Pushing certificates to iPads and fixing iTunes sign-in prompts in HexnodeSolved

Hello @luuk ,

Yes, certificates can be deployed to iPads using Hexnode policies.

To add a certificate for iOS devices:

1. Go to Policies.
2. Create a new policy or edit an existing one.
3. Navigate to iOS > Security > Certificates.
4. Upload the required certificate.
5. Associate the policy with the target iPads.

For the iTunes or Apple ID sign-in prompt, this is commonly seen when an app is assigned as a standard App Store app instead of a VPP app. Standard App Store apps require an Apple ID to associate the app license with the user.

To avoid this, deploy apps through Apple VPP. VPP app deployment allows apps to be installed silently on supervised iPads without asking users to sign in with an Apple ID, provided the app has valid VPP licenses and the VPP token is active.

Regards,
Simon Scott
Hexnode UEM

In our case, almost all apps are VPP apps, so I’ll need to find the one that isn’t. If everything looks like it’s VPP, what else should I check?

If most apps are already deployed through VPP, check these three areas:

1. Store apps added to Required Apps without VPP licenses

Go to Apps, search for the app, and filter by VPP and iOS. Confirm that the app has available VPP licenses and that the assigned app entry is the VPP version, not the standard App Store version.

2. Apple system apps added under Required Apps

Go to Policies > select the associated policy > iOS > App Management > Required Apps.

Check whether native Apple apps such as Mail, Safari, or other pre-installed system apps have been added there. These apps usually have bundle IDs starting with com.apple. Since they are already present on iOS, adding them as required apps is unnecessary and can cause app installation commands to remain pending. In some cases, it may also trigger a “Continue with iTunes” or Apple ID-related prompt on the device.

If such system apps are listed, remove them from Required Apps unless there is a specific need to manage them there.

3. Expired or unsynced VPP token

Go to Admin > Apple Business/School Manager > Apple VPP and sync the VPP token. After syncing, perform a device scan so the app installation status is refreshed.

If the token shows as expired or fails to sync, renew the VPP token first, then sync and scan the affected devices again. App deployment depends on a valid VPP token, so expired tokens can cause app install commands to fail or behave unexpectedly.