A password change on one admin account invalidates the Apple VPP token Intune depends on

An App Store install needs a license source. Without a content token connected, that source is the user's own Apple ID, so the App Store asks for one ^[1]. With a token in place the licenses come from Apple Business Manager, and Intune can put Company Portal on the phone while it is still walking through initial setup ^[2]. The dev.to walkthrough is direct about why that matters: making users type a personal Apple ID into a corporate-owned device "is something you want to avoid, both operationally and from an information management standpoint," the author wrote ^[3].

The token is an account-level credential. It is downloaded by an account, and it carries that account's password with it. Any role with permission to get licenses for apps and books can pull one, which covers Administrator, Content Manager and Device Enrollment Manager ^[8]. Change that account's password and the token is invalid ^[4]. The other invalidation is time, one year after creation ^[4].

When the token goes invalid, app and book license communication between ABM and Intune stops ^[5]. Download it on your own account and distribution breaks the next time you rotate your password or leave ^[6]. Apple's recommendation is a manually created Managed Apple Account with a custom role holding only the "Assign licenses for Apps and Books" permission, used for nothing but downloading and managing content tokens ^[7]. I would stand up that separate identity in any tenant with more than one admin.

Licenses have to be assigned before the token delivers anything. Microsoft's documentation lists "App licenses assigned to one or more location tokens" as a prerequisite ^[9], and with zero licenses the Install Company Portal with VPP option in the enrollment profile delivers no app ^[10]. A short count fails differently: Microsoft warns that devices are blocked from enrolling when there are not enough Company Portal licenses for a token, or when the token has expired ^[11]. Intune does raise an alert for an impending expiry and for low license counts ^[12]. Company Portal is free, so the quantity requested in ABM costs nothing ^[13].

There is one content token per organizational unit, and ABM creates the first one at signup under your organization name ^[14]. Splitting licenses by site or department is a menu item, Settings then Organizational Units then Add ^[15]. Each split also adds a token: four organizational units means four tokens with four expiry dates, each tied to an account whose password has to hold ^[1].

The download path is Settings under your account name, then Payments and Billing, then the Apps and Books tab, then Download beside the organizational unit, and the file arrives named like sToken for xxxxxxxxxxxx.vpptoken ^[16]. Apple keeps revising the labels, so depending on which document you have open it is Preferences or Settings, Location or Organizational Unit ^[17].

In Intune the token is created under Tenant administration, Connectors and tokens, Apple VPP tokens, and creation requires granting Microsoft permission to send both user and device information to Apple ^[18]. Management type on the same page defaults to MDM, which is what you need if any device in the fleet runs earlier than iOS or iPadOS 18 ^[19]. DDM requires 18 or later and, according to the post, gives more efficient app delivery and real-time app status reporting ^[20]. As of September 2026 DDM does not support Available assignments, so VPP apps can only be set Required or Uninstall ^[21]. The post's advice for anyone who wants users installing on demand from Company Portal is to choose MDM ^[22].