- Platforms
- iOSiPadOSmacOS
- Products
- Intune
- Result
- The Apple MDM push certificate is active for another 365 days, with no impact on enrolled devices
Overview
Renew the yearly Apple MDM push certificate in Microsoft Intune before it expires, so your iPhones, iPads and Macs stay managed without enrolling again.
The Apple MDM push certificate (APNs certificate) lets Microsoft Intune, or any other MDM server, talk to enrolled iPhones, iPads and Macs. It is valid for 365 days and must be renewed every year. When it expires, Intune can no longer manage your Apple devices; Microsoft gives you a 30-day grace period to renew it (see Renew Apple MDM push certificate).
Renewal works like the first setup: you download a new certificate signing request (CSR) from Intune, upload it in the Apple Push Certificates Portal, and upload the new .pem file back to Intune. The important part is to renew the existing certificate with the same Apple Account that created it. If you create a new certificate instead, all Apple devices must enroll again.
My certificate was about to expire in September 2021, so I took screenshots of the renewal in Intune.
Prerequisites
Before you start, check that you have the following.
| Area | What you need | Docs |
|---|---|---|
| Licence | Microsoft Intune Plan 1 (the certificate is a tenant setting) | Licensing |
| Admin role | Intune Administrator, or an Intune role that can manage Apple enrollment | Roles |
| Intune | An existing Apple MDM push certificate in Intune that is expiring (or expired less than 30 days ago) | Push certificate |
| Vendor | Access to the Apple Push Certificates Portal with the same Apple Account that created the certificate, ideally a company account with a shared mailbox | Apple portalRenewal steps |
Configuration
Renew the existing certificate in four steps, with the same Apple Account.
Check the current certificate in Intune
In the Intune admin center (intune.microsoft.com) the APNS expiry date connector shows the status. In 2021 I found it under Tenant administration > Tenant status > Connector status:
Open the certificate under Devices > Device onboarding > Enrollment > Apple > Apple MDM Push Certificate. The status shows Expiring. Note the Apple ID (Apple Account) used to create the certificate, usually a company account:
Find the certificate in the Apple portal
Sign in to the Apple Push Certificates Portal with the same Apple Account. If there is more than one certificate, compare the Subject ID in Intune with the certificate details in the Apple portal (the i icon), so you renew the right one:
Download the CSR and renew
In Intune select Download your CSR to save IntuneCSR.csr, then select Renew next to the right certificate in the Apple portal:
Choose the CSR file, optionally add a note to recognize the certificate later, and select Upload:
Upload the new certificate to Intune
On the confirmation page select Download to save the new .pem file (for example MDM_ Microsoft Corporation_Certificate.pem). Back in Intune, enter the Apple ID used to create the certificate, select the .pem file and select Upload:
Result
The status changes to Active and the certificate is valid for another 365 days. Renewal is complete when the certificate shows as active in both Intune and the Apple portal. Enrolled devices keep working; users don't need to do anything:
