Introduction
Managing Apple devices in Microsoft Intune requires maintaining active integrations with Apple services. To ensure continued functionality, administrators must periodically renew three key components:
- Apple MDM Push Certificate – Enables communication between Intune and Apple devices.
- Apple Volume Purchase Program (VPP) Token – Supports the deployment of purchased apps from Apple Business/School Manager.
- Apple Enrollment Program Token (DEP Token) – Facilitates automated device enrollment via Apple Business/School Manager.
Failure to renew these components before they expire can disrupt device management and app deployment. This guide provides a step-by-step approach to renewing each item in Microsoft Intune.
Please read some of my earlier articles on how to setup the connection between Apple Business Manager and Microsoft Intune:
Setting up Apple Business Manager for use with Azure Active Directory – Modern Workplace Blog
Connecting Microsoft Endpoint Manager to Apple Business Manager – Modern Workplace Blog
Renewing the Apple MDM Push Certificate
Prerequisites
- Access to the Apple ID used to create the existing MDM Push Certificate.
- Administrator permissions in Microsoft Intune.
Steps
- Sign in to Microsoft Intune admin center (https://intune.microsoft.com/).
- Navigate to Devices > iOS/iPadOS > Enrollment.
- Select Apple MDM Push Certificate.
- Click Renew Certificate and download the Intune Certificate Signing Request (CSR).
- Open a new tab and go to the Apple Push Certificates Portal (https://identity.apple.com/pushcert/).
- Sign in with the Apple ID originally used to create the certificate.
- Locate the existing certificate and click Renew.
- Upload the CSR file downloaded from Intune.
- Download the renewed certificate from Apple.
- Return to Intune and upload the new certificate.
- Click Save to complete the renewal process.
Renewing the Apple Volume Purchase Program (VPP) Token
Prerequisites
- Administrator access to Apple Business/School Manager.
- Microsoft Intune admin rights.
Steps
- Log in to Apple Business/School Manager (https://business.apple.com/ or https://school.apple.com/).
- Navigate to Settings > Apps and Books.
- Find the Server Token associated with Intune and click Download.
- Sign in to Microsoft Intune admin center.
- Navigate to Tenant Administration > Connectors and Tokens > Apple VPP Tokens
- Click on the existing VPP token entry.
- Click Renew Token and upload the new VPP Server Token file
- Click Save to confirm the changes.
Renewing the Apple Enrollment Program (DEP) Token
Prerequisites
- Administrator access to Apple Business/School Manager.
- Microsoft Intune admin rights.
Steps
- Log in to Apple Business/School Manager.
- Navigate to Settings > Device Management Settings.
- Locate the MDM Server associated with Microsoft Intune.
- Click Download MDM Server Token
- Sign in to Microsoft Intune admin center.
- Navigate to Tenant Administration > Apple Enrollment > Enrollment Program Tokens.
- Click the existing DEP token entry.
- Click Renew Token and upload the newly downloaded DEP Token from Apple.
- Click Save to complete the renewal.
Summary
Renewing the Apple MDM Push Certificate, VPP Token, and DEP Token is crucial to ensure seamless Apple device management in Microsoft Intune. Regularly monitoring their expiration dates and setting reminders for renewal helps avoid disruptions. By following this guide, administrators can efficiently maintain these integrations and ensure uninterrupted device enrollment, management, and app distribution.