VPP App Updates for macOS / iOS / tvOS devices

Description

By default, VPP Apps can update automatically whether they were installed from Kiosk or through a standard Deployment. Administrators can also control update timing, pause updates broadly, or hold back specific apps and versions.

Information

By default, with no defined customisation, FileWave will trigger automatic updates of VPP Apps installed on devices.  

At certain times, FileWave Server requests the list of installed applications.  MDM commands to devices may be observed in the 'Command History' tab of a device's information:

At minimum, this occurs during Automatic Verify, normally every 24 hours when the device is online. The following actions can also trigger an inventory or policy evaluation:

• Manual Verify
• Model Update
• Smart Group changes
• Opening Client Info for a device

If an installed App has an update, that App will be flagged.

When an installed app is flagged for an update, FileWave queues an install-application command for that app. The device contacts the App Store and reports the command result to the FileWave Server.

By default, when a device honours a normal VPP update request, it will update to the latest compatible version currently on the App Store.

Starting in FileWave 16.3.x, supported apps installed through DDM can also be controlled per Fileset from the Application update (DDM) setting in the Details tab. Options include Follow Store Settings, Always On, Always Off, and Pin specific version. This means FileWave can now leave a DDM-managed app on its current version, force normal updating, or target a specific App Store version instead of always taking the latest compatible release.

Included in FileWave Anywhere, is the option to determine timings of when VPP App upgrades may take place.  Please view the following KB on this topic:

https://kb.filewave.com/books/apple-school-business-manager/page/vpp-application-upgrade-timing

Managing Updates

There have been instances where disabling auto updates of VPP Apps has been required; due to unexpected behaviour from the App Store.  In such cases, it can be desirable to either block updates completely or block updates per App.

Beyond the timing controls above, you may still need to block updates completely or hold back specific versions. Starting in FileWave 16.3.x, supported DDM-installed apps can do this per Fileset in the UI. The custom settings below remain useful for broader server-side behavior and older workflows.

Overriding this behaviour may be done by adding options within the custom settings:

# macOS/Linux

/usr/local/filewave/django/filewave/settings_custom.py

Options available are:

Key	Description
SELF_HEAL_APPS_BY_VERSION	Enables/disables all VPP App updates
IGNORE_PREINSTALLED_APPS_SELF_HEAL	Block all update attempts for a defined App by Bundle ID (Unmanaged Apps only)
IGNORE_ITUNES_VERSION	Block updates, not only by a defined App Bundle ID, but only blocks defined version numbers

Directions

Each server-side example below edits /usr/local/filewave/django/filewave/settings_custom.py and requires Apache to be restarted. Self-managed customers can make this change on the FileWave Server. Hosted FileWave customers must ask FileWave Technical Support to apply it because they do not have direct server file access. Find required app Bundle IDs and versions in the device's Installed App list.

SELF_HEAL_APPS_BY_VERSION

Add the following line will block all updates of all Apps:

SELF_HEAL_APPS_BY_VERSION = False

To revert this behaviour, either set this as True or remove the entire line.

IGNORE_PREINSTALLED_APPS_SELF_HEAL

This option will only prevent erroneous attempts to update unmanaged Apps, where the device reports an incorrect Bundle ID.  As an unmanaged App, it may not be updated by MDM anyway, but installation errors would be seen in the Command History.

Obtain the Bundle ID of the App, then add the following option. For example, to block iMovie, Pages and Keynote:

settings.IGNORE_PREINSTALLED_APPS_SELF_HEAL = ("com.apple.iMovie", "com.apple.Pages", "com.apple.Keynote")

This is a comma separated list. Add each Bundle ID per App to be blocked for updates.

To revert this behaviour, either remove the Bundle ID no longer required for blocking or remove the entire line.

IGNORE_ITUNES_VERSION

Obtain the Bundle ID and version of the App to be blocked. The settings are set out as:

Each entry maps an app Bundle ID to the App Store version to block and the version currently installed:

'Bundle ID': [(version to block, version currently installed)]

The below example will:

• Keynote - Block version 3.0 from the iTunes Store if device has version 2.7 installed
• iMovie - Block version 10.1.14 from the iTunes Store if device has version 10.1.13 installed
• Pages - Block version 8.2 from the iTunes Store if device has version 8.2 installed

settings.IGNORE_ITUNES_VERSION = {
'com.apple.keynotes': [('3.0', '2.7'),],
'com.apple.iMovie': [('10.1.14', '10.1.13'),],
'com.apple.Pages': [('8.2', '8.2'),],
}

The Pages example prevents an App from continually attempting to update, where the version on the iTunes Store matches that on the device, yet the device is still reporting an update is required. Add or remove entries per item to be blocked.

Taking this one step forward, consider the above Keynote example.  Device has 2.7 installed, but version 3.0 is set to be ignored.  If version 3.1 were to be released, the device would upgrade to this version, if it were the next latest version available on the App Store, after receiving a new InstallApplication command.

To revert the behaviour, either remove the Bundle ID and versions no longer required for blocking or remove this entire code entry.

Do not indent top-level settings. Leading spaces or tabs before an added key can prevent the server configuration from loading correctly. Validate the file before restarting Apache.

Apache should then be restarted:

# macOS/Linux

/usr/local/filewave/apache/bin/apachectl graceful