Apps and Books
Apple Business has an app-licensing layer that most small orgs either ignore or misconfigure so badly they end up buying the same app twice. It used to be called VPP; Apple renamed it Apps and Books in 2021; most MDM consoles still say “VPP token.” Here’s the current 2026 flow: Locations, content tokens, device vs. user licensing, and the one renewal reminder that keeps your fleet’s App Store from going dark.
In this guide
Naming
Apple retired the standalone Volume Purchase Program portal in 2021 and folded it into
Apple Business Manager (now Apple Business) under the label Apps and
Books. The token format, the licensing model, and the server behavior
didn’t change, so every major MDM still labels the upload screen “VPP
Token.” Apple’s canonical name is content token or
location token; the .vpptoken file extension is the giveaway.
Treat the terms as interchangeable.
Concept
The mental model that unblocks everything else. Three layers, each with a single rule that keeps setups sane.
An organizational bucket inside Apple Business. Owns its own pool of app licenses, its own payment methods, its own content token. Apple creates a default Location named after your org at signup. Bigger orgs carve Locations by business unit or geography (“HQ — Chicago”, “EU Office — Dublin”, “Retail Stores”).
The .vpptoken file. The credential your MDM uses to talk to
Apple’s licensing service on behalf of one Location. The rule you cannot
break: one token = one Location = one MDM at a time. Uploading
the same token to two MDMs or two Intune tenants corrupts license assignments.
The MDM never hosts the .ipa. It tells Apple which licenses to assign
to which devices or accounts, and Apple’s servers deliver the install over
the MDM protocol. This is why “VPP” feels like a licensing system, not
a distribution system — that’s because it is a licensing
system.
Inside Apple Business, an Administrator or Content Manager with access to both Locations can transfer licenses across them. Useful when you reorganize regions. Licenses cannot move across Apple Business tenants.
Before you start
Administrator or Content Manager in Apple Business. Content Managers need to be explicitly granted access to each Location they manage; Administrators have access to every Location. Apple recommends Administrators own token renewals across all Locations.
The default Location created at signup is enough for most small orgs. Don’t create additional Locations just because you can — you’ll quadruple your renewal work.
This is the account you’ll enter into the MDM during token upload. Not a personal Apple ID. Not your admin login. The Managed Apple Account associated with the Location itself.
As of April 2026: Microsoft Intune, Jamf Pro, Jamf Now, Kandji, Mosyle, Addigy, SimpleMDM, Hexnode, Omnissa Workspace ONE. If the MDM exists and people have heard of it, it supports this.
Credit/debit card, VPP Credit code, or PO account, set under Payments and Billing. Required even for free apps — Apple still issues zero-cost licenses against a payment method.
Walkthrough 1
Sign in at business.apple.com. Click your name at the bottom of the sidebar and choose Preferences.
Open the Payments and Billing section (Apple’s current label, verified April 2026). If this is a fresh tenant and no payment method is on file, configure one here first — the token download works without it but buying anything will not.
Switch to the Apps and Books tab. Scroll to Content Tokens. Each Location appears as its own row with its own Download button.
Click Download next to the target Location. A
.vpptoken file lands in your Downloads folder. Alternative path for
bulk renewals: the top-level Apps and Books sidebar item → pick the
Location → same Download action.
The .vpptoken is base64-encoded and contains an API key. Never email
it, never commit it to source control, never share it across MDM tenants. Upload
it to exactly one MDM and delete the local copy when done.
Walkthrough 2
Worked example against Microsoft Intune, the MDM most small businesses on Microsoft 365 end up using. Other MDMs live in a different menu but the shape of the flow is identical.
Intune admin center: Tenant administration → Connectors and tokens → Apple VPP tokens. Click Create.
Token Name: descriptive, e.g. “ABM — HQ Location”. Apple
Account: the Managed Apple Account tied to the Location. VPP token file: browse
to the .vpptoken file.
Take control of token from another MDM: yes if migrating. Country/Region: the App Store storefront Intune should pull metadata from. Type of VPP account: Business. Automatic app updates: yes. Agree to the Microsoft-Apple data-sharing notice.
Add scope tags if your tenant uses them. Hit Review + create. Intune auto-syncs once a day; the Sync button on the token row triggers a manual sync when you need licenses to appear now.
Jamf Pro: Settings → Volume Content. Kandji: Integrations → Apps and Books. Mosyle: Apple Business Manager → VPP. Workspace ONE: Groups & Settings → All Settings → Devices & Users → Apple → VPP Managed Distribution.
Walkthrough 3
Apple Business sidebar → Apps and Books. Search the full App Store catalog plus any Custom Apps your org has been granted access to.
Click through to the purchase panel. Choose the Location that will own the licenses (double-check this — wrong Location is the #1 “why can’t my MDM see these licenses?” cause).
Quantity = number of licenses. Payment method = the one you configured earlier. Click Get for free apps, Buy for paid. Free apps still need a zero-cost “purchase” to create the license pool.
Licenses appear in the MDM on the next sync. Most MDMs run Apps and Books sync every 6 hours; a manual sync button is always available for impatient admins.
The critical decision
Pick one, and pick it deliberately. Mixing device and user licenses on the same device or user breaks install behavior in ways that are maddening to diagnose.
License ties to the device serial number. No Apple Account required on the device. Install is silent via the MDM. License travels with the device. Works in kiosk and single-app mode. This is the right answer for every corporate-owned, MDM-supervised device.
License ties to an Apple Account. User must accept an Apple Business invitation before install. License travels with the user across up to 5 devices. Required for books (device licensing is not supported for Books). Useful for User Enrollment (BYOD) where a personal Apple Account is appropriate.
Device for everything corporate, user only for BYOD User Enrollment and books. Microsoft flipped the Intune default in January 2026 to device on new VPP assignments, which matches Apple’s long-standing recommendation.
Mixing causes duplicate-install prompts, update failures, and uninstall loops. Pick the model for a given user/device and stick to it.
Assignment in the MDM
After sync, the app appears under Apps → All apps in Intune with the Location/token name in the VPP token name column. Filter by that column to find only your Apps-and-Books apps.
Open the app → Properties → Edit next to Assignments. Choose an intent: Required (silent install), Available (Company Portal self-service), or Uninstall (removes the app and reclaims the license).
Add a device group (or user group for Available assignments). Leave license type on Device unless you’re deliberately doing BYOD or books.
Removing the assignment does not uninstall the app or reclaim the license. You must set the assignment to Uninstall and let it apply. On macOS, revoked apps keep running for a 30-day grace period before Apple stops them.
Don’t skip this
Every content token is valid for 12 months. If it expires, sync stops: new apps don’t appear, license counts go stale, MDM dashboards show the token as expired or invalid. Nothing breaks catastrophically — existing installs keep running — but you can’t assign anything new until you renew.
Every Location gets its own token and its own 12-month clock. Calendar a renewal check at the 6- or 9-month mark per Location. Apple emails on expiry; MDMs flash warnings 30–60 days out. Don’t rely on either.
Download a fresh .vpptoken from Apple Business for that Location.
In the MDM, open the existing token entry and upload on top of it.
Do not delete the old token and create a new one — that orphans
every existing license assignment.
If you’re moving Apps and Books from one MDM to another, revoke from the old MDM first, then upload to the new one with Take control of token from another MDM set to yes. Running the same token live in two places corrupts the license state.
When it breaks
Sync stops. Renew the token (download fresh from Apple Business, upload on top of the existing MDM entry).
Intune shows “duplicate token” and license assignments corrupt. Revoke from the old MDM, re-upload fresh token to the new one.
You bought zero licenses. Go back to Apple Business, “buy” more zero-cost licenses, sync.
A restriction profile is blocking App Store access on the device. User-license invites require the App Store to be reachable. Switch the app to device-license, or remove the App Store restriction.
Supported via Apps and Books under the Custom Apps tab in Apple Business, but only if the developer granted your org access through App Store Connect. Worth asking your vendor for a “redemption code” or “organization distribution” if an internal-only app isn’t showing.
Can’t be redistributed through Apps and Books. Licenses are tied to the personal Apple ID that bought them. Re-purchase through Apps and Books as a corporate license.
Want this handled for you?
Token management, Location design, and the Intune or Kandji assignment rules that actually match your device model are part of how Arclion sets up a new Apple environment. If you want your fleet’s app catalog to “just work” without surprise billing, that’s Foundation.
What to send
Keep reading
Before you can push apps, the device has to be assigned to the right MDM. The manual, CSV, and default-assignment paths in Apple Business.
Read the guideThe end-to-end setup walkthrough for Apple Business itself — verification, MDM selection, admin roles. The step before anything in this article applies.
Read the guideFoundation, Managed, and Managed + Security packages and what each one covers, with transparent starting prices on the pricing section.
See services