Renewing Apple Enrollment Program, VPP Token, and MDM Push Certificate in Microsoft Intune and SCIM token in Entra.

Introduction

Managing Apple devices in Microsoft Intune requires maintaining active integrations with Apple services. To ensure continued functionality, administrators must periodically renew four key components, including the SCIM token for third-party applications integrated via Microsoft Entra ID:

  1. Apple MDM Push Certificate – Enables communication between Intune and Apple devices.
  2. Apple Volume Purchase Program (VPP) Token – Supports the deployment of purchased apps from Apple Business/School Manager.
  3. Apple Enrollment Program Token (DEP Token) – Facilitates automated device enrollment via Apple Business/School Manager.
  4. SCIM Token – Ensures secure user provisioning for third-party applications integrated with Microsoft Entra ID.

Failure to renew these components before they expire can disrupt device management and app deployment. This guide provides a step-by-step approach to renewing each item in Microsoft Intune.

Please read some of my earlier articles on how to setup the connection between Apple Business Manager and Microsoft Intune:

Setting up Apple Business Manager for use with Azure Active Directory – Modern Workplace Blog

Connecting Microsoft Endpoint Manager to Apple Business Manager – Modern Workplace Blog

Apple Business Manager device import options for later use within Microsoft Endpoint Manager – Modern Workplace Blog

Renewing the Apple MDM Push Certificate

Prerequisites

  • Access to the Apple ID used to create the existing MDM Push Certificate.
  • Administrator permissions in Microsoft Intune.

Steps

  1. Sign in to Microsoft Intune admin center (https://intune.microsoft.com/).
  2. Navigate to Devices > iOS/iPadOS > Enrollment.
  3. Select Apple MDM Push Certificate.
  4. Click Renew Certificate and download the Intune Certificate Signing Request (CSR).
  1. Open a new tab and go to the Apple Push Certificates Portal (https://identity.apple.com/pushcert/).
  2. Sign in with the Apple ID originally used to create the certificate.
  3. Locate the existing certificate and click Renew.
  1. Upload the CSR file downloaded from Intune.
  2. Download the renewed certificate from Apple.
  1. Return to Intune and upload the new certificate.
  2. Click Save to complete the renewal process.

Renewing the Apple Volume Purchase Program (VPP) Token

Prerequisites

  • Administrator access to Apple Business/School Manager.
  • Microsoft Intune admin rights.

Steps

  1. Log in to Apple Business/School Manager (https://business.apple.com/ or https://school.apple.com/).
  2. Navigate to Settings > Apps and Books.
  3. Find the Server Token associated with Intune and click Download.
  1. Sign in to Microsoft Intune admin center.
  2. Navigate to Tenant Administration > Connectors and Tokens > Apple VPP Tokens
  1. Click on the existing VPP token entry.
  2. Click Renew Token and upload the new VPP Server Token file
  1. Click Save to confirm the changes.

Renewing the Apple Enrollment Program (DEP) Token

Prerequisites

  • Administrator access to Apple Business/School Manager.
  • Microsoft Intune admin rights.

Steps

  1. Log in to Apple Business/School Manager.
  2. Navigate to Settings > Device Management Settings.
  3. Locate the MDM Server associated with Microsoft Intune.
  4. Click Download MDM Server Token
  1. Sign in to Microsoft Intune admin center.
  2. Navigate to Tenant Administration > Apple Enrollment > Enrollment Program Tokens.
  3. Click the existing DEP token entry.
  1. Click Renew Token and upload the newly downloaded DEP Token from Apple.
  1. Click Save to complete the renewal.

Renewing the SCIM Token of the Enterprise Application in Entra

Prerequisites

  • Administrator access to Microsoft Entra ID (formerly Azure AD).
  • Access to the third-party application using SCIM provisioning.

Steps

  1. Sign in to Microsoft Entra admin center (https://entra.microsoft.com/).
  2. Navigate to Identity > Applications > Enterprise applications.
  3. Locate and select the SCIM-integrated application, called Apple Business Manager
  4. Click on Provisioning, click Edit provisioning.
  5. Locate Secret Token section.

In order to generate the token, we need to login to Apple Business Manager.

6. Go to Preferences, and select Managed Apple Accounts.
7. Locate the Directory sync section, and click on Set up.

    8. Click +Client Secret to generate a new token.
    9. Click Copy to copy its content to your clipboard

      10. Copy the new token and update it in the Apple Business Manager application.

        11. Click on Test Connection and validate the its successful.

          12. Click Save in the Provisioning page of the Apple Business Manager application to complete the renewal process.
          13. In Apple Business Manager, remove the old token now that the new token is in place.

          Summary

          Renewing the Apple MDM Push Certificate, VPP Token, and DEP Token in Intune and SCIM token in Entra is crucial to ensure seamless Apple device management in Microsoft Intune. Regularly monitoring their expiration dates and setting reminders for renewal helps avoid disruptions. By following this guide, administrators can efficiently maintain these integrations and ensure uninterrupted device enrollment, management, and app distribution.

          References

          Leave a Reply

          Your email address will not be published. Required fields are marked *

          This site uses Akismet to reduce spam. Learn how your comment data is processed.