How to update IOS apps installed with Configurator2 VPP

Question

We started with Sophos MDM, but i can't find where i'm going wrong. How i work: We have Apple Configurator2, connected with an Apple VPP account. In a blueprint I push some apps like SMC and the iPad is showing up connected and managed in SMC (cloud version). From there I can run further tasks eand profiles. It seems all OK. 
 The users can make there own iTunes account in de the iPad to install apps of there own liking. But now some of the apps i installed with Configurator (also the SMC app itself) asking for updates on the iPad. I can klik "update" but then an pop-up appears to log in at iTunes. 
 But the app is installed via Configurator under VPP licence! So how to update these apps over the air? Asking them to come back to the office and update thru configurator is not an option.

Andrew Mullins · Accepted Answer

the apps thats installed via the vpp account on configurator2 will be associated with the vpp apple account so will require updating using that account, however i have not tested this but i would suggest you add the VPP account into SMC, import the vpp apps into SMC and then push out the apps to the devices from SMC, SMC should take over management of the app and update to the latest version.

Andrew Mullins · Answer

we use configuator2 to add config that SMC cant but we dont link configuartor2 to our VPP, configuator2 is good only in my opinion to build devices for a specific need as it is not over the air. 
 why not use DEP to auto enrol all apple devices? it installs SMC app via the VPP account, when you take the device out of the box and boot it it goes through your config options and install apps via the VPP account, installs your configurations profiles etc etc etc, you can automate everything. devices can in essence be delivered direct to the end users and have zero touch from IT, you can also ensure that replaceddevices stay within your organisation (not handed to an employee son for games) as they device can only be setup when via a valid employee user account. 
 
 smc does not auto update no which is good and bad, good because you can ensure app are on the same version but bad as if you have no patch management apps can become outdated.

Andrew Mullins · Answer

nope we dont. historically our IT have setup the device for users so they created an applie ID for the users using our corporate email address. 
 since putting dep into action this is done no more, everything is automated. DEP makes everything very easy, we have about 2500 devices, all new devices are auto enrolled and have automated setup when taken out of the box. all old devices currently on smc are also added to DEP so as soon as they are hard reset the device will boot into DEP setup and cannot be bypassed. 
 if DEP is setup correctly an end user account bypass the setup, they cannot remove management and if they hard rest the device it will reboot back into the DEP setup and force them to enroll again within SMC.