Setup guide · from scratch

Sync the token and assign a VPP app with silent device licensing

After upload, sync so ABM apps appear in Intune, then assign them Required with DEVICE licensing to an Entra group for a silent, Apple-ID-less install. Never mix device and user licensing on the same target.

Intune admin center (Apps > All Apps)

Step 1. In Tenant administration > Connectors and tokens > Apple VPP tokens, click '...' next to the token and choose 'Sync'.

Screenshot: '...' > Sync action on the token (captured during a live customer build — coming to this page)

Step 2. Wait a few minutes, then go to Apps > All Apps; the ABM apps you 'Got' now appear with a VPP token column.

Screenshot: All Apps showing freshly synced VPP apps (captured during a live customer build — coming to this page)

Step 3. Click the app > Properties > Edit next to Assignments.

Screenshot: App Properties > Assignments Edit pane (captured during a live customer build — coming to this page)

Step 4. Choose 'Required' (auto-install). Note: 'Available' is NOT supported for device groups.

Screenshot: Required intent selector (captured during a live customer build — coming to this page)

Step 5. Click 'Add group' and pick the Entra device group.

Screenshot: Group picker (captured during a live customer build — coming to this page)

Step 6. Keep the default licence type 'Device' for silent install; never add a user-licensed assignment to the same app/group.

Screenshot: Device licensing option selected (captured during a live customer build — coming to this page)

Step 7. Click Save.

Screenshot: Saved assignment showing Required + device licensing + the group (captured during a live customer build — coming to this page)

See it on a real device.

Decolla is in private build — early-access members see a build defined, deployed and rolled back first.

Get early access