From 00d30f28a0f2adcdbead7d99c4c6fbcdbd55c684 Mon Sep 17 00:00:00 2001
From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Date: Tue, 5 May 2026 17:19:56 -0400
Subject: [PATCH] Add "International companies" to best practice list (#44749)

- Also add example for "Umbrella companies"
---
 articles/apple-mdm-setup.md | 39 ++++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/articles/apple-mdm-setup.md b/articles/apple-mdm-setup.md
index 46ed68e040..17d1cd291d 100644
--- a/articles/apple-mdm-setup.md
+++ b/articles/apple-mdm-setup.md
@@ -130,11 +130,14 @@ Most organizations only need one AB token and one VPP token to manage their macO
 
 These organizations may need multiple AB and VPP tokens:
 
-- Managed Service Providers (MSPs)
-- Enterprises that acquire new businesses and as a result inherit new hosts
-- Umbrella organizations that preside over entities with separated purchasing authority (i.e. a hospital or university)
+- [Managed Service Providers (MSPs)](#msps)
+- [Enterprises that acquire](#enterprises-that-acquire) new businesses and as a result inherit new hosts
+- [Umbrella organizations](#umbrella-organizations) that preside over entities with separated purchasing authority (i.e. a hospital or university)
+- [International organizations](#international-organizations) that manage hosts across multiple countries
 
-For **MSPs**, the best practice is to have one AB and VPP connection per client.
+### MSPs
+
+For MSPs, the best practice is to have one AB and VPP connection per client.
 
 The default fleets for each client's AB token will look like this:
 - macOS: 💻 Client A - Workstations
@@ -143,7 +146,9 @@ The default fleets for each client's AB token will look like this:
 
 Client A's VPP token will be assigned to the above fleets.
 
-For **enterprises that acquire**, the best practice is to add a new AB and VPP connection for each acquisition.
+### Enterprises that acquire
+
+For enterprises that acquire, the best practice is to add a new AB and VPP connection for each acquisition.
 
 These will be the default fleets:
 
@@ -161,6 +166,30 @@ Acquisition AB token:
 
 The acquisitions's VPP token will be assigned to the above fleets.
 
+### Umbrella organizations
+
+For umbrella organizations (e.g., a hospital system or university) where each entity has its own purchasing authority, the best practice is to have one AB and VPP connection per entity.
+
+The default fleets for each entity's AB token will look like this:
+- macOS: 💻 Entity A - Workstations
+- iOS: 📱🏢 Entity A - Company-owned iPhones
+- iPadOS: 🔳🏢 Entity A - Company-owned iPads
+
+Entity A's VPP token will be assigned to the above fleets.
+
+### International organizations
+
+> Support for Apple App Store (VPP) apps from non-US stores is [coming soon](https://github.com/fleetdm/fleet/issues/43846).
+
+For international organizations that manage hosts across multiple countries, the best practice is to have one AB and VPP connection per country. Apple Business and VPP tokens are tied to a specific country or region.
+
+The default fleets for each country's AB token will look like this:
+- macOS: 💻 Country A - Workstations
+- iOS: 📱🏢 Country A - Company-owned iPhones
+- iPadOS: 🔳🏢 Country A - Company-owned iPads
+
+Each country's VPP token will be assigned to the above fleets.
+
 ## Simple Certificate Enrollment Protocol (SCEP)
 
 Fleet uses SCEP certificates (1 year expiry) to authenticate the requests hosts make to Fleet. Fleet