Helpdesk: new iPhones fail Company Portal enrollment with APNSCertificateNotValid or NoEnrollmentPolicy. Existing iPads still show as compliant but won't take a new config profile. Someone has already opened the Apple Push Certificates Portal and is one click away from Create a Certificate because the current one "looks expired."
Don't create a new certificate yet. Apple device management in Intune rides on one tenant-wide Apple MDM Push certificate (the APNs channel). The chain is: you know you're looking at the MDM push cert, not an ADE/DEP or VPP token → Intune (and Graph) show the real expiry and Apple ID → you understand the blast radius (new enrollments fail; management of enrolled iOS/iPadOS/macOS is disrupted) → you still have the same Apple ID that created the cert → you Renew that cert with a fresh CSR from Intune, you do not Create a replacement → you upload the renewed .pem and confirm status is active on both sides → devices can be reached again. Most "APNs expired" incidents are won or lost on renew-versus-replace, not on finding the portal.
If Windows Company Portal won't sync, start with the Company Portal / device not syncing triage. If app protection isn't applying on an already-open iOS app, that's APP/MAM, not APNs. SCEP/NDES device certificates are a different chain (SCEP triage). This post is only the Apple MDM Push (APNs) certificate that Intune uses to talk to iOS/iPadOS and macOS.
TL;DR
- One Apple MDM Push certificate per Intune tenant covers iOS/iPadOS and macOS management and enrollment (Company Portal and Apple bulk methods). It is valid 365 days, with a 30-day grace period after expiry to renew.
- Renew the same certificate with the same Apple ID. Microsoft's enrollment troubleshooting is explicit: renew, don't replace. Replacing forces re-enrollment of every iOS/iPadOS device.
-
Read expiry in three places before you click anything in Apple's portal: Intune Devices > Device onboarding > Enrollment > Apple > Apple MDM Push Certificate, Tenant administration > Tenant status > Connector status (Warning within 7 days, Unhealthy when expired), and Graph
GET /deviceManagement/applePushNotificationCertificate. -
Enrollment error names that point here:
NoEnrollmentPolicy,APNSCertificateNotValid,AccountNotOnboarded. - ADE/DEP enrollment program tokens and VPP tokens also expire annually — renew those separately. An expired ADE token is not fixed by renewing APNs.
- Match the cert: Apple portal UID / subject GUID ↔ device Settings > General > VPN & Device Management (or Device Management) > Management Profile > Topic.
Where in the chain did it break?
| Step | What should be true | Typical symptom when it breaks |
|---|---|---|
| 1. Right credential | You're on Apple MDM Push, not ADE token / VPP / a SCEP profile | Renewing the wrong annual Apple secret while APNs stays expired |
| 2. Expiry read | Intune, Tenant status, and Graph agree on expirationDateTime and Apple ID |
Surprise outage; "we never got an email" |
| 3. Impact scoped | You know new enrollments vs existing management vs "ADE sync" | Re-enrolling Windows or rebuilding APP policies for an Apple push outage |
| 4. Apple ID bond | Same org Apple ID (ideally a monitored shared mailbox) that created the cert | Signed into Apple with a personal or successor ID → Create instead of Renew |
| 5. Renew path | CSR from this Intune tenant → Renew on the existing Apple row → upload that .pem
|
Create a Certificate, delete-and-replace, or uploading another tenant's file |
| 6. Verify | Status active in Intune and Apple portal; Graph expiry moved forward; test device reaches MDM | Cert shows uploaded but certificateUploadFailureReason set, or Topic GUID mismatch |
| 7. Devices resume | New enroll succeeds; enrolled device Sync / check-in works again | Past grace + replaced cert → fleet needs unenroll/re-enroll |
Write down the Apple ID shown in Intune, the expiry timestamp, the certificate serial (if shown), and whether you are inside the 30-day grace window before you change anything.
Step 1: Confirm which Apple credential failed
Intune's Apple enrollment surface has several annual secrets. Only one of them is APNs.
| Credential | Where you read it in Intune | What breaks when it's bad |
|---|---|---|
| Apple MDM Push certificate (APNs) | Devices > Device onboarding > Enrollment > Apple tab > Apple MDM Push Certificate | iOS/iPadOS/macOS enrollment and MDM channel (this post) |
| Enrollment program (ADE/DEP) token | Enrollment program tokens under the same Apple enrollment area | ABM/ASM sync, Automated Device Enrollment — Microsoft lists Expired or invalid token, Access denied, etc. |
| VPP / Apple Business Manager apps token | Tenant / apps volume-purchase tokens (also on Tenant status connectors) | App assignment from Apple volume purchase — not MDM push |
| SCEP / PKCS device cert profiles | Devices > Configuration (profiles) | Per-device Wi-Fi/VPN cert install — different triage |
If ADE devices won't enroll but the MDM push certificate is still Active with a future expiry, stop this article and renew the enrollment program token instead. Microsoft documents ADE token errors separately from APNs enrollment errors.
Step 2: Read expiry, Apple ID, and Tenant status (read-only)
In the admin center:
- Devices > Device onboarding > Enrollment > Apple > Apple MDM Push Certificate
- Note Expiration, the Apple ID recorded for reminders, and whether status looks active or expired.
- Tenant administration > Tenant status > Connector status
Microsoft's connector health rules for certificate-style connectors (APNs is called out by name):
| Connector status | Microsoft's meaning for cert/credential connectors |
|---|---|
| Warning | Certificate or credential will expire within seven days |
| Unhealthy | Certificate or credential has expired (or, for sync-style connectors, last sync ≥3 days — not the APNs case) |
| Healthy | Will not expire within the next seven days |
Same read from Microsoft Graph (requires an Intune license on the tenant). Permission Microsoft documents: DeviceManagementServiceConfig.Read.All (or ReadWrite):
Connect-MgGraph -Scopes 'DeviceManagementServiceConfig.Read.All'
# Documented HTTP: GET /deviceManagement/applePushNotificationCertificate
$apns = Invoke-MgGraphRequest -Method GET `
-Uri 'https://graph.microsoft.com/v1.0/deviceManagement/applePushNotificationCertificate'
$apns | Select-Object appleIdentifier, topicIdentifier, expirationDateTime,
certificateSerialNumber, certificateUploadStatus, certificateUploadFailureReason,
lastModifiedDateTime
| Field | Read it as |
|---|---|
expirationDateTime |
Authoritative expiry for the cert Intune is holding |
appleIdentifier |
Apple ID Intune has on file for this push cert |
topicIdentifier |
Topic / UID side of the Apple bond (match to the device Management Profile Topic) |
certificateSerialNumber |
Serial to compare with the Apple Push Certificates Portal row |
certificateUploadStatus / certificateUploadFailureReason
|
Last upload outcome — if failure reason is populated after a renew attempt, the .pem never became the live cert |
lastModifiedDateTime |
When Intune last accepted a change |
If Graph returns no certificate object, enrollment was never completed (or the cert was removed). That is a create-first problem, not a renew problem — and creating after you previously had a different cert is the replace path Microsoft warns about.
Step 3: Impact — what users and enrollment errors look like
Microsoft: an Apple MDM Push certificate is required to manage iOS/iPadOS and macOS and to enroll via Company Portal and Apple bulk methods (ABM/ASM/Configurator). You must renew annually to maintain that management. After expiry there is a 30-day grace period to renew.
What you typically see while the channel is bad:
| Signal | Read it as |
|---|---|
| Brand-new Company Portal / ADE enrollments fail | Push channel or enrollment setup — decode the error below |
| Existing devices still listed, last check-in going stale, new apps/profiles don't land | Management channel impaired; don't trust "Compliant" alone |
| Only Windows tickets | Not APNs — use the Windows sync / Autopilot articles |
| Only MAM-without-enrollment | Not APNs — use the APP triage |
Microsoft's iOS/iPadOS enrollment error table — the rows that name APNs:
| Error message | Microsoft's issue summary | What to do in this triage |
|---|---|---|
| NoEnrollmentPolicy | APNs certificate missing, invalid, or expired; also confirm iOS/iPadOS platform enrollment is enabled | Step 2 read; renew if expired; confirm platform allowed |
| APNSCertificateNotValid | APNs setup never finished, or the certificate has expired | Renew (do not replace), then re-enroll the failed device if needed |
| AccountNotOnboarded | Same APNs channel problem wording (setup incomplete or expired) | Same as above; complete or renew the MDM push cert |
Microsoft's note on APNSCertificateNotValid is the one to print for change control: renew the APNs certificate; don't replace it. If you replace it, you have to re-enroll all iOS/iPadOS devices in Intune.
Intune for Education docs add the delete case in plain language: if you delete the Apple MDM certificate, you must reset and re-enroll devices with a new certificate.
Step 4: Confirm the Apple ID bond and topic UID (still read-only)
Microsoft: the certificate is associated with the Apple ID used to create it. Renew with the same Apple account. Best practice in the create article: use a company email as the Apple ID, monitored by more than one person (for example a distribution list); avoid a personal Apple ID.
Before anyone signs into identity.apple.com / the Apple Push Certificates Portal:
| Check | Pass | Fail |
|---|---|---|
Apple ID in Intune (appleIdentifier / the reminder field) |
Known shared mailbox; password/MFA recoverable by more than one admin | Personal ID of someone who left; nobody has MFA |
| Apple portal inventory | A certificate row whose details match Intune (serial / UID) | Empty list under this Apple ID, or only unrelated vendor certs |
| Device Topic GUID | On an enrolled iPhone/iPad: Settings > General > VPN & Device Management (wording varies by iOS version) > Management Profile > More Details — Topic contains a GUID | No management profile (not enrolled) or Topic doesn't match any portal row |
Microsoft's renew tip: each certificate has a unique UID; the subject ID shows the GUID portion; the enrolled device Management Profile Topic value contains that GUID so you can match the portal row. Use that match when the Apple ID has several Intune or third-party push certs.
If you must change the Apple ID associated with the certificate later, Microsoft's create article says to sign in with the new Apple ID, redownload the certificate file, and upload it to Intune with that new Apple ID. Treat Managed Apple ID federation as a planned Apple migration (Microsoft: contact Apple to migrate the existing APNs certificate) — not an emergency Friday renew.
Step 5: Renew without breaking the bond (change window)
Only after Steps 1–4. Microsoft's renew path for the commercial Intune admin center:
- Intune → Apple MDM Push Certificate → Download your CSR (save the signing request locally).
- Create your MDM push Certificate link opens the Apple Push Certificates Portal (the button name is historical — you are still renewing).
- Sign in with the same organizational Apple ID from Step 4.
- Find the existing certificate (Topic/UID match) → Renew (not Create).
- Upload the new CSR; add a note you will recognize later; download the renewed certificate (
.pem). - Return to Intune; enter/confirm the Apple ID; upload the
.pem.
Renewal is complete when status appears active in both the Intune admin center and the Apple Push Certificates Portal.
| Move | Outcome |
|---|---|
| Renew on the existing Apple row with a CSR from this tenant | Same push identity; devices keep the Topic bond |
| Create a Certificate (new row) and upload that to Intune | Replace path → Microsoft: re-enroll all iOS/iPadOS devices |
| Delete the cert in Intune, then upload "a new one" | Intune for Education: reset and re-enroll |
| Renew with a different Apple ID that doesn't own the row | You can't Renew the right row; easy to Create by mistake |
Upload a .pem from another environment / old backup |
Upload failure or a cert that doesn't match devices' Topic |
Grace period. Microsoft: once expired, you have 30 days to renew. Community and support cases describe renewing outside that window as Apple issuing a new certificate (replace semantics). Learn documents the grace period; it does not spell out Apple's post-grace serial behavior in the same article — so treat "expired >30 days" as high risk for replace/re-enroll and verify Topic/UID after upload before you declare success.
Step 6: Verify devices can be reached again
Read-only checks after upload:
Connect-MgGraph -Scopes 'DeviceManagementServiceConfig.Read.All'
$apns = Invoke-MgGraphRequest -Method GET `
-Uri 'https://graph.microsoft.com/v1.0/deviceManagement/applePushNotificationCertificate'
[pscustomobject]@{
AppleId = $apns.appleIdentifier
Expires = $apns.expirationDateTime
DaysRemaining = [int]([datetimeoffset]$apns.expirationDateTime - [datetimeoffset]::Now).TotalDays
UploadStatus = $apns.certificateUploadStatus
UploadFailure = $apns.certificateUploadFailureReason
Topic = $apns.topicIdentifier
Serial = $apns.certificateSerialNumber
LastModified = $apns.lastModifiedDateTime
}
| Check | Pass |
|---|---|
| Intune Apple MDM Push Certificate page | Status active; expiry ~one year out |
| Apple Push Certificates Portal | Same UID/row shows renewed expiry |
| Graph |
expirationDateTime moved forward; upload failure reason empty |
| Tenant status connector | Leaves Unhealthy/Warning after refresh |
| New enrollment | Company Portal or ADE enroll succeeds (no APNSCertificateNotValid / NoEnrollmentPolicy) |
| Existing device | Company Portal Sync / device check-in advances; a harmless test config or app assignment eventually shows |
If upload status fails, do not Create a second Apple certificate to "force it." Re-download the CSR, Renew the same portal row again, and upload the new .pem.
Step 7: Common failure modes
| Failure mode | How it shows up | Read-first fix |
|---|---|---|
| Wrong Apple ID | Portal has no Renew target; admin Creates a new cert | Recover the original Apple ID (shared mailbox / password vault); match Topic GUID from a still-enrolled device |
| Create instead of Renew | New UID; Intune accepts upload; entire iOS fleet won't manage under the old Topic | Stop. If the old cert is still within grace and still in the portal, Renew that row and re-upload. If you already replaced, plan unenroll/re-enroll |
Uploaded the wrong .pem
|
certificateUploadFailureReason set, or expiry unchanged |
Confirm file from the Renew confirmation download for this CSR |
| Expired mid-renewal / past grace | Enrollments dead; Renew may behave like a new cert | Verify Topic after upload; budget re-enrollment if UID changed |
| Mistook ADE/VPP expiry for APNs | ABM sync errors while APNs still healthy | Renew the enrollment program or VPP token; leave APNs alone |
| Platform enrollment disabled | NoEnrollmentPolicy-style failures with a valid future APNs expiry | Enrollment restrictions / iOS platform allow — not a cert renew |
| Personal Apple ID, owner left | Nobody can Renew | Account recovery with Apple + org process; last resort is replace + re-enroll (change control) |
Timing: when "still broken" is just waiting
| Event | Microsoft's timing / rule |
|---|---|
| Apple MDM Push certificate lifetime | 365 days |
| Grace period after expiry to renew | 30 days |
| Tenant status Warning for cert connectors | Expires within 7 days |
| Tenant status Unhealthy for cert connectors | Expired |
| ADE / VPP tokens | Also annual (separate renewals) |
| After a successful renew | Status active in Intune and Apple portal; then test enroll / check-in |
Apple may email the Apple ID about upcoming expiry (commonly reported at 30/10/1 days). That mail is easy to miss on a personal ID — Tenant status + a scheduled Graph read are the controls you own.
When a change is justified
| Finding | Prefer | Avoid |
|---|---|---|
| Expiry within 7–30 days, Apple ID known | Scheduled renew (CSR → Renew → upload) in a change window | Waiting for the grace period to start |
| Already expired, within 30-day grace, same Apple ID | Renew immediately on the existing portal row | Create a Certificate "to save time" |
| Expired, Apple ID lost | Recover the Apple ID first; match Topic from a device | Creating under a new Apple ID and uploading without a re-enroll plan |
| Upload failed | Retry Renew on the same row with a fresh CSR | Deleting the Intune cert entry to "clear" it |
| Confirmed replace (new UID) already uploaded | Communicate fleet re-enrollment; remove/re-enroll per Microsoft's device remove guidance | Hoping check-in will heal itself |
| ADE token expired, APNs healthy | Renew enrollment program token only | Touching APNs |
| Only one user's iPhone fails, APNs healthy | Device/user enrollment restrictions, license, or Company Portal — not APNs | Tenant-wide cert replace |
FAQ
What happens when the Intune APNs / Apple MDM push certificate expires?
Microsoft requires the certificate to manage iOS/iPadOS and macOS and to enroll those platforms. After expiry you have a 30-day grace period to renew. During an outage, expect enrollment failures such as APNSCertificateNotValid, NoEnrollmentPolicy, or AccountNotOnboarded, and impaired management of devices that already enrolled. Renew the same certificate; don't replace it.
How do I renew the Apple MDM push certificate in Intune without re-enrolling every iPhone?
Download a new CSR from Apple MDM Push Certificate in Intune, sign into the Apple Push Certificates Portal with the same Apple ID that created the cert, choose Renew on that certificate (match Topic/UID), download the .pem, and upload it back to Intune. Creating a new certificate and uploading it is the replace path that forces iOS/iPadOS re-enrollment.
Where do I see APNs certificate expiry in Intune?
Devices > Device onboarding > Enrollment > Apple > Apple MDM Push Certificate, plus Tenant administration > Tenant status > Connector status (Warning within seven days, Unhealthy when expired). For automation, Graph GET /deviceManagement/applePushNotificationCertificate returns expirationDateTime, appleIdentifier, and topicIdentifier.
Is the Apple MDM push certificate the same as the ADE (DEP) token or VPP token?
No. All three are annual Apple credentials in the Intune Apple enrollment story, but they fail differently. APNs is the push channel for MDM. ADE tokens cover Automated Device Enrollment sync with ABM/ASM. VPP covers volume-purchased apps. Renew the one that Tenant status / the enrollment blade says is expired.
We renewed but enrollments still fail with APNSCertificateNotValid. Now what?
Re-read Graph upload status and failure reason, confirm Intune and the Apple portal both show active with a future expiry, and confirm you Renewed the Topic GUID that devices already have. If someone uploaded a newly Created certificate, you are on the replace path — renewing again on the old row (if it still exists) or planning re-enrollment is the fork, not "Sync harder."
Related posts
- Company Portal can't connect / device not syncing — a 10-minute triage order (Windows MDM check-in; not APNs)
- Intune App Protection Policy Not Applying (MAM channel; no MDM push required)
- Intune SCEP Certificate Profile Failed (per-device cert profiles, not Apple push)
- Intune Configuration Profile Error 65000 or Conflict (Windows config delivery after the device already checks in)
Free checklist
Apple push expiry is an enrollment-hygiene item: the same runway that keeps break-glass accounts, pilot groups, and Conditional Access report-only reviews from becoming a Friday outage. The free Conditional Access pre-enforcement checklist is the one-pager we use before turning CA on harder:
If you want the rest of the Intune runway written down for the team (enrollment hygiene, compliance phasing, break/fix cards and read-only PowerShell snapshots), the Intune & M365 Admin Starter Pack pairs with this triage: https://cashflow4375.gumroad.com/l/joonf?utm_source=devto&utm_medium=article&utm_campaign=aps_first_sale&utm_content=intune-apns-certificate-expired
Admin Pack Studio; not affiliated with Microsoft or Apple. Steps 1–4 and the Graph samples only read (DeviceManagementServiceConfig.Read.All GET). Downloading a CSR, Renew in Apple's portal, and uploading a .pem are deliberate changes — take them in a change window, prefer Renew over Create, and check current Microsoft Learn for portal labels and defaults.
Top comments (0)