Sites and VPP

[ralvarezOES]

Hi,
I'm testing using the Sites feature in Jamf at our school. It looks like it would be a good fit for our organization and we would have a Lower school site for K-5, Middle school site for 6-8, and Upper school site for 9-12th grade.
I could give the Technology coordinators in those divisions access to their site with a clean/uncluttered view of the devices they manage.

They could even scope software to their devices and not create a help desk ticket... Or can they?

On testing, I'm having a hard time figuring out how to do this with VPP software. For example both LS and MS divisions we use the paid Green Screen App. I buy the software in VPP and it shows up in my Jamf pro console under Mac store apps. Once I assign it to the LS site, it's unavailable to the MS site.

Does anyone have a solution for this? If I can get past this one issue I think I'm a go for sites. Maybe individual Apple VPP accounts for each division?

[kstrick]

Create smart groups with a tautology (results always true) in each site....

Example--
Create a 3 smart device groups, one for each site, with criteria 'last inventory update after 2000-01-01'
Set the VPP account and App for site 'none'
Scope the APP to those 3 groups

[stevewood · Accepted solution]

@ralvarezOES Unfortunately there really isn't an elegant way to do this. Ideally you would be able to split the licenses between the three sites, then create three MAS entries in Jamf with a third of the licenses in each. VPP isn't setup to handle it in this manner and simply lumps all of the licenses into one.

What I would suggest is similar to what @kstrick mentioned above, but instead of Smart Groups you would use Static Groups. Create a Static Group for each site for each app. Then when the site admins want to provide an app for a user/Mac, they simply add that user/Mac to the appropriate Static Group.

For example, if you had Keynote, Numbers, and Pages as Self Service MacApp Store entries, you would create 9 different Static Groups and assign them to the proper apps:

Site1 - Keynote
Site2 - Keynote
Site3 - Keynote
Site1 - Pages
Site2 - Pages
Site3 - Pages

And so on. Or in your parlance:

LS - Green Screen
MS - Green Screen

Make sense?

[ralvarezOES]

I don't understand how that would solve my problem, actually I don't understand what you said at all. I have 20 copies of a software. I want user1 to be able to scope 10 copies to their devices (and no more,) and user2 to be able to scope 10 to their devices.

I think I answered my own question. I think the answer is to have multiple Apple manager accounts.

[ralvarezOES]

Ok thanks stevewood, I see what you mean. That would be a way to do that.

[stevewood]

@ralvarezOES

You got me curious about how you might accomplish this, and I'm sure other EDU users and probably some Biz users have already figured this out.

In Apple Business Manager I can create Locations. I can then assign apps to a location and I can download a server token for each location (click Settings, then Apps and Books, and finally scroll to the bottom to see a list of locations). So if you want to limit the number of licenses each grade level has, perhaps this would work:

1) In Apple School Manager (assuming it is the same as ABM), create a new location for each grade level.
2) Download the server token for each location.
3) Create accounts in ASM for each grade level admin and assign them to the corresponding location.
4) Under each of your apps in the Content list you can "transfer" your licenses. Transfer the quantity each grade level needs.
5) Now in Jamf Pro, create a VPP Account for each of the locations you created in ASM.

From here you wouldn't need to create Static Groups at all. Instead you would create a Mac App Store entry for each app for each grade level. When creating these entries, on the VPP tab you would simply check the "Assign VPP Content" box and then choose the appropriate VPP account.

Hopefully that makes sense. I think this is a more elegant way to handle it and probably more the way Apple and Jamf would suggest it get done.

[ralvarezOES]

After speaking to the tech coordinators, I'm going to use the "three static groups" option. The benefit with this is the flexibility of the licenses. Say we buy a classroom set of 30 licenses for Green screen. With the three folders we can easily move them in and out of each division reusing paid apps efficiently.

Thanks for all your help.