Use Microsoft Intune—not a generic SCCM console workflow—to create and manage an Apple Push Notification service (APNs) certificate in current deployments. Intune generates a certificate-signing request (CSR), Apple’s Push Certificates Portal signs it, and you upload the resulting .pem certificate back to the same MDM tenant. Configuration Manager (SCCM) can coexist with Intune, but its older Apple-management features are legacy and were deprecated in January 2022.
The most important operational rule is to renew an existing certificate rather than replace it. Replacing it can break enrolled iPhone and iPad relationships and may force re-enrollment.
First identify which product owns Apple management
An APNs certificate belongs to the MDM service that manages the Apple devices. Confirm the management authority before downloading anything:
| Environment | What to do |
|---|---|
| Microsoft Intune | Use the Intune admin center’s Apple enrollment/MDM configuration. This is the current Microsoft workflow for Apple device management. |
| Configuration Manager with co-management or tenant attach | Use Intune for the APNs integration unless your documented, version-specific architecture says otherwise. Configuration Manager remains the on-premises peer to Intune. |
| Legacy Configuration Manager Apple or mobile-device management | Treat the deployment as historical and verify its exact supported release before changing certificates. Microsoft’s Mac-client management feature was deprecated beginning January 2022 (Microsoft documentation). |
| Jamf, Kandji, Mosyle, Workspace ONE or another MDM | Generate the CSR and upload the signed certificate in that provider’s console, not in Intune or Configuration Manager. |
Microsoft describes Configuration Manager as the on-premises peer to Intune, while APNs is an Intune integration required for Apple device management (Microsoft Intune architecture). Do not copy an old blog’s console path such as “Administration → Cloud Services → Microsoft Intune Subscription” without confirming that it exists in your release.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
- WHY IPAD — The 11-inch iPad is now more capable than ever with the superfast A16 chip, a stunning Liquid Retina display, advanced cameras, fast Wi-Fi, USB-C connector, and four gorgeous colors.* iPad delivers a powerful way to create, stay connected, and get things done.
- PERFORMANCE AND STORAGE — The superfast A16 chip delivers a boost in performance for your favorite activities. And with all-day battery life, iPad is perfect for playing immersive games and editing photos and videos.* Storage starts at 128GB and goes up to 512GB.*
- 11-INCH LIQUID RETINA DISPLAY — The gorgeous Liquid Retina display is an amazing way to watch movies or draw your next masterpiece.* True Tone adjusts the display to the color temperature of the room to make viewing comfortable in any light.
- IPADOS + APPS — iPadOS makes iPad more productive, intuitive, and versatile. With iPadOS, run multiple apps at once, use Apple Pencil to write in any text field with Scribble, and edit and share photos.* iPad comes with essential apps like Safari, Messages, and Keynote, with over a million more apps designed specifically for iPad available on the App Store.
- FAST WI-FI CONNECTIVITY — Wi-Fi 6 gives you fast access to your files, uploads, and downloads, and lets you seamlessly stream your favorite shows.
What an APNs certificate does
APNs is the push channel between Apple devices and the MDM service. A notification tells a device to contact the MDM server for a command, policy or inventory request; APNs does not carry the complete management payload itself.
Apple documents several different credentials, and they are not interchangeable (Apple: Configure devices to work with APNs):
| Credential | Purpose |
|---|---|
| APNs push certificate | Authorizes the MDM service to use Apple’s push infrastructure. |
| MDM-server TLS certificate | Secures HTTPS communication between devices and the management service. |
| Configuration-profile signing certificate | Signs configuration profiles where the platform uses profile signing. |
| Apple Business Manager or Apple School Manager token | Connects the MDM to automated enrollment, apps and content; it is separate from APNs. |
| Device identity certificate | Authenticates an individual device or user. |
Prerequisites and safety checks
- Intune permissions to configure Apple enrollment or APNs.
- Access to the Apple account that originally created the certificate when renewing.
- Access to Apple’s Apple Push Certificates Portal.
- A secure location for the CSR and signed certificate.
- The correct tenant and MDM authority. A certificate made for another tenant or provider cannot be substituted.
- A CSR signed with SHA-2. Apple’s portal does not issue push certificates for SHA-1 CSRs.
Record the Apple account used at creation. Apple says that account is needed for renewal, and losing access can make recovery difficult (Apple deployment guidance).
Create or renew the certificate
1. Generate the CSR in the MDM console
Open the current Intune Apple enrollment or Apple MDM configuration area and choose the control to create or download the APNs certificate request. Labels change as the Intune admin center evolves, so use the label shown in your tenant rather than an obsolete SCCM menu sequence.
Rank #2
- WHY IPAD — The 11-inch iPad is now more capable than ever with the superfast A16 chip, a stunning Liquid Retina display, advanced cameras, fast Wi-Fi, USB-C connector, and four gorgeous colors.* iPad delivers a powerful way to create, stay connected, and get things done.
- PERFORMANCE AND STORAGE — The superfast A16 chip delivers a boost in performance for your favorite activities. And with all-day battery life, iPad is perfect for playing immersive games and editing photos and videos.* Storage starts at 128GB and goes up to 512GB.*
- 11-INCH LIQUID RETINA DISPLAY — The gorgeous Liquid Retina display is an amazing way to watch movies or draw your next masterpiece.* True Tone adjusts the display to the color temperature of the room to make viewing comfortable in any light.
- IPADOS + APPS — iPadOS makes iPad more productive, intuitive, and versatile. With iPadOS, run multiple apps at once, use Apple Pencil to write in any text field with Scribble, and edit and share photos.* iPad comes with essential apps like Safari, Messages, and Keynote, with over a million more apps designed specifically for iPad available on the App Store.
- FAST WI-FI CONNECTIVITY — Wi-Fi 6 gives you fast access to your files, uploads, and downloads, and lets you seamlessly stream your favorite shows.
Download the CSR, normally a .csr file. Do not create an unrelated OpenSSL request unless the selected MDM product explicitly requires it.
2. Choose creation or renewal in Apple’s portal
Sign in to the Apple Push Certificates Portal with the organization-controlled Apple account.
- Create: For a first-time APNs setup.
- Renew: For the certificate already used by enrolled devices.
- Replace: Not a routine renewal method; it can invalidate the existing device relationship.
Apple says APNs certificates require annual renewal. Use the renewal option for an active deployment and start before the displayed expiration date.
3. Submit the CSR and download Apple’s signed certificate
Upload the CSR to Apple, complete the prompts, and download the signed certificate. The returned file is generally a .pem file. The CSR is only the request; it is not the file you upload to Intune.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- WHY IPAD — The 11-inch iPad is now more capable than ever with the superfast A16 chip, a stunning Liquid Retina display, advanced cameras, fast Wi-Fi, USB-C connector, and four gorgeous colors.* iPad delivers a powerful way to create, stay connected, and get things done.
- PERFORMANCE AND STORAGE — The superfast A16 chip delivers a boost in performance for your favorite activities. And with all-day battery life, iPad is perfect for playing immersive games and editing photos and videos.* Storage starts at 128GB and goes up to 512GB.*
- 11-INCH LIQUID RETINA DISPLAY — The gorgeous Liquid Retina display is an amazing way to watch movies or draw your next masterpiece.* True Tone adjusts the display to the color temperature of the room to make viewing comfortable in any light.
- IPADOS + APPS — iPadOS makes iPad more productive, intuitive, and versatile. With iPadOS, run multiple apps at once, use Apple Pencil to write in any text field with Scribble, and edit and share photos.* iPad comes with essential apps like Safari, Messages, and Keynote, with over a million more apps designed specifically for iPad available on the App Store.
- FAST WI-FI CONNECTIVITY — Wi-Fi 6 gives you fast access to your files, uploads, and downloads, and lets you seamlessly stream your favorite shows.
Keep an inventory entry such as:
MDM platform: Microsoft Intune Tenant: Contoso Apple account: organization-managed account Certificate file: Contoso-Intune-APNs-2026.pem Created: 2026-09-28 Expires: [date shown by Apple] Renewal owner: [name/team] Backup location: [secure vault]
4. Upload the signed certificate to the same MDM service
Return to the Intune page that generated the CSR and upload the signed .pem file. Depending on the interface, you may also see the Apple identifier, topic, expiration date or upload status. Microsoft Graph exposes these attributes, including upload failure reason and expiration (Update-MgDeviceManagement reference).
A successful result is a valid or active status with an expiration date. Never upload the CSR in place of the signed certificate.
5. Test a pilot device
- Confirm the APNs status and expiration date.
- Sync a non-production iPhone, iPad or Mac enrolled in the same MDM.
- Request harmless inventory or policy check-in.
- Verify a recent check-in in Intune.
Do not begin testing with erase, lock or unenroll commands.
Network requirements for APNs
Both managed devices and the MDM service need outbound access to Apple’s network. Apple identifies 17.0.0.0/8 and documents these ports (Apple network guidance):
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- WHY IPAD — The 11-inch iPad is now more capable than ever with the superfast A16 chip, a stunning Liquid Retina display, advanced cameras, fast Wi-Fi, USB-C connector, and four gorgeous colors.* iPad delivers a powerful way to create, stay connected, and get things done.
- PERFORMANCE AND STORAGE — The superfast A16 chip delivers a boost in performance for your favorite activities. And with all-day battery life, iPad is perfect for playing immersive games and editing photos and videos.* Storage starts at 128GB and goes up to 512GB.*
- 11-INCH LIQUID RETINA DISPLAY — The gorgeous Liquid Retina display is an amazing way to watch movies or draw your next masterpiece.* True Tone adjusts the display to the color temperature of the room to make viewing comfortable in any light.
- IPADOS + APPS — iPadOS makes iPad more productive, intuitive, and versatile. With iPadOS, run multiple apps at once, use Apple Pencil to write in any text field with Scribble, and edit and share photos.* iPad comes with essential apps like Safari, Messages, and Keynote, with over a million more apps designed specifically for iPad available on the App Store.
- FAST WI-FI CONNECTIVITY — Wi-Fi 6 gives you fast access to your files, uploads, and downloads, and lets you seamlessly stream your favorite shows.
| Connection | Port | Use |
|---|---|---|
| Device to Apple | TCP 5223 | Persistent APNs communication. |
| Device fallback | TCP 443 | Activation and fallback connectivity. |
| MDM service to Apple | TCP 443 or 2197 | Sending notifications to APNs. |
- Do not use TLS interception that breaks APNs certificate validation.
- Check proxy behavior separately for device traffic and server-to-APNs traffic.
- Newer Apple operating systems can use a web proxy when proxy auto-configuration specifies one.
A certificate upload can succeed even when firewall or proxy rules prevent devices from receiving pushes.
Renew safely every year
Renew the existing APNs certificate with the same Apple account and the portal’s renewal workflow. Microsoft warns that replacing an Intune APNs certificate may require re-enrolling all iOS and iPadOS devices (Microsoft enrollment troubleshooting).
- Record the displayed expiration date in your certificate inventory.
- Set reminders for 60, 30 and 7 days before expiry.
- Assign two administrators and document account recovery contacts.
- Schedule renewal during a maintenance window.
- After upload, verify status and pilot-device check-ins.
If the certificate expires, devices can stop receiving MDM updates until a valid certificate is installed. Apple warns that losing the original Apple account may require re-enrollment to restore management connectivity (Apple ongoing management guidance).
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common failures
“APNs certificate is missing, invalid or expired”
Intune associates this condition with errors such as NoEnrollmentPolicy and APNSCertificateNotValid. Check:
Best Value
- WHY IPAD PRO — iPad Pro with the Apple M5 chip delivers extraordinary performance for effortless productivity on a stunning display. Take on pro workflows with Neural Accelerators for AI and a redesigned iPadOS with game-changing capabilities.*
- PERFORMANCE AND STORAGE — iPad Pro with M5 brings next-generation speed and the power of on-device AI to all your tasks.* Featuring up to 2TB of storage, 16GB of memory, and Neural Accelerators for next-level AI performance.*
- IPADOS — Run pro apps and get more done with iPadOS 26 with Liquid Glass design and game-changing capabilities.* With an intuitive and flexible windowing system, you can control, organize, and manage your workflows like never before.
- APPLE INTELLIGENCE — Apple Intelligence is the personal intelligence system that helps you communicate, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- 13-INCH ULTRA RETINA XDR DISPLAY — The world’s most advanced display, featuring extreme brightness, precise contrast, ProMotion, P3 wide color, and True Tone.* Nano-texture display glass available in 1TB and 2TB configurations
- The certificate is in the same tenant that generated the CSR.
- The expiration date has not passed.
- The Apple account is the original account.
- The uploaded file is Apple’s signed
.pem, not the CSR. - Intune reports a successful upload.
- The device is assigned to the correct MDM service and can reach APNs.
Upload rejects the file
- CSR uploaded instead of
.pem. - Certificate contents or line breaks were altered.
- Certificate came from another tenant or MDM provider.
- CSR used SHA-1 rather than SHA-2.
- An Apple Business Manager token was supplied instead of an APNs certificate.
Devices enroll but do not receive commands
Check APNs status, device TCP 5223, MDM-server TCP 443/2197, proxy inspection, device time, MDM assignment and the MDM server’s own TLS certificate. Apple treats the APNs credential and the HTTPS server certificate as separate credentials.
The certificate was replaced
Stop making further changes. Identify whether the original certificate and Apple account are available, then contact Microsoft or the MDM vendor for the supported recovery path. Prepare for possible re-enrollment only after confirming the impact.
Apple-account access was lost
Use an organization-controlled Managed Apple Account where supported, document ownership and recovery contacts, and avoid personal accounts belonging to departing staff. Apple states that loss of the original account can require device re-enrollment.
Do not confuse Configuration Manager certificates with APNs
Configuration Manager uses different self-signed and PKI certificates for site systems, IIS, trusted roots, client authentication and on-premises MDM (Configuration Manager certificates overview; on-premises MDM certificate setup). An SCCM server or IIS certificate does not become an APNs certificate merely because Apple devices connect to that server.
Recommended Free Tools
APNs, Apple Business Manager and other MDM choices
APNs is not a product sold by Apple. The commercial decision is which MDM owns the certificate and Apple device lifecycle.
| Platform | Typical fit | Official information |
|---|---|---|
| Microsoft Intune | Organizations already invested in Microsoft 365, Entra ID, Defender or Configuration Manager. | Product · Pricing |
| Jamf Pro | Deep Apple-specific macOS, iOS and iPadOS administration. | Product · Pricing |
| Kandji | Apple-focused automation and simplified administration. | Product · Pricing |
| Mosyle | Apple-focused deployments, including education and lower-complexity environments. | Product · Pricing |
| VMware Workspace ONE UEM | Broad multi-platform UEM estates. | Product |
Apple Business Manager and Apple School Manager service tokens are separate credentials with their own renewal cycle; Apple says external device-management service tokens expire after one year (Apple School Manager guidance).
Quick Recap
Annual certificate checklist
- Identify the MDM authority and tenant.
- Locate the original Apple account and certificate record.
- Check the expiration date at least 60 days ahead.
- Generate the CSR from the owning MDM.
- Use Apple’s renewal option, not replacement.
- Download and securely store the signed
.pem. - Upload it to the same MDM tenant.
- Verify active status, expiration and topic.
- Test a pilot device and APNs network paths.
- Update the inventory and next reminder date.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
