Forum Discussion
Handling of auto-updates on iOS and Android devices
Hi NielsScheffers , I'm jumping in 😉
onax_pf Let me see if I understand your question:
- you want to install and update apps automatically on supervised iOS devices
- you want to block (certain) apps from installing or from being used.
Hopefully this will clear things up a bit. I'm only talking about iOS, since I believe your Android devices do update.
VPP/ABM=Apple Business ManagerVPP does not mean you'll have to buy licenses (spend money) for every app you sync through VPP. You can acquire both free and paid apps that are available in the App Store.
When dealing with free apps, it looks like you are buying licenses in VPP, but the costs will be $0.00. I know this can be confusing. Finally when you assign the apps to user/devices with a device license. The apps (assigned with license type "device licensing") will automatically update.However, when you select "user licensing" for "license type" the apps store should not be blocked. Otherwise, apps will not update. Users need access to the app store to update.
For more info on VPP check out:
https://docs.microsoft.com/en-us/mem/intune/apps/vpp-apps-ios
Have a look at the table "How are purchased apps licensed?" as it also provides info on updates.
App store
Apps that are installed from the store should update automatically (provided the store is available). You can only assign free apps using this method.
Like NielsScheffers mentioned, you should hide the store app, not block it. When you block the store app, your users have no option to update apps. In this case, you should use VPP.
https://docs.microsoft.com/en-us/mem/intune/apps/apps-add
https://docs.microsoft.com/en-us/mem/intune/apps/store-apps-ios
https://docs.microsoft.com/en-us/mem/intune/apps/apps-deployRestricting apps
As far as I know, there is no easy way to block apps from being installed to iOS devices when users have access to the app store.
Create a Device configuration profile and configure restricted apps to stay informed about apps install status. It's a reporting feature and does not block app installs! You could use "Restricted apps" from within a compliance policy to mark devices non compliant when a certain app is installed, and block access to M365 using a conditional access policy.What you could do:
- Use VPP/ABM and block access to the app store. Assign the apps with a device license to enable automatic updates for apps.
- Use VPP/ABM- Setup federation between AAD and ABM and have users sign-in with their business accounts to the app store (this way you don't have to block the app store)
- Continue to deploy apps using the app store, and hide the app store instead of blocking it.
If you ask me, option 1 is the best way to go, but that's just my opinion.
Hope this helps.
We do not have VPP because we are not using any purchased apps.
"Granted, 'available' apps should be able to auto update in VPP as well.." - You mean VPP should work if we set it up with non-purchased apps and are able to control app updates? Can we also set it to "manual" or "approve"?
In your opinion, what is best way to implement iOS devices in Intune for our setup (control app updates)? Currently, we set devices up with apple configurator (which is horrible). If we later update some configuration settings in Intune, these are not applied onto the devices.
Hi NielsScheffers , I'm jumping in 😉
onax_pf Let me see if I understand your question:
- you want to install and update apps automatically on supervised iOS devices
- you want to block (certain) apps from installing or from being used.
Hopefully this will clear things up a bit. I'm only talking about iOS, since I believe your Android devices do update.
VPP/ABM=Apple Business Manager
VPP does not mean you'll have to buy licenses (spend money) for every app you sync through VPP. You can acquire both free and paid apps that are available in the App Store.
When dealing with free apps, it looks like you are buying licenses in VPP, but the costs will be $0.00. I know this can be confusing. Finally when you assign the apps to user/devices with a device license. The apps (assigned with license type "device licensing") will automatically update.
However, when you select "user licensing" for "license type" the apps store should not be blocked. Otherwise, apps will not update. Users need access to the app store to update.
For more info on VPP check out:
https://docs.microsoft.com/en-us/mem/intune/apps/vpp-apps-ios
Have a look at the table "How are purchased apps licensed?" as it also provides info on updates.
App store
Apps that are installed from the store should update automatically (provided the store is available). You can only assign free apps using this method.
Like NielsScheffers mentioned, you should hide the store app, not block it. When you block the store app, your users have no option to update apps. In this case, you should use VPP.
https://docs.microsoft.com/en-us/mem/intune/apps/apps-add
https://docs.microsoft.com/en-us/mem/intune/apps/store-apps-ios
https://docs.microsoft.com/en-us/mem/intune/apps/apps-deploy
Restricting apps
As far as I know, there is no easy way to block apps from being installed to iOS devices when users have access to the app store.
Create a Device configuration profile and configure restricted apps to stay informed about apps install status. It's a reporting feature and does not block app installs! You could use "Restricted apps" from within a compliance policy to mark devices non compliant when a certain app is installed, and block access to M365 using a conditional access policy.
What you could do:
- Use VPP/ABM and block access to the app store. Assign the apps with a device license to enable automatic updates for apps.
- Use VPP/ABM- Setup federation between AAD and ABM and have users sign-in with their business accounts to the app store (this way you don't have to block the app store)
- Continue to deploy apps using the app store, and hide the app store instead of blocking it.
If you ask me, option 1 is the best way to go, but that's just my opinion.
Hope this helps.
- Same . . . so what I am gonna try is a separate assignment to restrict app updates for a specific group of people (VIPS). Anyone had success with this approach yet?
Dear Oktay Sari , Dear All,
maybe the answer to my question is written in what you just discussed, but I could not decode it from the threads.
I have a company-supervised iPhone with Office 365 mobile apps installed. Outlook is my key e-mail and calendar client. I am frustrated by automated updates of Outlook and Teams mobile apps, because they start in a very uncompromising fashion without prior notification (e.g. a badge on the Appstore icon) and deactivate the app. Sod's laws ensure that this happens always at the least convenient time, when I need to use the app (working in automotive, busy job).
Is there a way how to control the installation time of the updates?
I asked our company IT and they keep saying they cannot do anything about it, that Apple is doing this and they cannot influence it. I am struggling to believe them, though.
Thank you.
- your welcome onax_pf
Oktay SariWhat an incredible reply of yours, I do understand the handling much better now!
Thanks for the help of you and NielsScheffers!
Cheers
Well, I can't think of anything more to add to Oktay Sari's reply. Thanks for the extensive write-up, mate!
