"He had been preparing (the shooting) for a year," Bavarian police chief Robert Heimberger told a news conference.
David Sonboly, 18, who had a Glock pistol and more than 300 bullets, killed himself after the attack.
The Bavarian State Crime Office said he had bought the illegal pistol used in the attack on the internet.
Vigils continue in Munich to commemorate the victims, seven of whom were teenagers.
A further 35 people were injured.
Heimberger, head of Bavaria's criminal police, also said that the victims of the attack had not been specifically targeted and were not classmates of the gunman.
Heimberger said the killer had paid a visit last year to the town of Winnenden - the scene of a previous school shooting in 2009 - and taken photographs.
He said it was likely the Glock pistol was bought on the "dark net" market, most likely from Slovakia.
The news conference was also told that Sonboly had spent two months as an inpatient at a mental care facility in 2015 and was afterwards treated as an outpatient.
Thomas Steinkraus-Koch, spokesman for the Munich prosecutor's office, told the briefing there was no evidence of any political motivation.