How to check the Apple push certificate in Intune

Before you start

The organisation needs Microsoft Intune to manage Apple devices. Administrators can use Intune without an assigned Intune licence in many tenants: unlicensed administrator access is on by default for tenants created after July 2021. The tenant's licensing requirements for managed users and devices still apply.

Use an Intune Read Only Operator assignment, or another role scoped to read Apple enrollment information. The PowerShell example requests the delegated Microsoft Graph permission DeviceManagementConfiguration.Read.All; administrator consent might be required. It reads the certificate and exports the returned details. It does not upload, renew or replace a certificate.

The status and dates are a configuration snapshot from the time of the read, not an audit history or proof that an Apple device has checked in. If Intune cannot read the certificate, treat that as an access or service issue, not confirmation that no certificate is configured.

Option 1

Check the Apple push certificate with PowerShell

Install the Graph modules once, then connect with a read permission and export the certificate details. The cmdlet reads the certificate for the connected tenant.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, `
    Microsoft.Graph.DeviceManagement.Administration -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementConfiguration.Read.All' -NoWelcome
try {
    $certificate = @(Get-MgDeviceManagementApplePushNotificationCertificate)
    if ($certificate.Count -eq 0) {
        Write-Output 'No certificate was returned. Check its configuration in Intune.'
    } else {
        $details = $certificate | Select-Object AppleIdentifier,CertificateUploadStatus,
            ExpirationDateTime,LastModifiedDateTime,TopicIdentifier
        $details | Export-Csv -Path './apple-push-certificate.csv' `
            -NoTypeInformation -Encoding utf8
        Write-Output 'Certificate details exported to apple-push-certificate.csv.'
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV holds the Apple ID associated with the certificate, its upload status, expiry date, last modified date and topic identifier. The example reads the certificate for the tenant you connected to; repeat it after connecting to each tenant you need to review. A missing certificate can produce a 404 response instead of an empty result, so check that case in the admin centre rather than treating another Graph error as a clean result.

Option 2

Review the Apple push certificate in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > Device onboarding > Enrollment.
3. Select the Apple tab, then select Apple MDM Push Certificate.
4. Read the certificate status, expiry date and Apple ID. Do not select the renewal or upload controls unless you intend to change the certificate.

This method suits a quick review when you are already working in Intune. It shows the certificate settings for that tenant; use PowerShell when you need a CSV snapshot or Altivane for a recurring review of connectors.

Common questions

What happens when the certificate expires?

Microsoft says the certificate is valid for 365 days and has a 30-day grace period for renewal. Renew it with the same Apple account that created it; replacing the account can break the existing trust relationship.

Does an active certificate prove that every Apple device is up to date?

No. It is required for Intune to manage iOS, iPadOS and macOS devices, but its status does not show device compliance or last check-in. To review compliance, see how to find non-compliant devices in Intune.

Why does PowerShell return 404 or an access error?

A 404 can mean that no Apple MDM push certificate has been configured. For other errors, check that you connected to the right tenant, have the Graph permission and Intune read role, and have any required consent.