How to auto-install the Intune Company Portal on ADE iPhones with VPP

Why use VPP

Without VPP, users end up installing the Intune Company Portal themselves from the App Store. And when they do, they're prompted for an Apple ID and password.

Making people type a personal Apple ID into a corporate-owned device is something you want to avoid, both operationally and from an information management standpoint.

Once you connect VPP (a content token), that prompt goes away. The Intune Company Portal can be installed automatically while the device is still going through initial setup.

Overall workflow

Three conditions to meet before you download the token

① An organizational unit (formerly "Location") has to exist

There is one content token per organizational unit. When you sign up for ABM, the first organizational unit is created automatically and reflects your organization name, so normally you already have one.

If you want to split app licenses by site or department, open ABM and go to Settings → Organizational Units → Add.

② You have to sign in with an account that's allowed to download the token

To download a content token, you need to be signed in with a role that has permission to get licenses for apps and books. Administrator, Content Manager, or Device Enrollment Manager roles qualify.

🚨 If you change the password of the Managed Apple Account used to download the token, the content token becomes invalid.

There are exactly two conditions that invalidate a content token:

1. One year after it's created
2. When the password is changed for the Managed Apple Account used to download the existing token

Once it's invalid, app and book license communication between ABM and Intune stops. If you run this on an individual admin's account, app distribution breaks every time that person changes their password or leaves the company.

To avoid an interruption of service, Apple recommends that you manually create a Managed Apple Account, create a custom role, and assign it only the "Assign licenses for Apps and Books" permission — and use that account to download and manage content tokens.

③ You have to get at least one app license

Microsoft's documentation lists "App licenses assigned to one or more location tokens" explicitly as a prerequisite.

With zero licenses, choosing "Install Company Portal with VPP" in the enrollment profile won't actually distribute anything. Here's how to get the licenses.

[Step 2] Get Intune Company Portal licenses in ABM

1. In ABM, open Apps and Services → Apps and Books from the top of the screen
2. Search for Intune Company Portal
3. Specify the organizational unit to assign to and the quantity, then get the licenses
4. Getting more than the number of devices you expect saves you from scrambling later when you add devices

It's a free app, so there's no cost.

💡 Why "get extra" is more than a nice-to-have

Microsoft's documentation warns that devices are blocked from enrolling if there aren't enough Company Portal licenses for a VPP token, or if the token expires. Intune does alert you when a token is about to expire or licenses are running low, but running your license count to the edge is a bad place to be.

[Step 3] Download the content token in ABM

1. Sign in to ABM as a user whose role has permission to get licenses for apps and books
2. Open Settings from your account name / organization name in the upper right
3. Select Payments & Billing
4. On the Apps and Books tab, select Download next to the relevant organizational unit
5. You get a file named something like sToken for xxxxxxxxxxxx.vpptoken

💡 ABM's UI labels keep getting revised.

Depending on which document you're reading, you'll see "Preferences" vs "Settings", and "Location" vs "Organizational Unit". They all point at the same place. Remember it as settings-type menu → Payments & Billing → Apps and Books / Content Tokens and you won't get lost.

[Step 4] Create the VPP token in Intune

1. Microsoft Intune admin center → Tenant administration
2. Connectors and tokens → Apple VPP tokens → Create
3. On the Basics page, enter the following

1. On the Settings page, configure the following

1. Select I grant Microsoft permission to send both user and device information to Apple
2. Add scope tags if you need them → Next
3. Review + create → Create

💡 About MDM vs. DDM for "Management type"

• MDM (default): the traditional management method. Choose this if you have any devices running versions earlier than iOS/iPadOS 18
• DDM (Declarative Device Management): Apple's policy-based management model, available on iOS/iPadOS 18 and later. It gives you efficient app delivery and real-time app status reporting

Note, though, that DDM doesn't yet support "Available" app assignments (as of September 2026). If you choose DDM, VPP apps can only be assigned as Required or Uninstall. If you have apps you want users to install on demand from the Company Portal, choose MDM.

[Step 5] Update the enrollment profile to enable VPP distribution

Edit the enrollment profile you created in Part 1.

1. Intune admin center → Devices → Device onboarding → Enrollment → Apple → Enrollment program tokens
2. Select your token → Profiles → select the target profile → edit it from Properties

Change the settings as follows.

⚠️ If the "token to use" dropdown is empty, it's one of these:

• The token hasn't synced with Apple yet (run a manual sync)
• You have no free Company Portal licenses left (go back to Step 2 and get some)

Step 6 Force users to authenticate

After initial setup finishes, if the user never authenticates in the Company Portal, ownership doesn't flip to "Corporate" and the primary user stays empty.

If you want to guarantee that they authenticate, configure this in the enrollment profile.

With this turned on, the Company Portal launches automatically once initial setup completes, and the user can't touch any other app until they finish authenticating. It's the setting to use when you want to eliminate people who never get around to signing in.

What to check

1. The moment setup completes and you land on the home screen, the Intune Company Portal is already installed
2. You were never prompted for an Apple ID during the install
3. Once you finish signing in to the Intune Company Portal, ownership becomes "Corporate"
4. The account you signed in with shows up as the primary user

If you set Step 6 to Yes, the Intune Company Portal launches automatically after setup completes, and no other app is usable until authentication is done.

References

• Manage Apple Volume-Purchased Apps - Microsoft Learn
• Set up automated device enrollment for iOS/iPadOS - Microsoft Learn
• Tutorial - Use Apple Business to enroll iOS/iPadOS devices in Intune - Microsoft Learn
• Manage content tokens in Apple Business - Apple Support
• Configure organizational units in Apple Business - Apple Support