Intune and Apple MDM push certificate expiry: renew it the right way

The Apple MDM push certificate your device-management system uses must be renewed every year. Microsoft documents it as valid for 365 days. If it lapses you can no longer manage iOS, iPadOS and macOS devices through it, and renewing the wrong way can force devices to re-enroll.

Where to see the date

In Microsoft Intune open Devices → Device onboarding → Enrollment → Apple tab → Apple MDM Push Certificate; the expiry date is shown there. Other MDM products show the same information on their Apple settings page.

Renew, do not replace

Renew the certificate in the Apple Push Certificates Portal with the same Apple ID that created it. Microsoft warns that deleting the MDM push certificate means devices must be reset and re-enrolled. Record which Apple ID owns the certificate, and make it a company-owned account that more than one person can access. Microsoft documents a 30-day grace period after expiry to renew; do not rely on it.

Also track the tokens

Apple enrollment program tokens and volume-purchase tokens also expire after 365 days, according to Microsoft's documentation. Renew each with the same Apple account. Do not click Download Token in Apple Business unless you are renewing, because it invalidates the token your MDM is using. Add each token to the tracker with its owner.

Questions

What happens if it expires?

Microsoft says the certificate must be renewed annually to keep managing iOS, iPadOS and macOS devices.

What if the original Apple ID is lost?

Record the owning Apple ID now. If you must change it, Microsoft documents re-downloading the certificate under the new Apple ID and uploading it with that ID.

Track this in the free tracker

Guides last checked 2026-10-18. Check the details against your vendor's current documentation; products and policies change.