In this Apple app deployment guide, we’ll cover everything Apple IT teams need to know about app purchasing and distribution for your organization. This guide has also been updated to include the latest features from WWDC 2020, which introduced some exciting changes for macOS Big Sur. Here’s a quick overview of the topics that we’ll cover:
- What are Apple VPP Apps (App Store Apps)?
- What are Custom Apps (Third-Party Apps)?
- How Do I Purchase Them?
- How Do I Deploy Them?
- What Changed with macOS Big Sur?
With Volume Purchase Program (VPP) being replaced by Apple Business Manager, considerable changes are coming to how IT administrators purchase, manage, and deploy apps.
In early 2020, Kandji also released Auto Apps – custom apps that are pre-packaged, hosted, and automatically updated apps available to deploy with a single click.
We’ll start with a quick overview of the platforms that we’ll be discussing. But before we move forward, it’s important to make clear that VPP will be deprecated and merged with Apple Business Manager on December 1st of 2019. From that day onwards, VPP will not be available – though we will still use the term in this guide.
A Primer on Apple Platforms
Apple devices use different operating systems, so downloading an app on an iPad won’t be the same as downloading it on a Mac. This fundamental difference between the devices underlies many of the Apple app deployment issues that we’ll discuss later in this article – primarily concerning macOS.
Before we move on, let’s make sure we have a shared vocabulary. Below is a table that lists which operating systems and app stores are used by four major Apple devices. We’ll be referring to these throughout our Apple enterprise app deployment guide.
Mac App Store
Apple TV App Store
As we’ll cover later, these App Stores aren’t the only way to get apps.
What Are Apple VPP Apps?
When it comes to finding apps for your business, you’ll run into two types:
- Apple VPP apps, or App Store apps, can be found in the App Store and purchased through Apple Business Manager. They tend to be the easiest apps to manage and deploy.
- Third-party apps, also informally referred to as “custom apps,” aren’t available in the App Store, so you have to access them from their developers’ websites. They tend to be harder to manage and deploy.
We’ll cover both types of apps in this guide, focusing first on what App Store apps are and how you can buy them.
What is Apple VPP?
Let’s start by describing what VPP is and how it relates to Apple Business Manager.
In short, VPP is a tool that makes purchasing, managing, and deploying apps and books easy for businesses. No matter which of the thousands of apps you’re using from the App Store or Mac App Store, VPP lets you manage and deploy them to your employees’ Apple devices.
Recently, Apple announced that VPP will not be available after December 1, 2019. As we’ll discuss later, VPP and the Device Enrollment Program (DEP) are merging with Apple Business Manager.
Before Apple VPP was introduced, employees with company-owned Apple devices had to use their own Apple accounts to purchase apps, and then wait for their company to reimburse them. This was more than just a hassle. Because the apps were purchased with the employee’s personal accounts, they owned the app licenses – not the company.
Apple created VPP to avoid this issue and introduce a streamlined process for purchasing and distributing apps and books in bulk. No longer do companies have to reimburse their employees for licenses that they don’t legally own.
With Apple VPP, licenses can be owned by companies and assigned to employees. If an employee no longer needs to use the app anymore, the license can easily be revoked and reassigned. This gives organizations much more control over what apps they want to buy and who gets to use them.
Apple VPP vs. Apple Business Manager
As we mentioned earlier, Apple VPP is being deprecated and merged with Apple Business Manager. This means there will be some changes regarding how you purchase and deploy apps and books for your company’s devices.
You can read our guide to Apple Business Manager if you aren’t familiar with the platform. In short, it’s a web-based portal that IT administrators can use to buy content and manage Apple devices for a company.
Just like with Apple VPP, purchasing apps through Apple Business Manager ensures that your company retains full ownership of the licenses, so you have the power to revoke and reassign apps at any time. This could come in handy if you take on a temporary employee or let someone go.
Apple Business Manager can also work together with your mobile device management (MDM) solution to give your company more power over how you buy and deploy apps and books. Once paired with your MDM, you can remotely distribute content to your users and devices. This is called managed distribution, which we’ll cover in more depth later.
Here are a few changes you can expect:
- While Apps and Books used to be purchased through the VPP portal, now you can buy them through Apple Business Manager. Before this, you had to access DEP and VPP through different portals. Now, both programs are accessible through Apple Business Manager.
- Admin roles in the Apple Deployment Programs (DEP and VPP) have been updated and embedded in Apple Business Manager. Now, DEP Admins are Device Managers in Apple Business Manager, and Apple VPP Admins are Content Managers.
- Because Apple VPP and DEP are now integrated into Apple Business Manager, IT administrators can both deploy and manage apps in one place.
As you can imagine, these changes have considerable implications for how IT administrators will manage Apple app deployment across company devices.
How to Purchase Apps and Books in Apple Business Manager
The App Store and Apple Books are stocked with great resources for your organization. You can buy content from either store by visiting the “Apps and Books” section of Apple Business Manager. It’s a pretty straightforward process that we’ll walk you through here.
The first step toward purchasing the right app is finding it in the store. You can begin your search by following these steps:
- Sign in to Apple Business Manager with a Content Manager role.
- Select “Apps and Books.” It’s located in the sidebar.
- Click in the “Search Accounts” field above the search bar, and then type in the app you’re looking for.
- Click the “Filter” in the search bar if you want to specify criteria that narrows down the search results.
If you can’t find the app you’re looking for on the Mac App Store, don’t worry. We’ll cover how you can find it in the next section. If you do find it, you can move on to buying a license for it.
To do this, just follow these steps:
- Remain signed in to Apple Business Manager with a Content Manager role.
- Click the app in the search results that you want to buy.
- Select the location where the app license will be initially assigned.
- Select the number of licenses that you want to purchase.
- Make sure the proper payment method is selected.
- Click “Buy.”
Depending on the number of licenses that you purchase, the availability of the app will vary. If you bought under 5,000, then the license is immediately processed. If you bought more, expect a delay.
What Are Custom Apps (Third-Party Apps)?
If you’re browsing Apple Business Manager, you might have some trouble finding Mac versions of the apps you want to use. Even popular business apps like Zoom and Google Chrome aren’t available directly through the Mac App Store.
Why Are Common Business Apps not Available in the Mac App Store?
It’s important to understand that the Mac App Store isn’t like the iPhone or iPad App Store. Since macOS evolved without an app store for years, users are experienced with getting their apps directly from developers. This used to be done with installation disks, but now you can just visit their websites and download an installer package.
Though an App Store was eventually introduced to Mac, users continued to get apps as they always had – straight from the developers. The result? A pretty limited selection on the Mac App Store.
Part of this has to do with the lengthy process that developers have to go through to get their apps onto the Mac App Store. Going through the notarization and upload process is one thing, but some developers are unwilling to strip their app of unsupported payment models (like plan upgrades), modern licensing models, and other common features (like free demos).
In summary, the Mac App Store isn’t the only way to get apps – businesses can also find non-Mac App Store applications if their favorite business programs aren’t showing up. You can expect to use a mix of both as your business grows.
Let’s take a look at a few examples of common business apps that you can’t find in the Mac App Store next, and then we’ll show you how you can deploy them to your team.
Common Apps Not Available in the Mac App Store
To illustrate just how many big-name apps aren’t available on the Mac App Store, we’ve created a quick list:
- Adobe Creative Cloud
- Google Chrome
- Jira Cloud
- InVision Studio
Why Non-Mac App Store Apps are a Challenge
When you can’t find that great app on the Mac App Store, the next step is to check the developer’s website. Downloading third-party apps is a must for any company with needs that exceed the limited inventory of the Mac App Store. Unfortunately, third-party apps pose a few challenges for IT administrators.
One issue is safety. While App Store apps are strictly vetted, third-party apps aren’t held to the same standards. In an attempt to make downloading third-party Mac apps safer, Apple made their App Notarization feature required for all apps installed on macOS 10.15 Catalina.
With this update, installer packages for non-Mac Store Apps are automatically scanned by Gatekeeper for malicious content or code-signing issues. The user is then prompted with a message, like the one pictured below, so they can make an informed decision about launching the app. That means users can feel more confident while using third-party apps.
Another issue is app availability. As we discussed earlier, developers have to use different tools to create apps for macOS and iOS, which plays into the Mac App Store’s limited selection. Because apps cannot be reliably found on the Mac App Store, accessing and maintaining them requires more effort.
But Apple is working on a feature that might help: Project Catalyst. This ambitious project will make it easier to develop macOS versions of iOS apps by automating the development process. Project Catalyst was announced in the macOS Catalina 10.15 update. It’s still in development, but it has already planted seeds for a significant shift in app development and deployment.
Under Project Catalyst, developers will be able to use a new Xcode development kit that will let them translate their iPhone or iPad apps into Mac apps. That means it will be less taxing for developers to get their apps on more app stores.
Needless to say, Project Catalyst has big implications for IT administrators. As more applications become available on the Mac App Store, bulk app management could be simplified. Rather than download app packages from developer websites, IT administrators could just use the Mac App Store, which would make processes like patching and auto-updating easier.
Until then, managing and deploying third-party applications is tricky. That's why the Kandji team built Auto Apps, which are designed to streamline Mac patch management for apps that are not available in the Mac App Store. Kandji has loaded 20+ of the most common business apps that are not available in the App Store into our Library and will govern versioning for all those apps moving forward, so you have peace of mind without manual package management work. Learn more in our Auto Apps release.
Apple MDM App Distribution: How to Deploy Apps
Managed distribution is exactly what it sounds like – it’s a feature that lets you distribute purchased apps and books to company devices (“managed” devices) and authorized users. You can take full advantage of managed distribution by using an MDM solution, which will let you distribute Apple App Store and third-party apps.
Of course, Apple app deployment will look a bit different depending on the MDM you’re using. For this article, we’ll show you how you can add and deploy apps using our Apple MDM solution, Kandji.
Accessing App Store (VPP) Apps from Your MDM Library
Since Kandji is integrated with Apple Business Manager, your Apple Business Manager (formerly VPP) apps will automatically be synced into your Library once you connect Kandji with your Apple Business Manager account. You’ll be able to see how many licenses have been used and which Apple operating systems that app is compatible with.
Enabling Auto Apps in Kandji
As mentioned above, Kandji automates patch management for 20+ common business apps that are not in the Mac App Store with our Auto Apps feature. Here's an overview of how it works:
With Auto Apps, you can also have peace of mind that your end users won’t be disrupted by unnecessary or confusing user approval requests. Every single Auto App includes:
- Notification whitelisting: Enables a silent install without the user being notified
- Kernel Extension (KEXT) whitelisting: Ensures users will not receive prompts to approve Kernel Extension access
- PPPCP (Privacy Preferences Policy Control Profile): Lets apps access protected user and system resources without the user being prompted to approve the action
Adding Custom Apps to Your MDM Library
For non-Auto Apps, adding other custom apps to your library is a breeze. As you can see in the video below, it only takes a few clicks and one upload before your app is ready to be deployed.
To add an app to the Kandji library, just follow these steps:
- Click “Library.” It’s located in the navigation bar.
- Click “Add New” and then select “Custom App.”
- Fill out the information on the page. It will include the following sections:
- Execution Frequency: This section lets you configure the execution frequency of the app. You can choose one of two options:
- Install once per device: With this setting, Kandji will install the app once. If a user uninstalls the program on a company computer, it will not be reinstalled automatically. This is a good option for a software patch since it shouldn’t be run continuously.
- Install and enforce: With the install and enforce option, Kandji will ensure that the app is currently installed during each check-in. If the app is not installed, Kandji will automatically reinstall it.
- Install Details: This section lets you upload an installer package (.pkg or .mpkg), a Disk Image (copy .app from disk image to /Applications), or ZIP File (unzip contents into specified directory).
- Preinstall and Postinstall Scripts: This section lets you add scripts to specify more behaviors once you deploy the app. Kandji lets you add pre and/or postinstall scripts, which we’ll describe below. Both give you more control over the installation process
- Preinstall Script: You can add a pre-install script to perform an action before installation occurs. For instance, you might include a script that removes an app that is being replaced.
- Postinstall Script: You can add a post-install script to perform an action after the app is installed. For instance, you might include a script that lets you configure the Custom App that was just installed.
- Execution Frequency: This section lets you configure the execution frequency of the app. You can choose one of two options:
- Restart After Successful Installation: Some applications require a device to be restarted after installation. You can do this by checking the “restart after successful installation” box. Note that users will not be prompted before the restart occurs.
- Click “Save.”
That’s it! Now that your apps are saved to your Kandji library, let’s see how to deploy them to your company’s devices.
Deploying Apps to Your Devices
Once an app has been added to your Library, you can deploy it to any enrolled device. As we mentioned earlier, app deployment will be different depending on the MDM solution that you’re using. Kandji uses Blueprints to make deployment simple and powerful.
Blueprints let you define what apps will be deployed to specific devices. For instance, if one department in your company requires a different set of library items, you can create a unique deployment set using Blueprints.
For a visual explanation of how Blueprints work, you can watch the video below.
In summary, Blueprints give you control over what content you want to deploy and where you want it to go. As you’ll see, they’re really easy to use.
Here’s how you can deploy apps with Blueprints:
- Login to Kandji and click on "Blueprints." It’s located in the navigation bar.
- Select the Blueprint you'd like to add the app to.
- Click "Edit Library Items."
- Find the desired app and then click the toggle button to enable it.
- Click “Save.”
Once you do this, all devices that are enrolled in the Blueprint you selected will receive the application on their next check-in.
What Changed with Big Sur?
Managed apps have been available on iOS for a few years, but at WWDC 2020, Apple announced that they’re coming to macOS Big Sur. This announcement included a couple of exciting capabilities related to this new app classification. These include the ability to:
- Convert Unmanaged Apps to Managed: Now that Big Sur recognizes Mac apps as managed or unmanaged, IT has the ability to convert unmanaged apps (also referred to as third-party, or custom, apps) to managed (VPP) apps. This can be done via MDM.
- Remove Apps Upon Unenrollment: This feature lets IT remove apps using MDM commands and automatically remove apps upon unenrollment.
In the next two sections, we’re going to explore each of these features in more depth.
Converting Unmanaged Apps to Managed
We already discussed how third-party apps can be challenging for IT to manage and deploy. In macOS Big Sur, these apps are classified as “unmanaged.” Before this change, these types of apps could not be converted into VPP apps — unlike on iOS, macOS just didn’t have a concept for “managed” or “unmanaged.”
Now, that’s changed. As of macOS Big Sur, IT can convert unmanaged apps to managed by using MDM. There’s only one catch: this feature isn’t available on devices enrolled via the “User Enrollment” enrollment method, note that this is not the same as manual device enrollment. On devices enrolled via other methods, previously-deployed App Store (VPP) apps can be converted to managed. Likewise, apps downloaded from the App Store, like Slack, can be converted to the VPP version.
Removing Apps Upon Unenrolling a Mac
The other new macOS feature removes apps from devices upon unenrollment. Before this change came to macOS Big Sur, Mac App Store apps deployed through Apple Business Manager (previously VPP) could be remotely installed — but not remotely removed via MDM or upon unenrollment.
Now, IT has more complete management capabilities for Mac apps that are deployed through Apple Business Manager. Using native MDM commands, they can remotely remove VPP apps and have apps automatically removed from devices upon unenrollment.
Kandji makes Apple app deployment in your organization a breeze. Our MDM solution gives you complete visibility into the apps installed on your company’s devices, and it lets you deploy third-party apps in just a few clicks.
And that’s not all. From deployment to retirement, Kandji keeps your Apple devices safe, offering great features like pre-built security settings, one-click compliance, zero-touch deployment, and plenty more. It’s time to manage your devices like your business depends on it.