Catch Expiring Apple MDM Certificates Before Your Devices Do ​

October 5, 2026 · InfraScout Team

Intune manages Apple devices through three credentials that Apple issues for one year at a time. The most important is the Apple MDM push certificate. Once it expires, Intune can no longer reach the devices enrolled with it. Apple then gives you 30 days to renew it with the same Apple ID. Miss that window, and you have to create a new certificate. A new certificate means re-enrolling every iPhone, iPad and Mac in the tenant. Renewing on time is routine, and re-enrolling a fleet is not, so the only hard part is remembering to renew. You can now ask InfraScout instead:

text
Check the Apple MDM certificates and tokens in this tenant. Which ones
expire in the next 60 days, and is anything failing to sync?

Three Credentials, One Answer ​

The new tool, mscloud_intune_get_apple_token_health, reads all three in one call and reports each one separately:

  • Apple MDM push certificate (APNs). It shows the Apple ID that owns the certificate and when it expires. That Apple ID is the one you must use to renew. If someone else renews with a different ID, you are back to re-enrolling.
  • Volume Purchase Program (VPP) tokens. For each token, it shows the organization, the Apple ID, the expiry date, the token state and the result of the last sync. An expired VPP token stops apps and licenses bought through Apple Business Manager from syncing to Intune.
  • Automated Device Enrollment (ADE) tokens. For each token, it shows the token name, the Apple ID, the expiry date, the last successful sync and any sync error. An expired ADE token means new devices from Apple Business Manager stop appearing in Intune.

Every item comes with the number of days until it expires and a clear flag once it has expired, so the AI can rank what needs attention first. When Intune itself does not report an item's expiry date, both are left out rather than guessed. A credential you don't use is reported as not configured, never as a failure. A tenant without Macs or VPP gets a clean answer, not a list of errors.

Each section stands on its own. If one of them can't be read, for example because a permission is missing, the other two still answer, and the failed section says exactly what went wrong. The AI therefore never reports a partial check as a healthy tenant.

Read-Only, and No Secrets in the Output ​

The tool only reads expiry and sync details. It never returns the certificate itself or the VPP token value, even though Microsoft stores both in the same place. Results are kept in the execution history like every other tool call, so you can come back to them later without worrying about what the record contains. Renewal still happens in the Intune admin center and the Apple portals, and the AI can walk you through it.

What an Administrator Grants Once ​

The push certificate and the ADE tokens need the Microsoft Graph application permission DeviceManagementServiceConfig.Read.All. The VPP section also works with the Intune app permission your connection already holds.

New tenants get the permission automatically: the onboarding script now grants it by default. For an existing tenant, re-run the onboarding script in Extend mode. It adds only the missing permission and leaves your client secret alone. Then press Test connection on the connector. Until then, the connection's capability panel lists Apple MDM tokens as not granted. In chat, the push certificate and ADE sections name the missing permission, and the VPP section answers as usual.

Try It ​

Ask for the Apple token check at the start of an Intune review, or before an Apple Business Manager change. Better still, make it part of a scheduled workflow, so an expiry 60 days out reaches you while renewal is still routine. The Microsoft Intune tools reference lists the full toolset. Connecting Entra ID covers the onboarding script and every permission it grants.

Questions or feedback? Reach us at info@infrascout.cloud.