Testing the VPP token returns "This token is not managed by ZENworks or any other MDM provider. You need to use a different VPP token for this subscription."

  • 7025093
  • 30-Apr-2021
  • 06-May-2021


ZENworks Configuration Management 2020


The VPP token for managing iOS applications had been previously set up and working properly. Then, even though the VPP token is valid and not expired, testing the token or attempting to run the Subscription returns the error:
"This token is not managed by ZENworks or any other MDM provider. You need to use a different VPP token for this subscription."

While in this state, VPP apps cannot be updated in ZCC or distributed to mobile devices.


Contact ZENworks Customer Support for assistance running the following.

Postman software is needed for this solution. This can be downloaded here:

Using the Postman software, run a GET command of:

The body of the get command is in the following format:
    "sToken": "eyJleHBEYXRlIjoiMjAyMi0wNC0yM1QxMDo1MzoyMSswMDAwIiwidG9rZW4iOiI0R0RoMWx3OThlSHVzTGlSWklpVjFQUGhteXd

The token string is replaced by the VPP token string from your environment. You can get this string by opening the VPP token itself in a notepad file.

This returns information about the token.  When seeing this issue, the "ClientContext" string is missing and that is where this issue lies, that string is required for the token to work with the ZCM server.

If the highlighted section is missing, a POST command is required to replace it.

POST: https://vpp.itunes.apple.com/mdm/VPPClientConfigSrv

BODY of the post command would be:
    "clientContext": "{\"guid\":\"86c036e98165d1103df3cda9c0ed612e\",\"hostname\":\"burg-zcm01\"}",
    "sToken": "eyJleHBEYXRlIjoiMjAyMi0wNC0yM1QxMDo1MzoyMSswMDAwIiwidG9rZW4iOiI0R0RoMWx3OThlSHVzTGlSWklpVjFQUGhteXdO

In the body, replace the 3 highlighted pieces of information with the following.
  1. Replace the guid with the zone UID of the ZENworks server. This information can be gathered by running "select * from zzone" against the ZENworks database.
  2. Replace hostname with the hostname of the MDM primary.
  3. Replace stoken with the stoken of the VPP token in use in your environment.  This is the same stoken that was run in the GET command.

Once the POST command is run with the information above, the ClientContext is replaced and the VPP token should now update successfully.


Development is investigating the root cause that could lead to this situation.


Reported to Engineering