Device-Based Volume Purchase Program is a device licensing and app distribution model used to assign purchased apps or books to managed Apple devices rather than to a specific user account. It is typically used with mobile device management so entitlement stays on the device for shared or kiosk use, but licence assignment and revocation remain centrally controlled.
How the Device-Based Volume Purchase Program Works
This licensing model lets organisations buy apps or books once and assign them to managed Apple devices instead of tying entitlement to a named user. That makes it well suited to shared iPads, kiosk fleets, and other device-centric deployments where the hardware, not the person, is the control point for distribution.
Because assignment is device-based, the operational question is not “who owns the app” but “which managed device is entitled to it right now.” That distinction matters when devices are reimaged, reassigned, or removed from management, because entitlement follows the device lifecycle and the organisation’s control over that lifecycle.
Why It Matters for Shared and Managed Devices
Device-based licensing reduces friction in environments where multiple people use the same hardware, or where end users should not receive app access through their personal account. It also supports tighter control over distribution, since the MDM layer becomes the mechanism for pushing, maintaining, and withdrawing entitlement.
The model is most useful when the device is the stable asset and the user is transient. In practice, that often includes frontline endpoints, classroom devices, retail kiosks, and task-specific tablets where consistent app availability is more important than per-user portability.
How Licensing, Distribution, and Revocation Interact
The value of this model comes from separating acquisition from end-user identity. An administrator can assign a licence centrally, deploy the app through managed channels, and revoke access when the device leaves the fleet, is retired, or no longer meets policy requirements.
That same separation introduces a governance requirement: the organisation needs reliable inventory, device ownership records, and a clear process for reassignment. If a device is not accurately tracked, entitlement can persist longer than intended or be lost when the device changes state.
Common Operational Dependencies and Limits
Device-based volume purchasing depends on MDM integration, supervised or otherwise managed endpoints, and a clean distinction between corporate and personal devices. It is not a substitute for broader application governance, content lifecycle management, or endpoint compliance.
It also works best where apps can function without a per-user purchase relationship. If workflows require personal portability, user-specific settings, or cross-device continuity tied to an individual account, a device-only model can create usability gaps and support overhead.
Risk and Threat Considerations
Device-based entitlement is only as strong as the organisation’s control over the device estate. If an endpoint is lost, repurposed, rooted, or removed from management without proper revocation, purchased content can remain accessible longer than intended or be reassigned incorrectly.
Failure mechanism: Weak inventory, unmanaged reassignment, or delayed deprovisioning can let app or book entitlement outlive the intended device lifecycle. A related control weakness is treating device ownership as static when in reality the endpoint may change hands, posture, or trust status.
Impact: The result can be unauthorised access to purchased content, licence leakage, poor auditability, and inconsistent enforcement across a shared-device fleet. In regulated or high-control environments, that can also undermine confidence in endpoint governance and asset accountability.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Covers governed assignment and revocation of access to managed endpoints. |
| Recommendation — Tie device entitlements to managed device identity and revoke access when ownership or trust changes. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | Supports lifecycle control over assigned access and timely revocation. |
| Recommendation — Track entitlement assignment and remove access when devices are retired or reassigned. | ||
| ISO/IEC 27001:2022 | A.5.9 — Inventory of information and other associated assets | Requires asset inventory discipline that underpins device-based entitlement control. |
| Recommendation — Maintain an accurate device inventory before assigning and revoking purchased content. | ||
Practitioner Guidance
Governance implication: Treat device-based purchasing as part of endpoint and software asset governance, not just as a procurement choice. The key decision is whether the organisation can reliably tie entitlement to managed device state and revoke it when that state changes.
What to watch for: Review how often devices are reassigned, whether unmanaged endpoints appear in the fleet, and whether app entitlement is removed promptly during offboarding, retirement, or policy violations. If those steps are manual or inconsistent, the model will be harder to control at scale.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org