VPP - User was Retired

[merc_support]

We've got about 100 staff with iPads that need VPP-purchased apps assigned to them. We use the on-screen prompt to invite the staff member, at which point they sign in (or input their password) and accept the terms and conditions.

So far only two staff members have successfully been enrolled in the program. The other staff members are prompted every ten minutes exactly with another invitation prompt.

When looking through the invitation usage, each ten minutes it lists 'User was retired' - which must be when it re-prompts. For one patient staff member, there's a whole page of 'User was retired' messages.

Has anyone else experienced this? Or have an idea of what could fix it?

[philipwoods]

I'm getting exactly the same behaviour. Did you ever figure out what was causing it?

[bdemetris]

just out of curiosity. do either of you guys have your vpp token lingering anywhere else? profile manager? other mdm solution?

[Hackert]

I am also getting the same message, but I am using the same VPP token in Profile Manager. We run two MDMs. Wondering now if that is the issue.

[bdemetris]

yea, having profile manager and casper running with the same token is problematic. what we have seen is that sending an invite out of the JSS will look totally normal, but you will notice some strange entries in the usage section of your invitation. looks like duplication is happening, and users just get retired.

what I actually think (i haven't proved this or anything) is that you have ipads enrolled in another mdm, so that mdm has a trust to manage the device (trust 1). sending the invite out through another trust (trust 2) is going to look great on the device, but when the other trust (trust 1) sees the user join, its going to retire the user because it didn't send the invite. that will most likely cause the JSS to reinvite the user, and so on, and so on.

anyway, in practice taking that profile manager out of the equation is going to make your day a lot better. just for fun I was testing this little battle royal out with meraki's system manager. meraki has a live view of apple's api, and can pull in users that were joined through casper. it was just nice for troubleshooting, but thats about it.

good luck guys!

[Hackert]

To be clear, I do not have any devices in two MDMs, but I do use one VPP token in two MDMs. Each MDM manages its own clients, but shares the VPP token.

But considering the problems I am having, I am making a new iTunes account and new VPP token for the JSS. Eliminate every possible problem, right?

[btaniyama]

@Hackert Did you find that creating a new ID worked?

[Hackert]

@btaniyama Still waiting to verify that I authorized to make purchases on behalf of the school. When we started the process they said it could take up to 5 business days to call us.

[Malcolm]

is your connection behind a proxy? there is a known fault with proxy based schools and VPP.

We had to network our school and route the servers traffic via a 4g connection, to work around this.

That and flush out any pending actions using the sql command.

[mmashlan]

Ever find a resolution for this? I'm having the same problem.

[Simmo]

@mmashlan As mentioned above is your VPP token in use anywhere else?