IBM Security MaaS360

FAQ: Apple VPP and DEP Tokens must be renewed yearly – What are they and how are they renewed?

By Margaret Radford posted Thu March 04, 2021 03:36 PM

  

I work with many of our smaller/midsize customers who might not have a dedicated IT/Security staff to manage their endpoints. I get many questions around “What is this VPP and DEP Expiry Alert and what do I need to do about it?”

The MaaS360 portal and documentation provide details on these alerts, but much like that check engine light on your car, some of us dig into the details, others might call their local mechanic looking for more guidance from the experts.

Here is the formal product documentation on DEP and VPP token renewal: https://www.ibm.com/support/knowledgecenter/SS8H2S/com.ibm.mc.doc/pag_source/concepts/pag_platform_messages.htm

Let’s take a look at both and how to renew them so we can save you from having to make a call.

DEP Token renewal

The DEP Token is typically set up when you first rollout MaaS360 for company owned Apple devices that you want full control over. Your authorized reseller usually loads a list of your company owned devices into the Apple Business Manager portal using your purchase order number or by uploading a list of serial numbers. In order to then get those devices into MaaS360 so you can assign a profile to them and get your users enrolled, you need to create a DEP token in the Apple Business Manager portal that is associated with the devices, and then upload that token to the MaaS360 portal. Once that’s initially completed, the token then must be renewed yearly. If you don’t log into the portal that often, or if you are a new administrator, you might not be sure what your next steps are.

What happens if the DEP token expires?

If you do not renew the DEP token, devices attached to this token will not be able to enroll. Existing enrolled devices will not be affected.

What does the alert look like?

In addition to an alert in the MaaS360 portal My Alert Center, the portal Administrator will receive an email notification from maa360@maas360.ibm.com that looks like this:

Log into the Portal and check your DEP Token Name

The email above indicates the name of the DEP token expiring, in this case it’s called DEP Token, and the date when it’s expiring. Log into the MaaS360 portal and go to Devices>Enrollments> Other Enrollment Options> Apple Device Enrollment Program> Tokens and find the token with the same name. In this case, the token was already updated, but you will see the upcoming expiry date. Keep this workflow open.

Log into your Apple Business Manager(ABM) Portal and download the Token file

Log into your Apple Business Manager portal https://business.apple.com/and find the token name that is expiring. Go to Settings> MDM Servers and download the token file.

Update the Token in MaaS360

Go back to the Tokens workflow in MaaS360:  Devices>Enrollments> Other Enrollment Options> Apple Device Enrollment Program> Tokens

Click Update below the expiring DEP token and select the token file you just downloaded from ABM.

The token and the associated expiry date are now updated.

 

VPP Token renewal

Volume Purchase Program (VPP) tokens enable your company to purchase apps in volume using Apple Business Manager, then by integrating with MaaS360 you can distribute the apps to Apple devices eliminating the need for users to purchase apps individually. Even if apps are free, using VPP enables you to silently distribute and install those apps to MaaS360 supervised devices without the device user intervention. 

VPP tokens must be renewed yearly. Typically, VPP is set up when you initially rollout MaaS360 which might mean if you are the current administrator, you might have forgotten how this was set up, or if a new administrator, you might be totally unfamiliar with it.

What happens if the VPP token expires?

If you do not renew the VPP token, apps associated with the token cannot be distributed to devices. Apps already distributed to devices are not affected.

What does the alert look like?

In addition to an alert in the MaaS360 portal My Alert Center, the portal Administrator will receive an email notification from maa360@maas360.ibm.com that looks like this:

Log into the Portal and check your VPP Token

The email above indicates the name of the VPP token expiring and the date when it’s expiring. Log into the MaaS360 portal and go to Apps>More (upper right)>Apple VPP Licenses. Find the VPP token name, there is an Update action below the name. 

Log into your Apple Business Manager(ABM) Portal and download the VPP Token file

Log into your Apple Business Manager portal https://business.apple.com/and find the token name that is expiring. Go to Accounts> Settings> Apps and Books. Scroll to the My Server Tokens list. Select Download for the token name that matches the VPP token name in the alert and the MaaS360 portal.

This document provides more details: Downloading the Apple VPP token from Apple Business Manager (ibm.com)

Update the Token in MaaS360

Go back to the Apple VPP Licenses workflow in MaaS360:  Apps>More (upper right)>Apple VPP Licenses

Click Update below the expiring VPP token and select the token file you just downloaded from ABM.

The token and the associated expiry date are now updated.

 

 

 

 

 

 

0 comments
22 views

Permalink