Intune Apple Token Audit

Read-only PowerShell script that lists the Intune Apple push certificate, ADE and VPP tokens with expiry dates, days left and the Apple ID behind each.

Send me the scriptView on GitHub

What it does

  • Reads the Apple MDM push certificate, every ADE enrolment program token and every Apps and Books (VPP) token from Intune through Microsoft Graph, with your own account
  • Shows the expiry date, days left and the Apple ID behind each one, with where to renew it
  • Notes whether an expired push certificate is still inside Microsoft's 30-day grace period
  • Flags personal Apple IDs (Gmail, iCloud, Outlook and similar) and VPP tokens Intune reports as invalid or assigned to another MDM
  • Counts the iPhones, iPads and Macs that depend on the push certificate
  • Exports a CSV and exits 1 when anything is expired, invalid or inside the warning window, so it can run on a schedule
  • Read-only: it changes nothing in your tenant and renews nothing. Apple renewals need an interactive sign-in with the right Apple ID

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ===== CONFIG =====
$OutputPath        = Join-Path $env:USERPROFILE 'Desktop\Atliso-AppleTokens.csv'
$WarnDays          = 60     # flag anything that expires within this many days
$CriticalDays      = 14
$CountAppleDevices = $true  # count the Apple devices that depend on the push certificate
$LogPath           = Join-Path $env:LOCALAPPDATA 'Atliso\AppleTokenAudit.log'
# ==================

Run it

It runs on your own workstation, not on devices, with Windows PowerShell 5.1 or PowerShell 7:

PowerShell
Preview snippet. The full, tested script lives in the vault.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
Install-Script Atliso-AppleTokenAudit -Scope CurrentUser   # from the PowerShell Gallery
Atliso-AppleTokenAudit.ps1
# MSPs: run once per customer tenant
.\Atliso-AppleTokenAudit.ps1 -TenantId contoso.onmicrosoft.com

Full walkthrough, including how to renew each one without forcing every device to re-enrol: Apple MDM push certificate expired in Intune? Check all 3 Apple dates

Version history

Scripts are checked against each month's Windows and Intune changes and patched when something breaks. Every version stays available: if a newer one misbehaves in your environment, use the one before it and reply to any Atliso email to tell me.

  1. v1.0.0Latest

    First release. Lists the Apple MDM push certificate, every ADE enrolment token and every Apps and Books (VPP) token in Intune with expiry date, days left and the Apple ID behind each. Notes the 30-day push certificate grace period, flags personal Apple IDs and invalid VPP tokens, exports a CSV and exits 1 when anything needs renewing. Read-only.

    Tested: Pester (10 tests, Graph mocked) on Windows PowerShell 5.1 and PowerShell 7; live run against a lab tenant with no Apple setup (push certificate 404, ADE and VPP empty, exit 0).

    Guide: https://atliso.com/blog/intune-apple-mdm-push-certificate-expired

    Download v1.0.0 from GitHub

Get Intune Apple Token Audit

We'll send the script, and updates when Apple or Microsoft change how the renewals work. No spam.