VPP apps not being removed from iOS devices

[ccerrudo]

Hello!

I'm in an elementary school w/ 1:1 for each grade level. Our workflow has users assigned to static groups, and VPP assignments for both free and purchased apps assigned to the groups. Within the static groups, we assign the users, who are added in via prestage enrollment. At the end of the year, we removed the users from the static groups, which should have also removed the previous grade apps, and instead assign current grade apps. However, that isn't consistently working - some apps are removed, but others remain. Any thoughts on a quick way to insure all old apps are removed from an iPad besides factory resetting it?

[jwojda]

it was explained to me that they aren't removed, they are offered to the end user to buy, if they decline, then they become version locked to what is installed (no future releases/patches).

have you noticed if it was the free/paid apps or a mixture of both?

[ccerrudo]

mixture of both. That is an interesting explanation that sounds like a vestigial of their commercial model. Doesn't help us in ed, though!

[bcampbell]

The purpose of VPP assignments is not to install apps. When I user gets a VPP assignment it puts the app in the purchase history of the user who accepts the VPP assignment. So that means for a paid app, they don't have to pay. For free and paid apps, it means that on a SUPERVISED device, the app can be installed without entering the Apple ID password.

Actual installation of apps is handled through the app catalog. To get an app to automatically install, you add the app to the catalog and choose the distribution option "Install Automatically/Prompt User to Install" If a supervised device is scoped in and the app is already on the purchased list, which you take care of with the VPP assignment, the app will silently install. When you install apps that way, they are installed as managed in most cases. Only managed apps can be automatically removed from in iPad, and this will happen if the app is no longer scoped to that device or user.

Therefore, to do what you suggest, I believe you want to assign an app in the app catalog to the static groups you are talking about. Then when you remove users from those groups, the apps will be removed from the iPad since they were installed as managed in the first place. This will also remove the license from the purchased history but only because you are using the same group with the app catalog entry and the VPP assignment.

The way some people intentionally or accidentally use VPP assignments as a way to actually install the apps is by having the iTunes & App Store setting for Automatic Downloads > Apps to true. What that seems to do is to install an app on a device when it has been purchased on a different device using the same Apple ID. VPP license assignments seem to simulate that so the app does get installed most of the time. However, because the app was not installed via Casper managed app deployment, it is not managed and can not be removed by Casper. This also feels a little hit or miss because someone can easily change that setting, and it is not clear what devices are scoped to receive what apps. (Remember VPP assignments are to users not devices.) Therefore, I suggest that App Store setting always be left off in a managed educational environment, and all apps intentionally get installed with App Catalog entries.

It's taken me about a a year to finally understand how managed VPP app licensing works so I'm pretty sure this is correct. This past summer, I finally started doing what I suggest above methodically and have been pretty happy with the results. Of course, there are folks out there with more experience than me so I'm open to being corrected if something I said above is incorrect.

[ccerrudo]

Thank you for the explanation - that makes sense, since the apps were not in the catalog to begin with.

Now with 9.8.1, I would rather assign to devices, but have to find someone that has a good workflow for doing this!