Intune Apple MDM Push Certificate Test

An Apple MDM Push certificate is required to manage iOS/iPadOS and macOS devices in Microsoft Intune, and enables devices to enroll via the Intune Company Portal app, Apple bulk enrollment methods, such as the Device Enrollment Program, Apple School Manager, and Apple Configurator. The Apple MDM push certificate is valid only for 365 days and must be renewed annually to maintain iOS/iPadOS and macOS device management.

If an active Apple MDM Push certificate suddenly expires, iOS/iPadOS and macOS applications will no longer be able to communicate with Endpoint Management and vice-versa. To avoid this, administrators should proactively identify certificates nearing expiry and renew the certificates. This is where the Intune Apple MDM Push Certificate test helps. This test captures the expiry date of the active Apple MDM Push certificate, computes how long each active certificate will remain valid, and proactively alerts administrators if any certificate is nearing expiry.

Target of the Test: Microsoft Azure Intune

Agent deploying the test: A remote agent

Output of the test: One set of results for the Apple MDM Push certificate used by the Azure Intune

Configurable parameters for the test
Parameters	Description
Test Period	How often should the test be executed.
Host	The host for which the test is to be configured.
Tenant ID	Specify the Directory ID of the Azure AD tenant to which the target subscription belongs. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor Microsoft Azure Intune Using Intune REST API.
Client ID, Client Password, and Confirm Password	To connect to the target subscription, the eG agent requires an Access token in the form of an Application ID and the client secret value. For this purpose, you should register a new application with the Azure AD tenant. To know how to create such an application and determine its Application ID and client secret, refer to Configuring the eG Agent to Monitor Microsoft Azure Intune Using Intune REST API. Specify the Application ID of the created Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box.
ProxyHost and ProxyPort	In some environments, all communication with the Azure cloud be routed through a proxy server. In such environments, you should make sure that the eG agent connects to the cloud via the proxy server and collects metrics. To enable metrics collection via a proxy, specify the IP address of the proxy server and the port at which the server listens against the ProxyHost and ProxyPort parameters. By default, these parameters are set to none, indicating that the eG agent is not configured to communicate via a proxy, by default.
ProxyUsername, ProxyPassword, Confirm Password	If the proxy server requires authentication, then, specify a valid proxy user name and password in the Proxy Username and Proxy Password parameters, respectively. Then, confirm the password by retyping it in the Confirm Password text box. If no proxy server is used, or if the proxy server used does not require authentication, then the default setting - none - of these parameters, need not be changed.
DD Frequency	Refers to the frequency with which detailed diagnosis measures are to be generated for this test. The default is 1:1. This indicates that, by default, detailed measures will be generated every time this test runs, and also every time the test detects a problem. You can modify this frequency, if you so desire. Also, if you intend to disable the detailed diagnosis capability for this test, you can do so by specifying none against DD frequency.
Detailed Diagnosis	To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option. The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled: The eG manager license should allow the detailed diagnosis capability Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measurements reported by the test

Measurement

Description

Measurement Unit

Interpretation

Certificate validity status

Indicates the current validity status of the Apple MDM Push certificate.

The values reported by this measure and its numeric equivalents are mentioned in the table below:

Measure Value	Numeric Value
Good	0
Warning	1
Error	2
Critical	3
Expired	4

Note:

By default, this measure reports the Measure Values listed in the table above to indicate the validity state of each certificate. The graph of this measure however, is represented using the numeric equivalents only - 0 to 4.

Use the detailed diagnosis of this measure to know the exact date on which the certificate will expire.

Days until expiration

Indicates the number of days by which the Apple MDM Push certificate will expire

Number

A high value is desired for this measure.

A very low value indicates that the certificate is about to expire very soon. You may want to consider renewing the certificate before this eventuality strikes.