Forum Discussion
Intune and iOS App Deployment
You cannot deploy vpp apps based on device assignment within the silverlight portal, this has changed in the Azure portal and you can assign vpp apps based on device, it wont even require an Apple ID on the device so minimises user interaction to get a new app.
I have found using the silverlight portal when assigning a VPP app I need to have an apple ID set up on the device app store.
- if there isnt an apple id setup it will prompt you to login and accept vpp terms and conditions.
- if the app store is blocked by policy and there is not apple id on the device then the app wont install and you probably wont see any pop ups or prompts.
- if there is an apple id on the device, and the app deployed to a user it will install in the background.
I would suggest waiting till you have access to the Azure portal and assign apps based on device or user as it works so seamless and i have set it up and got it working great.
I would also suggest having all iOS devices as DEP or supervised even if you dot use any supervisibn permissions, it adds scope and there are some very restriction permissions for supervised devices that come in use.
Happy to help out with questions :)
Thanks for the reply, John. That's pretty much what I had assumed. I think what was throwing me off is it appears that we have the Azure Intune portal, but looking at things closer it's only in part. For example: While, our Intune groups have moved to over to Azure (as expected), the Intune Service Admin can't create any new groups (like he should be able to). Likewise, the several other features in the Azure Intune Portal (which is still listed as preview) don't appear to be fully functional.
I get this screen when trying to access Apple Enrollment, Device Enrollment Managers, and on the Mobile Apps blade, iOS VPP Tokens is grayed out so I can't configure it.
So, now that I know that I'm still in preview, I get why I'm seeing what I'm seeing with the notable exception of the group creation. I still don't understand why -- once the groups were moved to Azure -- the Intune Service Admin wouldn't be permissioned to be able to create groups like they are supposed to be able to do. We can work around this, of course, but it's adding a step to the process that doesn't need to be there.
Thanks for the input.
it sounds liek your group service has been migrated and is now managed by teh Azure portal which could be why there are issues creatign groups as they nee to be created in Azure portal and suitable RBAC set up for permissions.