Apple Business and volume-purchase tokens: expiry and renewal in Intune

Besides the MDM push certificate, device-management setups depend on tokens from Apple Business: one for automated device enrollment and one for buying apps in volume. Microsoft documents that these tokens expire 365 days after they are created, and they are easy to forget because each is renewed separately.

What to track

• The MDM push certificate (see the push certificate guide).
• Each enrollment program token.
• Each volume-purchase (Apps and Books) token.

Record the expiry date, the Apple account that owns it, and which MDM server it is connected to.

Renewing safely

Renew each token with the same Apple account that created it. Microsoft's warning matters here: do not click Download Token in Apple Business unless you are renewing, because it invalidates the token your MDM is currently using. The steps are to download a new token for the same server in Apple Business, then upload it in the MDM's token settings (in Intune, under the Apple enrollment section).

Make it survive staff changes

Use a company-owned Apple account that more than one person can access, and note in the tracker who owns each token. Tokens tied to a departed employee's Apple account are the classic cause of a failed renewal.

Questions

Do the tokens expire on the same day as the push certificate?

Not necessarily. Each is created at a different time and expires 365 days after its own creation, so track each date separately.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.