Why use VPP
Without VPP, users end up installing the Intune Company Portal themselves from the App Store. And when they do, they're prompted for an Apple ID and password.
Making people type a personal Apple ID into a corporate-owned device is something you want to avoid, both operationally and from an information management standpoint.
Once you connect VPP (a content token), that prompt goes away. The Intune Company Portal can be installed automatically while the device is still going through initial setup.
| Without VPP | With VPP (this article) | |
|---|---|---|
| Intune Company Portal | The user installs it manually from the App Store | Installed automatically during initial setup |
| Apple ID entry | Required | Not required |
| Effort for the user | High | Practically zero |
Overall workflow
| # | Where | What |
|---|---|---|
| 1 | ABM | Check the three conditions before downloading |
| 2 | ABM | Get licenses for the Intune Company Portal |
| 3 | ABM | Download the content token |
| 4 | Intune | Create the VPP token |
| 5 | Intune | Update the enrollment profile to enable VPP distribution |
| 6 | Intune | (Optional) Force authentication |
Three conditions to meet before you download the token
① An organizational unit (formerly "Location") has to exist
There is one content token per organizational unit. When you sign up for ABM, the first organizational unit is created automatically and reflects your organization name, so normally you already have one.
If you want to split app licenses by site or department, open ABM and go to Settings → Organizational Units → Add.
② You have to sign in with an account that's allowed to download the token
To download a content token, you need to be signed in with a role that has permission to get licenses for apps and books. Administrator, Content Manager, or Device Enrollment Manager roles qualify.
🚨 If you change the password of the Managed Apple Account used to download the token, the content token becomes invalid.
There are exactly two conditions that invalidate a content token:
- One year after it's created
- When the password is changed for the Managed Apple Account used to download the existing token
Once it's invalid, app and book license communication between ABM and Intune stops. If you run this on an individual admin's account, app distribution breaks every time that person changes their password or leaves the company.
To avoid an interruption of service, Apple recommends that you manually create a Managed Apple Account, create a custom role, and assign it only the "Assign licenses for Apps and Books" permission — and use that account to download and manage content tokens.
③ You have to get at least one app license
Microsoft's documentation lists "App licenses assigned to one or more location tokens" explicitly as a prerequisite.
With zero licenses, choosing "Install Company Portal with VPP" in the enrollment profile won't actually distribute anything. Here's how to get the licenses.
[Step 2] Get Intune Company Portal licenses in ABM
- In ABM, open Apps and Services → Apps and Books from the top of the screen
- Search for Intune Company Portal
- Specify the organizational unit to assign to and the quantity, then get the licenses
- Getting more than the number of devices you expect saves you from scrambling later when you add devices
It's a free app, so there's no cost.
💡 Why "get extra" is more than a nice-to-have
Microsoft's documentation warns that devices are blocked from enrolling if there aren't enough Company Portal licenses for a VPP token, or if the token expires. Intune does alert you when a token is about to expire or licenses are running low, but running your license count to the edge is a bad place to be.
[Step 3] Download the content token in ABM
- Sign in to ABM as a user whose role has permission to get licenses for apps and books
- Open Settings from your account name / organization name in the upper right
- Select Payments & Billing
- On the Apps and Books tab, select Download next to the relevant organizational unit
- You get a file named something like
sToken for xxxxxxxxxxxx.vpptoken
💡 ABM's UI labels keep getting revised.
Depending on which document you're reading, you'll see "Preferences" vs "Settings", and "Location" vs "Organizational Unit". They all point at the same place. Remember it as settings-type menu → Payments & Billing → Apps and Books / Content Tokens and you won't get lost.
[Step 4] Create the VPP token in Intune
- Microsoft Intune admin center → Tenant administration
- Connectors and tokens → Apple VPP tokens → Create
- On the Basics page, enter the following
| Item | What to enter |
|---|---|
| Token name | Any name you like, for administrative purposes |
| Apple Account | The Managed Apple Account associated with the token |
| VPP token file | The .vpptoken file you downloaded in Step 3 |
- On the Settings page, configure the following
| Item | Value | Notes |
|---|---|---|
| Take control of token from another MDM | No (for a new token) | Set it to Yes only when you're moving a token that's in use with another MDM over to Intune |
| Country/Region | Japan | Apps from the store you specify are the ones that sync |
| Management type | MDM (default) or DDM | See below |
| Type of VPP account | Business | Choose Education if you're an educational institution |
| Automatic app updates (when management type is MDM) | Yes or No | Pushes App Store updates to devices automatically |
- Select I grant Microsoft permission to send both user and device information to Apple
- Add scope tags if you need them → Next
- Review + create → Create
💡 About MDM vs. DDM for "Management type"
- MDM (default): the traditional management method. Choose this if you have any devices running versions earlier than iOS/iPadOS 18
- DDM (Declarative Device Management): Apple's policy-based management model, available on iOS/iPadOS 18 and later. It gives you efficient app delivery and real-time app status reporting
Note, though, that DDM doesn't yet support "Available" app assignments (as of September 2026). If you choose DDM, VPP apps can only be assigned as Required or Uninstall. If you have apps you want users to install on demand from the Company Portal, choose MDM.
[Step 5] Update the enrollment profile to enable VPP distribution
Edit the enrollment profile you created in Part 1.
- Intune admin center → Devices → Device onboarding → Enrollment → Apple → Enrollment program tokens
- Select your token → Profiles → select the target profile → edit it from Properties
Change the settings as follows.
| Item | Value |
|---|---|
| User Affinity | Enroll with User Affinity |
| Authentication method | Company Portal |
| Install Company Portal with VPP | Select the token you created in Step 4 |
⚠️ If the "token to use" dropdown is empty, it's one of these:
- The token hasn't synced with Apple yet (run a manual sync)
- You have no free Company Portal licenses left (go back to Step 2 and get some)
Step 6 Force users to authenticate
After initial setup finishes, if the user never authenticates in the Company Portal, ownership doesn't flip to "Corporate" and the primary user stays empty.
If you want to guarantee that they authenticate, configure this in the enrollment profile.
| Item | Value |
|---|---|
| Run Company Portal in Single App Mode until authentication | Yes |
With this turned on, the Company Portal launches automatically once initial setup completes, and the user can't touch any other app until they finish authenticating. It's the setting to use when you want to eliminate people who never get around to signing in.
| Setting | What the user experiences |
|---|---|
| Yes | After setup, the Company Portal launches automatically. No other apps until they authenticate |
| No | The user opens the Company Portal themselves and authenticates on their own |
What to check
- The moment setup completes and you land on the home screen, the Intune Company Portal is already installed
- You were never prompted for an Apple ID during the install
- Once you finish signing in to the Intune Company Portal, ownership becomes "Corporate"
- The account you signed in with shows up as the primary user
If you set Step 6 to Yes, the Intune Company Portal launches automatically after setup completes, and no other app is usable until authentication is done.
References
- Manage Apple Volume-Purchased Apps - Microsoft Learn
- Set up automated device enrollment for iOS/iPadOS - Microsoft Learn
- Tutorial - Use Apple Business to enroll iOS/iPadOS devices in Intune - Microsoft Learn
- Manage content tokens in Apple Business - Apple Support
- Configure organizational units in Apple Business - Apple Support
Top comments (1)
The MDM vs DDM note is the part that saves the most rework, because it isn't a preference — if any app must be install-on-demand from Company Portal, DDM simply can't express it yet, and you find out after the enrollment profile is already pointing at the DDM token. Choosing MDM for mixed fleets and migrating later is the only order of operations that doesn't end in a re-enrollment.
The ABM label drift is worth writing down too: every doc I meet uses a different menu name for the same content token, and the screenshots are always two revisions behind. Did you hit the other classic of this flow — the VPP token imported but licenses never returned to the pool after someone leaves, so the count says assigned and the device says nothing available?