iOS devices home "unsupervised" (as in parental)...kids login with personal accounts and fill devices with crap or secret apps or porn or whatever....we have decided as a district "curate" the apps available on ALL student iPads but make it "brain dead easy" for staff to request whatever they need from us for educational purposes. We also leave App Store open for staff so they can find what they desire the students to have. In short for staff we do user-based VPP but put the onus on staff to follow directions to create their own Apple IDs. Students do straight device-based with no App Store and no Apple ID.

[sedwards]

In our case, we have a 1 to 1 program where the kids take the devices home...bad things happen when students take iOS devices home "unsupervised" (as in parental)...kids login with personal accounts and fill devices with crap or secret apps or porn or whatever....we have decided as a district "curate" the apps available on ALL student iPads but make it "brain dead easy" for staff to request whatever they need from us for educational purposes. We also leave App Store open for staff so they can find what they desire the students to have. In short for staff we do user-based VPP but put the onus on staff to follow directions to create their own Apple IDs. Students do straight device-based with no App Store and no Apple ID.

Interesting. Our iPads don't leave the district and as we are currently transitioning from Redemption Codes to managed distribution, our iPads all use a single iTunes account (per building). The student iPads are not logged in with unique iTunes accounts. I'm wondering what's the best way forward for this. Our iPads are only used by Special Education and they are shared so we don't want to setup AppleIDs for all of them.

[sedwards]

Also, if using Self Service for App distribution, is it possible to allow certain devices access to say one group/category of Apps while other devices have access to another group/category? I don't want teachers from one building installing apps earmarked for devices in a different building.

[blackholemac]

@sedwards We were that way three years ago...when 1 to 1 forced the district to allow take home, we started by using user-based VPP with individual Apple IDs (using the old Apple ID for Students program) as that is the only tool we had but after about 6 months into the 1 to 1 the admins declared that we are going to find a way to close the App Store...period. Didn't like that, but didn't really want to fight back either as it was truly a problem for us....device based VPP was the way to go ultimately and we were able to switch to that last summer. I would advise waiting until summer to change deployment methods...and I'm guessing you hate Apple IDs as much as I do however many you have.

That being said, unless you are doing some trickery, getting that managed distribution conversion done is your hard part and I wish you good luck on that. Sure Apple will convert any VPP codes issued on your entire account to Managed Distribution, but only codes that weren't burnt!

Luckily prior to us going 1 to 1 we were doing said trickery...buying the number of apps we needed but using an older method (@nsdjoe 's old method [https://www.jamf.com/jamf-nation/discussions/7446/k12-deploying-ipad-apps-ota-without-passwords](link URL)) to get them on the devices through Self Service...we only burnt one app code for each app used. If you have burnt your app codes previously, it's no fun trying to get Apple to handle that conversion. That being said, once you are 100% on managed distribution, it's a breeze.

[sedwards]

@blackholemac Yea I've already read up on the whole process of converting to Managed Distribution and that's going to be hit and miss for us. Most apps we only used one of say 10 redemption codes for an app so we can transfer those over. However the expensive apps that we only purchased one here and there of obviously won't be transferable.

How do you manage what apps show up in Self Service? Or do all users/devices that have the Self Service app have full access to install any app you put in Self Service?

[blackholemac]

Very easily once you are all on Managed Distribution and have your tokens in a row…at that point you use the app catalog to install apps. You set up an app scope it to devices and decide what VPP account you want to draw managed distribution licenses from. You also decide whether to automatically install the app (no creds needed) or put it in self service. In general unless it is a testing app or the web filtering system we use, I tend to rely on self service. In the Self Service tab you can even assign app categories where the app appears in Self Service.

[sedwards]

Ahhh, that makes sense thanks for talking me through it. I think what will work best for my use case is setting up iPad Cart groups so that I can make apps available in Self Service only for the teachers managing the iPads on said carts.