Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
Applications fail to install on devices.Admin is unable to install VPP apps to devices from Workspace ONE UEM Console (while using User Based VPP).VPP applications are not pushed to devices.VPP licenses show as externally redeemed or unknown.Newly purchased apps not syncing into Workspace ONE.After updating Workspace ONE, the following error message is received when attempting to sync purchases: "The sToken that you are trying to upload is being used in another environment. Please note that if you choose to continue, the licenses claimed in the other environment will be marked as 'Externally Redeemed' and can be revoked from this environment. Do you still wish to continue?" Unable to renew VPP sToken as this error is present: "Save Failed Country is required" Purchased VPP applications not appearing in App Catalog as expected and/or attempts to install VPP apps via the App Catalog result in queued or pending commands.
This article outlines several common errors and issues that may occur when using Apple's Volume Purchase Program (VPP) for applications with the Workspace ONE UEM Console for device management and also outlines the resolutions to each example listed: Applications fail to install and/or auto-install on devices.Admin is unable to install VPP apps to devices from Workspace ONE UEM Console (while using User Based VPP).VPP applications are not pushed to devices.VPP licenses show as externally redeemed or unknown.Newly purchased apps not syncing into Workspace ONE: please reference VPP apps not syncing with Workspace ONE Console.Attempting to sync purchases after upgrading Workspace ONE reports error: "The sToken that you are trying to upload is being used in another environment...When renewing a VPP sToken, the renewal fails with the error "Country is required"Purchased VPP applications not appearing in App Catalog as expected and/or attempts to install VPP apps via the App Catalog result in queued or pending commands.Additional considerations to keep in mind while troubleshooting. Refer to these related resources for further information on the integration of VPP with Workspace ONE: Integrating Apple's Volume Purchase Program (VPP) with Workspace ONEUnderstanding VPP Process Flows with Workspace ONE
Applications fail to install/auto-install If an application fails to install, first check the Troubleshooting Logs of the device on the Console. For Workspace ONE UEM Console 1908+, the logs present a more detailed error code such as "License for app with iTunes Store ID XXXXXX could not be found." Device-Based VPP:For device based VPP, installation issues are usually caused when the device cannot verify the license. Ensure that: License is associated appropriately in ConsoleDevice network has access to vpp.itunes.apple.comVPP sToken is not shared with another mobile device management system (MDM) Note: VMware has noted instances where other MDM vendor solutions auto-revoke device-based licenses that are associated with Workspace ONE UEM. User-Based VPP:For user-based VPP, installation issues usually occur when the Apple ID on the device is changed after having accepted the VPP invitation to install purchased apps. In the Workspace ONE UEM database, an encoded form of the Apple ID that is used to accept the VPP invite is stored along with the enrollment user information. This combination is used as a reference for the Console to assign purchased applications. A change in the Apple ID causes a mismatch in our records and thus app assignment cannot be completed.The WorkspaceONE Support team can confirm if the Apple ID username and password currently in use on the device are being provided correctly to the Console. The encoded form of the provided credentials will not match with the ones that were used to register this user in the Volume Purchase Program if the Apple ID has been changed.There are several ways to rectify this issue: Change the Apple ID on the device to the one that was present when the device was registered in VPP. Workspace ONE only has the encoded form of the Apple ID; the Console will not be able to retrieve the actual value for you.The other way to rectify this is to delete the user record from the Workspace ONE UEM database through the Console. You can do this by carrying out the following steps: Delete the device from the Workspace ONE UEM console (and ensure that it is unenrolled).Delete the enrollment user account from the console.Add the user back to Console (perform a user group sync if you are using Active Directory).Following that, enroll the device and accept the VPP invitation again. You will then be able to install any purchased applications until the Apple ID remains the same. Unable to install VPP apps to devices from Workspace ONE UEM Console (User Based VPP) Ensure user has accepted VPP invitationYou may notice that you are unable to manually push applications to certain devices in the Workspace ONE UEM Console. If you navigate to the Apps section of the Device Details page of a particular device, you may see that certain VPP apps have the options to install grayed out. In these cases, you will be unable to push the app to the device from the console. A common reason for this behavior is that the user has not accepted the VPP invitation yet. To validate this, navigate in the Workspace ONE UEM Console to Applications > Native > Purchased. To the right of the app in question, select the magnifying glass icon to open the Manage Devices page. Here, you will be able to confirm if a device has accepted the VPP invitation or not, and can also choose to resend the invitation to a device if necessary. Once Workspace ONE UEM receives confirmation that the invitation has been accepted, admins will be able to manually push VPP apps to these devices. VPP applications are not pushed to devices Check license availabilityIf apps are not pushing to newly assigned/enrolled devices, double check whether you still have available licenses for this app. If you navigate to Apps & Books > Applications > List View > Purchased within the Workspace ONE UEM Console and select the name of the app in question, you will see information similar to the image below. Ensure that there are still some unallocated licenses left for new devices. In the event that there are no available unallocated licenses, additional licenses must be added to the assignment. If any licenses have previously been marked as On Hold, these can be reduced as well to ensure that more licenses are available for devices. Additionally, on the right-hand side of this same window, ensure that the total redeemed quantity is less than the total allocated quantity. Externally redeemed or unknown licenses (cause and resolution) The scenarios where the licenses show as externally redeemed or unknown are: Scenario 1: If a device is included in two smart groups assigned to one VPP application, deleting the assignment whose smart group ID was attributed to the license association first in the database will cause the Edit Assignment menu to display the license as Externally Redeemed.Scenario 2: This behavior also appears when a device moves from one assigned smart group into another. For scenarios 1 & 2, even though the license is counted as externally redeemed on the Edit Assignment page, it is still in use and can not be revoked. Scenario 3: This can happen when the license of an un-enrolled device is not revoked prior to un-enrollment.If you click into the associated license list, you can then click into the associated license number of the affected app and manually revoke the unused licenses. Sometimes, the externally redeemed number will remain inaccurate in the app details view because of the aforementioned scenarios. This has been improved in all currently supported versions of Workspace ONE UEM.On clicking the application in the purchased tab of the Console, you can view the count of externally redeemed licenses on the right-hand side.Note: For Workspace ONE UEM 1903+, the redeemed and externally redeemed counts have been combined. Workspace ONE Console 1908+: Admins can also see the total redeemed license list by clicking on an application in the list and selecting License Info.The total redeemed count is the sum of licenses redeemed by this Workspace ONE UEM console and licenses redeemed outside of this Workspace ONE UEM console. These licenses have been claimed by devices and must be revoked before they can be distributed. Scenario 4: This can also occur when records correspond to applications that have been removed from the App Store. This can be resolved by verifying that the application is no longer available in the App Store and deleting the apps themselves. However, please note that they will re-appear if the licenses are re-synced. After updating Workspace ONE, the following error message is received when attempting to sync purchases: "The sToken that you are trying to upload is being used in another environment. Please note that if you choose to continue, the licenses claimed in the other environment will be marked as 'Externally Redeemed' and can be revoked from this environment. Do you still wish to continue?" This message appears due to the console having recently been upgraded to a new version that comes with VPP enhancements. The new version of the console is simply seeing your current sToken as a different sToken since it existed on the previous version of the Console.To resolve this issue and take advantage of these new VPP enhancements:Sync your sToken. After syncing your sToken, the message should no longer present itself. Unable to renew VPP token: When renewing a VPP sToken, a "Save Failed Country is required" error may appear, causing the renewal to fail.To resolve this issue:Re-save the existing settings before choosing the option to renew. This will ensure that the saved data matches the correct information when renewing the token. Purchased VPP apps are not appearing in App Catalog as expected and/or attempts to install VPP apps via the App Catalog result in queued or pending commands. Often, this behavior occurs when the service has stopped running.To resolve this issue: Check the Console and Device Services servers to verify that the batch processing service is running.Restart the service.
Additional Considerations Users with multiple devices (User Based VPP)When allocating licenses, the Console allocates a single license to each assigned user account. Further, on a device level, different devices that use the same Apple ID can share application licenses. As a best practice, VMware recommends that devices enrolled under the same enrollment user also use the same Apple ID when using VPP. If a user has multiple devices enrolled, and each device utilizes a different Apple ID, then the app license will not be shared between the devices. In these cases, the app will install on devices using the same Apple ID as the first device to download the app but will remain unallocated on other devices. If it is a requirement that these devices use different Apple IDs, we recommend using Device Based Licensing.However, note that there are also considerations to be made for the maximum number of devices tied to a single Apple ID. For more information, please read Apple's documentation here. Disclaimer: VMware is not responsible for the reliability of any data, opinions, advice, or statements made on third-party websites. Inclusion of such links does not imply that VMware endorses, recommends, or accepts any responsibility for the content of such sites. App store restrictionsDevices must have the App Store available in order to properly process the VPP Invitation when first signing up for the program. In cases where the invitation does not come down to devices, double-check to ensure there are no restrictions to app store availability on this device. Within the Workspace ONE UEM Console, ensure that both the Restricted App Mode (left) under Settings > Apps > Workspace ONE > App Restrictions is not enabled at the Organization Group where the device is enrolled and that there is not a restriction profile that blocks the installation of public apps (right) pushed down to the device. Application compatibilityIf you experience issues where an application does not install on certain device models (for example, it installs on iPads but not iPods, or it only installs on iOS 12 devices), please verify the compatibility of the app in the App Store. This can be done by searching for the app in iTunes and verifying the details below on the information page of the app itself.Additionally, an age range restriction can result in applications not installing if there is a restriction profile on the device that filters the media content to a certain level/ages. Install delaysSometimes users may experience a slight delay between selecting the install option and the install processing beginning on a device. As this process requires communication and approval of several different components (for example, Workspace ONE UEM Console, Apple servers, devices), please allow up to 3-5 minutes for an install command to process during times of high latency.For additional details, refer to Volume Purchase Program (VPP) Application Management.Other Languages: 日本語 Integrating Apple's Volume Purchase Program (VPP) with Workspace ONEUnderstanding VPP Process Flows with Workspace ONE